phplush Privacy
Policy

This Privacy Policy applies to all personal information collected by phplush in connection with the phplush Casino platform accessible at phplush.one, including all games, services, promotional communications, customer support interactions, and any other features or content made available through the platform.

This policy applies to all registered Players, unregistered visitors browsing phplush.one, and any person who contacts phplush through any communication channel. It does not apply to the privacy practices of third-party game providers, payment processors, or other external services linked to or integrated with the phplush platform — those entities operate under their own privacy policies.

phplush is committed to handling personal data responsibly, lawfully, and transparently in compliance with Republic Act No. 10173, the Data Privacy Act of 2012, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines.

For the purposes of the Philippine Data Privacy Act and this Privacy Policy, phplush — the operator of phplush.one — acts as the Personal Information Controller (PIC) in respect of all personal data collected from Players and visitors through the platform.

phplush has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this policy and with applicable data protection law. Privacy enquiries, data subject requests, and complaints may be directed to the DPO at:

phplush collects personal information through several channels. The categories of data collected, and the circumstances in which they are collected, are set out below.

3.1 Information You Provide Directly

• Registration data: full legal name, date of birth, email address, Philippine mobile number, and chosen password.
• KYC verification documents: photographs or scans of Philippine government-issued identification (PhilSys National ID, passport, driver's license, UMID, SSS card, COMELEC Voter's ID), selfie photographs, and proof of address where required.
• Payment information: GCash wallet number, Maya wallet number, bank account details (BPI, BDO, Metrobank), and other payment method identifiers used to make deposits or receive withdrawals. phplush does not store full card numbers or payment credentials directly — these are processed via PCI-compliant third-party payment processors.
• Support communications: messages, chat transcripts, emails, and other content you submit to phplush's customer support team.
• Responsible gaming declarations: information you provide when setting deposit limits, requesting self-exclusion, or accessing responsible gaming tools.

3.2 Information Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and mobile carrier.
• Session data: login timestamps, session duration, pages visited, games accessed, in-game actions, bet amounts, and game outcomes.
• Location data: approximate geographic location derived from your IP address for regulatory compliance and fraud prevention purposes.
• Cookies and tracking technologies: see Section 7 of this policy for full details.

3.3 Information from Third Parties

• Identity verification results from KYC verification service providers.
• Transaction confirmation and status data from GCash, Maya, and other payment processors.
• Fraud screening signals from third-party anti-fraud and risk management services.
• Regulatory and sanctions list screening results as required by PAGCOR and anti-money laundering obligations.

phplush processes personal data for the following specific purposes:

phplush does not sell, rent, or commercially license your personal data to third parties for their own marketing purposes. Promotional communications from phplush are sent only where you have provided explicit consent at registration or through your account communication preferences.

Under the Philippine Data Privacy Act, phplush relies on the following legal bases for the processing of your personal data:

• Contract Performance: Processing necessary to register your phplush Account, provide gaming services, and facilitate deposits and withdrawals as part of the service agreement between you and phplush.
• Legal Obligation: Processing required by PAGCOR regulations, the Anti-Money Laundering Act (RA 9160 as amended), the Philippine Data Privacy Act, and other applicable Philippine legislation — including KYC verification, transaction monitoring, and regulatory reporting.
• Legitimate Interest: Processing necessary for fraud prevention, account security, platform integrity, customer support quality, and aggregated analytics — where these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for direct marketing communications and non-essential cookies, where you have given freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

phplush does not disclose personal data to third parties except in the circumstances described in this section. All third-party recipients are required to handle personal data in compliance with applicable law and are bound by data processing agreements where required.

6.1 Service Providers (Personal Information Processors)

phplush engages third-party service providers who process personal data on phplush's behalf solely for the purposes described in this policy. These include:

• KYC and identity verification technology providers.
• Payment processing partners — GCash (GXI), Maya (Voyager Innovations), and bank payment gateways. These parties process payment credentials under their own applicable data protection obligations.
• Cloud hosting and infrastructure providers on whose servers phplush data may be stored.
• Third-party game software providers who may process session data within the game environment.
• Customer support platform providers who host live chat and support ticket systems.
• Anti-fraud and risk management technology providers.

6.2 Regulatory and Law Enforcement Disclosure

phplush will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or any other competent Philippine government authority where required by law, court order, or regulatory direction. phplush is not required to notify you of such disclosures where notification would compromise a legal investigation or is otherwise prohibited by applicable law.

6.3 Business Transfers

In the event of a merger, acquisition, sale of assets, or restructuring of the phplush business, personal data may be transferred to the acquiring entity as part of that transaction. phplush will notify registered Players of any such transfer that materially affects their data rights prior to the transfer taking effect.

phplush uses cookies and similar tracking technologies on phplush.one to support the operation of the platform and to improve the Player experience. The types of cookies used are described below.

