phkay Privacy Policy

This Privacy Policy ("Policy") describes how phkay ("phkay," "we," "us," or "our") collects, uses, discloses, stores, and protects the personal information of individuals ("Member," "you," or "your") who access or use the phkay platform, including the website at phkay.vip and all associated gaming, betting, and account management services.

phkay is committed to processing personal data lawfully, fairly, and transparently, in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations. This Policy applies to all personal data collected from Filipino players and any other individuals who interact with phkay, regardless of how access to the platform is obtained.

phkay acts as the personal information controller ("PIC") in respect of personal data collected from members and platform users, as defined under the Philippine Data Privacy Act of 2012. This means phkay determines the purposes for which, and the means by which, personal data is processed.

Where phkay engages third-party service providers to process personal data on its behalf — such as payment processors, identity verification services, or cloud infrastructure providers — those parties act as personal information processors ("PIP") under phkay's instruction and are subject to written data processing agreements that require them to implement appropriate data protection measures.

For all privacy-related inquiries and exercise of data subject rights, please refer to Section 17 (Contact & Data Protection Officer) of this Policy.

phkay collects the following categories of personal data from members and platform users:

phkay collects personal data through the following channels:

• Direct interaction: Data you provide when registering a phkay account, completing KYC verification, submitting a deposit or withdrawal request, contacting customer support, or participating in a promotion.
• Automated technologies: Technical data collected automatically when you access the phkay platform — including IP address, device information, session data, and cookie-based identifiers — through phkay's servers and analytics infrastructure.
• Third-party sources: Identity verification data confirmed or supplemented through licensed KYC/AML service providers; transaction data received from payment processors including GCash, Maya, BPI, BDO, Metrobank, and cryptocurrency network nodes.
• Platform activity: Game session data, betting history, and responsible gaming tool interactions generated through your use of the phkay casino, sportsbook, and instant game products.

phkay uses the personal data it collects for the following purposes:

• Account registration and management: Creating and maintaining your phkay account, authenticating your identity at login, and managing account settings and preferences.
• KYC and AML compliance: Verifying your identity and age (21+ requirement) in accordance with PAGCOR's regulatory framework and applicable AML/CTF obligations under Philippine law.
• Payment processing: Processing deposits to your phkay wallet via GCash, Maya, BPI, BDO, Metrobank, and cryptocurrency channels, and processing withdrawal requests to your verified payment account.
• Game and platform delivery: Providing access to phkay's casino games, sportsbook, instant games, and live dealer products; recording game session outcomes for account history and dispute resolution.
• Responsible gaming: Monitoring gaming patterns to support phkay's responsible gaming commitments; delivering deposit limit, loss limit, and session time reminder functionality; processing self-exclusion requests.
• Security and fraud prevention: Detecting and investigating suspicious activity, unauthorized access attempts, fraudulent transactions, and prohibited conduct as defined in phkay's Terms & Conditions.
• Customer support: Responding to member inquiries, resolving complaints, and providing technical assistance through phkay's 24/7 live chat and email support channels.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to members who have given their consent — and only to those members. Opt-out is available at any time.
• Legal compliance: Meeting phkay's legal obligations under RA 10173, PAGCOR regulations, Philippine AML law, and any order or direction from a competent regulatory or law enforcement authority.
• Platform improvement: Analyzing aggregated and anonymized usage data to improve phkay's platform features, game selection, and user experience for Filipino players.

Under RA 10173, personal data may only be processed if there is a lawful basis for doing so. phkay relies on the following legal bases for processing member personal data:

• Contractual necessity: Processing required to perform the agreement between phkay and the member, including account registration, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable Philippine law — including PAGCOR regulations, AML/CTF obligations, and the Data Privacy Act.
• Legitimate interests: Processing for fraud prevention, platform security, and improving phkay's services for Filipino players, where these interests are not overridden by the data subject's privacy rights.
• Consent: Processing for optional marketing communications and non-essential analytics, where phkay has obtained the member's explicit prior consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

phkay does not sell, rent, or trade your personal data to third parties for their own commercial purposes. phkay shares personal data with third parties only in the following circumstances:

Service Providers (Personal Information Processors)

phkay engages licensed third-party service providers who process personal data solely on phkay's instruction and for the purposes described in this Policy. Categories include: payment processors (GCash / Maya / banking partners / cryptocurrency infrastructure), KYC/AML identity verification providers, licensed game software providers, cloud computing and hosting infrastructure, customer support platform technology, and cybersecurity and fraud prevention services.

