Privacy Policy

1. Who We Are

This Privacy Policy applies to phgraet and the online casino platform operated at phgraet.net (the "Platform"). References to "phgraet," "we," "us," or "our" throughout this document refer to the operator of the phgraet Platform.

phgraet is an online gaming platform designed for Filipino players, offering casino games, crash games, slots, bingo, and related entertainment services. We are committed to handling your personal data responsibly and in accordance with applicable data privacy laws in the Philippines.

For any privacy-related questions or requests, you may contact our Data Privacy team at the contact details provided in Section 13 of this Policy.

2. What Personal Data We Collect

phgraet collects personal data that is necessary to provide you with a safe, functional, and compliant gaming experience. The categories of personal data we collect include:

2.1 Account Registration Data

• Full legal name (as it appears on your government-issued ID);
• Date of birth (for age verification — you must be 21 or older);
• Email address;
• Mobile phone number;
• Residential address (city, province, country);
• Username and encrypted password.

2.2 Identity Verification (KYC) Data

• Copies of government-issued identification documents (e.g., PhilSys National ID, Philippine Passport, Driver's License, SSS/GSIS ID, PRC ID, Voter's ID);
• Proof of address documents where required;
• Selfie or facial verification image where required for enhanced KYC.

2.3 Financial and Transaction Data

• Deposit and withdrawal transaction records;
• Payment method details (e.g., GCash account reference, Maya account reference, bank account details — stored in tokenized or reference form only, never full card numbers);
• Account balance history;
• Bonus and promotion redemption records.

2.4 Gaming Activity Data

• Game session logs (games played, wagers placed, outcomes);
• Responsible gaming tool usage (deposit limits set, session reminders, cooling-off periods);
• Self-exclusion status and history.

2.5 Technical and Device Data

• IP address and approximate geolocation;
• Device type, operating system, and browser information;
• Session timestamps and login history;
• Cookie identifiers and platform interaction logs.

2.6 Communications Data

• Support chat and email correspondence with phgraet's customer service team;
• Survey responses and feedback submissions;
• Marketing communication preferences.

3. How We Collect Your Data

phgraet collects your personal data through the following means:

• Directly from you: When you register a phgraet account, complete KYC verification, make a deposit or withdrawal, contact support, or respond to a survey;
• Automatically: When you use the phgraet Platform, we automatically collect technical and device data through cookies, server logs, and similar technologies;
• From third-party payment providers: When you make a deposit or withdrawal via GCash, Maya, or a Philippine bank, we receive transaction confirmation data from the relevant payment provider;
• From identity verification services: Where phgraet uses third-party KYC verification tools, those services may return verification results and associated data to phgraet;
• From fraud prevention and security services: phgraet may receive risk signals and fraud indicators from security service providers to protect the integrity of the Platform.

4. Why We Use Your Data (Legal Bases)

phgraet processes your personal data for specific, legitimate purposes. The table below summarizes the primary purposes for which we use your data and the legal basis for each:

5. How We Share Your Data

phgraet does not sell your personal data. We share your data only in the following limited circumstances and only to the extent necessary for each purpose:

5.1 Payment Processors

To process your deposits and withdrawals, phgraet shares relevant transaction data with approved Philippine payment providers including GCash, Maya, and partner banks (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank). These providers process your data solely to complete the requested transaction and are bound by their own privacy obligations.

5.2 Identity Verification Providers

phgraet uses third-party KYC and identity verification services to confirm your identity and age. Your identification documents and verification data are shared with these providers solely for verification purposes and are not retained by them beyond the period necessary to complete verification.

5.3 Fraud Prevention and Security Services

phgraet shares technical and behavioral data with fraud prevention and cybersecurity service providers to protect the Platform and its players from unauthorized access, fraud, and money laundering. These providers act as data processors under phgraet's instructions.

5.4 Regulatory and Legal Authorities

phgraet may disclose your personal data to Philippine regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory directive. This includes disclosures required under anti-money laundering regulations and gaming regulatory frameworks.

5.5 Corporate Transactions

In the event of a merger, acquisition, or sale of all or part of phgraet's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material changes to this Privacy Policy that result from it.

