ph46 Privacy Policy

1.1 ph46 is committed to safeguarding the privacy of all individuals who interact with our Platform. This Policy applies to all personal data collected through the ph46 website, mobile-optimised interface, customer support channels, and any other medium through which you interact with ph46.

1.2 This Policy should be read together with our Terms and Conditions and, where applicable, any specific terms governing particular services or promotions offered on the Platform.

1.3 Where ph46 acts as a data processor on behalf of a third-party data controller (for example, a game provider whose platform integrates with ph46), the privacy practices of that third party shall also apply to the extent their platform is involved in processing your data. ph46 will, however, only engage processors that provide adequate data protection guarantees.

2.1 For the purposes of the Data Privacy Act of 2012 and this Policy, the data controller responsible for your personal information is ph46, operating the online gaming Platform at ph46.org.

2.2 ph46 has designated a Data Protection Officer ("DPO") who is responsible for overseeing compliance with this Policy and applicable data protection laws. You may contact the DPO using the details in Section 16 of this Policy.

2.3 ph46's personal information processing activities have been registered with the National Privacy Commission of the Philippines ("NPC") in accordance with applicable registration requirements under NPC Circular No. 17-01.

3.1 ph46 collects the following categories of personal data depending on how you interact with the Platform:

• Full legal name, date of birth, and nationality;
• Philippine government-issued ID number and document type;
• Residential address (barangay, city/municipality, province);
• Mobile phone number (Philippine Globe, Smart, or DITO network);
• Email address.

• Username and hashed account password;
• GCash wallet number, Maya account details, bank account details (BPI, BDO, Metrobank), or other linked payment method identifiers;
• Deposit history, withdrawal history, and current wallet balance;
• Bonus and promotional credit history;
• Transaction reference numbers.

• Game session logs, wager amounts, bet history, and results;
• Sports betting selections and stake history;
• Session duration, login frequency, and device usage patterns;
• Responsible gaming tool usage and self-exclusion records.

• IP address, device type and model, operating system and version;
• Browser type and version;
• Geolocation data (country and region level) derived from IP address;
• Cookie identifiers and session tokens.

• Live chat transcripts and support ticket content;
• Email and SMS correspondence with ph46;
• Responses to surveys or feedback requests.

4.1 ph46 collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, contacting customer support, or participating in a promotion;
• Automated collection: Technical data collected automatically via cookies, web server logs, and analytics tools as you navigate the Platform;
• Third-party sources: Identity verification providers, payment processors (e.g., GCash, Maya, BPI), fraud detection services, and publicly available sources used to verify the information you provide;
• Game providers: Aggregated session and wagering data shared by licensed game providers whose content is hosted on the ph46 Platform.

4.2 ph46 does not purchase data lists or obtain personal data from data brokers for marketing or targeting purposes without your prior, separate, and specific consent.

5.1 ph46 processes your personal data for the following purposes:

5.2 ph46 will not use your personal data for purposes incompatible with those listed above without obtaining your prior consent or without a valid legal basis under applicable law.

6.1 ph46 processes personal data under the following legal bases as provided under Section 12 and 13 of the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform our obligations under the account agreement — account management, payment processing, and game provision;
• Legal obligation: Processing required to comply with Philippine laws, including AMLC reporting requirements, PAGCOR regulatory obligations, and NPC data processing requirements;
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where our interests do not override your fundamental rights;
• Consent: Processing for marketing communications, optional analytics, and other non-essential purposes where we have obtained your explicit, freely-given, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7.1 ph46 does not sell, rent, or trade your personal information to third parties for their own commercial purposes. We may share your personal data with the following categories of recipients, strictly as necessary for the stated purposes:

• Identity verification providers: Licensed KYC and AML service providers used to verify your identity and screen for sanctions or politically exposed persons;
• Payment processors: GCash (Mynt), Maya (PayMaya Philippines Inc.), BPI, BDO, Metrobank, and other financial service providers for the purpose of processing your deposits and withdrawals;
• Game providers: Licensed game studios and aggregators (e.g., JILI Technology, PG Soft, Evolution, Pragmatic Play) receive pseudonymised player session identifiers to facilitate game access and record game results;
• Fraud prevention services: Third-party providers of device fingerprinting, IP reputation, and transaction monitoring services;
• Customer support platforms: Licensed third-party live chat and helpdesk software vendors who process support communications on our behalf under data processing agreements;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities, where required by law or court order.

7.2 All third-party data processors engaged by ph46 are bound by data processing agreements that require them to process personal data only on ph46's documented instructions, maintain appropriate security measures, and not retain data beyond the scope of the specific processing task.

8.1 Some of ph46's third-party service providers operate from jurisdictions outside the Philippines. Where personal data is transferred to recipients in countries that have not been deemed to provide an adequate level of data protection under Philippine law, ph46 implements appropriate safeguards, including:

• Standard contractual clauses approved by the National Privacy Commission;
• Binding corporate rules (where applicable for intra-group transfers);
• Data processing agreements that impose obligations equivalent to those required under Philippine law.

8.2 In all cases, ph46 will only transfer personal data internationally where necessary for the specific processing purpose and where at least one of the lawful bases in Section 6 applies to the transfer.

9.1 ph46 retains personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. Retention periods are determined as follows:

• Account and KYC data: Retained for the duration of the account relationship plus a minimum of five (5) years after account closure, in compliance with AML record-keeping requirements under Republic Act No. 9160 (Anti-Money Laundering Act);
• Transaction and financial records: Retained for a minimum of five (5) years from the date of the transaction;
• Game session logs: Retained for a minimum of two (2) years from the date of the session;
• Customer support records: Retained for three (3) years from the date of the last interaction;
• Marketing consent and opt-out records: Retained indefinitely to document consent history and honour opt-out requests;
• Cookies and technical data: Session cookies expire when you close your browser; persistent cookies expire as described in Section 10.

