phdram Privacy Policy

1.1 This Privacy Policy governs the collection, use, storage, disclosure, and protection of personal information processed by phdram in connection with the operation of the phdram online gaming platform.

1.2 phdram is committed to compliance with the Philippine Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations (IRR), as administered by the National Privacy Commission (NPC) of the Philippines.

1.3 This policy applies to all personal data phdram processes, whether collected online through the phdram platform, provided via customer support channels, or obtained through third-party payment processors and game providers operating on behalf of phdram.

1.4 "Personal information" in this policy refers to any information from which you can be identified, directly or indirectly — including your name, mobile number, date of birth, address, payment details, device identifiers, and gaming activity records.

2.1 phdram is the data controller responsible for your personal information collected and processed through the phdram platform. As data controller, phdram determines the purposes and means of processing your personal data.

2.2 phdram operates under the PAGCOR regulatory framework. Our data processing activities are therefore also subject to PAGCOR's applicable data governance requirements in addition to the NPC's rules.

2.3 For all data protection enquiries, requests, and complaints, you may contact the phdram Data Protection Officer at: [email protected] (subject line: "Data Privacy Request").

phdram collects personal information through several channels. The table below summarises the categories of data we collect, the source of each category, and the primary purpose for which it is collected.

3.1 phdram does not collect sensitive personal information (as defined by RA 10173) beyond what is strictly necessary for identity verification and regulatory compliance. We do not collect information relating to race, religion, political opinions, health (beyond responsible gaming declarations), or biometric data beyond KYC photo identification.

phdram processes your personal information for the following purposes:

• Account management: Creating, maintaining, and securing your phdram player account; verifying your identity and age; processing login authentication.
• Service delivery: Enabling access to games, processing wagers, crediting winnings, managing your phdram wallet, and administering bonuses and promotions.
• Payment processing: Facilitating deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, and other approved payment methods; conducting anti-fraud and AML checks on transactions.
• Regulatory compliance: Meeting phdram's obligations under PAGCOR licensing conditions, RA 10173, anti-money laundering (AMLA) requirements, and other applicable Philippine law.
• Responsible gaming: Monitoring gaming activity for signs of problem gambling; administering deposit limits, session reminders, and self-exclusion requests; maintaining exclusion records.
• Customer support: Responding to enquiries, resolving complaints, and maintaining records of support interactions.
• Security and fraud prevention: Detecting and investigating suspicious account activity, cheating, bonus abuse, and unauthorised access attempts.
• Platform improvement: Analysing anonymised and aggregated usage data to improve platform performance, game selection, and user experience.
• Marketing communications: Sending promotional offers, game updates, and bonus notifications to players who have not opted out — subject to your communication preferences.

4.1 phdram will not use your personal information for any purpose not listed above without obtaining your prior consent or unless required to do so by law.

Under RA 10173, phdram processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our agreement with you — account registration, game access, payment processing, and support services.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, AML obligations, NPC data protection requirements, and other applicable Philippine law.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and anonymised analytics — where these interests are not overridden by your rights.
• Consent: Processing for marketing communications and certain optional features — where your consent is the appropriate basis. You may withdraw consent at any time by contacting [email protected] or updating your account settings.

6.1 phdram does not sell, rent, or trade your personal information to any third party for their own marketing purposes. Period.

6.2 phdram may share your personal information with the following categories of recipient, strictly on a need-to-know basis and subject to appropriate data protection obligations:

• Payment processors: GCash (GXI), BancNet, BPI, BDO, Metrobank, UnionBank, and PayMaya — to process deposits and withdrawals and conduct transaction verification.
• Game providers: JILI Technology, Fa Chai Gaming, PG Soft, Spadegaming, and other licensed game studios — to facilitate game access and record keeping for auditing and dispute resolution.
• KYC and AML service providers: Third-party identity verification and anti-money laundering screening services used to meet PAGCOR and AMLA compliance obligations.
• Regulatory authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and law enforcement agencies — when required by law, court order, or regulatory directive.
• IT and infrastructure providers: Cloud hosting, security monitoring, and technical support providers who process data on phdram's behalf under strict data processing agreements.

6.3 All third-party service providers engaged by phdram are required to maintain data protection standards consistent with RA 10173 and phdram's own data governance requirements.

7.1 phdram retains your personal information for as long as necessary to fulfil the purposes described in this policy, or as required by applicable law.

