phlag Privacy Policy

1. Introduction

phlag ("phlag," "we," "us," or "our") operates the online gaming platform accessible at phlag.net (the "Platform"). We are committed to protecting the privacy and personal data of all individuals who interact with the phlag Platform, including registered players, prospective players, and visitors to our website.

This Privacy Policy ("Policy") describes how phlag collects, uses, stores, shares, and protects personal data in connection with your use of the Platform. It also explains the rights you have in relation to your personal data and how you can exercise those rights.

This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), and the implementing rules and regulations issued by the National Privacy Commission ("NPC"). By registering for a phlag account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

2. Personal Data We Collect

phlag collects the following categories of personal data from and about you:

phlag does not intentionally collect sensitive personal information as defined under the DPA (such as health data, religious beliefs, or political affiliations) unless specifically required for responsible gaming or regulatory compliance purposes, in which case your explicit consent will be obtained.

3. How We Collect Your Data

phlag collects personal data through the following means:

3.1 Direct Collection

You provide personal data directly to phlag when you register for an account, complete KYC verification, make a deposit or withdrawal, contact phlag support, participate in promotions, or update your account settings. The accuracy of data you provide directly is your responsibility.

3.2 Automated Collection

When you access and use the phlag Platform, we automatically collect technical and usage data through cookies, web beacons, pixel tags, and similar tracking technologies. This data is collected to ensure the Platform functions correctly, to detect fraud, and to improve the user experience. Please refer to Section 7 (Cookies & Tracking) for more details.

3.3 Third-Party Sources

phlag may receive personal data about you from third-party sources, including:

• Payment processors (e.g., GCash, PayMaya, BPI, BDO, Metrobank) — transaction confirmation and payment status data;
• Identity verification service providers — results of KYC and age verification checks;
• Fraud detection and anti-money laundering screening services — risk assessment data;
• Analytics providers — aggregated and anonymised usage statistics.

4. How We Use Your Personal Data

phlag uses your personal data for the following purposes:

• Account Management: To create, maintain, and administer your phlag account, including processing your registration, verifying your identity and age, and managing your account settings and preferences.
• Service Delivery: To provide you with access to phlag's games, features, and services, including processing deposits and withdrawals in Philippine Peso and crediting winnings to your account.
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance through phlag's support channels.
• Regulatory Compliance: To comply with phlag's legal and regulatory obligations, including anti-money laundering (AML) requirements, Know Your Customer (KYC) obligations, and reporting requirements under applicable Philippine law.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, cheating, money laundering, and other prohibited conduct on the Platform.
• Responsible Gaming: To monitor gaming activity for signs of problem gambling, to enforce responsible gaming tools such as deposit limits and self-exclusion, and to comply with PAGCOR's responsible gaming requirements.
• Marketing and Promotions: To send you information about phlag promotions, bonuses, and new features, where you have consented to receive such communications. You may opt out of marketing communications at any time through your account settings.
• Platform Improvement: To analyse usage patterns, conduct research, and improve the functionality, performance, and user experience of the phlag Platform.
• Legal Proceedings: To establish, exercise, or defend legal claims involving phlag.

5. Legal Basis for Processing

phlag processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual Necessity: Processing is necessary for the performance of phlag's contract with you (the Terms & Conditions), including providing gaming services, processing transactions, and managing your account.
• Legal Obligation: Processing is necessary for phlag to comply with its legal and regulatory obligations, including AML/KYC requirements and PAGCOR compliance obligations.
• Legitimate Interests: Processing is necessary for phlag's legitimate interests, including fraud prevention, platform security, and improving the Platform, provided these interests are not overridden by your privacy rights.
• Consent: For certain processing activities, such as sending marketing communications or processing sensitive personal information, phlag relies on your freely given, specific, informed, and unambiguous consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Sharing Your Personal Data

phlag does not sell, rent, or trade your personal data to third parties for their own marketing purposes. phlag may share your personal data with the following categories of recipients, strictly on a need-to-know basis:

• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers engaged to process your deposits and withdrawals.
• Identity Verification Providers: Third-party KY C and age verification service providers engaged to verify your identity and age in compliance with regulatory requirements.
• Fraud Detection Services: Third-party providers engaged to assist phlag in detecting and preventing fraudulent activity, money laundering, and other prohibited conduct.
• Analytics Providers: Third-party analytics services that help phlag understand how the Platform is used. These providers receive only aggregated or anonymised data where possible.
• IT and Infrastructure Providers: Cloud hosting, data storage, and technology service providers engaged to support the operation and maintenance of the phlag Platform.
• Legal and Professional Advisers: Lawyers, accountants, auditors, and other professional advisers engaged by phlag in connection with its business operations.
• Regulatory and Law Enforcement Authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), law enforcement agencies, and other government bodies where phlag is required by law or court order to disclose your personal data.

All third-party service providers engaged by phlag are contractually required to process your personal data only for the specific purposes for which it was shared, to maintain appropriate security measures, and to comply with applicable data protection laws. phlag remains responsible for ensuring that such providers handle your data in accordance with this Policy.

7. Cookies and Tracking Technologies

7.1 What Are Cookies

Cookies are small text files placed on your device when you visit the phlag Platform. They allow phlag to recognise your device, remember your preferences, and collect information about how you use the Platform. phlag also uses similar technologies such as web beacons, pixel tags, and local storage objects.

