phky Privacy Policy

The operator of the phky platform at phky.asia ("phky," "we," "us," "our") is the data controller responsible for the personal data you provide when registering for or using the phky Platform. phky operates under PAGCOR oversight for the Philippine online gaming market and processes personal data in accordance with Republic Act No. 10173 (the Data Privacy Act of 2012, "DPA"), its Implementing Rules and Regulations, and all issuances of the National Privacy Commission of the Philippines ("NPC").

phky has appointed a Data Protection Officer ("DPO") responsible for overseeing the organization's data privacy compliance program. The DPO's contact details are set out in Section 15 of this Policy.

phky collects the following categories of personal data from players and platform visitors:

phky does not intentionally collect sensitive personal information as defined under the DPA (such as health data, religious beliefs, or political views) unless specifically required for responsible gaming compliance, in which case the legal basis and specific purpose will be clearly communicated to you at the time of collection.

phky collects personal data through the following channels:

• Direct provision by you: When you complete account registration, submit KYC documents, make a deposit or withdrawal, use live chat support, or communicate with phky by any means.
• Automated collection: Through cookies, web beacons, server logs, and similar tracking technologies when you access and interact with the phky Platform. See Section 9 for details on cookies.
• Third-party sources: phky may receive identity verification data from licensed KYC and anti-money laundering (AML) screening service providers, and fraud risk signals from payment processors. All third-party data sources used by phky are subject to contractual data processing agreements.
• Regulatory sources: PAGCOR or other Philippine regulatory authorities may provide phky with information about a Player where required by law, such as self-exclusion registry data or regulatory investigation requirements.

phky processes your personal data on the following legal bases as recognized under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform phky's obligations under the account registration agreement and these Terms and Conditions — including account management, gameplay, payment processing, and customer support.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, Anti-Money Laundering Act obligations (RA 9160 as amended), Know Your Customer requirements, and any other applicable Philippine law or regulatory direction.
• Legitimate interests: Processing conducted for phky's legitimate business interests, including fraud prevention, security monitoring, platform analytics for service improvement, and responsible gaming monitoring — provided such interests are not overridden by your rights and freedoms.
• Consent: Where phky relies on your consent as the legal basis for processing (for example, for certain marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

phky uses the personal data it collects for the following purposes:

• Creating and managing your phky account, including identity verification and authentication;
• Processing deposits, withdrawals, and all financial transactions associated with your account;
• Providing and operating phky games, live casino, bingo, lottery, and all platform services;
• Administering bonuses and promotions in accordance with their respective terms;
• Communicating with you regarding account activity, transactions, security alerts, and support requests;
• Conducting anti-fraud analysis, AML monitoring, and regulatory compliance screening;
• Enforcing phky's Terms and Conditions, including investigating suspected breaches;
• Operating phky's responsible gaming program, including monitoring for problem gambling indicators and administering self-exclusion requests;
• Improving the phky Platform through aggregated, anonymized usage analytics;
• Complying with lawful requests from PAGCOR, the NPC, or other competent Philippine authorities;
• Where you have provided consent, sending promotional communications about phky offers and new features.

phky does not sell, rent, or trade your personal data. phky may share your personal data with the following categories of recipients only to the extent necessary for the stated purpose:

• Licensed game providers (such as Evolution, Pragmatic Play, PG Soft, and others): Necessary session and authentication data is shared to enable game delivery. Game providers are bound by contractual data processing terms.
• Payment service providers (GCash, PayMaya, BPI, BDO, Metrobank): Transaction data required to process your deposits and withdrawals.
• KYC and AML compliance vendors: Identity documents and verification data shared solely for the purpose of fulfilling phky's regulatory identity verification obligations.
• IT and infrastructure service providers: Cloud hosting, database, and security service providers operating on phky's behalf under data processing agreements that prohibit secondary use of your data.
• Regulatory and law enforcement authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council, or any other Philippine authority with lawful jurisdiction, where required by law, court order, or regulatory direction.
• Professional advisors: Legal counsel, auditors, or accountants bound by confidentiality obligations, where required in connection with phky's business operations.

In all cases where phky shares personal data with third-party service providers, phky maintains data processing agreements that obligate those providers to process your data solely for the specified purpose, maintain appropriate security standards, and not disclose your data to further third parties without phky's authorization.

Some of phky's service providers and game platform partners may be located outside the Philippines. Where personal data is transferred outside the Philippines, phky ensures that appropriate safeguards are in place in accordance with the Data Privacy Act and NPC regulations, including:

• Contractual clauses approved by the NPC or substantially equivalent to standard contractual clauses;
• Transfers to countries that the NPC has recognized as providing adequate data protection;
• Binding corporate rules or equivalent instruments where applicable.

You may request information about the specific safeguards governing any international transfer of your personal data by contacting the phky Data Protection Officer at the details in Section 15.

phky retains personal data for the minimum period necessary to fulfill the purposes for which it was collected, subject to the following mandatory retention requirements:

• KYC and identity verification records: Retained for a minimum of five (5) years from the date of account closure, in compliance with PAGCOR licensing conditions and Anti-Money Laundering Act requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required under RA 9160 (Anti-Money Laundering Act) and its implementing regulations.
• Gameplay and bet history logs: Retained for a minimum of three (3) years, or longer if required for an unresolved dispute or regulatory inquiry.
• Communications and support records: Retained for three (3) years from the date of the interaction, unless a longer period is required for an unresolved complaint.
• Marketing consent records: Retained for the duration of your Account, and for one (1) year following Account closure, to demonstrate consent compliance.

