Your Privacy Matters to phtaya.

This Privacy Policy ("Policy") describes how phtaya. ("phtaya.," "we," "us," or "our") collects, uses, stores, and discloses personal information in connection with the online gaming platform operated at phtaya.onl ("Platform"). It applies to all users of the Platform, including registered players, visitors who browse without registering, and any person who contacts phtaya. through any channel.

By accessing or using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described herein, you should discontinue use of the Platform and, if applicable, request closure of your account.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy. Where those documents address data-related matters, this Policy governs.

phtaya. is the data controller responsible for the personal information collected through the Platform. As data controller, phtaya. determines the purposes and means by which your personal data is processed. All data processing activities described in this Policy are carried out by phtaya. or by third-party processors acting under phtaya.'s instruction and bound by appropriate data processing agreements.

If you have questions about how phtaya. handles your personal data, or if you wish to exercise any of your rights under applicable data protection law, please contact us using the details provided in Section 14 of this Policy.

phtaya. collects personal information in the following categories:

phtaya. does not intentionally collect sensitive personal information beyond what is required for identity verification and responsible gaming compliance. Where sensitive data is collected — such as a copy of a government-issued ID — it is handled with additional safeguards as described in Section 9 of this Policy.

phtaya. collects personal information through the following means:

• Direct interactions: Information you provide when registering an account, completing identity verification, making deposits or withdrawals, contacting support, or submitting feedback.
• Automated technologies: Technical and usage data collected automatically when you access or interact with the Platform, including through cookies, server logs, and similar tracking technologies. See Section 10 for more detail.
• Third-party sources: Information received from payment processors (such as GCash, PayMaya, BPI, BDO, and Metrobank) in connection with transaction processing, and from identity verification service providers used to confirm your age and identity.
• Publicly available sources: In limited circumstances, phtaya. may verify information you have provided against publicly available records, including government databases, where permitted by applicable law.

phtaya. uses the personal information it collects for the following purposes:

• Account management: To create, maintain, and administer your phtaya. account, including verifying your identity and age (21+ requirement), processing your registration, and managing your account settings.
• Transaction processing: To process deposits and withdrawals in Philippine Peso (₱) via your chosen payment method, and to maintain accurate records of all financial transactions on your account.
• Platform security and fraud prevention: To detect, investigate, and prevent fraudulent activity, money laundering, unauthorized account access, and other prohibited conduct as described in our Terms & Conditions.
• Responsible gaming: To monitor gameplay patterns for indicators of problem gambling, to administer deposit limits and self-exclusion requests, and to comply with responsible gaming obligations.
• Customer support: To respond to your queries, resolve disputes, and improve the quality of our support services.
• Legal and regulatory compliance: To comply with applicable Philippine laws and regulations, including anti-money laundering (AML) obligations, data privacy requirements under the Data Privacy Act of 2012, and any directions from competent regulatory authorities.
• Platform improvement: To analyze usage patterns and technical performance data in order to improve the Platform's features, stability, and user experience.
• Communications: To send you transactional notifications (e.g., deposit confirmations, withdrawal updates, security alerts) and, where you have opted in, promotional communications about phtaya. offers and new games.

phtaya. processes your personal data on the following legal bases under the Data Privacy Act of 2012 of the Philippines and applicable data protection principles:

• Contractual necessity: Processing required to perform the contract between you and phtaya. — including account registration, transaction processing, and customer support.
• Legal obligation: Processing required to comply with applicable laws and regulations, including AML obligations, age verification requirements, and regulatory reporting.
• Legitimate interests: Processing carried out for phtaya.'s legitimate business interests, including fraud prevention, platform security, and service improvement, where those interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, and informed consent — primarily in relation to optional promotional communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

phtaya. does not sell, rent, or trade your personal information. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate safeguards:

• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers, to the extent necessary to process your deposits and withdrawals.
• Identity verification providers: Third-party KYC and age verification services used to confirm your identity and satisfy our legal obligations.
• Technology and hosting providers: Cloud infrastructure, platform software, and security service providers who process data on phtaya.'s behalf under binding data processing agreements.
• Regulatory and law enforcement authorities: Where phtaya. is required by law, court order, or regulatory direction to disclose personal information, including to the National Privacy Commission of the Philippines or other competent authorities.
• Professional advisers: Legal, accounting, and auditing professionals, subject to professional confidentiality obligations, where necessary for phtaya.'s business operations.