7.2 The following general retention periods apply:

• Account and identity data: Retained for the lifetime of the account plus five (5) years after account closure, in compliance with PAGCOR and AMLA record-keeping requirements.
• Transaction and gaming records: Retained for a minimum of five (5) years following the transaction date, as required by AMLA regulations.
• Support communications: Retained for three (3) years from the date of the interaction.
• Marketing consent records: Retained until you withdraw consent, plus two (2) years thereafter as a record of the consent history.
• Technical logs: Retained for twelve (12) months unless extended for security investigation purposes.

7.3 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual.

8.1 phdram employs a range of technical and organisational security measures to protect your personal information from unauthorised access, disclosure, alteration, and destruction:

• 256-bit SSL/TLS encryption on all data transmissions between your device and phdram servers.
• Encryption at rest for sensitive data including passwords (stored as salted hashes — never in plain text), payment identifiers, and identity documents.
• Role-based access controls ensuring that only authorised phdram personnel can access personal data relevant to their specific function.
• Multi-factor authentication for phdram staff accessing internal systems containing personal data.
• Regular security audits and penetration testing of the phdram platform infrastructure.
• Incident response procedures for detecting, containing, and reporting personal data breaches in accordance with NPC notification requirements.

8.2 While phdram takes all reasonable precautions to protect your data, no internet transmission is completely secure. You are responsible for maintaining the security of your own phdram login credentials. phdram will never ask for your password by email, SMS, or chat.

Under RA 10173, you have the following rights with respect to your personal information held by phdram:

• Right to be informed: The right to know what personal information phdram holds about you and how it is used — which this Privacy Policy addresses.
• Right of access: The right to request a copy of the personal information phdram holds about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal information.
• Right to erasure: The right to request deletion of your personal information where there is no longer a legitimate basis for phdram to retain it, subject to legal and regulatory retention obligations.
• Right to object: The right to object to processing of your personal information for direct marketing purposes. You may opt out of marketing communications at any time.
• Right to data portability: The right to receive your personal data in a structured, commonly used format where technically feasible.
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission if you believe phdram has violated your data privacy rights.

9.1 To exercise any of the above rights, contact the phdram Data Protection Officer at [email protected] with the subject line "Data Privacy Request." phdram will respond within fifteen (15) business days of receiving a verifiable request.

9.2 phdram may be required to verify your identity before processing a data rights request to prevent unauthorised access to another person's information.

10.1 phdram uses cookies and similar tracking technologies (including local storage and session tokens) on the phdram platform. These technologies serve the following purposes:

• Essential cookies: Required for core platform functionality — maintaining your login session, storing your wallet state during gameplay, and securing authenticated requests. These cannot be disabled without impairing platform functionality.
• Analytical cookies: Used to collect anonymised data on how players interact with the phdram platform — page visits, feature usage, error rates — to help us improve the product.
• Preference cookies: Used to remember your display preferences, notification settings, and responsible gaming configurations between sessions.

10.2 phdram does not use third-party advertising cookies or share cookie data with advertising networks.

10.3 You may manage cookie preferences through your browser settings. Disabling essential cookies will affect your ability to log in and use the phdram platform.

11.1 phdram does not knowingly collect personal information from any person under the age of 21 years. Creating a phdram account requires confirmation that you are at least 21 years of age, consistent with PAGCOR regulations.

11.2 If phdram discovers or has reason to believe that personal information has been collected from a person under the age of 21, the relevant account will be immediately suspended, all associated data will be reviewed, and the personal information will be securely deleted where there is no overriding legal obligation to retain it.

11.3 If you believe a minor has registered or attempted to use the phdram platform, please contact us immediately at [email protected].

12.1 phdram reserves the right to update or amend this Privacy Policy at any time. Material changes will be communicated to registered players via the mobile number or email address on file, and/or via a prominent notice on the phdram platform.

12.2 The "Last Updated" date at the top of this page reflects when the most recent revision was made. Continued use of the phdram platform following notification of changes constitutes your acceptance of the revised Privacy Policy.

12.3 We encourage you to review this Privacy Policy periodically to stay informed of how phdram is protecting your personal information.

For all privacy-related enquiries, data rights requests, or concerns about how phdram has handled your personal information, please contact:

phdram is committed to resolving all data privacy concerns fairly, transparently, and within the timeframes required by the National Privacy Commission.