phlag Privacy Policy

This Privacy Policy ("Policy") describes how phlag ("phlag," "we," "us," "our") collects, uses, discloses, and safeguards the personal information of users ("Player," "you") of the phlag online gaming platform accessible at phlag.one. This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 of the Philippines ("DPA"), and its Implementing Rules and Regulations.

By creating an account or using phlag, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

1. Who We Are (Data Controller)

phlag is the data controller responsible for personal data processed through the phlag Platform. phlag operates under a valid license issued by the Philippine Amusement and Gaming Corporation (PAGCOR) and is subject to the jurisdiction of the Republic of the Philippines.

For all data privacy inquiries, you may contact our Data Protection Officer at: [email protected]

2. Personal Data We Collect

phlag collects the following categories of personal data:

Category	Examples
Identity Data	Full legal name, date of birth, government-issued ID number (PhilSys, Driver's License, Passport, UMID), selfie photograph for ID verification
Contact Data	Mobile number (Philippine format), email address (if provided)
Financial Data	GCash account reference, PayMaya account reference, bank account details (for bank transfer users: BPI, BDO, Metrobank), transaction history, deposit and withdrawal records
Technical Data	IP address, device type, browser type, operating system, session duration, login timestamps, cookie identifiers
Usage Data	Games played, bet amounts, win/loss records, promotional offers accessed, platform navigation paths
Communications Data	Records of live chat conversations with phlag support, SMS notifications sent to your registered mobile number
Responsible Gaming Data	Deposit limits set, self-exclusion requests and periods, session time preferences, any problem gambling disclosures

phlag does not collect sensitive personal information such as health data, racial or ethnic origin, religious beliefs, or political opinions, except where expressly required by law (for example, voluntary disclosure of a gambling problem in connection with responsible gaming tools).

3. How We Collect Personal Data

phlag collects personal data through the following channels:

• Directly from you — when you register an Account, complete KYC (Know Your Customer) verification, make deposits or withdrawal requests, contact customer support, or respond to surveys;
• Automatically — through cookies, server logs, and similar tracking technologies when you access phlag.one;
• From third parties — identity verification service providers conducting document checks; payment processors (GCash/Maya, BPI, BDO, Metrobank) confirming transaction status; fraud detection service providers; and PAGCOR or other regulatory bodies as required by law.

4. Purpose and Legal Basis for Processing

phlag processes personal data for the following purposes, on the following legal bases under the DPA:

• Account registration and management — performance of a contract with you (DPA Section 12(b));
• Identity and age verification (KYC) — compliance with legal obligations under PAGCOR license conditions and anti-money laundering (AMLA) regulations (DPA Section 12(c));
• Payment processing and fraud prevention — performance of contract and legitimate interest (DPA Section 12(b), 12(f));
• Regulatory reporting — compliance with legal obligations under PAGCOR license, AMLA, and other applicable Philippine laws (DPA Section 12(c));
• Customer support communications — performance of contract and legitimate interest;
• Responsible gaming tools — protection of vital interests and legitimate interest in player wellbeing (DPA Section 12(e), 12(f));
• Marketing communications — with your consent (DPA Section 12(a)), which may be withdrawn at any time by contacting support or updating notification settings in your Account;
• Platform improvement and analytics — legitimate interest (DPA Section 12(f)), using aggregated and where possible anonymized data.

5. Disclosure and Data Sharing

5.1 phlag does not sell personal data to third parties. We share personal data only in the following circumstances:

• Payment service providers — GCash, PayMaya (Maya), BPI, BDO, Metrobank, and other processors receive the minimum data necessary to execute deposits and withdrawals;
• Identity verification providers — third-party KYC services receive document images and personal details solely for age and identity verification;
• Fraud prevention services — IP data and device fingerprints are shared with fraud detection providers to protect players and the platform;
• Regulatory authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine authorities receive data as required by law and our operating license;
• Professional advisors — lawyers, auditors, and insurers under confidentiality obligations where necessary for phlag's business operations;
• Business transfers — in the event of a merger, acquisition, or sale of all or part of phlag's business, player data may be transferred to the acquiring entity, subject to the same privacy protections.

5.2 All third-party data processors engaged by phlag are required to maintain appropriate security measures and to process personal data only in accordance with phlag's documented instructions and applicable Philippine law.

