phace Casino Privacy Policy

1. Introduction

1.1 This Privacy Policy applies to all personal data collected, processed, and stored by phace Casino in connection with your use of the phace website, mobile platform, and all associated services (collectively, the "phace Platform").

1.2 By registering for a phace account, accessing the phace Platform, or otherwise providing your personal data to phace, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

1.3 This Privacy Policy should be read together with phace's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

1.4 If you do not agree with any part of this Privacy Policy, you should not use the phace Platform or provide your personal data to phace.

2. Data Controller

2.1 For the purposes of the Data Privacy Act of 2012 and its Implementing Rules and Regulations, phace Casino is the personal information controller responsible for your personal data collected through the phace Platform.

2.2 phace operates under the regulatory oversight of the Philippine Amusement and Gaming Corporation (PAGCOR) and is registered with the National Privacy Commission (NPC) of the Philippines.

2.3 If you have any questions or concerns about how phace handles your personal data, you may contact our Data Protection Officer (DPO) at [email protected]. Please include "Data Privacy" in the subject line of your message.

3. Personal Data We Collect

3.1 phace collects the following categories of personal data from players and platform visitors:

3.2 phace does not intentionally collect sensitive personal information (as defined under the Data Privacy Act) unless strictly required for regulatory compliance, such as government-issued ID details for KYC purposes.

4. How We Collect Your Data

4.1 phace collects personal data through the following means:

• Direct interactions: Data you provide when registering your phace account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated technologies: Technical and usage data collected automatically when you access the phace Platform, including through cookies, web beacons, and server logs.
• Third-party sources: Identity verification data from KYC service providers; fraud and AML screening data from compliance partners; payment data from GCash, Maya, and banking partners.
• Regulatory sources: Data received from PAGCOR or other regulatory bodies in connection with licensing, compliance, or enforcement activities.

4.2 phace will always inform you at the point of collection what data is being collected and for what purpose, where required by law.

5. How We Use Your Personal Data

5.1 phace uses your personal data for the following purposes:

• To create, verify, and manage your phace account;
• To process deposits, withdrawals, and other financial transactions in Philippine Peso (PHP);
• To verify your identity and age (21+) in compliance with PAGCOR requirements;
• To conduct anti-money laundering (AML) and counter-terrorism financing (CTF) screening as required by Philippine law;
• To detect, investigate, and prevent fraud, cheating, and other prohibited conduct on the phace Platform;
• To provide customer support and resolve disputes;
• To send you transactional communications, including deposit confirmations, withdrawal notifications, and security alerts;
• To send you promotional communications about phace bonuses and offers, where you have consented to receive such communications;
• To monitor your gaming activity for responsible gaming purposes and to apply any responsible gaming tools you have requested;
• To improve and personalise the phace Platform and your gaming experience;
• To comply with applicable Philippine laws, PAGCOR regulations, and NPC requirements;
• To enforce phace's Terms & Conditions.

5.2 phace will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your consent or establishing another lawful basis for processing.

6. Legal Basis for Processing

6.1 phace processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform the contract between you and phace (i.e., to operate your phace account and provide gaming services);
• Legal obligation: Processing required to comply with PAGCOR regulations, AML/CTF laws, tax obligations, and other applicable Philippine legal requirements;
• Legitimate interests: Processing necessary for phace's legitimate interests, including fraud prevention, platform security, and service improvement, where these interests are not overridden by your privacy rights;
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent, such as for marketing communications. You may withdraw your consent at any time.

7. Sharing Your Personal Data

7.1 phace does not sell, rent, or trade your personal data to any third party for marketing purposes. phace may share your personal data with the following categories of recipients only where necessary and lawful:

• KYC and identity verification providers: Third-party services that assist phace in verifying your identity and age in compliance with PAGCOR requirements;
• Payment processors: GCash, Maya, and Philippine banking partners (BPI, BDO, Metrobank, UnionBank, Security Bank, Landbank, PNB) for the purpose of processing your deposits and withdrawals;
• AML and fraud screening providers: Compliance technology partners that assist phace in meeting its anti-money laundering and fraud prevention obligations;
• IT and platform service providers: Cloud hosting, data storage, and software providers that support the operation of the phace Platform, all of whom are bound by strict data processing agreements;
• Regulatory and law enforcement authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other competent Philippine authorities, where disclosure is required by law or regulatory directive;
• Professional advisers: Lawyers, auditors, and accountants where necessary for legal, compliance, or financial purposes, subject to professional confidentiality obligations.

7.2 All third parties with whom phace shares personal data are required to handle that data in accordance with applicable Philippine privacy laws and phace's data protection standards.

7.3 phace will notify you of any disclosure of your personal data to regulatory or law enforcement authorities where it is legally permitted to do so.