All service providers are subject to written data processing agreements that bind them to data protection obligations consistent with RA 10173 and phkay's standards.

Regulatory and Law Enforcement Authorities

phkay may disclose personal data to PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), the Philippine National Police, the National Bureau of Investigation, or any other competent Philippine government authority where required by law, court order, or lawful direction.

Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of phkay's business, personal data held by phkay may be transferred to the acquiring or successor entity, subject to equivalent data protection obligations and prior notification to affected members as required by RA 10173.

phkay uses cookies and similar tracking technologies on the phkay.vip website to support platform functionality, security, and — where consent is obtained — analytics. The following categories of cookies are used:

• Strictly necessary cookies: Essential to the operation of the phkay platform, including maintaining your authenticated session after phkay login, remembering your language preference, and supporting security features. These cookies cannot be disabled.
• Functional cookies: Enhance your phkay experience by remembering preferences such as your default game view or responsible gaming tool settings. Disabling these may reduce platform functionality.
• Analytics cookies: Used to understand aggregated usage patterns on the phkay platform — including which game categories are most visited and how members navigate the lobby. These cookies are only activated with your consent and collect data in anonymized or pseudonymized form.
• Security cookies: Support fraud detection and unauthorized access prevention by maintaining session integrity indicators. These are strictly necessary and cannot be opted out of.

You may manage cookie preferences through your browser settings. Note that disabling functional or analytics cookies does not affect your ability to use the core phkay platform. Strictly necessary cookies cannot be disabled without preventing basic platform functionality.

phkay retains personal data only for as long as is necessary for the purposes for which it was collected, subject to applicable legal and regulatory retention requirements. The following retention periods apply:

• Account and identity data: Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, as required by PAGCOR regulations and Philippine AML record-keeping obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, consistent with AMLC record-keeping requirements under Republic Act No. 9160 (Anti-Money Laundering Act), as amended.
• KYC verification documents: Retained for the duration of the account relationship and for five (5) years post-closure or as required by applicable regulation, whichever is longer.
• Game session and betting records: Retained for a minimum of two (2) years for dispute resolution and responsible gaming monitoring purposes.
• Customer support communications: Retained for two (2) years from the date of the last interaction for quality assurance and dispute resolution purposes.
• Technical and security logs: Retained for twelve (12) months unless a longer period is required for an active security investigation.
• Marketing preference data: Retained while the member's account is active and until consent is withdrawn. Following withdrawal of consent, marketing data is deleted within 30 days.

Upon expiry of applicable retention periods, phkay securely deletes or anonymizes personal data using processes that render the data irrecoverable and non-attributable.

phkay implements a comprehensive set of technical and organizational security measures designed to protect member personal data against unauthorized access, disclosure, alteration, loss, and destruction. Key measures include:

• Encryption in transit: All data transmitted between member devices and phkay's servers is encrypted using 256-bit SSL/TLS protocols.
• Encryption at rest: Sensitive personal data fields — including identity data and financial account references — are encrypted at rest using industry-standard cryptographic algorithms.
• Password security: Member passwords are hashed using modern one-way cryptographic hashing functions. phkay does not store passwords in recoverable form.
• Access controls: Strict role-based access controls limit phkay staff access to member personal data on a need-to-know basis. Access to sensitive data categories requires additional authorization.
• Two-factor authentication: Members are offered SMS OTP-based two-factor authentication for phkay login. phkay's internal administrative systems require multi-factor authentication for staff access to member data.
• Infrastructure security: phkay's platform is hosted on ISO-certified cloud infrastructure with DDoS protection, intrusion detection, and regular penetration testing.
• Staff training: All phkay personnel with access to member data undergo data protection training and are bound by confidentiality obligations.

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to personal data held by phkay. These rights may be exercised by contacting phkay's Data Protection Officer as described in Section 17:

• Right to be Informed: You have the right to be informed that your personal data is being or has been collected and processed by phkay, including the purposes for processing and the identity of any third-party recipients.
• Right of Access: You have the right to request confirmation of whether phkay holds personal data about you, and to receive a copy of that data in an intelligible format, together with information about the source, purposes, and processing activities involved.
• Right to Rectification: You have the right to request correction of any inaccurate, outdated, incomplete, or misleading personal data phkay holds about you. Correction requests will be processed and confirmed within ten (10) business days.
• Right to Erasure (Right to be Forgotten): You have the right to request deletion of personal data where it is no longer necessary for the purposes for which it was collected, where consent has been withdrawn and there is no other lawful basis for retention, or where processing is unlawful. This right is subject to phkay's mandatory retention obligations under PAGCOR regulations and AML law.
• Right to Object: You have the right to object to the processing of your personal data for purposes of direct marketing, or where processing is based on legitimate interests and your privacy rights override those interests.
• Right to Data Portability: You have the right to receive personal data you have provided to phkay in a structured, commonly used, and machine-readable format, and to have that data transmitted to another controller where technically feasible.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe phkay has processed your personal data in violation of RA 10173.

