phi99 Privacy Policy – How We Protect Your Personal Data

1. Overview

phi99 ("we", "us", "our") is committed to protecting the privacy and personal data of every player who uses our platform. This Privacy Policy applies to all personal data collected through the phi99 website at phi99.app, any associated mobile applications, and all interactions between you and phi99's customer support team.

By creating an account on phi99, depositing funds, placing wagers, or otherwise using our services, you acknowledge that you have read this Privacy Policy and consent to the collection and processing of your personal data as described here. If you do not agree with any part of this policy, you should not use phi99.

phi99 operates in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines and its implementing rules and regulations. We are registered with the National Privacy Commission (NPC) where required and uphold the rights of data subjects as defined under Philippine law.

2. Data Controller

phi99 is the personal information controller (PIC) for all personal data processed through the phi99 platform. As the PIC, phi99 determines the purposes and means of processing your personal data and is responsible for ensuring that all processing complies with applicable Philippine data protection law.

Any questions, requests, or concerns relating to your personal data can be directed to our Data Protection Officer (DPO) at privacy@phi99.app. Our DPO handles all data subject rights requests, breach notifications, and privacy compliance matters for phi99.

3. What Personal Data We Collect

phi99 collects personal data that is adequate, relevant, and limited to what is necessary for the purposes described in this policy. We do not collect personal data speculatively or for purposes we haven't disclosed to you.

4. How We Collect Your Data

phi99 collects your personal data through the following channels:

• Directly from you — when you register, complete KYC verification, make a deposit or withdrawal, contact support, or respond to a survey or promotion on phi99.
• Automatically during platform use — through server logs, cookies, and similar technologies that record your device and browsing behaviour when you use phi99.
• From payment processors — transaction confirmation data passed to phi99 by GCash, Maya, banks, and card processors after you initiate a payment.
• From identity verification providers — during KYC processes, phi99 may use regulated third-party identity verification services that process your documents on our behalf.
• From fraud prevention and AML partners — phi99 may receive risk signals or flags from regulated compliance data providers used to verify the legitimacy of transactions.

5. Why We Use Your Personal Data

phi99 uses your personal data for specific, legitimate purposes. Every processing activity has a legal basis under the Data Privacy Act of 2012.

phi99 will never use your personal data for purposes not listed above without first obtaining your explicit consent or establishing a new legitimate legal basis. If you have questions about a specific processing activity, contact our DPO at privacy@phi99.app.

6. Sharing Your Personal Data

phi99 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Ever. Your data is shared only in the limited circumstances described below, and only to the extent necessary for each purpose.

• Payment processors (GCash, Maya, BDO, BPI, etc.): Transaction data is shared with your chosen payment provider to process deposits and withdrawals. Each provider has their own privacy policy governing how they handle this data.
• Identity verification providers: During KYC checks, your identification documents may be processed by a regulated third-party verification service acting as a personal information processor (PIP) on behalf of phi99.
• Fraud prevention and AML compliance partners: phi99 shares transaction and device data with regulated compliance technology providers to detect and prevent money laundering and fraud.
• Gaming platform and content providers: To operate the phi99 game catalog (including JILI slots, fishing games, and live casino titles), game session data is shared with our licensed game content providers. These providers are contractually bound to handle this data securely and only for the purpose of delivering game services.
• Regulatory authorities and law enforcement: phi99 will disclose personal data to the relevant Philippine government agencies, the National Privacy Commission, gaming regulatory authorities, or law enforcement bodies when legally required to do so.
• Professional advisors: Lawyers, auditors, and accountants engaged by phi99 may access personal data on a strictly need-to-know basis, subject to professional confidentiality obligations.

7. How Long We Keep Your Data

phi99 retains personal data for as long as necessary to fulfil the purposes described in this policy and to comply with applicable legal and regulatory retention requirements. The following general retention periods apply:

• Account data: Retained for the lifetime of your phi99 account, plus a minimum of five (5) years after account closure, in line with AML and gambling regulatory retention requirements under Philippine law.
• KYC and identity verification documents: Retained for a minimum of five (5) years after the completion of the relationship, or longer if required by applicable AML regulations or law enforcement holds.
• Transaction records: Retained for five (5) years from the date of each transaction, consistent with BSP and AMLC requirements for Philippine financial records.
• Gameplay and betting logs: Retained for three (3) years to support dispute resolution and responsible gaming monitoring obligations.
• Customer support communications: Retained for two (2) years from the date of the last interaction in a support case, or longer if the case involves an unresolved dispute or legal claim.
• Marketing preferences: Retained until you withdraw consent or request deletion. Withdrawal of marketing consent does not affect the lawfulness of processing that occurred prior to withdrawal.

