phgems Privacy Policy

1Introduction

1.1 phgems is a Philippines-based online casino and sports betting platform operating under PAGCOR oversight. As a regulated operator serving Filipino players, phgems is firmly committed to protecting the privacy and personal data of every individual who interacts with our platform.

1.2 This Privacy Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and the issuances of the National Privacy Commission (NPC) of the Philippines.

1.3 This Policy applies to all personal data collected through the phgems website at phgems.net, mobile applications, live chat, email communications, and any other channel through which you interact with phgems. It applies to registered players, prospective registrants, and casual visitors alike.

1.4 phgems acts as the Personal Information Controller (PIC) with respect to all personal data collected through the Platform. Where phgems engages third-party service providers to process data on its behalf, those providers act as Personal Information Processors (PIPs) under binding data processing agreements.

2Personal Data We Collect

2.1 phgems collects personal data that is adequate, relevant, and not excessive in relation to the purposes for which it is collected. The categories of personal data we collect include:

2.2 Sensitive Personal Information. Certain data categories — including government-issued ID numbers and financial account details — are classified as sensitive personal information under the DPA. phgems applies heightened security measures and stricter access controls to such data and processes it only where legally required or with your explicit consent.

2.3 Voluntary Disclosure. You are not obligated to provide personal data beyond what is required for basic platform access. However, failure to provide certain mandatory data — particularly for KYC and AML compliance — may prevent phgems from processing withdrawals or maintaining your account in active standing.

3How We Collect Personal Data

3.1 phgems collects personal data through the following methods:

• Direct Collection: Information you provide when completing the phgems registration form, submitting KYC documents, making a deposit or withdrawal, contacting customer support, or participating in promotional activities;
• Automated Technologies: Technical and usage data collected automatically when you access the phgems website, including through cookies, server logs, and web beacons (see Section 7);
• Third-Party Sources: Identity and fraud screening data from PAGCOR-approved KYC and AML service providers; payment verification data from GCash, Maya, and partnered Philippine banks; and publicly available information where relevant to fraud prevention;
• Live Chat and Support Interactions: Content of messages exchanged with phgems's customer support team via live chat or email, which may be retained for quality assurance, training, and dispute resolution purposes.

3.2 phgems does not collect personal data from social media platforms or public profiles without your explicit consent, and does not monitor your social media activity.

4Purpose of Processing

4.1 phgems processes personal data for the following purposes:

• Account Management: Creating, maintaining, and administering your phgems player account;
• Identity Verification: Conducting KYC checks to verify your identity, age (21+), and eligibility to use the phgems platform in compliance with PAGCOR requirements;
• Payment Processing: Facilitating deposits and withdrawals through GCash, Maya, BPI, BDO, Metrobank, and other accepted Philippine payment channels;
• Regulatory Compliance: Meeting obligations under PAGCOR regulations, the Anti-Money Laundering Act (AMLA), and the Data Privacy Act;
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, cheating, and unauthorized access;
• Customer Support: Responding to your inquiries, resolving disputes, and improving our support quality;
• Platform Improvement: Analyzing usage patterns to improve the phgems platform, user experience, and game offerings;
• Responsible Gaming: Monitoring gaming behavior to identify potential problem gambling indicators and administering self-exclusion or account restriction tools;
• Marketing Communications: Sending you promotional offers, bonuses, and platform updates — where you have provided consent and subject to your communication preferences.

4.2 phgems will not process your personal data for any purpose that is incompatible with those listed above without first obtaining your explicit consent or establishing a new lawful basis for such processing.

5Legal Basis for Processing

5.1 phgems processes personal data on the following legal bases under the Data Privacy Act of 2012 and its IRR:

• Consent: Where you have given your free, specific, informed, and unambiguous consent to the processing of your personal data — for example, for receiving marketing communications;
• Contractual Necessity: Where processing is necessary for the performance of the contract between you and phgems — including account registration, game participation, and payment processing;
• Legal Obligation: Where phgems is required to process data to comply with applicable Philippine laws and PAGCOR regulations, including AMLA obligations, KYC mandates, and tax reporting requirements;
• Legitimate Interests: Where processing is necessary for phgems's legitimate interests — such as fraud prevention, platform security, and service improvement — provided those interests are not overridden by your rights and freedoms.

6Data Sharing & Disclosure

6.1 phgems does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. Personal data is shared with third parties only in the following limited circumstances:

• Service Providers: Trusted third-party providers who process data on phgems's behalf under binding data processing agreements — including KYC/AML verification providers, payment processors (GCash, Maya, BPI, BDO, Metrobank), cloud hosting providers, and customer support platforms;
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities where disclosure is required by law or court order;
• Fraud Prevention Networks: Industry-wide fraud and cheating detection networks where sharing data is necessary to protect the integrity of the Philippine online gaming industry;
• Corporate Transactions: In the event of a merger, acquisition, or restructuring of the phgems business, personal data may be transferred as part of that transaction, subject to equivalent privacy protections and prior notification to affected players.

6.2 No Cross-Border Transfers Without Safeguards. Where personal data is transferred outside the Philippines, phgems ensures that adequate safeguards are in place — including NPC-approved standard contractual clauses or equivalent protections — to maintain the level of protection required under the DPA.

6.3 All third-party service providers engaged by phgems are vetted for data security compliance and are contractually obligated to process data only for the specified purposes and in accordance with phgems's instructions.