6. International Data Transfers

6.1 phlag's primary data processing infrastructure is located within the Philippines. Where data is processed by third-party service providers outside the Philippines — for example, global fraud detection or cloud infrastructure providers — phlag ensures that appropriate safeguards are in place.

6.2 Such safeguards may include standard contractual clauses, adequacy determinations by the NPC, or binding corporate rules, in each case consistent with the DPA's requirements for cross-border data transfers.

7. Data Retention

7.1 phlag retains personal data for as long as necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods:

• KYC and identity verification records — 5 years from account closure, as required under PAGCOR license conditions and AMLA regulations;
• Financial transaction records — 5 years from the date of the transaction, in compliance with AMLA and tax regulations;
• Customer support records — 2 years from the date of the interaction;
• Account data (active accounts) — maintained for the duration of the account's active status;
• Marketing consent records — for the period the consent is relied upon, plus 2 years after withdrawal of consent as evidence of lawful processing.

7.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymized.

8. Data Security

8.1 phlag implements appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, and destruction. Specific measures include:

• TLS 1.2/1.3 encryption for all data in transit between the Platform and player devices;
• AES-256 encryption for sensitive data stored in phlag's databases;
• Role-based access controls limiting data access to authorized personnel on a need-to-know basis;
• Multi-factor authentication for phlag's internal data systems;
• Regular penetration testing and vulnerability assessments by independent security specialists;
• Security incident response procedures compliant with NPC breach notification requirements.

8.2 In the event of a personal data breach that is likely to result in risk to your rights and freedoms, phlag will notify you and the NPC within the timeframes prescribed by the DPA and NPC Circular No. 16-03.

9. Cookies and Tracking Technologies

9.1 phlag uses cookies and similar technologies (local storage, session storage) on phlag.one. The categories of cookies used are:

• Strictly necessary cookies — required for platform functionality including authentication (maintaining your logged-in session), security tokens, and load balancing. These cannot be disabled without breaking core platform functions;
• Functional cookies — store your preferences such as language settings and responsible gaming tool configurations;
• Analytics cookies — collect anonymized or aggregated data about how players navigate phlag.one, used to improve platform usability. No individual profiling is conducted through analytics cookies.

9.2 phlag does not deploy third-party advertising or behavioral tracking cookies. You may manage functional and analytics cookies through your browser settings, though disabling strictly necessary cookies will impair your ability to use phlag.

10. Your Data Privacy Rights

Under the DPA and its Implementing Rules, you have the following rights with respect to your personal data held by phlag:

• Right to be Informed — to know what data phlag holds about you and how it is used (addressed by this Policy);
• Right to Access — to request a copy of the personal data phlag holds about you;
• Right to Rectification — to request correction of inaccurate or incomplete personal data;
• Right to Erasure or Blocking — to request deletion or blocking of data that is unlawfully processed or no longer necessary, subject to phlag's legal retention obligations;
• Right to Object — to object to processing of your data for marketing purposes or where processing is based on legitimate interests;
• Right to Data Portability — to receive your personal data in a structured, machine-readable format;
• Right to Lodge a Complaint — to file a complaint with the National Privacy Commission if you believe phlag has violated the DPA.

To exercise any of these rights, contact our Data Protection Officer at [email protected]. phlag will respond within 15 business days. We may require verification of your identity before processing rights requests.

11. Children and Minors

11.1 phlag is strictly prohibited to persons under 21 years of age. phlag does not knowingly collect or process personal data from individuals under 21. If phlag discovers that personal data has been collected from a person under 21, that Account will be immediately closed, the data deleted, and any balance reviewed in accordance with phlag's Terms and PAGCOR requirements.

11.2 If you believe a minor has accessed phlag, contact support immediately for emergency account suspension.

12. Changes to This Policy

12.1 phlag may update this Privacy Policy from time to time to reflect changes in our data practices or applicable law. Material changes will be communicated to registered players via Account notification or SMS prior to the change taking effect.

12.2 The current version of this Policy is always accessible at phlag.one/privacy-policy. The "Last Updated" date at the top of this document indicates when this version was published.

13. Contact and Complaints

For any questions, concerns, or requests relating to this Privacy Policy or phlag's data practices, contact our Data Protection Officer:

If you are not satisfied with phlag's response, you may file a complaint with the National Privacy Commission (NPC) of the Philippines through its official published channels.