phkay Privacy Policy –
How We Handle Your Data

1Introduction

phkay ("phkay," "we," "us," "our") operates the online gaming platform accessible at phkay.club and provides casino games, sports betting, bingo, online sabong, and associated gaming services to Philippine-resident players. In the course of operating this platform, phkay necessarily collects and processes personal information relating to its users.

This Privacy Policy has been prepared in accordance with the Republic of the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as overseen by the National Privacy Commission (NPC). It describes what personal data phkay collects, the purposes for which it is processed, who it may be shared with, how long it is retained, and the rights available to you as a data subject under Philippine law.

This Policy should be read together with the phkay Terms & Conditions, which govern your use of the Platform. In the event of any conflict between this Privacy Policy and the Terms & Conditions in relation to a privacy matter, this Privacy Policy shall prevail.

2Data Controller

For the purposes of the Data Privacy Act of 2012, phkay is the personal information controller with respect to the personal data collected through the phkay platform. phkay is responsible for ensuring that personal data processed through the Platform is handled in accordance with this Policy and applicable Philippine data privacy law.

phkay has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act and this Policy. Enquiries relating to this Privacy Policy or to the exercise of your data subject rights may be directed to the phkay support team, who will route them to the DPO where appropriate. Contact details are set out in Section 14 of this Policy.

3Personal Data We Collect

phkay collects personal data in several ways — directly from you when you register or use the Platform, automatically when you interact with the Platform, and in some cases from third parties such as payment processors. The categories of data collected are described below.

4How We Use Your Personal Data

phkay uses the personal data it collects for the following specific purposes:

• Creating and managing your phkay account, including authentication at login via your registered credentials and two-factor OTP.
• Processing deposits via GCash, Maya, BPI, BDO, and other supported Philippine payment methods.
• Processing withdrawal requests and confirming fund transfers to your registered payment method.
• Providing access to games, sports betting markets, bingo, and sabong on the Platform.

• Conducting Know Your Customer (KYC) identity verification as required by applicable Philippine regulations and PAGCOR-aligned standards.
• Fulfilling anti-money laundering (AML) obligations, including transaction monitoring and reporting where required by Philippine law.
• Verifying that all players are aged 21 or above prior to permitting real-money gaming access.
• Maintaining records required by Philippine gaming regulators and financial regulators.

• Detecting and preventing fraudulent activity, unauthorised account access, and multi-accounting.
• Monitoring for unusual betting patterns indicative of match-fixing, bonus abuse, or coordinated exploitation.
• Enforcing self-exclusion decisions and verifying that self-excluded players do not re-register.

• Responding to your support enquiries via Live Chat and email.
• Sending transactional communications related to your account (deposit confirmations, withdrawal status, OTP codes).
• Sending promotional communications where you have provided consent or where permitted under the Data Privacy Act — with an opt-out mechanism provided in every marketing message.

• Administering deposit limits, loss limits, session timers, and self-exclusion tools set by you.
• Identifying patterns of play that may indicate problematic gambling behaviour, in accordance with our responsible gaming obligations.

• Analysing aggregated, anonymised usage data to improve Platform performance, game selection, and user experience — in ways that do not identify individual players.

5Legal Basis for Processing

Under the Data Privacy Act of 2012, phkay processes your personal data on one or more of the following lawful bases:

• Contractual necessity: Processing required to perform the phkay Terms & Conditions agreement with you, including account operation, payment processing, and game access.
• Legal obligation: Processing required to comply with applicable Philippine laws, including AML regulations, PAGCOR requirements, and age verification obligations.
• Legitimate interests: Processing carried out for phkay's legitimate operational interests — including fraud prevention, platform security, and responsible gaming monitoring — where these interests are not overridden by your rights and interests.
• Consent: For certain processing activities such as direct marketing communications, phkay will obtain your prior consent where required by law. You have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

6Sharing Your Personal Data

phkay does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Your data may be shared in the following limited circumstances:

• Payment processors: GCash (GXI Inc.), Maya (Voyager Innovations), and participating Philippine banks, for the purpose of processing deposits and withdrawals on your behalf.
• KYC and identity verification providers: Third-party verification services that assist phkay in fulfilling its age and identity verification obligations under Philippine regulations.
• Game providers: JILI Gaming, Pragmatic Play, PG Soft, and other licensed providers whose game platforms are integrated into phkay. These providers may process limited technical data to deliver gameplay, subject to their own privacy policies.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other competent Philippine government authorities where disclosure is required by law.
• Law enforcement: Philippine law enforcement authorities where phkay is legally compelled to disclose information.
• Service providers: Third-party companies engaged to provide infrastructure, analytics, fraud detection, or customer support technology services on behalf of phkay, subject to data processing agreements that restrict use to the service purpose only.

Where phkay shares your data with third parties, it does so under contractual arrangements that require those parties to handle your data in compliance with the Data Privacy Act of 2012 and this Privacy Policy.

