ph17 Privacy Policy

ph17 ("ph17," "we," "us," "our") is the operator of ph17.one, a PAGCOR-licensed online gaming platform providing casino games, sports betting, bingo, and related services to Filipino players in the Philippines.

For purposes of the Philippine Data Privacy Act of 2012 (RA 10173), ph17 acts as the Personal Information Controller (PIC) in respect of the personal data collected through the ph17 Platform. ph17 is responsible for ensuring that personal data is processed lawfully, fairly, and transparently in accordance with this Privacy Policy and applicable law.

Our designated Data Protection Officer (DPO) can be reached through ph17 support. Contact details are provided in Section 13 of this Policy.

ph17 collects the following categories of personal data from registered players and Platform visitors:

ph17 does not collect sensitive personal information as defined under RA 10173 (e.g., race, religion, health data) except where strictly required for responsible gaming compliance purposes (e.g., self-exclusion records).

ph17 collects personal data through the following methods:

• Direct collection: Information you provide when registering a ph17 Account, completing KYC, making deposits or withdrawals, contacting support, or using any Platform feature.
• Automated technical collection: Data collected automatically when you access ph17.one, including through cookies, server logs, session tracking, and analytics tools used to maintain Platform performance and security.
• Third-party sources: Identity and address verification data may be cross-checked against Philippine government databases or licensed third-party KYC and AML service providers for compliance purposes.
• Payment processors: Transaction confirmation data received from GCash, PayMaya, BDO, BPI, Metrobank, InstaPay, UnionBank, and other integrated payment processors.

ph17 processes your personal data for the following specific purposes:

• Account management: To create, maintain, and operate your ph17 Account, including authentication, password resets, and account security alerts.
• KYC and identity verification: To verify that you meet the 21+ age requirement and satisfy PAGCOR identity verification obligations before activating full Account functionality.
• Payment processing: To process deposits and withdrawals via GCash, PayMaya, and other supported Philippine payment methods accurately and securely.
• Gaming service delivery: To operate the casino, sports betting, bingo, and slot services you access through your ph17 Account, including maintaining game session records.
• Regulatory compliance: To fulfill ph17's obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160), and applicable NPC regulations including mandatory reporting of covered and suspicious transactions.
• Responsible gaming: To monitor gaming activity for problem gambling indicators, apply player-set limits and self-exclusion requests, and comply with PAGCOR responsible gaming requirements.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, unauthorized Account access, and other Platform security threats.
• Customer support: To respond to your queries, resolve disputes, and manage support interactions through ph17's live chat and email channels.
• Marketing communications: To send promotional offers, bonus notifications, and Platform updates — only where you have provided consent and only through channels you have agreed to. You may opt out at any time through Account settings or by contacting ph17 support.
• Platform improvement: To analyze aggregated, anonymized usage data for the purpose of improving ph17's games, features, and user experience. Individual player data is not used for this purpose without appropriate legal basis.

Under the Philippine Data Privacy Act, ph17 relies on the following legal bases for processing your personal data:

• Contract performance: Processing necessary to create and operate your ph17 Account and deliver gaming services under our Terms & Conditions.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, AML/CTF obligations, NPC regulations, and other applicable Philippine law.
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by your data protection rights.
• Consent: Processing for direct marketing communications, non-essential cookies, and any other processing activities where RA 10173 requires explicit consent. Consent may be withdrawn at any time.

ph17 does not sell your personal data to third parties. We share personal data only in the following circumstances and with the following categories of recipients:

• PAGCOR and regulatory authorities: As required by our operating license, PAGCOR may require access to player data for audit, compliance, and enforcement purposes. ph17 is also obligated to report covered and suspicious transactions to the Anti-Money Laundering Council (AMLC) as required under RA 9160.
• KYC and AML service providers: Licensed third-party providers engaged to perform identity verification, sanctions screening, and politically exposed persons (PEP) checks as required by PAGCOR and AMLC regulations.
• Payment processors: GCash, PayMaya, BDO, BPI, Metrobank, InstaPay, UnionBank, and other payment service providers receive transaction data necessary to process your deposits and withdrawals.
• Game content providers: Licensed third-party game studios whose games are available on ph17 may receive anonymized game session data necessary to operate their certified gaming systems. No personally identifiable data is shared with game providers without explicit necessity.
• Technology service providers: Cloud hosting, cybersecurity, fraud detection, and customer support platform providers engaged by ph17, all of whom are contractually bound to process data only on ph17's instructions and in compliance with RA 10173.
• Law enforcement and courts: Where ph17 is required to disclose data by court order, lawful subpoena, or other binding legal process under Philippine law.

