phlag Privacy Policy

1 Introduction

phlag operates the online casino and sports betting platform accessible at phlag.cam, offering services including live dealer casino games, sports betting, slot games, and online bingo to eligible players across the Philippines. In the course of operating these services, phlag necessarily collects and processes certain categories of personal data about its players and website visitors.

phlag is committed to handling your personal data responsibly, transparently, and in strict compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations issued by the National Privacy Commission, and all other applicable Philippine laws and regulations, including anti-money laundering requirements under Republic Act No. 9160 (as amended) and PAGCOR regulatory directives.

This Policy applies to all personal data collected through phlag.cam, our live chat support system, our payment processing interfaces, our email communications, and any other channel through which you interact with phlag.

2 Data Controller Information

phlag acts as the Data Controller with respect to the personal data of its registered players and website visitors. As Data Controller, phlag determines the purposes for which personal data is processed and the means by which such processing is carried out.

phlag has designated a Data Protection Officer (DPO) in accordance with the requirements of the National Privacy Commission. The DPO is responsible for overseeing phlag's data protection compliance, handling data subject requests, and acting as the point of contact for the National Privacy Commission.

To contact phlag's Data Protection Officer regarding privacy matters, please use the contact details set out in Section 14 of this Policy.

3 Personal Data We Collect

phlag collects personal data in the following categories, depending on your level of interaction with the Platform:

phlag does not intentionally collect sensitive personal data (as defined under the Philippine Data Privacy Act, such as data on health, religion, or political affiliation) except where specifically required for responsible gaming assessments or legally mandated AML/KYC purposes.

4 How We Use Your Personal Data

phlag uses your personal data for the following purposes:

• Account Creation and Management: To register your phlag account, verify your identity, maintain your account, and enable phlag Login access.
• Service Delivery: To provide access to casino games, sports betting markets, online bingo, and all other services available on the phlag platform.
• Payment Processing: To process deposits via GCash, Maya, BPI, BDO, Metrobank, UnionBank, USDT TRC20, Coins.ph, and 7-Eleven Cliqq, and to process withdrawal requests to your designated payment method.
• KYC and Identity Verification: To verify that you meet the minimum age requirement of 21 years and to comply with Know Your Customer obligations under Philippine anti-money laundering laws.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, money laundering, match-fixing, and other prohibited activities.
• Regulatory Compliance: To comply with PAGCOR regulatory requirements, anti-money laundering obligations, and lawful orders from competent Philippine government authorities.
• Customer Support: To respond to your support queries, resolve disputes, and maintain records of communications for quality assurance purposes.
• Responsible Gaming: To monitor gambling behaviour patterns that may indicate problem gambling and to administer self-exclusion, deposit limit, and cooling-off tools you have activated.
• Marketing and Promotions: To send you information about phlag promotions, bonuses, and new game releases where you have consented to receive such communications. You may opt out at any time by contacting support.
• Platform Improvement: To analyse aggregated usage data and improve the functionality, performance, and game selection of the phlag platform.

5 Legal Basis for Processing

Under the Philippine Data Privacy Act, phlag processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform the phlag Terms & Conditions agreement with you — including account creation, game access, and payment processing.
• Legal Obligation: Processing required to comply with phlag's obligations under Philippine law, including AML/KYC requirements, PAGCOR regulatory directives, and tax reporting obligations.
• Legitimate Interests: Processing necessary for phlag's legitimate business interests, including fraud prevention, security, platform improvement, and responsible gaming monitoring, where such interests are not overridden by your data protection rights.
• Consent: For marketing communications and non-essential cookies, processing is based on your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6 Data Sharing and Disclosure

6.1 No Sale of Data. phlag does not sell, rent, or trade your personal data to any third party for their own commercial purposes.

6.2 Service Providers. phlag shares personal data with carefully selected third-party service providers who process data on phlag's behalf and under phlag's instructions. These include: payment processors (GCash, Maya, BPI, BDO, Metrobank, UnionBank, Coins.ph); KYC and identity verification providers; game providers and live casino studios (who operate the games streamed through the phlag platform); IT infrastructure and cloud hosting providers; customer support software providers; and anti-fraud and security analytics providers. All such providers are contractually bound to maintain appropriate data security standards.

6.3 Regulatory Authorities. phlag discloses personal data to competent Philippine authorities — including PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), and law enforcement — when required to do so by applicable Philippine law, regulatory directive, court order, or other binding legal obligation.

6.4 Self-Exclusion Registers. Where a player registers for self-exclusion, phlag may share relevant identification data with PAGCOR-administered self-exclusion programmes as required under responsible gaming regulations.

6.5 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of phlag's business assets, your personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

7 Data Retention

phlag retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods required by applicable Philippine law:

• Account and KYC Records: Retained for a minimum of five (5) years from the date of account closure, in compliance with PAGCOR regulatory requirements and AML record-keeping obligations under RA 9160.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Communications Records: Live chat transcripts and support email records retained for three (3) years from the date of the communication.
• Marketing Consent Records: Retained for as long as you remain a registered player or until you withdraw consent, whichever is earlier.
• Self-Exclusion Records: Retained for the duration of the self-exclusion period plus five (5) years thereafter.

