Privacy Policy

1.1 phlogo Casino ("phlogo", "We", "Us", "Our") operates the online gaming platform accessible at phlogo.club. As an operator that collects and processes personal data from Filipino players and other users, phlogo acts as a Personal Information Controller under the Data Privacy Act of 2012.

1.2 This Privacy Policy ("Policy") describes the personal data we collect, the purposes for which we process it, the legal bases that justify that processing, who we share data with, how long we retain it, the security measures we apply, and the rights you are entitled to exercise regarding your personal data.

1.3 By accessing phlogo Casino, creating an account, making a deposit, or otherwise interacting with our platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the processing of your personal data in the manner described herein, where consent is the applicable legal basis.

1.4 This Policy should be read alongside phlogo's Terms & Conditions, which govern the overall relationship between phlogo and its players.

2.1 The Personal Information Controller responsible for your personal data processed through the phlogo platform is phlogo Casino, which operates under a license issued by the Philippine Amusement and Gaming Corporation (PAGCOR).

2.2 phlogo Casino has designated a Data Protection Officer (DPO) responsible for overseeing data protection compliance, handling data subject rights requests, and serving as the contact point for the National Privacy Commission. Inquiries related to this Privacy Policy or your personal data rights may be directed to phlogo's support team at the contact details provided in Section 14.

2.3 phlogo is registered with and subject to oversight by the National Privacy Commission of the Philippines in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173).

3.1 phlogo collects personal data that falls into the following categories. The specific data points collected depend on the nature of your interaction with phlogo Casino:

3.2 phlogo does not collect sensitive personal information beyond what is strictly necessary for identity verification and PAGCOR regulatory compliance. phlogo does not collect biometric data beyond the selfie photograph required for KYC matching purposes.

3.3 Providing accurate personal data is a condition of using phlogo's services. Providing false, incomplete, or misleading information may result in account suspension and constitutes a violation of phlogo's Terms & Conditions.

4.1 phlogo collects personal data through the following channels:

• Direct Collection: Data you provide when registering your phlogo account, completing KYC verification, making deposits or withdrawals, contacting our support team, or participating in promotions;
• Automated Collection: Technical and gaming activity data collected automatically when you access phlogo Casino through log files, cookies, web beacons, and similar tracking technologies embedded in the platform;
• Third-Party Collection: Data received from payment processors (such as GCash and Maya) confirming transaction completion, from identity verification service providers used in KYC processing, and from fraud detection service partners;
• PAGCOR and Regulatory Sources: Information received from PAGCOR or other Philippine regulatory authorities in connection with licensing obligations, self-exclusion registers, or compliance inquiries.

5.1 phlogo processes your personal data only for specific, explicitly stated purposes and only where a valid legal basis under the Data Privacy Act of 2012 exists. The following table sets out our processing purposes and their respective legal bases:

5.2 Where phlogo relies on your consent as the legal basis for processing — specifically for marketing communications — you may withdraw that consent at any time by updating your communication preferences in your phlogo account settings or by contacting phlogo support. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6.1 phlogo shares personal data with the following categories of recipients, each bound by confidentiality obligations and, where applicable, data processing agreements consistent with the Data Privacy Act of 2012:

• PAGCOR: Player identity, gaming activity, and financial data as required by our operating license and applicable PAGCOR reporting requirements;
• Payment Processors: GCash, Maya, BPI, BDO, UnionBank, USDT network providers, Coins.ph, and other payment partners, for transaction processing and reconciliation purposes only;
• Identity Verification Providers: Third-party KYC service providers engaged to verify government-issued ID documents and perform facial matching, operating under strict data processing agreements;
• Fraud Prevention and Security Partners: Technology providers that assist phlogo in detecting, investigating, and preventing fraudulent activity, account takeovers, and money laundering;
• IT and Cloud Infrastructure Providers: Hosting, database, and cloud service providers that process data on phlogo's behalf under data processing agreements that include appropriate security and confidentiality obligations;
• Legal and Regulatory Authorities: The National Privacy Commission, law enforcement agencies, courts, and other government authorities in the Philippines where disclosure is required by law or a valid legal order;
• Professional Advisors: Legal counsel, auditors, and compliance consultants, strictly for the provision of professional services and subject to professional confidentiality obligations.