7Cookies & Tracking Technologies

7.1 phgems uses cookies and similar tracking technologies to enhance your experience on the platform, maintain session security, and gather analytics. The types of cookies used include:

• Strictly Necessary Cookies: Essential for core platform functionality — including login sessions, security tokens, and fraud prevention. These cannot be disabled without impairing your ability to use phgems;
• Performance and Analytics Cookies: Collect anonymized data about how players use the phgems platform — including pages visited, time on site, and error occurrences — to help phgems improve its services;
• Functional Cookies: Remember your preferences — such as language settings, game display options, and responsible gaming settings — so you don't have to re-enter them each visit;
• Marketing Cookies: Used with your consent to deliver relevant promotional offers within the phgems platform. phgems does not use cross-site tracking for third-party advertising.

7.2 Cookie Management. You can manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies may affect your ability to log in and use the phgems platform. A cookie consent banner is presented on your first visit to phgems.net.

8Data Retention

8.1 phgems retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following general retention periods apply:

• Active Account Data: Retained for the duration of your active phgems account plus five (5) years following account closure, in compliance with AMLA record-keeping requirements;
• KYC and Identity Documents: Retained for a minimum of five (5) years after the end of the business relationship, as required by PAGCOR and AMLA regulations;
• Financial Transaction Records: Retained for five (5) years from the date of transaction, in accordance with AMLA and BIR requirements;
• Support Communications: Retained for two (2) years from the date of interaction, unless retained longer for active dispute resolution;
• Website Usage and Analytics Data: Retained in anonymized or aggregated form for up to two (2) years.

8.2 Upon expiry of the applicable retention period, phgems will securely destroy or anonymize personal data in accordance with NPC guidelines. Data that is the subject of an ongoing legal dispute, regulatory inquiry, or fraud investigation may be retained for longer where necessary.

9Data Security

9.1 phgems implements a comprehensive set of technical, organizational, and physical security measures to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and phgems servers;
• AES-256 encryption for sensitive data fields stored at rest, including government ID scans and financial account details;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Multi-factor authentication (MFA) for all phgems staff accessing systems that contain personal data;
• Regular third-party penetration testing and security audits of phgems infrastructure;
• Intrusion detection and prevention systems monitoring for unauthorized access attempts;
• Formal data breach response procedures aligned with NPC notification requirements.

9.2 Data Breach Notification. In the event of a personal data breach that poses a real risk of serious harm to affected players, phgems will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, and will notify affected players without undue delay in accordance with NPC Circular 16-03.

9.3 While phgems implements robust security measures, no internet transmission or electronic storage system is one hundred percent (100%) secure. Players are encouraged to use strong, unique passwords for their phgems account and to enable available two-factor authentication features.

10Your Rights as a Data Subject

10.1 Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phgems:

• Right to Be Informed: The right to be notified of the nature and extent of processing of your personal data — fulfilled by this Privacy Policy;
• Right of Access: The right to request a copy of the personal data phgems holds about you and information on how it is being processed;
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data held by phgems;
• Right to Erasure or Blocking: The right to request deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, subject to phgems's legal retention obligations;
• Right to Data Portability: The right to receive a copy of your personal data in a structured, commonly used, machine-readable format;
• Right to Object: The right to object to the processing of your personal data — in particular, processing for direct marketing purposes;
• Right to File a Complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated.

10.2 Exercising Your Rights. To exercise any of the above rights, please contact the phgems Data Protection Officer using the contact details in Section 13. phgems will respond to all data subject requests within fifteen (15) business days. In complex cases, this period may be extended by a further fifteen (15) business days with prior notification to you.

10.3 Identity Verification. For the protection of your data, phgems may require you to verify your identity before processing a data subject request. This is to prevent unauthorized access to your personal data by third parties.

11Children's Privacy

11.1 The phgems Platform is strictly intended for individuals who are at least twenty-one (21) years of age. phgems does not knowingly collect personal data from any person below the age of 21.

11.2 If phgems discovers or has reason to believe that personal data has been collected from a person under 21, the associated account will be immediately suspended and all collected data will be securely deleted, except where retention is required for regulatory compliance or fraud investigation purposes.

11.3 If you are a parent or guardian and believe that a minor has registered on phgems or provided personal data to phgems without your consent, please contact the phgems Data Protection Officer immediately at the contact details listed in Section 13.

12Changes to This Privacy Policy

12.1 phgems may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or NPC guidance. The date of the most recent update is displayed at the top of this page.

12.2 Where changes are material — meaning they significantly affect how phgems processes your personal data or alter your rights — phgems will notify registered players by email or by a prominent in-Platform notification at least fourteen (14) days before the changes take effect.

12.3 Continued use of the phgems Platform after a revised Privacy Policy has taken effect constitutes your acceptance of the updated terms. If you do not accept the revised policy, you must discontinue use of the Platform and may request account closure in accordance with the phgems Terms & Conditions.

13Contact & Data Protection Officer

13.1 phgems has designated a Data Protection Officer (DPO) in accordance with Section 21 of the Data Privacy Act of 2012. The DPO is responsible for overseeing phgems's compliance with data privacy obligations and is the point of contact for all data subject rights requests and privacy concerns.

13.2 You may contact the phgems Data Protection Officer or our support team through the following channels:

• Live Chat: Available 24/7 via the phgems Platform — average response time under 2 minutes
• Email (plain text — not a link): [email protected]

13.3 If you are not satisfied with phgems's response to your data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines through their official regulatory channels.