• Strictly Necessary Cookies: Required for core platform functionality including authentication session management, security token verification, and fraud prevention. These cookies cannot be disabled without impairing the platform's basic functions.
• Functional Cookies: Remember your preferences such as language settings, preferred game filters, and lobby display options to personalise your phplush experience across sessions.
• Analytics Cookies: Collect aggregated, anonymised data about how Players navigate phplush.one — which pages are visited most, where Players enter and exit, and how they interact with the game lobby — to help phplush improve the platform.
• Marketing Cookies (Consent Required): Used only where you have provided explicit consent to receive personalised promotional content. These cookies track engagement with phplush communications to measure campaign relevance and effectiveness.

You may manage your cookie preferences through your browser settings. Disabling cookies beyond the strictly necessary category may affect certain platform features but will not prevent you from accessing the core phplush Casino services.

phplush retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by Applicable Law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised. Where deletion is not technically immediately feasible (e.g., data in backup systems), phplush will isolate the data from active processing until deletion is carried out in the next scheduled backup cycle.

phplush implements appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Encryption: All data transmitted between your device and phplush.one is encrypted using TLS (Transport Layer Security).
• Data Encryption at Rest: Sensitive personal data stored on phplush servers, including identity documents and payment details, is encrypted at rest using industry-standard encryption algorithms.
• Password Hashing: Account passwords are never stored in plain text. phplush uses industry-standard cryptographic hashing to protect password data.
• Two-Factor Authentication (2FA): phplush offers SMS OTP-based 2FA for Account login, providing an additional layer of access control beyond the password.
• Access Controls: Access to personal data within phplush's systems is restricted on a need-to-know basis and subject to role-based permissions, logging, and regular access review.
• Security Auditing: phplush conducts periodic security assessments of its platform infrastructure and data handling practices.
• Breach Response: phplush maintains an incident response procedure for personal data breaches. In the event of a breach likely to result in high risk to your rights, phplush will notify the National Privacy Commission and affected individuals in accordance with RA 10173.

As a data subject under the Philippine Data Privacy Act, you have the following rights in relation to your personal data held by phplush. To exercise any of these rights, contact the phplush Data Protection Officer via the contact details in Section 14.

• Right to Be Informed: The right to be informed of how your personal data is being collected, used, shared, and retained — which is the primary purpose of this Privacy Policy.
• Right of Access: The right to request a copy of the personal data held by phplush about you, along with information about how and why it is being processed.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data held by phplush about you.
• Right to Erasure / Right to Be Forgotten: The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where consent has been withdrawn, or where processing is unlawful. This right is subject to phplush's legal obligations to retain certain data under PAGCOR regulations and the AMLA.
• Right to Data Portability: The right to receive a structured, commonly used, and machine-readable copy of the personal data you provided to phplush, for transmission to another controller.
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interest, subject to phplush's ability to demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe phplush has processed your personal data in violation of RA 10173.

phplush will respond to verified data subject requests within thirty (30) days. phplush may request additional identification to verify your identity before processing a data subject request.

Age is verified at registration through date of birth entry and confirmed during KYC through government-issued identification. Any Account found to be associated with a person under 21 years of age will be immediately suspended, all data associated with that Account will be processed for deletion in accordance with legal obligations, and the matter will be reported to PAGCOR where required.

If you are a parent or guardian and believe that a person under 21 has registered on phplush, please contact phplush support immediately so that the Account can be reviewed and suspended without delay.

Some of phplush's third-party service providers — including cloud infrastructure providers and certain KYC and fraud prevention technology providers — may process personal data in jurisdictions outside the Philippines. Where such transfers occur, phplush ensures that appropriate safeguards are in place in accordance with RA 10173 and NPC guidelines, including contractual data processing agreements that require recipients to maintain data protection standards equivalent to those required under Philippine law.

phplush will not transfer personal data to any jurisdiction that does not provide an adequate level of data protection unless appropriate safeguards are in place.

phplush may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or platform features. Material changes will be communicated to registered Players by email to the address on file or via a notice on the phplush platform prior to the change taking effect.

The version date displayed at the top of this page indicates when the policy was last revised. Continued use of phplush following notification of any material update constitutes your acceptance of the revised policy. If you do not agree to the revised terms, you should cease using phplush and contact support to request Account closure.

For any privacy-related enquiry, to exercise a data subject right, or to raise a complaint regarding phplush's handling of your personal data, please contact the phplush Data Protection Officer:

If phplush's response to a data subject complaint is unsatisfactory, you have the right to escalate your complaint to the National Privacy Commission of the Philippines, the designated supervisory authority for personal data protection under RA 10173.