phshy Privacy Policy —
How We Handle Your Personal Data

1. Introduction & Scope

// SECTION 1.1–1.3

This Privacy Policy ("Policy") applies to all personal data collected, processed, stored, or used by phshy ("phshy", "we", "us", "our") in connection with the operation of the phshy online gaming platform accessible at phshy.org, including all subdomains, associated mobile interfaces, and related services ("Platform").

This Policy applies to all registered players, prospective players, and visitors to the phshy Platform, regardless of location, insofar as their data is processed by phshy. This Policy does not apply to third-party websites, applications, or services that may be linked from the phshy Platform — those entities are governed by their own privacy policies.

phshy processes personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and all relevant issuances of the National Privacy Commission (NPC) of the Philippines.

2. Data Controller Identity

// SECTION 2.1

phshy acts as the personal information controller for all personal data collected through the phshy Platform. phshy has designated a Data Privacy Officer (DPO) responsible for overseeing data protection compliance. Contact details for phshy's DPO are provided in Section 14 of this Policy.

3. Personal Data We Collect

// SECTION 3.1–3.5

phshy collects personal data that you provide directly, data generated through your use of the Platform, and data received from third parties in connection with account verification and regulatory compliance. The categories of data phshy may collect are detailed below.

phshy does not collect special categories of sensitive personal data (e.g., racial or ethnic origin, political opinions, religious beliefs, health data) unless specifically required by applicable PAGCOR regulations or law. Where such data must be collected, phshy will seek your explicit consent and clearly state the purpose.

4. Legal Basis for Processing

// SECTION 4.1–4.4

phshy processes your personal data on one or more of the following legal bases as established under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to fulfil phshy's obligations to you as an account holder — including account management, game delivery, deposit processing, and withdrawal processing;
• Legal obligation: Processing required to comply with phshy's legal obligations under PAGCOR regulations, the Anti-Money Laundering Act (AMLA), and other applicable Philippine laws;
• Legitimate interests: Processing conducted for phshy's legitimate business interests, including fraud prevention, platform security, and responsible gaming enforcement, where these interests do not override your fundamental rights;
• Consent: Processing for purposes such as marketing communications, where your explicit prior consent has been obtained. You may withdraw consent for marketing communications at any time through your phshy account settings.

5. How We Use Your Personal Data

// SECTION 5.1–5.7

phshy uses the personal data it collects for the following specific purposes:

• Account creation and management: To register your phshy account, verify your identity, maintain your player profile, and process your login authentication;
• Payment processing: To process deposits, withdrawals, and refunds through your nominated payment methods including GCash, PayMaya, bank transfers, and USDT crypto transactions;
• PAGCOR regulatory compliance: To fulfil phshy's obligations under its PAGCOR operating licence, including AML screening, age verification, KYC documentation, and regulatory reporting;
• Game delivery and account activity: To provide access to the phshy game library, maintain gameplay records, resolve disputes, and calculate bonus eligibility;
• Responsible gaming enforcement: To monitor player activity for signs of problem gambling, enforce self-exclusion requests, apply deposit and loss limits, and comply with PAGCOR's player protection requirements;
• Customer support: To respond to your support queries, process complaints, and communicate relevant account information;
• Marketing communications: To send you promotional offers, news, and platform updates where you have consented to receive such communications.

6. Data Sharing & Third-Party Disclosure

// SECTION 6.1–6.5

phshy may share your personal data with the following categories of recipients where necessary and proportionate:

• PAGCOR and regulatory authorities: phshy is legally required to share player data with PAGCOR and other Philippine regulatory bodies including the Anti-Money Laundering Council (AMLC) upon lawful request or as required under phshy's operating licence;
• Payment service providers: Your financial data is shared with GCash, PayMaya, BPI, BDO, Metrobank, Visa, Mastercard, and crypto wallet processors solely to process your deposit and withdrawal transactions;
• Game technology providers: Game providers integrated with the phshy Platform may receive session data necessary to deliver game services. All phshy game partners are contractually bound to data confidentiality obligations consistent with this Policy;
• Identity verification services: KYC document verification may be handled by contracted third-party identity verification providers operating under equivalent data protection standards;
• Law enforcement: phshy may disclose personal data to Philippine law enforcement authorities where required by valid legal process, court order, or to prevent fraud or criminal activity.