After the applicable retention period expires, phlag will securely delete or anonymise your personal data in accordance with its data destruction policy, unless further retention is required by a specific legal obligation.

8 Cookies and Tracking Technologies

phlag uses cookies and similar tracking technologies (such as local storage and session tokens) on phlag.cam. These serve the following functions:

• Strictly Necessary Cookies: Required for the Platform to function — maintaining your phlag Login session, storing your authentication token, and enabling core gaming and payment features. These cannot be disabled.
• Functional Cookies: Remember your preferences, such as language settings, game lobby filters, and responsible gaming limit configurations you have set.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players navigate and use the Platform — helping phlag identify and fix usability issues and improve performance. phlag uses privacy-compliant analytics tools and does not share raw analytics data with third-party advertisers.
• Security Cookies: Used to detect and prevent fraudulent login attempts, bot activity, and other security threats to your phlag account.

You may manage cookie preferences through your browser settings. Note that disabling functional or analytics cookies will not affect your ability to play on phlag, though some personalisation features may be limited. Disabling strictly necessary cookies will prevent Platform access.

9 Data Security Measures

phlag implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction:

• Encryption in Transit: All data transmitted between your device and phlag.cam is encrypted using 256-bit SSL/TLS protocols.
• Encryption at Rest: Sensitive personal data and financial records stored in phlag's databases are encrypted at rest using industry-standard encryption algorithms.
• Password Hashing: phlag account passwords are never stored in plain text. They are hashed using bcrypt with a high work factor before storage, meaning phlag staff cannot read your actual password.
• Access Controls: Access to personal data within phlag's systems is restricted to authorised personnel on a need-to-know basis. All staff with data access undergo mandatory data privacy training.
• Two-Factor Authentication: phlag offers optional two-factor authentication (2FA) for all player accounts. Players are strongly encouraged to enable 2FA via their account security settings.
• Penetration Testing: phlag's platform and infrastructure undergo regular third-party security audits and penetration testing to identify and remediate vulnerabilities.
• Incident Response: phlag maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, phlag will notify the National Privacy Commission within 72 hours and notify affected players without undue delay, as required under the Philippine Data Privacy Act.

10 Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phlag:

• Right to Be Informed: The right to know whether phlag holds personal data about you and to be informed about the purposes of processing. This Privacy Policy fulfils phlag's obligation to inform you.
• Right of Access: The right to request a copy of the personal data phlag holds about you, together with information about how it is being used.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected. You may update most contact and preference data directly through your phlag account settings.
• Right to Erasure: The right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected. This right is subject to phlag's overriding obligations to retain data under PAGCOR regulations and AML laws.
• Right to Data Portability: The right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
• Right to Object: The right to object to processing of your personal data for direct marketing purposes or on grounds relating to your particular situation where processing is based on legitimate interests.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe phlag has mishandled your personal data. NPC contact details are publicly available on the NPC website.

To exercise any of these rights, please contact phlag's Data Protection Officer using the details in Section 14. phlag will respond to all verified data subject requests within 15 business days. phlag may request proof of identity before processing your request to prevent unauthorised access to your data.

11 Protection of Minors

The phlag Platform is strictly intended for individuals who are 21 years of age or older. phlag does not knowingly collect personal data from persons under the age of 21. If phlag becomes aware that personal data has been collected from a person under 21 without verifiable parental or guardian consent, phlag will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that a minor has registered an account on phlag, please contact phlag support immediately via live chat or email at the address in Section 14.

12 Third-Party Links and Services

The phlag Platform may contain references to or integrations with third-party services — including game providers, payment processors, and identity verification providers. These third parties operate under their own privacy policies, which are separate from and independent of this phlag Privacy Policy.

phlag is not responsible for the privacy practices, data collection methods, or data security measures of third-party service providers. phlag contractually requires all third-party data processors to maintain appropriate data protection standards, but phlag does not control their internal policies beyond the scope of the data processing agreement.

Players who have questions about how a specific game provider or payment processor handles personal data should refer to that provider's own privacy documentation.

13 Changes to This Privacy Policy

phlag reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable Philippine law, NPC guidance, PAGCOR requirements, or phlag's data processing practices. The updated Policy will be posted at phlag.cam/privacy-policy with a revised effective date.

Where changes are material — for example, where phlag begins processing a new category of personal data or sharing data with a new category of recipients — phlag will notify registered players via the email address associated with their account at least 14 days before the amended Policy takes effect.

Your continued use of the phlag Platform after the effective date of any amended Privacy Policy constitutes your acknowledgement of the revised Policy. If you do not accept the revised Policy, you should cease using the Platform and may request account closure in accordance with the phlag Terms & Conditions.

14 Contact and Data Protection Officer

For any privacy-related queries, data subject requests, or concerns about phlag's handling of your personal data, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week through the phlag Platform. Select "Privacy / Data Request" as the query category.
• Email (Data Protection Officer): [email protected] — please include "Privacy Policy Request" in the subject line. (Plain text address — not a clickable link.)

phlag aims to acknowledge all privacy requests within 5 business days and to resolve them within 15 business days. For complex requests requiring extensive data retrieval, phlag may extend the response period by a further 15 business days, with notification to you of the extension.

If you are not satisfied with phlag's response to your privacy request or complaint, you have the right to escalate the matter to the National Privacy Commission of the Philippines.