phfream Privacy Policy

This Privacy Policy governs the collection, use, storage, sharing, and protection of personal data by phfream in connection with the phfream Platform — including the phfream website at phfream.net, any phfream mobile application, and all associated services (collectively, the "Platform"). By accessing or using the Platform, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.

phfream recognises that your personal information is important to you. We are committed to handling it responsibly, transparently, and in strict accordance with the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173, referred to herein as the "DPA"), its Implementing Rules and Regulations, and all relevant issuances from the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy should be read alongside phfream's Terms and Conditions, which govern your use of the Platform and are incorporated herein by reference. Any capitalised terms not defined in this Policy carry the same meaning assigned to them in the Terms and Conditions.

For the purposes of the Philippines' Data Privacy Act of 2012, phfream is the Personal Information Controller (PIC) in respect of all personal data collected from users of the Platform. phfream determines the purposes and means of processing your personal information.

phfream operates under a valid licence issued by the Philippine Amusement and Gaming Corporation (PAGCOR). All data processing activities conducted by phfream in connection with its licensed operations are subject to PAGCOR's data governance requirements in addition to the DPA.

Where phfream engages third-party service providers to process personal data on its behalf — for example, payment processors, identity verification providers, or analytics platforms — those parties act as Personal Information Processors (PIPs) under the DPA. phfream ensures all PIPs are bound by appropriate data processing agreements consistent with DPA requirements.

For all data-related enquiries, the phfream Data Protection Officer (DPO) can be contacted via: [email protected] — please use the subject line "Data Privacy Enquiry" to ensure prompt routing to the DPO team.

phfream collects personal data that is adequate, relevant, and limited to what is necessary for the purposes described in this Privacy Policy. The categories of personal data we collect include:

phfream does not intentionally collect sensitive personal information as defined under Section 3(l) of the DPA (such as health data, political opinions, or religious beliefs) unless directly relevant to a responsible gaming or regulatory compliance context, in which case explicit consent will be sought.

phfream collects personal data through the following channels:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, respond to a survey, participate in a promotion, or interact with any form or feature on the Platform.
• Automatically from your device: When you visit the phfream Platform, our servers and analytics tools automatically record technical and usage data including your IP address, device information, and browsing behaviour on the Platform. This occurs via cookies, web beacons, and server logs.
• From third-party identity verification providers: phfream uses licensed KYC and identity verification partners to cross-check the documents you submit during KYC. These providers may return verification status data and fraud risk scores to phfream.
• From payment processors: When you transact via GCash, PayMaya, BPI, BDO, or Metrobank, phfream receives transaction confirmation data from those processors, including your registered account name, transaction reference number, and transaction amount.
• From PAGCOR and regulatory authorities: In limited circumstances, phfream may receive information about Players from PAGCOR or other Philippine regulatory bodies, such as self-exclusion list data or regulatory investigation notices.

Under the Philippines' Data Privacy Act of 2012, phfream processes your personal data on the following legal bases:

• Contractual necessity: Processing is necessary for the performance of the contract between you and phfream — specifically, to create and manage your account, process deposits and withdrawals, verify your identity, and deliver gaming services.
• Legal obligation: phfream is required by PAGCOR regulations, the Anti-Money Laundering Act (AMLA), the Data Privacy Act, and other applicable Philippine law to collect and retain certain personal and transactional data.
• Legitimate interests: phfream processes certain data based on its legitimate interests as a regulated gaming operator, including fraud prevention, platform security, responsible gaming monitoring, and improvement of gaming services — where those interests are not overridden by your data rights.
• Consent: For optional processing activities such as marketing communications, phfream relies on your explicit consent, which you may withdraw at any time through your account settings or by contacting support.

phfream uses your personal data for the following specific purposes:

• Account management: Creating, maintaining, and administering your phfream account, including authentication, password resets, and account settings changes.
• Identity verification (KYC): Verifying that you are who you say you are, that you meet the 21+ age requirement, and that your payment methods belong to you — as required by PAGCOR and AMLA.
• Payment processing: Processing GCash, PayMaya, BPI, BDO, and Metrobank deposits and withdrawals in Philippine Peso (PHP), including fraud and error checks.
• Gaming services delivery: Enabling you to play slots, live casino games, bingo, fishing games, and other phfream products, and maintaining accurate game and betting records.
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behaviour and applying responsible gaming tools, deposit limits, or self-exclusion measures as required or requested.
• Fraud prevention and security: Detecting, investigating, and preventing fraud, cheating, money laundering, multi-accounting, and other prohibited conduct on the Platform.
• Regulatory compliance: Fulfilling phfream's reporting, record-keeping, and audit obligations under PAGCOR regulations, the AMLA, and other applicable Philippine law.
• Customer support: Responding to your enquiries, resolving disputes, and improving the quality of support services through record-keeping of interactions.
• Platform improvement: Analysing usage patterns and technical data to improve the Platform's performance, stability, user experience, and game offering.
• Marketing (with consent): Sending you promotional offers, bonus notifications, and product updates via email, SMS, or push notification — only where you have opted in and for as long as you maintain that consent.

phfream does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share your personal data only in the following circumstances and only to the extent necessary:

• Payment processors: GCash (G-Xchange, Inc.), PayMaya (Maya Philippines, Inc.), BPI, BDO, and Metrobank receive the transaction data necessary to process your deposits and withdrawals. These institutions operate under their own DPA-compliant privacy policies and BSP regulatory oversight.
• KYC and identity verification providers: Licensed third-party partners receive copies of your submitted identity documents and biometric data for the purpose of verification. These providers are bound by DPA-compliant data processing agreements with phfream.
• Game providers: Your gaming session data (Player ID, wager amount, game outcomes) is shared with the certified third-party game providers whose games you play, for the purpose of resolving disputes and maintaining audit trails.
• PAGCOR: phfream is obligated to share Player data, gaming records, and financial transaction data with PAGCOR upon lawful request, as a condition of its operating licence.
• Anti-Money Laundering Council (AMLC): phfream files Suspicious Transaction Reports (STRs) and Covered Transaction Reports (CTRs) with the AMLC as required by Republic Act 9160 (AMLA) and its amendments. These reports include Player identity and transaction data.
• Law enforcement and courts: phfream will disclose personal data to Philippine law enforcement agencies, courts, or other competent authorities where required by a valid court order, subpoena, or legal obligation.
• IT and infrastructure providers: Cloud hosting, cybersecurity, and IT support providers may have limited access to Platform data as part of their service delivery. All such providers are bound by DPA-compliant data processing agreements and do not access personal data beyond what is necessary for their technical function.
• Group companies: In the event phfream operates as part of a corporate group, limited data sharing within the group may occur for consolidated reporting or fraud prevention purposes, subject to equivalent data protection standards.

phfream uses cookies and similar tracking technologies to operate the Platform, maintain your session, remember your preferences, analyse usage, and — with your consent — personalise marketing content. A cookie is a small text file placed on your device by the phfream Platform when you visit.

phfream uses the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in securely and cookies that remember your language preferences. These cannot be disabled without breaking Platform functionality.
• Functional cookies: Remember your account preferences such as display settings, responsible gaming tool configurations, and notification preferences. These improve your experience but are not essential to core functionality.
• Analytics cookies: Allow phfream to understand how Players use the Platform — which games are most popular, where users drop off in the registration flow, and how long sessions last. This data is aggregated and anonymised where possible.
• Marketing cookies (consent required): Used to track whether promotional communications have been opened or acted upon, and to personalise offers shown to you within the Platform. These are only activated with your explicit consent.

You can manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the phfream Platform, including the ability to log in and access your account. Disabling analytics or marketing cookies will not affect your ability to play or transact.

phfream retains your personal data for no longer than is necessary for the purpose for which it was collected, subject to legal and regulatory minimum retention obligations. The following retention periods apply:

• Account and KYC data: Retained for the duration of your account and for a minimum of 5 years after account closure, in compliance with AMLA record-keeping requirements and PAGCOR audit obligations.
• Transaction data: All deposit, withdrawal, and gaming transaction records are retained for a minimum of 5 years from the date of transaction, as required under the AMLA and PAGCOR regulations.
• Support and communications data: Live chat transcripts, support emails, and complaint records are retained for 3 years from the date of the interaction, for quality assurance and dispute resolution purposes.
• Marketing preferences and consent records: Retained for the duration of your account and for 3 years after account closure, as evidence of consent management.
• Technical and usage data (logs): Server and access logs are retained for up to 12 months in active storage and up to 3 years in archive, for security investigation purposes.
• Self-exclusion records: Retained indefinitely to prevent circumvention of self-exclusion through re-registration, consistent with responsible gaming best practice and PAGCOR guidance.