The phkay platform is strictly for individuals who are twenty-one (21) years of age or older, consistent with PAGCOR's minimum age requirement for casino-style online gambling in the Philippines. phkay does not knowingly collect personal data from any individual under the age of 21.

If phkay discovers or is informed that it has collected personal data from a person under 21 years of age, phkay will take immediate steps to: close the associated account, delete or destroy the personal data collected, and return any deposits made to the originating payment source. Any winnings accumulated on an underage account are forfeited.

Parents or guardians who believe their minor child's personal data may have been submitted to phkay should contact phkay's Data Protection Officer immediately using the contact information in Section 17. phkay will treat such reports as priority matters and respond within 24 hours.

phkay sends promotional communications — including bonus offers, game announcements, and platform updates — only to members who have provided explicit prior consent to receive such communications. Consent is collected at registration and can be updated at any time through your phkay account settings.

If you wish to stop receiving marketing communications from phkay, you may:

• Update your notification preferences in your phkay account settings
• Contact phkay's customer support team via 24/7 live chat or email at [email protected]

Opt-out requests are processed within 5 business days. Note that withdrawing consent for marketing communications does not affect the delivery of transactional messages required for account operation — such as deposit confirmations, withdrawal notifications, security alerts, and responsible gaming communications.

In the course of delivering its Services, phkay may transfer certain personal data to service providers or infrastructure partners located outside the Philippines — for example, internationally licensed game providers or cloud hosting services operating data centers in other jurisdictions.

Where personal data is transferred internationally, phkay ensures that appropriate safeguards are in place in accordance with RA 10173 and any applicable NPC rules on cross-border data transfers. Safeguards include: contractual clauses requiring the recipient to maintain data protection standards equivalent to those required under Philippine law; and, where applicable, transfers only to jurisdictions with adequate data protection frameworks recognized by the NPC.

phkay does not transfer personal data to countries or territories where phkay cannot ensure that the transferred data will be protected to an equivalent standard to that which applies in the Philippines under RA 10173.

phkay maintains incident response procedures designed to detect, contain, investigate, and remediate personal data breaches promptly. In the event of a confirmed personal data breach that poses a real risk of serious harm to affected data subjects, phkay will:

• Notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, or as otherwise required by the NPC's Personal Data Breach Management Circular.
• Notify affected members promptly and in plain language — describing the nature of the breach, the categories and approximate number of affected individuals, the data involved, the likely consequences, and the steps phkay has taken or proposes to take to address the breach.
• Provide practical guidance to affected members on steps they can take to protect themselves, which may include changing passwords, monitoring payment accounts, or activating phkay's account security features.

phkay maintains detailed records of all personal data breaches, including those that do not meet the notification threshold, in accordance with RA 10173 and NPC regulations.

phkay reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, phkay's data processing activities, or platform features. The updated Policy will be published at phkay.vip/privacy-policy with a revised "Last Reviewed" date at the top of the document.

When material changes are made to this Policy — changes that materially affect how phkay collects, uses, or shares member personal data — phkay will provide reasonable advance notice to active members through an in-account notification, an email to the registered address, or a prominent notice on the platform. Non-material or editorial updates may be made without individual notification.

Continued use of the phkay platform following the effective date of any updated Policy constitutes acceptance of the revised terms. Members who do not accept the updated Policy should contact phkay's Data Protection Officer and, if appropriate, request account closure.

phkay has designated a Data Protection Officer (DPO) responsible for overseeing phkay's compliance with RA 10173 and this Privacy Policy. The DPO is the point of contact for all data subject rights requests, privacy inquiries, and data breach reports.

To exercise your data subject rights, submit a privacy inquiry, report a potential breach, or raise a concern about phkay's data processing practices, please contact phkay through the following channels:

• Email (Data Protection Officer): [email protected] — please use the subject line "Privacy Policy / DPO Inquiry" for all privacy-related matters
• 24/7 Live Chat: Available directly on phkay.vip — for urgent privacy concerns, including suspected unauthorized account access

phkay is committed to responding to all privacy inquiries within 3 business days and to resolving all data subject rights requests within 15 business days. For complex requests that require additional time, phkay will notify you of the extended timeline and the reason for it.