After the applicable retention period expires, phi99 will securely delete or anonymise your personal data unless a specific legal requirement mandates its continued storage.

8. Security Measures

phi99 implements technical and organisational security measures appropriate to the sensitivity of the personal data we hold. These include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phi99 platform.
• Bcrypt password hashing — your phi99 password is never stored in a readable format. Even phi99's own technical staff cannot see your password.
• Two-factor authentication (2FA) available for all phi99 accounts to add a second layer of protection against unauthorised access.
• Segregated data storage — different categories of personal data (e.g., KYC documents vs. gameplay logs) are stored in separate, access-controlled environments.
• Role-based access controls — phi99 staff can only access the personal data necessary for their specific job function. No single employee has unrestricted access to all player data.
• Regular third-party security audits and penetration testing conducted by independent security firms to identify and remediate vulnerabilities.
• Automatic session timeouts on the phi99 platform to reduce the risk of account access from unattended devices.

Despite these measures, no system is completely secure. If phi99 becomes aware of a personal data breach that poses a risk to your rights and freedoms, we will notify affected players and the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, as required by the Data Privacy Act of 2012.

9. Cookies and Tracking Technologies

phi99 uses cookies and similar tracking technologies on its platform. A cookie is a small file stored on your device that helps the phi99 platform remember your preferences and activity. phi99 uses the following categories of cookies:

phi99 does not use third-party advertising cookies or cross-site tracking technologies. We do not participate in ad retargeting networks or share cookie data with advertising platforms.

You can manage cookie settings through your browser. Note that disabling essential cookies will affect the functionality of phi99 and may prevent you from logging in or accessing your account.

10. Children and Minors

phi99 strictly prohibits access by persons under the age of 21. We do not knowingly collect personal data from individuals under 21 years of age. If phi99 discovers that personal data has been collected from a minor, the account will be immediately suspended, all associated data will be securely deleted, and any funds deposited by the minor will be returned to the source payment method.

If you believe that a minor has created a phi99 account using false age information, please report this to privacy@phi99.app immediately. phi99 takes these reports seriously and will act on them as a priority matter.

11. Your Data Rights Under Philippine Law

Under the Data Privacy Act of 2012 (Republic Act 10173), you have the following rights regarding your personal data held by phi99. To exercise any of these rights, contact our DPO at privacy@phi99.app. phi99 will respond to all rights requests within thirty (30) calendar days.

12. Cross-Border Data Transfers

Some of phi99's third-party service providers — including game content providers, cloud infrastructure, and fraud prevention partners — may be located outside the Philippines. Where personal data is transferred to a third country, phi99 takes steps to ensure that adequate protections are in place, including:

• Requiring contractual clauses that impose equivalent data protection standards to those required under Philippine law.
• Conducting privacy impact assessments before engaging new offshore processors that will handle Philippine player data.
• Registering cross-border data transfers with the National Privacy Commission where required under the Data Privacy Act of 2012 and its implementing rules.

phi99 will always disclose the countries in which your data may be processed if you make a written request to privacy@phi99.app.

13. Changes to This Privacy Policy

phi99 may update this Privacy Policy periodically to reflect changes in our data practices, applicable law, or platform features. When material changes are made, phi99 will:

• Send an email notification to your registered phi99 email address at least fourteen (14) days before the changes take effect.
• Update the "Effective Date" at the top of this page.
• Display a prominent notice on the phi99 platform for at least thirty (30) days after a material change takes effect.

For minor corrections (such as fixing typographical errors or clarifying existing language without changing the substance of the policy), phi99 may update this page without prior notice. Your continued use of phi99 after the effective date of any updated Privacy Policy constitutes your acceptance of the revised version.

14. Contact Our Data Protection Officer

If you have any questions about this Privacy Policy, want to exercise your data rights, or need to report a privacy concern related to phi99, please contact us through the following:

If you are not satisfied with phi99's response to a privacy complaint, you have the right to lodge a complaint with the National Privacy Commission of the Philippines: