🔐 phlagu Privacy Policy

1Introduction & Scope

This Privacy Policy ("Policy") is published by phlagu ("we," "us," "our," "phlagu"), the operator of the online gaming platform accessible at phlagu.app. This Policy applies to all personal information collected from individuals ("you," "Player," "User") who register for, access, or use any phlagu service, including the website, mobile-optimized platform, live chat support, and all associated phlagu features.

phlagu acts as a Personal Information Controller under the Philippine Data Privacy Act. We are responsible for determining the purposes and means of processing personal data collected through our Platform. By registering a phlagu account or otherwise using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal information as described herein.

This Policy should be read in conjunction with phlagu's Terms & Conditions. In the event of conflict between this Policy and the Terms, this Policy governs matters relating to personal data processing.

2Personal Data We Collect

phlagu collects personal data necessary to provide, secure, and improve our gaming services. The categories of data we collect include:

phlagu does not collect sensitive personal information beyond what is required for legal identity verification. Specifically, phlagu does not collect racial or ethnic origin, religious beliefs, health data, or sexual orientation.

3How phlagu Uses Your Personal Data

phlagu processes your personal data strictly for the following defined purposes:

• Account Management: Creating, maintaining, and securing your phlagu account, including authentication and access control.
• Identity Verification (KYC): Verifying your identity and age (21+ requirement) as required by PAGCOR regulations and anti-money laundering laws applicable in the Philippines.
• Payment Processing: Facilitating deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and 7-Eleven; detecting and preventing payment fraud.
• Platform Operation: Delivering game content, calculating game outcomes, crediting winnings, and applying bonus rewards to your phlagu account.
• Legal Compliance: Meeting obligations under Philippine law, including the Anti-Money Laundering Act (AMLA), Data Privacy Act, and PAGCOR regulatory requirements.
• Customer Support: Responding to inquiries, resolving disputes, and processing complaints submitted via live chat or email.
• Security & Fraud Prevention: Monitoring account activity for suspicious behavior, detecting multi-accounting, and protecting phlagu and its players from fraud.
• Responsible Gaming: Monitoring player activity patterns to identify problem gambling indicators and applying self-exclusion or deposit limit restrictions where requested or required.
• Service Improvement: Analyzing aggregated usage data to improve phlagu's game offerings, platform performance, and user experience — without identifying individual players.
• Marketing Communications: Sending promotional emails, bonus notifications, and platform updates to Players who have opted in to receive such communications. You may opt out at any time.

4Legal Basis for Processing

phlagu processes personal data only where a valid legal basis exists under the Philippine Data Privacy Act. The legal bases applicable to phlagu's processing activities are:

• Contractual Necessity: Processing required to perform the phlagu account agreement with you, including game delivery, payment processing, and account management.
• Legal Obligation: Processing required to comply with Philippine laws, including KYC/AML obligations, PAGCOR licensing conditions, and tax reporting requirements.
• Legitimate Interest: Processing for fraud prevention, security monitoring, and platform improvement where such interests do not override your fundamental privacy rights.
• Consent: Processing for marketing communications and non-essential cookies, where your explicit opt-in consent has been obtained. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5Data Sharing & Disclosure

phlagu does not sell, rent, or trade your personal information to third parties for commercial purposes. Personal data may be disclosed to the following categories of recipients only where necessary:

• Payment Service Providers: GCash (Mynt/Globe), PayMaya (Voyager), BPI, BDO, Metrobank, and other payment partners receive the minimum data necessary to process transactions.
• Identity Verification Partners: Third-party KYC service providers used to verify government-issued Philippine IDs. These providers are contractually bound to process data solely for verification purposes.
• Game Content Providers: Where required to resolve disputes over game outcomes, technical logs may be shared with game software providers under strict data processing agreements.
• Regulatory Authorities: The Philippine Amusement and Gaming Corporation (PAGCOR), the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine authorities where disclosure is required by law or court order.
• Professional Advisors: Legal counsel, auditors, and accountants, subject to professional confidentiality obligations.

All third-party data processors engaged by phlagu are required to maintain data security standards equivalent to or exceeding those applied by phlagu itself, and to process personal data only for the specific purposes defined in their data processing agreements.

6Cookies & Tracking Technologies

phlagu uses cookies and similar tracking technologies to operate the Platform efficiently and improve user experience. The types of cookies used by phlagu include:

• Strictly Necessary Cookies: Required for platform login, session management, and security functions. These cannot be disabled without affecting core Platform functionality.
• Functional Cookies: Remember your preferences such as language settings and game lobby layout between sessions.
• Analytics Cookies: Collect anonymized data on how players navigate phlagu to help improve the platform. No individual player is identified in analytics reporting.
• Marketing Cookies: Used with your consent to deliver relevant phlagu promotional content. You may withdraw consent via your browser cookie settings at any time.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies may prevent you from accessing certain phlagu features, including the login function.

7Data Retention

phlagu retains personal data for as long as necessary to fulfill the purposes for which it was collected, subject to the following retention standards:

• Active Accounts: All account data is retained for the duration of the active account relationship with phlagu.
• Closed Accounts: Following account closure, phlagu retains personal data for a minimum of five (5) years to comply with PAGCOR audit requirements, Philippine AML obligations, and applicable tax laws.
• Transaction Records: Financial transaction logs are retained for a minimum of five (5) years from the date of the transaction.
• Support Communications: Customer support records are retained for three (3) years from the date of the last interaction.
• Marketing Data: Consent records and marketing communication logs are retained for three (3) years from the date of last consent or opt-out.

Upon expiry of the applicable retention period, personal data is securely destroyed or anonymized so that it can no longer be linked to an identifiable individual.

8Data Security

phlagu implements comprehensive technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Our security framework includes:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phlagu Platform.
• Encryption at rest for sensitive data including payment details and government ID information stored in phlagu systems.
• Role-based access controls ensuring that only authorized phlagu personnel with a legitimate need can access personal data.
• Multi-factor authentication for internal phlagu systems containing personal data.
• Regular security audits, penetration testing, and vulnerability assessments of the phlagu Platform infrastructure.
• Incident response procedures to detect, contain, and notify affected Players of any personal data breaches within the timeframes required by the National Privacy Commission.

While phlagu applies industry-standard security practices, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your phlagu login credentials and for notifying us immediately if you suspect unauthorized access to your account.

9Your Rights as a Data Subject

Under the Philippine Data Privacy Act, you have the following rights with respect to your personal data held by phlagu:

• Right to Be Informed: The right to know what personal data phlagu collects and how it is processed — which this Privacy Policy fulfills.
• Right of Access: The right to request a copy of the personal data phlagu holds about you, including how it is being used.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected. You may update basic account information directly through phlagu Account Settings; other corrections may be requested via support.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes collected, subject to phlagu's legal retention obligations.
• Right to Object: The right to object to processing based on legitimate interest, including the right to opt out of direct marketing communications at any time.
• Right to Data Portability: The right to receive a copy of your personal data in a commonly used, machine-readable format.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe phlagu has violated your data privacy rights.

To exercise any of the above rights, contact phlagu's Data Protection Officer using the contact details in Section 13. phlagu will respond to all data subject requests within thirty (30) days of receipt, or as otherwise required by law.

10Minors & Age Restriction

phlagu's services are strictly intended for individuals who are 21 years of age or older as required by PAGCOR regulations. phlagu does not knowingly collect personal data from individuals under the age of 21. Where phlagu discovers that personal data has been collected from a person under 21, the associated account will be immediately closed, all data will be deleted, and any deposited funds will be returned through the original payment method after verification.

If you are a parent or guardian and believe your child has registered a phlagu account, please contact us immediately using the details in Section 13. phlagu takes underage gambling prevention seriously and will act promptly on all such notifications.

11Third-Party Links & Services

The phlagu Platform may contain links to third-party websites or integrate third-party services (such as payment processors) that operate under their own privacy policies. phlagu is not responsible for the privacy practices of third-party services. When you leave the phlagu Platform to interact with a third-party service — such as your GCash or BDO online banking portal — their privacy policy, not this Policy, governs the handling of your data on their platform.

phlagu recommends reviewing the privacy policies of any third-party services you use in connection with your phlagu account.

12Changes to This Privacy Policy

phlagu reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or service offerings. Material changes will be communicated to registered phlagu Players via email to their registered address and/or through a prominent notice displayed on the Platform prior to the change taking effect.

The "Last Updated" date at the top of this Policy reflects the most recent revision. We encourage you to review this Policy periodically. Your continued use of phlagu following any update constitutes acceptance of the revised Policy. If you do not accept the updated terms, you must cease using phlagu and may request account closure.

13Contact & Data Protection Officer

phlagu has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Philippine Data Privacy Act and this Privacy Policy. For all data privacy inquiries, requests to exercise your data subject rights, or complaints regarding phlagu's data processing practices, please contact:

• Data Protection Officer, phlagu
• Email: support@phlagu.app (Subject line: "Data Privacy Request") — plain text only, not a clickable link
• Live Chat: Available 24/7 via the phlagu Platform
• Response Time: Within 30 days for formal data subject requests; 2–4 hours for general support queries

For escalation beyond phlagu's internal process, data subjects in the Philippines may file a complaint with the National Privacy Commission (NPC) through its official channels.