Upon expiry of applicable retention periods, phky securely deletes or anonymizes personal data so that it can no longer be associated with any individual. Where full deletion is technically impractical within complex database systems, phky implements pseudonymization and access restrictions as interim measures.

phky uses cookies and similar tracking technologies on its Platform to enable core functionality, maintain session security, and analyze platform usage. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function, including authentication session cookies, security tokens, and load-balancing cookies. These cannot be disabled without preventing access to the Platform.
• Functional Cookies: Store your preferences such as language settings, game lobby filters, and responsible gaming configurations so you do not need to reset them on each visit.
• Analytics Cookies: Used to collect aggregated, anonymized data about how players use the phky Platform. This data is used internally to identify areas for improvement. Analytics data is not shared with advertising networks.

phky does not use third-party advertising cookies or behavioral tracking cookies for purposes unrelated to Platform operation. You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impair your ability to use the phky Platform. All cookie-related data processing is handled by phky and its contracted service providers only.

phky implements a multi-layered technical and organizational security framework to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Security measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and phky servers;
• AES-256 encryption for all personal data stored in phky databases;
• Role-based access controls restricting employee access to personal data on a strict need-to-know basis;
• Multi-factor authentication for all phky staff with administrative system access;
• Continuous automated monitoring of systems for intrusion attempts, anomalous access patterns, and security incidents;
• Regular independent penetration testing and security audits of the phky Platform;
• Secure development practices applied to all Platform updates and new feature releases;
• Physical and logical data center security controls at phky's infrastructure providers.

No electronic transmission or storage system is entirely immune from security risk. While phky implements industry-standard protections, phky cannot guarantee the absolute security of your data. You also play a role in account security — see Section 5 of phky's Terms and Conditions for your obligations regarding credential management.

Under Republic Act No. 10173 (the Data Privacy Act of 2012), you have the following rights with respect to your personal data held by phky:

To exercise any of the above rights, contact phky's Data Protection Officer using the contact details in Section 15. phky will respond to verified data rights requests within thirty (30) days. Where a request is complex or phky receives a large number of requests, this period may be extended by a further thirty (30) days with notice to you.

phky may need to verify your identity before processing a data rights request to prevent fraudulent access to another person's personal data. Requests that cannot be fulfilled in full due to a conflicting legal obligation will be declined with a written explanation. You have the right to lodge a complaint with the National Privacy Commission if you believe phky has not handled your request in accordance with the DPA.

The phky Platform is strictly restricted to individuals who are 21 years of age or older in compliance with PAGCOR regulations. phky does not knowingly collect personal data from any individual under the age of 21. Account registration requires age confirmation, and KYC verification confirms the identity and age of every Account holder prior to withdrawal processing.

If phky discovers that personal data has been collected from an individual under 21 years of age, the relevant Account will be immediately closed, any balance will be handled in accordance with phky's Terms and Conditions, and all associated personal data will be securely deleted to the extent not required to be retained for regulatory compliance purposes.

Parents and guardians who believe that a minor has registered on the phky Platform should immediately contact the phky Data Protection Officer using the contact details in Section 15.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, phky will take the following actions:

• Contain the breach and assess its scope and impact as promptly as possible following discovery;
• Notify the National Privacy Commission within seventy-two (72) hours of becoming aware of a notifiable breach, in accordance with NPC Circular 16-03;
• Notify affected individuals where the breach is likely to result in a high risk to their personal rights and freedoms, without undue delay and with sufficient information to allow them to take protective measures;
• Document the breach, its effects, and all remedial actions taken, and maintain that documentation in phky's breach register.

If you suspect that your phky account has been compromised or that your personal data has been exposed without authorization, please contact phky immediately via the in-account live chat or the DPO contact details in Section 15.

phky reserves the right to update or modify this Privacy Policy at any time in response to changes in Philippine data protection law, PAGCOR regulatory requirements, phky's processing activities, or best-practice guidance from the National Privacy Commission.

When material changes are made to this Privacy Policy, phky will notify active Account holders by publishing the updated policy on the Platform and, where reasonably practicable, by notifying you via your registered contact details before the changes take effect. The "Last Updated" date at the top of this policy reflects the most recent revision.

Your continued use of the phky Platform after the effective date of any amended Privacy Policy constitutes your acknowledgment of the revised policy. If you do not accept the changes, you should cease using the Platform and request Account closure through phky's 24/7 live chat support.

For all matters relating to this Privacy Policy — including data rights requests, questions about phky's data processing practices, or reports of suspected data breaches — please contact phky's Data Protection Officer through the following channels:

• Live Chat: Available 24/7 inside your phky account dashboard — the fastest channel for most inquiries.
• Email: [email protected] — please use the subject line "Privacy / DPO Request" so your message is routed correctly.

phky aims to respond to all Privacy Policy inquiries within five (5) business days. Data rights requests will be acknowledged promptly and substantively resolved within the thirty (30) day statutory period. If you are not satisfied with phky's response to a data rights request or privacy complaint, you have the right to escalate the matter to the National Privacy Commission of the Philippines.