6. International Data Transfers

phgraet primarily stores and processes your personal data within servers located in the Asia-Pacific region. In some cases, data may be transferred to or accessed from locations outside the Philippines — for example, where phgraet uses cloud infrastructure or third-party service providers with operations in other countries.

Where such transfers occur, phgraet ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that required under Philippine data privacy law. These safeguards may include contractual data protection clauses, data processing agreements, and assessments of the recipient country's data protection framework.

If you would like more information about the specific safeguards applied to international transfers of your data, please contact phgraet's Data Privacy team using the details in Section 13.

7. Data Retention

phgraet retains your personal data for as long as is necessary to fulfill the purposes for which it was collected, subject to the following retention principles:

• Active account data: Retained for the duration of your phgraet account and for a period of at least five (5) years following account closure, in accordance with applicable anti-money laundering and gaming regulatory requirements;
• KYC and identity documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later;
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction;
• Support communications: Retained for up to three (3) years from the date of the last communication, unless a longer period is required for dispute resolution;
• Marketing preferences: Retained until you withdraw your consent or request deletion, subject to any overriding legal retention obligations;
• Technical and device logs: Retained for up to twelve (12) months from collection, unless required for longer periods for security or fraud investigation purposes.

When personal data is no longer required, phgraet securely deletes or anonymizes it in accordance with our internal data disposal procedures.

8. Cookies and Tracking Technologies

phgraet uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device when you visit a website. phgraet uses the following categories of cookies:

phgraet does not use advertising or cross-site tracking cookies. You can manage your cookie preferences through your browser settings at any time. Note that disabling essential cookies will affect your ability to use the phgraet Platform.

9. Security Measures

phgraet implements a layered approach to data security, combining technical, organizational, and procedural safeguards to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Our security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phgraet Platform;
• Encryption at rest for sensitive personal data stored in phgraet's databases;
• Password hashing using industry-standard algorithms — phgraet never stores your password in plain text;
• Two-factor authentication (2FA) available for all phgraet accounts;
• Role-based access controls limiting internal access to personal data to authorized personnel only, on a need-to-know basis;
• Regular security audits and vulnerability assessments of the phgraet Platform;
• Intrusion detection systems and real-time monitoring for suspicious activity;
• Staff training on data privacy and security obligations.

Despite these measures, no system is completely immune to security risks. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, phgraet will notify you and the relevant regulatory authority in accordance with applicable legal requirements.

10. Your Privacy Rights

As a phgraet player and a data subject under applicable Philippine privacy law, you have the following rights with respect to your personal data:

To exercise any of these rights, please contact phgraet's Data Privacy team using the details provided in Section 13. phgraet will respond to all valid requests within thirty (30) days. In complex cases, this period may be extended by a further sixty (60) days, and you will be informed of any such extension.

phgraet will not charge a fee for exercising your privacy rights unless a request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

11. Children and Minors

The phgraet Platform is strictly intended for individuals who are 21 years of age or older, in accordance with Philippine gaming regulations applicable to casino-style gambling. phgraet does not knowingly collect personal data from individuals under the age of 21.

If phgraet discovers or has reason to believe that a registered account belongs to a person under 21 years of age, that account will be immediately suspended, all associated data will be reviewed, and the account will be permanently closed in accordance with our Terms & Conditions and applicable regulatory requirements.

12. Changes to This Privacy Policy

phgraet reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, phgraet will:

• Update the "Last Updated" date at the top of this page;
• Notify registered players via the email address associated with their phgraet account;
• Where required by law, obtain fresh consent before processing your data under the revised terms.

Your continued use of the phgraet Platform following the publication of an updated Privacy Policy constitutes your acknowledgment of the changes. We recommend reviewing this page periodically to stay informed of how phgraet protects your data.

13. Contact and Data Inquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or phgraet's handling of your personal data, please contact our Data Privacy team. We are committed to addressing all privacy inquiries promptly and transparently.

You may reach phgraet's Data Privacy team through the following channel:

• Email: [email protected]
• General Support: [email protected]

phgraet aims to respond to all data privacy inquiries within fifteen (15) business days. For requests to exercise your data subject rights, the response period is up to thirty (30) days as outlined in Section 10.