phyaya Privacy Policy

1.1 phyaya takes the privacy and security of your personal data seriously. This Policy has been drafted to give you clear, honest information about what data phyaya collects, why it is collected, how long it is kept, who it may be shared with, and what rights you have as a data subject under Philippine law.

1.2 phyaya operates as an online gaming platform serving Filipino players across the Philippines, including those in Metro Manila, Cebu, Davao, Quezon City, Iloilo, Cagayan de Oro, and all other regions. Given the nature of online gaming — which involves real-money transactions, age verification, anti-money laundering compliance, and responsible gaming obligations — phyaya necessarily collects certain personal data as a condition of providing its services.

1.3 phyaya is committed to collecting only the minimum data necessary for stated purposes, keeping it secure, retaining it only for as long as required, and providing you with meaningful control over your information. This Policy reflects those commitments in full.

1.4 This Policy should be read alongside phyaya's Terms and Conditions, which govern the overall relationship between you and phyaya, and our Responsible Gaming Policy. In the event of any conflict between this Privacy Policy and phyaya's Terms and Conditions regarding data matters, this Privacy Policy shall take precedence.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information from which you can be directly or indirectly identified, including but not limited to your name, date of birth, Philippine mobile number, email address, government ID details, payment information, IP address, and device identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" — phyaya, as the entity that determines the purposes and means by which your personal data is processed.
• "Data Processor" — a third party that processes personal data on phyaya's behalf in accordance with phyaya's instructions and this Policy.
• "Data Subject" — you, the individual whose personal data is being processed by phyaya.
• "NPC" — the National Privacy Commission of the Philippines, the regulatory authority responsible for enforcing the Data Privacy Act of 2012.
• "KYC" — Know Your Customer verification processes, including identity document collection and verification required under applicable anti-money laundering and gaming regulations.
• "DPO" — phyaya's designated Data Protection Officer, responsible for overseeing compliance with this Policy and applicable data protection law.

3.1 phyaya collects personal data in the following categories, depending on how you interact with the platform:

3.2 phyaya does not collect sensitive personal data — such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, or health data — except where health-related information is voluntarily provided in the context of a responsible gaming self-exclusion or limit-setting request. Such information is used exclusively for the stated responsible gaming purpose and is not used for any other processing activity.

3.3 Where data collection is mandatory for regulatory compliance (such as KYC documentation required under applicable anti-money laundering regulations), failure to provide the required data will result in phyaya's inability to process withdrawal requests or, in certain circumstances, to maintain the Account.

4.1 phyaya uses the personal data it collects for the following purposes:

• Account creation and management — to register your Account, authenticate your identity at login, manage your account settings, and communicate essential account-related information;
• Service delivery — to enable your participation in casino games, sports betting, bingo, and all other phyaya gaming services;
• Payment processing — to facilitate deposits via GCash, Maya, and other Philippine payment channels, and to process withdrawal requests to your verified payment instruments;
• Identity verification and KYC compliance — to verify your identity, age (confirming the 21+ requirement), and the legitimacy of your payment instruments in compliance with anti-money laundering and gaming regulatory requirements;
• Fraud prevention and security — to detect, investigate, and prevent unauthorized access, fraudulent activity, bonus abuse, collusion, and money laundering on the phyaya platform;
• Responsible gaming — to monitor gaming patterns for indicators of problem gambling, enforce deposit limits and self-exclusion instructions, and communicate responsible gaming resources to players exhibiting at-risk behavior;
• Customer support — to respond to your inquiries, resolve disputes, and maintain records of support interactions;
• Legal and regulatory compliance — to fulfill phyaya's obligations under applicable Philippine laws, PAGCOR regulatory requirements, and any lawful request from competent authorities;
• Platform improvement — to analyze aggregated platform usage data to improve game selection, interface design, payment processing, and overall player experience;
• Marketing communications — to send promotional offers and platform updates where you have given consent or where phyaya has a legitimate interest and has not received an objection.

4.2 phyaya will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or establishing a separate lawful basis for the new processing activity.