Any third party that receives personal data from phtaya. is required to handle that data in accordance with applicable data protection law and phtaya.'s instructions. phtaya. does not permit third-party processors to use your data for their own purposes.

phtaya. retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with AML and regulatory record-keeping obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, as required by applicable Philippine financial regulations.
• Technical and usage data: Retained for up to twenty-four (24) months from collection, unless a longer period is required for security investigations or legal proceedings.
• Support communications: Retained for up to three (3) years from the date of the last interaction, for quality assurance and dispute resolution purposes.

Where personal data is no longer required for any lawful purpose, phtaya. will securely delete or anonymize it. Anonymized data — which can no longer be linked to any individual — may be retained indefinitely for analytical purposes.

phtaya. implements a range of technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the phtaya. Platform.
• Encryption of sensitive data at rest, including identity documents and financial account details.
• Role-based access controls that limit access to personal data to phtaya. personnel who require it to perform their job functions.
• Regular security assessments and penetration testing of the Platform infrastructure.
• Multi-factor authentication options for player accounts and mandatory multi-factor authentication for phtaya. staff accessing personal data systems.
• Incident response procedures to detect, contain, and notify affected individuals and authorities in the event of a data breach, in accordance with the Data Privacy Act of 2012.

phtaya. uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device that help us recognize you, remember your preferences, and understand how you use the Platform.

The following categories of cookies are used on phtaya.:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled without affecting your ability to use the Platform.
• Functional cookies: Used to remember your preferences, such as language settings and display options, to provide a more personalized experience.
• Analytics cookies: Used to collect aggregated, anonymized data about how players use the Platform, helping phtaya. identify areas for improvement. This data does not identify individual users.
• Security cookies: Used to detect and prevent fraudulent activity, including bot detection and session integrity verification.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform. phtaya. does not use third-party advertising cookies or behavioral tracking cookies for the purpose of serving targeted advertisements on external platforms.

Under the Data Privacy Act of 2012 of the Philippines and applicable data protection principles, you have the following rights in relation to your personal data held by phtaya.:

• Right to be informed: The right to know what personal data phtaya. collects about you and how it is used — which is the purpose of this Policy.
• Right of access: The right to request a copy of the personal data phtaya. holds about you, along with information about how it is processed.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data. You can update most account information directly through your account settings.
• Right to erasure: The right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected. Note that this right is subject to phtaya.'s legal obligations to retain certain data, as described in Section 8.
• Right to object: The right to object to processing of your personal data where that processing is based on legitimate interests, including profiling for responsible gaming purposes.
• Right to data portability: The right to receive a copy of personal data you have provided to phtaya. in a structured, commonly used, machine-readable format.
• Right to withdraw consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact phtaya. support using the details in Section 14. phtaya. will respond to all verified requests within thirty (30) days. In complex cases, this period may be extended by a further thirty (30) days, with notice provided to you.

phtaya. may need to verify your identity before processing a data rights request to ensure that personal data is not disclosed to unauthorized parties.

The phtaya. Platform is strictly intended for persons aged 21 years and above. phtaya. does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration process, and phtaya. reserves the right to request documentary proof of age at any time.

phtaya. reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. Where changes are material, phtaya. will provide reasonable advance notice by posting the updated Policy on the Platform and, where practicable, by notifying registered players via their registered email address.

The date of the most recent revision is displayed at the top of this page. Your continued use of the Platform following the effective date of any update constitutes your acceptance of the revised Policy. If you do not agree with the updated Policy, you should cease using the Platform and may request account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or phtaya.'s handling of your personal data, please contact our Data Privacy team:

Email: [email protected]

General support: [email protected]

phtaya. aims to acknowledge all privacy-related queries within 48 hours and to resolve them within 30 days. If you are not satisfied with phtaya.'s response to your complaint, you have the right to lodge a complaint with the National Privacy Commission of the Philippines, which is the competent supervisory authority for data protection matters in the Philippines.