7.2 Types of Cookies Used by phlag

• Strictly Necessary Cookies: These cookies are essential for the Platform to function and cannot be disabled. They include session cookies that keep you logged in to your phlag account and security cookies that help detect fraudulent activity.
• Performance and Analytics Cookies: These cookies collect information about how you use the Platform, such as which pages you visit most frequently and whether you encounter any errors. This data helps phlag improve the Platform's performance and user experience.
• Functionality Cookies: These cookies remember your preferences and settings, such as your preferred language and responsible gaming limits, so you do not have to re-enter them each time you visit.
• Targeting and Marketing Cookies: These cookies are used to deliver relevant promotional content to you based on your interests and gaming activity. They may also be used to measure the effectiveness of phlag's marketing campaigns.

7.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse or delete cookies. However, disabling strictly necessary cookies may affect the functionality of the phlag Platform and prevent you from accessing certain features, including your account. Please refer to your browser's help documentation for instructions on managing cookie settings.

8. Data Security

phlag takes the security of your personal data seriously and implements a range of technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the phlag Platform;
• Encryption of sensitive data at rest, including financial and identity data;
• Access controls limiting access to personal data to authorised phlag personnel and service providers on a strict need-to-know basis;
• Regular security assessments, penetration testing, and vulnerability scanning of the Platform;
• Multi-factor authentication requirements for access to phlag's internal systems;
• Staff training on data protection and information security practices;
• Incident response procedures for detecting, reporting, and managing personal data breaches.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, phlag will notify the National Privacy Commission and, where required, affected individuals in accordance with the timelines prescribed under the DPA and its implementing rules.

9. Data Retention

phlag retains your personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting requirements. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your phlag account and for a minimum of five (5) years following account closure, in compliance with AML and KYC regulatory requirements.
• Financial and Transaction Data: Retained for a minimum of five (5) years from the date of each transaction, in compliance with applicable financial record-keeping requirements.
• Gaming Activity Data: Retained for a minimum of three (3) years from the date of each gaming session, for regulatory compliance and dispute resolution purposes.
• Communications Data: Support communications and correspondence are retained for a minimum of two (2) years from the date of the last communication.
• Technical and Usage Data: Retained for up to twelve (12) months from collection, unless required for longer periods for security or fraud investigation purposes.
• Marketing Consent Records: Retained for the duration of your consent and for a reasonable period thereafter to demonstrate compliance with consent requirements.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you. Where data is anonymised rather than deleted, it may be retained indefinitely for statistical and analytical purposes.

10. Your Data Rights

Under the Data Privacy Act of 2012 and its implementing rules, you have the following rights in relation to your personal data held by phlag:

• Right to Be Informed: You have the right to be informed about how phlag collects and uses your personal data, as set out in this Policy.
• Right of Access: You have the right to request a copy of the personal data phlag holds about you, together with information about how it is processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data phlag holds about you. You may update certain account information directly through your phlag account settings.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to phlag's legal and regulatory retention obligations.
• Right to Object: You have the right to object to phlag's processing of your personal data for direct marketing purposes. You may opt out of marketing communications at any time through your account settings.
• Right to Data Portability: You have the right to receive a copy of personal data you have provided to phlag in a structured, commonly used, and machine-readable format, where technically feasible.
• Right to Withdraw Consent: Where phlag processes your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe phlag has processed your personal data in violation of the DPA.

To exercise any of your data rights, please contact phlag's Data Protection Officer using the contact details provided in Section 14 of this Policy. phlag will respond to your request within thirty (30) days of receipt, or within such extended period as permitted under applicable law.

11. Children's Privacy and Age Restriction

The phlag Platform is strictly intended for individuals who are at least 21 years of age, in accordance with Philippine gaming regulations. phlag does not knowingly collect personal data from individuals under the age of 21.

phlag implements age verification procedures during the registration process and may request documentary proof of age at any time. Where phlag discovers that personal data has been collected from an individual under the age of 21, phlag will immediately suspend the relevant account, delete the personal data collected, and take appropriate steps to prevent further access by the underage individual.

If you are a parent or guardian and believe that your child under the age of 21 has registered for a phlag account or provided personal data to phlag, please contact phlag support immediately so that appropriate action can be taken.

12. International Data Transfers

phlag primarily processes and stores personal data within the Philippines. However, some of phlag's third-party service providers, including cloud hosting providers and technology partners, may process or store data in other countries. Where personal data is transferred outside the Philippines, phlag ensures that appropriate safeguards are in place to protect your data in accordance with the DPA and NPC regulations.

Such safeguards may include contractual clauses requiring the recipient to maintain data protection standards equivalent to those required under Philippine law, or reliance on the recipient country's adequacy determination by the NPC. By using the phlag Platform, you acknowledge and consent to the transfer of your personal data to countries outside the Philippines where necessary for the purposes described in this Policy.

13. Changes to This Privacy Policy

phlag reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or the features and services offered on the Platform. The date of the most recent revision is indicated at the top of this page.

Where changes to this Policy are material, phlag will notify registered players by email or through a prominent notice on the Platform prior to the changes taking effect. We encourage you to review this Policy periodically to stay informed about how phlag protects your personal data.

Your continued use of the phlag Platform following the effective date of any amendment to this Policy constitutes your acknowledgement of the revised Policy. If you do not agree to the revised Policy, you should cease using the Platform and close your account.

14. Contact and Data Protection Officer

phlag has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable data protection laws. If you have any questions, concerns, or requests relating to this Privacy Policy or phlag's handling of your personal data, please contact the phlag DPO:

Data Protection Officer — phlag
Email: [email protected]

For general customer support enquiries, you may also contact the phlag support team via live chat on the Platform or by email at: [email protected]

phlag aims to respond to all data rights requests and privacy-related enquiries within thirty (30) days of receipt. For complex requests, phlag may extend this period by a further thirty (30) days, in which case you will be notified of the extension and the reasons for it.

If you are not satisfied with phlag's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.