8. Data Retention

8.1 phace retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

8.2 The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your phace account and for a minimum of 5 years after account closure, in accordance with PAGCOR and AML record-keeping requirements;
• Transaction and financial data: Retained for a minimum of 5 years from the date of the transaction, as required by Philippine AML regulations;
• Communications and support data: Retained for up to 3 years from the date of the communication, or longer if required for dispute resolution;
• Technical and usage data: Retained for up to 2 years from collection, unless required for longer for security or fraud investigation purposes.

8.3 When personal data is no longer required, phace will securely delete or anonymise it in accordance with its data disposal procedures.

9. Cookies & Tracking Technologies

9.1 The phace Platform uses cookies and similar tracking technologies to enhance your experience, maintain your session, and collect technical and usage data. The following types of cookies are used:

• Strictly necessary cookies: Essential for the phace Platform to function. These include session cookies that keep you logged in to your phace account. These cannot be disabled.
• Functional cookies: Remember your preferences, such as language settings and display options, to personalise your phace experience.
• Analytics cookies: Help phace understand how players use the Platform, which pages are most visited, and where improvements can be made. Data collected is aggregated and anonymised where possible.
• Security cookies: Used to detect and prevent fraudulent activity, bot access, and other security threats on the phace Platform.

9.2 You can control non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the phace Platform and your ability to access some features.

9.3 phace does not use cookies to serve third-party advertising or to track your activity across unrelated websites.

10. Your Privacy Rights

10.1 Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phace:

• Right to be informed: You have the right to know what personal data phace collects about you, why it is collected, and how it is used.
• Right of access: You may request a copy of the personal data phace holds about you at any time.
• Right to rectification: If any personal data phace holds about you is inaccurate or incomplete, you have the right to request that it be corrected.
• Right to erasure: You may request that phace delete your personal data where it is no longer necessary for the purposes for which it was collected, subject to phace's legal and regulatory retention obligations.
• Right to object: You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests.
• Right to data portability: You may request that phace provide your personal data in a structured, commonly used, and machine-readable format.
• Right to lodge a complaint: If you believe phace has violated your privacy rights, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

10.2 To exercise any of the above rights, please contact phace's Data Protection Officer at [email protected] with the subject line "Data Privacy Request". phace will respond to your request within 15 business days, as required by the Data Privacy Act.

10.3 phace may need to verify your identity before processing a data rights request to ensure that personal data is not disclosed to an unauthorised person.

11. Children & Minors

11.1 The phace Platform is strictly intended for persons aged 21 years and above. phace does not knowingly collect personal data from individuals under the age of 21.

11.2 If phace discovers that it has inadvertently collected personal data from a person under 21, it will immediately delete that data and close the associated account. Any funds deposited by an underage player will be returned to the source payment method.

11.3 If you believe that a minor has registered for a phace account or provided personal data to phace, please contact us immediately at [email protected].

12. Data Security

12.1 phace implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phace Platform;
• Encrypted storage of sensitive personal and financial data at rest;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Regular security audits, vulnerability assessments, and penetration testing;
• Multi-factor authentication for phace staff accessing internal systems;
• Continuous monitoring for suspicious activity and potential security incidents.

12.2 While phace takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. phace cannot guarantee absolute security but will notify you and the NPC promptly in the event of a data breach that poses a risk to your rights and freedoms.

12.3 You are responsible for keeping your phace Login credentials confidential. Do not share your username or password with anyone. If you suspect that your account has been compromised, contact phace customer support immediately.

13. International Data Transfers

13.1 phace primarily processes and stores personal data within the Philippines. In some cases, personal data may be transferred to or processed by service providers located outside the Philippines, such as cloud infrastructure providers or international compliance screening services.

13.2 Where personal data is transferred outside the Philippines, phace ensures that appropriate safeguards are in place to protect your data, including contractual clauses that require the recipient to apply data protection standards equivalent to those required under the Data Privacy Act of 2012.

13.3 phace will not transfer your personal data to a country or territory that does not provide an adequate level of data protection without first implementing appropriate safeguards and, where required, obtaining your consent.

14. Changes to This Privacy Policy

14.1 phace reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or regulatory requirements. The "Last Updated" date at the top of this page will be revised accordingly.

14.2 Where changes are material, phace will notify registered players via email or a prominent notice on the phace Platform at least 7 days before the changes take effect, where practicable.

14.3 Your continued use of the phace Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. We encourage you to review this page periodically to stay informed about how phace protects your personal data.

15. Contact & Complaints

15.1 If you have any questions, concerns, or requests regarding this Privacy Policy or phace's data practices, please contact our Data Protection Officer:

• Email: [email protected] — Subject line: "Data Privacy"
• Live Chat: Available within your phace account dashboard, 24/7 in English and Tagalog
• Help Centre: Visit our FAQ page for answers to common privacy questions

15.2 If you are not satisfied with phace's response to your privacy concern, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Philippines. The NPC is the independent government body responsible for administering and implementing the Data Privacy Act of 2012.

15.3 phace takes all privacy complaints seriously and will investigate and respond to every complaint received in good faith, within the timeframes required by Philippine law.