5.1 phyaya processes your personal data on the following legal bases as recognized under the Data Privacy Act of 2012 and its implementing rules:

• Contractual necessity — processing required to enter into and perform the contract between you and phyaya (the Terms and Conditions you accepted at registration), including Account management, payment processing, and service delivery;
• Legal obligation — processing required to comply with applicable Philippine laws, including anti-money laundering legislation, PAGCOR regulatory requirements, and any lawful order from competent courts or government authorities;
• Legitimate interests — processing necessary for phyaya's legitimate interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement, provided such interests are not overridden by your fundamental rights and freedoms;
• Consent — processing for marketing communications, optional analytics participation, and any other processing activity not covered by the bases above. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6.1 phyaya does not sell, rent, or commercially trade your personal data. Data is shared with third parties only in the following limited circumstances:

• Payment service providers — GCash (operated by Globe Telecom), Maya (operated by Voyager Innovations), BPI, BDO, Metrobank, and other Philippine payment processors receive the minimum financial data necessary to process your deposit and withdrawal transactions;
• Game studio providers — Pragmatic Play, PG Soft, Evolution Gaming, JILI Gaming, and other certified game studios may receive your player identifier and game session data necessary to deliver and log game outcomes on their systems;
• Identity verification services — phyaya may use third-party KYC verification providers to verify identity documents and cross-reference against relevant databases for compliance purposes;
• IT and infrastructure providers — cloud hosting, database management, security monitoring, and content delivery network providers that support the technical operation of phyaya's platform, all bound by data processing agreements;
• Regulatory and law enforcement authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, law enforcement agencies, and courts where disclosure is required by applicable law or a lawful order;
• Professional advisers — lawyers, auditors, and accountants who require access to data in the course of providing professional services to phyaya, all bound by professional confidentiality obligations.

6.2 All third-party processors engaged by phyaya are subject to written data processing agreements that require them to process personal data only in accordance with phyaya's instructions and to implement appropriate technical and organizational security measures.

7.1 phyaya uses cookies and similar tracking technologies on phyaya.net for the following purposes:

• Essential cookies — required for the platform to function correctly. These include session authentication cookies that keep you logged in, security tokens, and cookies that remember your language and display preferences. Essential cookies cannot be disabled without impairing platform functionality;
• Analytics cookies — used to collect anonymized and aggregated information about how players use phyaya.net, including pages visited, session duration, and navigation paths. This data helps phyaya improve the platform experience;
• Functionality cookies — remember your preferences within phyaya, such as your preferred deposit method, game lobby filters, and notification settings, so you don't need to reconfigure them on every visit;
• Security cookies — support phyaya's fraud detection and security monitoring systems by tracking device fingerprinting and detecting anomalous access patterns.

7.2 phyaya does not use third-party advertising or tracking cookies that profile you for advertising purposes across other websites.

7.3 You can manage cookie preferences through your browser settings. Disabling essential cookies will impair your ability to log in and use the phyaya platform. Disabling analytics or functionality cookies will not prevent platform access but may reduce the quality of your experience.

8.1 phyaya retains personal data for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable law and regulatory obligations. Key retention periods include:

8.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that renders re-identification impossible. Anonymized, aggregated data may be retained indefinitely for statistical and analytical purposes.

8.3 Where you exercise your right to erasure (see Section 10), phyaya will assess the request against mandatory retention obligations. Data subject to legal retention requirements cannot be deleted during the mandatory retention period, but phyaya will restrict its use to compliance purposes only and will notify you accordingly.

9.1 phyaya implements the following technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction:

• 256-bit SSL/TLS encryption for all data transmitted between your device and phyaya's servers;
• AES-256 encryption for personal data stored in phyaya's databases;
• Strict access controls and role-based permissions ensuring only authorized personnel can access personal data, on a need-to-know basis;
• Multi-factor authentication requirements for all phyaya staff accessing internal systems containing personal data;
• Regular third-party security audits and penetration testing of phyaya's infrastructure;
• Automated fraud detection and anomaly monitoring systems that flag unusual account access or transaction patterns in real time;
• Incident response procedures ensuring that data breaches are identified, contained, and reported to the NPC and affected data subjects within the timeframes prescribed by the Data Privacy Act of 2012;
• Employee training and confidentiality obligations covering all staff who handle personal data.