9.2 Upon expiry of the applicable retention period, ph46 will securely destroy or permanently anonymise personal data in accordance with NPC-approved disposal methods.

10.1 ph46 uses cookies and similar tracking technologies to enable core Platform functionality, maintain your login session, and improve the user experience. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These enable login session persistence, fraud prevention, and load balancing. They cannot be disabled without disrupting Platform access;
• Functional cookies: Remember your preferences such as language and preferred currency display. These persist for up to 12 months;
• Analytics cookies: Used to collect anonymised data about how players navigate the Platform, enabling us to improve the user experience. These require your consent and may be disabled without affecting core functionality;
• Marketing cookies: Used to deliver relevant promotional content within the ph46 Platform based on your gaming preferences. These require your explicit consent.

10.2 You may manage your cookie preferences through your browser settings at any time. Disabling strictly necessary cookies will affect your ability to log in and use the Platform. ph46 does not use third-party tracking cookies that share your data with advertising networks outside the Platform.

11.1 ph46 implements a comprehensive set of technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These include:

• Encryption in transit: All data transmitted between your device and ph46 servers is encrypted using TLS 1.2 or higher (HTTPS);
• Encryption at rest: Sensitive personal data, including government ID documents and financial account details, is encrypted at rest using AES-256;
• Password hashing: Account passwords are stored as salted hash values using bcrypt — ph46 staff cannot retrieve your plain-text password;
• Access controls: Access to personal data within ph46's systems is restricted on a need-to-know basis with role-based permissions and multi-factor authentication for staff;
• Network security: Web Application Firewall (WAF), Distributed Denial of Service (DDoS) protection, and intrusion detection systems are deployed across all Platform infrastructure;
• Regular audits: ph46 conducts periodic security assessments and penetration testing to identify and remediate vulnerabilities.

11.2 Data Breach Response. In the event of a personal data breach that is likely to result in harm to affected data subjects, ph46 will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, and will notify affected individuals without undue delay, in accordance with Section 20(f) of the Data Privacy Act.

12.1 Under the Data Privacy Act of 2012, you have the following rights as a data subject, which ph46 is committed to honouring:

• Right to be Informed: The right to be told what personal data ph46 collects, processes, and retains about you — as satisfied by this Policy;
• Right of Access: The right to obtain a copy of the personal data ph46 holds about you and information about how it is processed;
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected or updated;
• Right to Erasure or Blocking: The right to request deletion or blocking of personal data that is no longer necessary, was unlawfully processed, or where consent has been withdrawn — subject to ph46's legal retention obligations;
• Right to Object: The right to object to processing based on legitimate interests, including direct marketing;
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format where technically feasible;
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines if you believe your data rights have been violated.

12.2 To exercise any of the above rights, please contact ph46's Data Protection Officer using the details in Section 16. ph46 will respond to verified requests within thirty (30) days. We may request proof of identity before acting on a request to protect against unauthorised access to your data.

12.3 Exercising your data rights will not result in any penalty, account restriction, or adverse treatment from ph46, except where the exercise of a particular right (e.g., erasure) is technically incompatible with continued access to the Platform due to legal or regulatory requirements.

13.1 ph46 is strictly prohibited from being used by persons under the age of twenty-one (21) years. ph46 does not knowingly collect personal data from individuals under 21.

13.2 If ph46 becomes aware that personal data has been collected from an individual under the age of 21 — whether through the KYC process, a third-party report, or internal detection — ph46 will immediately:

• Suspend the associated account and restrict access to the Platform;
• Delete or anonymise all personal data associated with the account to the extent permitted by law;
• Return any deposited funds to the payment source;
• Notify relevant regulatory authorities where required by law.

13.3 ph46 encourages account holders to implement device-level parental controls and to not share their ph46 login credentials with family members under the age of 21.

14.1 The ph46 Platform integrates with third-party game providers and payment services whose interfaces you may interact with directly. These third parties operate their own privacy policies, and ph46 is not responsible for the data processing practices of third-party services beyond the scope of data processing agreements entered into with ph46.

14.2 ph46 does not include links to third-party websites outside the Platform. Any URLs found in ph46 communications directing you away from ph46.org should be treated with caution and verified through ph46 customer support before clicking, as they may indicate a phishing attempt.

15.1 ph46 reserves the right to update or revise this Privacy Policy at any time. The effective date of the current version is displayed at the top of this page. ph46 recommends that you review this Policy periodically.

15.2 For material changes — those that significantly affect your rights or how ph46 uses your personal data — ph46 will provide at least fourteen (14) days' advance notice via email or SMS to your registered contact details. Your continued use of the Platform after the effective date of any revision constitutes acceptance of the updated Policy.

15.3 If you do not agree with a material change to this Policy, you have the right to close your account and request deletion of your personal data prior to the effective date of the change, subject to applicable legal retention obligations.

16.1 For any privacy-related requests, enquiries, or complaints — including the exercise of your data subject rights under Section 12 — please contact ph46's Data Protection Officer through the following channels:

• Live Chat (Fastest): Available 24/7 at ph46.org — state "Data Privacy Request" at the start of your message for priority routing to the DPO team;
• Email: support at ph46.org — mark the subject line "Privacy / DPO Request" for direct routing;
• Response Time: ph46 targets acknowledgement within 48 hours and full resolution within 30 days for data subject requests.

16.2 If you are not satisfied with ph46's response to your privacy complaint, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC), which may be reached through official NPC channels.