When the applicable retention period expires, phfream securely destroys or anonymises the relevant personal data such that it can no longer be linked back to an identifiable individual.

phfream implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and phfream's servers.
• Encryption at rest for sensitive personal data including KYC documents, government ID copies, and financial account references stored in phfream's databases.
• Role-based access controls ensuring that phfream staff can only access personal data to the extent necessary for their specific job function.
• Multi-factor authentication for phfream staff accessing internal systems that store or process Player data.
• Regular penetration testing and security audits conducted by qualified cybersecurity professionals to identify and remediate vulnerabilities.
• Intrusion detection and monitoring systems that continuously monitor Platform traffic for unusual access patterns or potential breaches.
• Staff training on data privacy obligations under the DPA and phfream's internal data handling policies.

In the event of a personal data breach that is likely to result in harm to affected individuals, phfream will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected Players within a reasonable timeframe, in accordance with the DPA's breach notification requirements.

Under the Philippines' Data Privacy Act of 2012, you have the following rights in respect of your personal data held by phfream. These rights may be exercised by contacting phfream's Data Protection Officer at [email protected] with the subject line "Data Rights Request".

phfream will respond to all data rights requests within 30 days of receipt. Where a request is complex or involves a large volume of data, phfream may extend this period by a further 30 days with prior notice. phfream will not charge a fee for reasonable data rights requests.

Please note that certain rights are subject to limitations where phfream has a legal obligation to retain data (for example, AMLA record-keeping requirements) or where honouring the request would compromise an ongoing fraud investigation or regulatory compliance obligation.

The phfream Platform is strictly for individuals aged 21 years and above, as required by PAGCOR regulations governing online gaming in the Philippines. phfream does not knowingly collect personal data from individuals under the age of 21.

Age verification is a mandatory step in the phfream KYC process. Any account found to have been registered by a person under 21 years of age will be immediately closed, and any personal data associated with that account will be deleted except to the extent retention is required for regulatory compliance or fraud investigation purposes.

phfream's primary data processing infrastructure is located in the Philippines. However, certain third-party service providers engaged by phfream — such as cloud hosting providers, cybersecurity vendors, or game certification laboratories — may process data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, phfream ensures that such transfers comply with Section 21 of the Data Privacy Act and the NPC's rules on cross-border data transfers. Specifically, phfream implements the following safeguards:

• Data processing agreements requiring the recipient to maintain data protection standards equivalent to those required under the DPA.
• Standard contractual clauses approved or recognised by the NPC for cross-border data transfers.
• Transfers are made only to jurisdictions or specific recipients that phfream has assessed as providing an adequate level of data protection.

Upon request, phfream will provide further information about the specific safeguards in place for any cross-border data transfers affecting your personal information.

phfream may, with your prior explicit consent, send you promotional communications about bonuses, new games, special offers, and Platform updates. Marketing communications may be delivered via email, SMS, or in-Platform push notifications.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your notification preferences in your phfream account settings.
• Clicking the "Unsubscribe" link included in any phfream marketing email.
• Contacting phfream support via live chat and requesting removal from marketing lists.

Withdrawal of marketing consent will be processed within 5 business days. Please note that even after opting out of marketing communications, phfream may still send you transactional and account-related communications such as deposit confirmations, withdrawal notifications, KYC requests, and account security alerts. These communications are necessary for the operation of your account and cannot be opted out of while your account remains active.

phfream reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, PAGCOR regulatory requirements, phfream's data processing practices, or the services offered on the Platform. The most current version of this Privacy Policy will always be accessible at phfream.net/privacy-policy.

Where changes are material — meaning they significantly affect how phfream processes your personal data or reduce your rights — phfream will provide advance notice of at least 30 days before the changes take effect. This notice will be provided via a prominent in-Platform notification and, where practicable, via email to your registered address.

Your continued use of the phfream Platform after the effective date of any amended Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any changes, you should close your phfream account prior to the effective date of the amended Policy.

For non-material changes — such as typographical corrections, clarifications that do not alter the substance of the Policy, or updates to contact details — phfream may update the Policy without advance notice, with the effective date updated accordingly at the top of the document.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way phfream handles your personal data, please contact the phfream Data Protection Officer:

• Email: [email protected] (subject line: "Data Privacy Enquiry")
• Response time: Within 5 business days for general enquiries; within 30 days for formal data rights requests
• Applicable law: Philippines' Data Privacy Act of 2012 (RA 10173) and NPC Implementing Rules and Regulations

If you are not satisfied with phfream's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines:

• National Privacy Commission (NPC) — the independent Philippine government authority responsible for administering and implementing the Data Privacy Act of 2012.
• You may file a complaint with the NPC through its official online complaint mechanism. phfream encourages you to contact phfream directly first so that we have the opportunity to resolve your concern before escalation.