6.2 Any third-party service provider that processes personal data on behalf of phlogo is required to do so only in accordance with phlogo's written instructions and is prohibited from using phlogo player data for any purpose beyond the specific service being provided.

6.3 In the event of a corporate restructuring, merger, acquisition, or sale of phlogo's business or assets, your personal data may be transferred to the acquiring entity, subject to the same level of data protection described in this Privacy Policy.

7.1 phlogo Casino uses cookies and similar tracking technologies (including web beacons, pixel tags, and session tokens) to operate the platform, maintain your login session, personalize your experience, and analyze usage patterns for platform improvement purposes.

7.2 The following categories of cookies are used on phlogo:

• Strictly Necessary Cookies: Essential for platform functionality, including maintaining your phlogo login session, processing transactions, and preserving game state. These cannot be disabled without significantly impairing platform functionality;
• Performance and Analytics Cookies: Collect anonymized data about how players navigate phlogo Casino — which pages are visited, how long sessions last, and where errors occur — to help us improve the platform experience;
• Functional Cookies: Remember your preferences such as language settings, preferred game categories, and responsible gaming tool configurations;
• Security Cookies: Used for fraud detection, identifying unusual login patterns, and protecting phlogo accounts from unauthorized access.

7.3 You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may prevent you from using certain phlogo features, including the ability to maintain an active session while playing casino games. phlogo does not currently use third-party advertising cookies or cross-site tracking cookies.

8.1 phlogo retains personal data for as long as is necessary to fulfill the purposes described in this Privacy Policy, or as required by applicable Philippine law and PAGCOR regulatory requirements. The following retention periods apply as a general guide:

• Active Account Data: Retained for the duration of the active phlogo account relationship and for a minimum period of five (5) years following account closure, in accordance with PAGCOR and Anti-Money Laundering Act (AMLA) requirements;
• Transaction and Financial Records: Retained for a minimum of five (5) years from the date of each transaction, as required by AMLA and PAGCOR record-keeping obligations;
• KYC and Identity Verification Documents: Retained for a minimum of five (5) years following account closure;
• Gaming Activity Logs: Retained for a minimum of three (3) years from the date of the activity, for dispute resolution and regulatory audit purposes;
• Support Communications: Retained for two (2) years from the date of the last communication, unless longer retention is required for ongoing dispute resolution;
• Marketing Consent Records: Retained for the duration of the consent and for two (2) years following withdrawal of consent, as evidence of compliance.

8.2 Where phlogo retains data beyond the periods above for litigation or regulatory investigation purposes, that data will be clearly flagged and access will be restricted to personnel with a legitimate need to access it.

8.3 When personal data is no longer required, phlogo will securely delete or anonymize it in a manner that makes re-identification impossible.

9.1 phlogo's security framework for personal data protection includes the following measures:

• Encryption in Transit: All data transmitted between your browser or device and phlogo's servers is encrypted using TLS 1.2 or higher (256-bit SSL), ensuring that your login credentials, payment information, and personal data cannot be intercepted in transit;
• Encryption at Rest: Sensitive data stored in phlogo's databases — including identity documents, financial data, and authentication credentials — is encrypted at rest using AES-256 encryption or equivalent;
• Access Controls: Access to personal data within phlogo's systems is restricted on a strict need-to-know basis. Internal staff are granted access only to the personal data categories necessary for their specific role, and all access is logged and auditable;
• Two-Factor Authentication (2FA): Available to all phlogo players for account access and recommended as a security best practice. All phlogo internal systems with access to personal data require multi-factor authentication;
• Security Monitoring: phlogo operates real-time security monitoring and intrusion detection systems that identify and respond to abnormal access patterns or potential data security events;
• Penetration Testing and Security Audits: phlogo's platform security is regularly assessed through independent penetration testing and security audits to identify and remediate vulnerabilities.