7Cookies & Tracking Technologies

phkay uses cookies and similar tracking technologies on the Platform to support functionality, maintain your login session, and understand how users interact with the site. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session cookies that maintain your authenticated login state. They cannot be disabled without affecting your ability to use phkay.
• Functional cookies: Remember your preferences such as game filter settings, responsible gaming tool configurations, and language preferences.
• Analytics cookies: Used in anonymised, aggregated form to understand how players navigate the Platform, which games are most popular, and where technical issues occur. Individual players are not identified through analytics data.
• Security cookies: Used to detect fraudulent activity, bot traffic, and suspicious login behaviour — for example, identifying login attempts from unusual geographic locations relative to your registered Philippine address.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to or using the phkay Platform. phkay does not use cookies to serve advertising for third-party products or to track your activity across other websites.

8Data Security

phkay implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption applied to all data in transit between your device and phkay's servers.
• Hashed password storage — passwords are never stored in plain text and cannot be recovered by phkay staff.
• Two-factor authentication (2FA) available to all registered players via OTP to their registered +63 mobile number.
• Access controls — internal access to personal data is restricted to authorised personnel with a documented operational need, with access logging maintained.
• Regular security assessments of Platform infrastructure and data storage systems.
• Incident response procedures in place to identify, contain, and notify affected parties of data breaches in accordance with NPC notification obligations under the Data Privacy Act.

9Data Retention

phkay retains personal data for as long as necessary to fulfil the purposes described in this Policy or as required by applicable Philippine law. The following general retention periods apply:

• Active account data: Retained for the duration of your phkay account relationship and for a minimum of five (5) years following account closure, as required by AML regulations and PAGCOR-aligned record-keeping standards.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, in compliance with applicable Philippine financial recordkeeping obligations.
• KYC and identity verification documents: Retained for a minimum of five (5) years from account closure or the date of last transaction, whichever is later.
• Support communications: Retained for three (3) years from the date of the last communication, to support dispute resolution and service improvement.
• Technical and log data: Retained for a period of up to twelve (12) months, after which it is routinely deleted or anonymised.

Upon expiry of the applicable retention period, phkay will securely delete or anonymise your personal data such that it can no longer be associated with your identity. Where data is anonymised rather than deleted, it may be retained and used for aggregated statistical purposes without limitation.

10Your Data Subject Rights

As a Philippine resident, you have the following rights over your personal data under the Data Privacy Act of 2012. These rights may be exercised by contacting phkay's support team as described in Section 14.

11Children and Minors

phkay is strictly a 21+ platform. The Platform is not directed at, and does not knowingly collect personal data from, any person under the age of 21. This age threshold reflects the minimum age requirement for casino-style gambling in the Philippines as referenced under PAGCOR guidelines, and is more restrictive than the general "child" threshold under the Data Privacy Act.

If phkay becomes aware that personal data has been collected from a person under the age of 21 without verified parental or guardian consent, phkay will promptly delete that data and close the associated account. If you believe a minor has registered on phkay, please notify us immediately via Live Chat or email so we can take appropriate action.

12International Data Transfers

phkay primarily processes and stores personal data within the Philippines. However, some third-party service providers — including certain game providers and technical infrastructure suppliers — may process personal data in other jurisdictions. Where such international transfers occur, phkay ensures they are conducted in accordance with the requirements of the Data Privacy Act of 2012, including where necessary by entering into data transfer agreements that provide equivalent protections to those available under Philippine law.

phkay does not transfer your financial data (GCash details, bank account information) to jurisdictions that do not provide adequate data protection standards, except where required by the payment processing infrastructure of your chosen Philippine payment method.

13Changes to This Privacy Policy

phkay may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, Platform features, or our data processing practices. The effective date of the current version is stated at the top of this Policy and in the Table of Contents sidebar.

Where material changes are made to this Policy, phkay will notify registered players via the mobile number or email address associated with their account, or through a notice on the Platform. Your continued use of phkay following the effective date of an updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not accept the updated Policy, you may request voluntary account closure and withdrawal of any remaining balance.

14Contact Us

For questions, concerns, or requests relating to this Privacy Policy or to the exercise of your data subject rights, please contact the phkay team through any of the following channels:

• Live Chat: Available 24/7 via the phkay Platform. This is the fastest channel for privacy-related enquiries.
• Email: [email protected] — include "Privacy Request" in your subject line for faster routing.
• Languages: Support is available in Filipino (Tagalog) and English.

phkay aims to acknowledge all privacy-related enquiries within five (5) business days and to resolve them within thirty (30) calendar days. Where a request requires additional time due to complexity, phkay will notify you of the expected resolution timeframe.

If you are not satisfied with phkay's handling of a privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC), the government body responsible for enforcement of the Data Privacy Act of 2012.