7. Cookies & Tracking Technologies

// SECTION 7.1–7.4

The phshy Platform uses cookies and similar tracking technologies to operate efficiently and deliver a consistent user experience. Cookies are small data files placed on your device when you visit phshy.org. phshy uses the following categories of cookies:

• Essential cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during your phshy session. These cannot be disabled without affecting Platform functionality;
• Functional cookies: Store your preferences such as language settings, game lobby filters, and responsible gaming tool configurations;
• Analytics cookies: Used to understand how players interact with the phshy Platform, measure page performance, and identify areas for improvement. Analytics data is aggregated and anonymized where possible;
• Security cookies: Used to detect and prevent fraudulent activity, unauthorized access attempts, and to enforce session security.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not affect your ability to use phshy's core gaming services, though some Platform features may be affected.

8. Data Security

// SECTION 8.1–8.4

phshy implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or alteration. These measures include:

• AES-256 encryption for all data stored at rest on phshy's servers;
• TLS 1.3 encryption for all data transmitted between your device and phshy's infrastructure;
• Multi-factor authentication requirements for all phshy administrative system access;
• Regular independent security audits and penetration testing of phshy's infrastructure;
• Role-based access controls ensuring phshy staff can only access personal data where necessary for their specific job function;
• Documented incident response and breach notification procedures compliant with NPC requirements.

9. Data Retention

// SECTION 9.1–9.3

phshy retains personal data for the periods described below, after which data is securely deleted or irreversibly anonymized:

• Account and identity data: Retained for the duration of your active account, and for a minimum of five (5) years following account closure to comply with PAGCOR regulatory retention requirements and AMLA obligations;
• Transaction records: Retained for a minimum of five (5) years from the transaction date, as required by the Anti-Money Laundering Act;
• KYC documents: Retained for a minimum of five (5) years from the date of verification, or longer if required by PAGCOR or AMLC;
• Gameplay logs: Retained for a minimum of two (2) years for dispute resolution purposes;
• Marketing data: Retained until you withdraw consent or request erasure, subject to applicable legal retention obligations;
• Support communications: Retained for two (2) years from the date of the final communication in each support case.

10. Your Data Rights Under RA 10173

// SECTION 10.1–10.8

Under the Data Privacy Act of 2012 (Republic Act No. 10173), you hold the following rights with respect to your personal data processed by phshy. These rights may be exercised by contacting phshy's Data Privacy Officer using the details provided in Section 14.

11. Children & Minors

// SECTION 11.1

12. Cross-Border Data Transfers

// SECTION 12.1–12.2

Some of phshy's technology infrastructure, game delivery systems, and contracted service providers operate outside the Philippines. Where your personal data is transferred outside the Philippines, phshy ensures that such transfers are conducted in compliance with the Data Privacy Act of 2012, including ensuring that the receiving country or organization provides an adequate level of data protection or that appropriate contractual safeguards are in place.

phshy does not transfer player financial data or KYC documents to recipients outside the Philippines unless explicitly required to do so by PAGCOR regulations, AMLC requirements, or other applicable Philippine law.

13. Changes to This Privacy Policy

// SECTION 13.1–13.2

phshy may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or Platform services. When material changes are made, phshy will notify registered players via email to their registered address and post a prominent notice on the Platform at least fourteen (14) days before the changes take effect.

The current version of this Privacy Policy is always accessible at phshy.org/privacy-policy. The date at the top of this document indicates when the Policy was last updated. Your continued use of the phshy Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms.

14. Contact & Data Privacy Officer

// SECTION 14.1

To exercise any of your data rights, to ask questions about this Privacy Policy, or to report a data privacy concern, please contact phshy's Data Privacy Officer: