866ph Privacy Policy

This Privacy Policy ("Policy") is issued by 866ph ("we," "us," "our," or the "Company"), the operator of the online gaming platform available at 866ph.vip (the "Platform"). 866ph acts as the data controller in respect of personal data collected from users ("you," "your," or "data subject") of the Platform.

This Policy describes how 866ph collects, uses, stores, shares, and protects personal data in connection with your use of the Platform, and explains the rights available to you as a data subject under the Data Privacy Act of 2012 (Republic Act No. 10173, or "DPA") and its Implementing Rules and Regulations issued by the National Privacy Commission of the Philippines (the "NPC").

By registering for an account or using any 866ph service, you acknowledge that you have read and understood this Policy. This Policy should be read in conjunction with the Terms and Conditions and the Responsible Gaming Policy, both of which are incorporated by reference.

866ph collects personal data across several categories depending on how you interact with the Platform. The following table sets out the categories of personal data collected and the context in which each category arises:

866ph does not intentionally collect sensitive personal information as defined under the DPA (such as racial or ethnic origin, religious beliefs, health data, or biometric data used for identification) beyond what is strictly necessary for KYC compliance as required by PAGCOR and applicable AML regulations.

866ph collects your personal data through the following channels:

Under the Data Privacy Act of 2012, 866ph is required to have a lawful basis for each category of personal data processing. The legal bases on which 866ph relies are as follows:

• Contractual Necessity: Processing required to fulfil the agreement between you and 866ph as set out in the Terms and Conditions — including account management, payment processing, game delivery, and customer support.
• Legal Obligation: Processing required to comply with applicable Philippine law and regulatory requirements, including PAGCOR obligations, Anti-Money Laundering Act (AMLA) requirements, and NPC data protection obligations.
• Legitimate Interests: Processing for 866ph's legitimate business interests where those interests are not overridden by your rights — including fraud prevention, platform security, and responsible gaming monitoring.
• Consent: For non-essential marketing communications and optional platform features where consent is the appropriate legal basis. You may withdraw consent at any time without affecting the lawfulness of processing based on other grounds.

866ph uses the personal data it collects for the following specific purposes:

866ph does not sell your personal data to any third party. We share personal data only in the limited circumstances described below, and only to the extent necessary for each specific purpose:

• Gaming Technology Providers: Third-party game suppliers (including but not limited to Evolution Gaming, JILI, Pragmatic Play, and PG Soft) receive the minimum necessary data to deliver their games to your account. These providers are bound by contractual data processing obligations consistent with this Policy.
• Payment Processors: GCash, Maya, GrabPay, and Philippine banking partners receive the data necessary to process deposits and withdrawals to and from your account. These entities operate under their own regulatory requirements and privacy policies.
• Identity Verification Providers: Third-party KYC service providers receive the identity documents and biometric data necessary to verify your identity in accordance with PAGCOR and AMLA requirements. These providers are accredited and subject to data processing agreements with 866ph.
• Regulatory and Law Enforcement Authorities: 866ph will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, or law enforcement agencies where required by applicable Philippine law, court order, or legitimate regulatory investigation.
• Professional Advisers: Lawyers, auditors, and compliance consultants engaged by 866ph may have access to personal data on a confidential basis where necessary for professional advice.

866ph retains personal data for the periods set out below, calculated from the later of account closure or the last relevant activity. These periods reflect the minimum retention obligations imposed by PAGCOR, the AMLC, and the NPC, as well as operational requirements:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised using industry-standard methods such that the data can no longer be associated with any identifiable individual.

866ph implements a layered information security programme designed to protect your personal data against unauthorised access, disclosure, alteration, destruction, or accidental loss. The technical and organisational measures in place include:

• Transport Encryption: All data transmitted between your device and 866ph's platform infrastructure is encrypted using TLS 1.2 or higher (128-bit SSL). The padlock in your browser's address bar confirms this encryption is active.
• Password Hashing: Account passwords are stored exclusively as salted cryptographic hashes (bcrypt). 866ph staff cannot view your password in any form, which is why lost passwords must be reset rather than retrieved.
• Access Controls: Access to personal data within 866ph's systems is restricted to staff who require it for their specific job function. Access is governed by role-based permissions and logged for audit purposes.
• Two-Factor Authentication: 866ph offers optional two-factor authentication (2FA) for member accounts. Members are encouraged to enable 2FA to add a second layer of security to their login process.
• Fraud Detection Systems: Automated systems monitor transaction patterns and login activity for indicators of fraudulent or suspicious behaviour, triggering alerts and manual review where necessary.
• Data Breach Response: 866ph maintains a documented data breach response procedure. In the event of a personal data breach that poses risk to data subjects, 866ph will notify the NPC within seventy-two (72) hours of becoming aware of the breach, and will notify affected data subjects without undue delay as required by the DPA.

While 866ph implements robust security measures, no digital system is completely impenetrable. You are responsible for maintaining the security of your own 866ph account credentials and for ensuring that you access the Platform through a secure, trusted device and connection.

The 866ph Platform uses cookies and similar tracking technologies to operate the Platform, improve your experience, and fulfil security and analytics functions. A cookie is a small text file stored on your device by your browser when you visit the Platform.

Under the Data Privacy Act of 2012, you hold the following rights in respect of your personal data held by 866ph. These rights may be exercised by contacting our Data Protection Officer (DPO) at the details in Section 14 of this Policy:

866ph services are strictly intended for adults aged 21 years and older in accordance with PAGCOR regulations and Philippine law. 866ph does not knowingly collect personal data from persons under 21 years of age. Age is collected at registration through date of birth entry and is verified during the KYC process through government-issued identification.

In the event that 866ph discovers or has reasonable cause to believe that personal data of a person under 21 years of age has been collected — whether as a result of misrepresentation at registration or any other reason — 866ph will immediately suspend the relevant account, delete all associated personal data to the extent not required to be retained for legal compliance purposes, and report the matter to the relevant authorities as required by applicable law.

Some of 866ph's third-party service providers — particularly gaming technology providers and cloud infrastructure partners — may be located outside the Philippines. Where personal data is transferred to a country outside the Philippines, 866ph ensures that appropriate safeguards are in place to protect your personal data to a standard consistent with the DPA. These safeguards include:

• Data processing agreements incorporating the NPC's standard contractual clauses or equivalent protections
• Transfers only to recipients in countries or organisations that the NPC has recognised as providing adequate data protection
• Binding corporate rules or contractual mechanisms where the above standards are not otherwise satisfied

866ph will not transfer your personal data internationally unless at least one of the above safeguards is in place. If you require further information about the specific safeguards applicable to a particular international transfer, please contact our DPO using the details in Section 14.

866ph reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, NPC guidance, PAGCOR regulatory requirements, or our data processing practices. All updates will be published on this page with a revised "Effective Date" at the top of the Policy.

Where a change is material — meaning it significantly affects how we process your personal data or the rights available to you — 866ph will provide advance notice of at least fourteen (14) days via notification on the Platform and/or SMS to your registered mobile number before the change takes effect. For non-material updates (such as clarifications of existing practices or administrative corrections), changes may take effect upon publication without prior notice.

Your continued use of the 866ph Platform after the effective date of any updated Policy constitutes your acknowledgement of the updated terms. If you do not agree with the updated Policy, you should discontinue use of the Platform and may request account closure in accordance with the Terms and Conditions.

866ph has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and with the Data Privacy Act of 2012. If you wish to exercise any of your data subject rights, have a question about how your personal data is processed, or wish to raise a privacy concern, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week at 866ph.vip — our fastest channel for urgent privacy matters
• Email (DPO): [email protected] — for formal data subject rights requests and privacy enquiries
• General Support: [email protected] — for general account queries that may involve personal data

All formal privacy requests submitted to the DPO should include your full name as registered with 866ph, your registered mobile number, and a clear description of the request or concern. Where requests concern sensitive matters (such as erasure or access to gaming history), 866ph may require additional identity verification before processing the request.

If you are dissatisfied with 866ph's response to your privacy concern, you have the right to file a complaint with the National Privacy Commission of the Philippines (NPC) at npc.gov.ph. This right exists independently of any rights you have under these Terms or our dispute resolution process.

This Privacy Policy was last reviewed and updated by the 866ph Data Protection Officer on 1 January 2026. The current version supersedes all prior versions of this Policy.