ph17 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law:

• Account data: Retained for the duration of your active ph17 Account plus a minimum of five (5) years following Account closure, in compliance with PAGCOR licensing requirements and AML record-keeping obligations under RA 9160.
• Transaction records: Financial transaction records are retained for a minimum of five (5) years as required by the AMLC and PAGCOR.
• KYC documents: Identity verification documents are retained for five (5) years following the end of the business relationship, or longer if required by a specific regulatory obligation or ongoing investigation.
• Gaming activity logs: Retained for a minimum of two (2) years from the date of the gaming session for dispute resolution and audit purposes.
• Support communications: Live chat transcripts and email correspondence are retained for two (2) years.
• Marketing consent records: Retained for the duration of the consent plus three (3) years to demonstrate compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with NPC-approved data disposal procedures.

ph17 implements technical and organizational security measures designed to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and ph17.one.
• Encryption of sensitive data (passwords, financial credentials) at rest using industry-standard encryption protocols.
• Two-factor authentication (2FA) available for all ph17 Accounts, with mandatory 2FA for high-value withdrawal requests.
• Access controls ensuring that ph17 staff access personal data only on a need-to-know basis, with all access logged and auditable.
• Regular penetration testing and vulnerability assessments of the ph17 Platform infrastructure.
• 24/7 security monitoring with automated alerts for unusual login patterns, transaction anomalies, and potential data breaches.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, ph17 will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with NPC Circular No. 16-03.

ph17.one uses cookies and similar tracking technologies to operate the Platform, maintain your session, and improve your experience. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function (e.g., session management, login authentication, security tokens). These cannot be disabled without impairing Platform functionality.
• Performance and analytics cookies: Used to collect anonymized data about how players use ph17.one, including page load times, error rates, and feature usage. This data is used to improve Platform performance.
• Functionality cookies: Store your preferences such as language settings, game lobby layout, and responsible gaming limit displays.
• Security cookies: Support fraud detection and bot prevention systems that protect your Account and the Platform from malicious activity.

ph17 does not use advertising or tracking cookies for cross-site behavioral advertising. On first access to ph17.one, you will be presented with a cookie consent notice allowing you to accept or configure non-essential cookie categories. You may adjust your cookie preferences at any time through Platform settings.

Under the Philippine Data Privacy Act (RA 10173), you have the following rights in respect of your personal data held by ph17:

• Right to be Informed: The right to know what personal data ph17 holds about you, how it is used, and with whom it is shared — as described in this Privacy Policy.
• Right to Access: The right to request a copy of the personal data ph17 holds about you.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected. You may update most Account information directly in your ph17 Account settings; for KYC-related corrections, contact ph17 support.
• Right to Erasure or Blocking: The right to request deletion or blocking of personal data that is no longer necessary for the purpose it was collected, collected unlawfully, or processed in violation of RA 10173 — subject to ph17's legal retention obligations.
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes. You may opt out of marketing communications at any time through Account settings or by contacting support.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used format for transfer to another controller, where technically feasible.
• Right to Damages: The right to claim compensation for damages suffered as a result of a violation of RA 10173 by ph17.
• Right to Complain: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe ph17 has violated your data privacy rights.

To exercise any of the above rights, contact ph17's Data Protection Officer through the ph17 support live chat or email. ph17 will respond to verified data subject requests within 15 business days of receipt, or within a longer period if permitted by NPC regulations for complex requests.

The ph17 Platform is strictly intended for users aged 21 years and older in compliance with PAGCOR online gaming regulations. ph17 does not knowingly collect personal data from any individual under the age of 21.

If ph17 discovers that personal data has been collected from a person under 21 years of age, the associated Account will be immediately suspended, all gaming activity will be voided, and the data will be deleted in accordance with our data disposal procedures. The matter will be reported to PAGCOR as required by our operating license.

If you are a parent or guardian and believe a minor has created a ph17 Account, please contact ph17 support immediately via live chat. We will act on such reports without delay.

ph17 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. The "Last Updated" date at the top of this page indicates when the current version took effect.

Material changes to this Privacy Policy will be communicated to registered players via SMS notification to your registered Philippine mobile number or a prominent notice on ph17.one at least 7 days before the changes take effect, unless immediate changes are required for legal, security, or regulatory compliance reasons.

Your continued use of the ph17 Platform following the effective date of any update constitutes your acknowledgment of the revised Privacy Policy. We encourage you to review this page periodically.