9.2 Despite these measures, no internet-based system is entirely immune from security risk. phyaya cannot guarantee absolute security but will notify affected players and the NPC without undue delay in the event of a confirmed data breach that poses a significant risk to your rights and freedoms.

10.1 As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phyaya:

10.2 To exercise any of these rights, contact phyaya's Data Protection Officer via official live support chat or the email address specified in Section 15. phyaya will acknowledge your request within 3 business days and provide a substantive response within 15 business days. In complex cases, this period may be extended by a further 15 business days with notification to you.

10.3 phyaya will not charge a fee for processing rights requests in standard cases. Where requests are manifestly unfounded or excessive, phyaya reserves the right to apply a reasonable administrative fee or decline the request, with written explanation.

10.4 If you believe phyaya has not adequately addressed your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines at privacy.gov.ph.

11.1 phyaya employs KYC age verification processes to confirm that all registered players meet the 21-year minimum age requirement before full platform access and withdrawal capabilities are granted.

11.2 If phyaya becomes aware that personal data has been collected from a person under 21 years of age, the Account will be immediately suspended, all data associated with the underage Account will be deleted or returned as appropriate, and any balance will be refunded to the originating payment method. Appropriate notification will be provided.

11.3 If you are a parent or guardian and believe that a minor in your care has registered a phyaya Account, please contact phyaya support immediately via official live chat. phyaya will treat such reports as a priority and act without delay.

12.1 phyaya may send marketing communications — including promotional offers, bonus notifications, new game announcements, and platform updates — to registered players via SMS, email, and in-platform notifications, subject to the following conditions:

• Where you have given explicit consent to receive marketing communications at the time of registration or subsequently through Account settings;
• Where phyaya has a legitimate interest in communicating with existing players about services materially similar to those already used, and you have not opted out.

12.2 You can opt out of marketing communications at any time by updating your notification preferences in phyaya's Account settings. Opt-out requests take effect within 48 hours. Opting out of marketing communications does not affect phyaya's ability to send you essential transactional communications such as deposit confirmations, withdrawal notifications, and account security alerts.

12.3 phyaya will not use your personal data for profiling that produces legally significant decisions about you without human review and the opportunity for you to contest such decisions.

13.1 Some of phyaya's third-party service providers — particularly game studio partners and cloud infrastructure providers — may be located outside the Philippines. Where personal data is transferred to recipients in other countries, phyaya ensures appropriate safeguards are in place, including:

• Data processing agreements incorporating standard contractual clauses recognized under the Data Privacy Act of 2012;
• Transfers only to jurisdictions that the NPC has assessed as providing an adequate level of personal data protection;
• Specific technical measures such as pseudonymization or data minimization where the recipient only requires limited data to perform their service.

13.2 In all cases of cross-border transfer, phyaya retains accountability for ensuring that your personal data continues to be processed in accordance with this Privacy Policy regardless of where it is physically located.

14.1 phyaya may update this Privacy Policy from time to time to reflect changes in data processing practices, platform features, regulatory requirements, or legal developments. The current version and effective date are displayed at the top of this document.

14.2 Material changes — those that significantly affect your rights or how your data is used — will be communicated to registered players via email or SMS to your registered contact details at least seven (7) calendar days before taking effect. Minor clarifications may be published immediately without prior notice.

14.3 Continued use of phyaya following the effective date of a revised Privacy Policy constitutes your acknowledgment of the updated Policy. If you disagree with any changes, you may close your Account in accordance with phyaya's Terms and Conditions.

15.1 phyaya has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and the Data Privacy Act of 2012. The DPO is the appropriate point of contact for all data subject rights requests, privacy complaints, and data protection inquiries.

15.2 You may contact phyaya's DPO through the following channels:

15.3 If you are not satisfied with phyaya's response to your privacy concern, you have the right to submit a complaint to the National Privacy Commission of the Philippines (NPC). The NPC's contact information and complaint procedures are publicly available through official Philippine government channels.