9.2 In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, phlogo will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular 16-03. Affected players will be notified without undue delay where the breach poses a high risk to their individual rights.

9.3 While phlogo implements robust security measures, no internet-based system is entirely immune to security risks. phlogo encourages all players to take their own security precautions, including using strong unique passwords, enabling 2FA, and avoiding access to phlogo via unsecured public networks.

10.1 Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights with respect to your personal data processed by phlogo Casino. These rights may be exercised by contacting phlogo at the details provided in Section 14:

10.2 phlogo will respond to verified data subject rights requests within thirty (30) calendar days. In complex cases, this period may be extended by a further thirty (30) days, with prior notification to the requesting party. phlogo reserves the right to verify the identity of the person making the request before processing it.

10.3 Certain rights are subject to limitations where phlogo has a legal obligation to retain or process data — for example, data required to be retained under PAGCOR licensing conditions or the Anti-Money Laundering Act cannot be deleted upon request. phlogo will notify you where a rights request cannot be fully granted and explain the applicable legal basis for the limitation.

11.1 phlogo Casino is an online gambling platform restricted to adults aged twenty-one (21) and above under PAGCOR regulations. phlogo does not knowingly collect, process, or retain personal data from any person below the minimum age requirement.

11.2 Age verification is conducted during the registration and KYC process using government-issued Philippine identification documents. Any account found to belong to a person under twenty-one (21) years of age will be immediately closed, any balance will be processed in accordance with applicable regulations, and the matter may be reported to PAGCOR.

11.3 If you believe that phlogo has inadvertently collected personal data from a minor, please contact phlogo immediately using the details in Section 14 so the matter can be investigated and resolved promptly.

12.1 The phlogo platform may contain references to or integrations with third-party services, including payment processors such as GCash and Maya, game providers, and identity verification services. While phlogo selects third-party partners carefully and requires them to maintain appropriate data protection standards, phlogo is not responsible for the privacy practices of third-party entities.

12.2 When you interact with a third-party payment application (such as approving a GCash deposit), you are subject to that application's own privacy policy and terms of service in addition to this phlogo Privacy Policy. phlogo recommends reviewing the privacy policies of any third-party services you use in connection with your phlogo account.

12.3 phlogo's Privacy Policy applies solely to personal data processed by phlogo Casino in connection with the phlogo platform. It does not govern data collection or processing by third parties operating their own platforms or services.

13.1 phlogo Casino may update this Privacy Policy from time to time to reflect changes in applicable Philippine law, PAGCOR regulatory requirements, phlogo's data processing activities, or developments in privacy best practice. The "Last Reviewed" date at the top of this Policy reflects the date of the most recent revision.

13.2 For material changes — those that substantively affect how phlogo processes your personal data or the rights you hold — phlogo will provide advance notice to registered players via the email address or mobile number on file, or through a prominent notice on the phlogo platform, not less than fourteen (14) days before the change takes effect.

13.3 Your continued use of phlogo Casino following the effective date of a revised Privacy Policy constitutes your acknowledgment of the changes. If you do not agree to the revised Privacy Policy, you should cease using phlogo and may request account closure in accordance with the Terms & Conditions.

13.4 phlogo maintains an archive of previous versions of this Privacy Policy, which are available upon request from the Data Protection Officer.

14.1 For all matters relating to this Privacy Policy, the exercise of your data subject rights under the Data Privacy Act of 2012, or any concerns about how phlogo processes your personal data, please contact phlogo's Data Protection Officer through the following channels:

• Email (plain text — not a clickable link): [email protected] — addressed to Data Protection Officer
• Subject Line Guidance: Use the subject line "Data Privacy Request — [Your Account Reference]" for faster routing to the DPO team
• Live Chat: Available within your phlogo account portal — select "Privacy & Data" as the inquiry category
• Response Timeframe: phlogo aims to acknowledge all data privacy inquiries within three (3) business days and provide a substantive response within thirty (30) calendar days

14.2 If you are dissatisfied with phlogo's response to a data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC), which oversees compliance with the Data Privacy Act of 2012.