65ph Privacy Policy

Definitions

In this Privacy Policy, the following terms carry the meanings set out below unless the context indicates otherwise:

Data Controller Identity

65ph is the Data Controller responsible for the personal data processed through the Platform. As Data Controller, 65ph determines the purposes for which your personal data is collected and the means by which it is processed, stored, and protected.

65ph operates within the regulatory framework of the Philippines Amusement and Gaming Corporation (PAGCOR) and is registered with the National Privacy Commission as required under the Data Privacy Act of 2012. Formal data privacy inquiries and requests from Data Subjects may be directed to the 65ph Data Protection Officer (DPO), the contact details for whom are provided in Section 15 of this Policy.

Personal Data We Collect

65ph collects personal data in the following categories, depending on how you interact with the Platform:

65ph does not collect sensitive personal information beyond what is necessary for legally required identity verification. Specifically, 65ph does not collect medical records, biometric data beyond facial recognition used for KYC liveness checks, or information on political or religious affiliations.

How We Collect Your Data

65ph collects personal data through the following methods:

• Direct submission by the Data Subject: Information you provide during account registration, KYC document upload, payment method linking, form submissions, or support interactions.
• Automated collection via Platform technology: Technical and device data collected automatically through server logs, browser cookies, and session tracking when you access or interact with the Platform. See Section 6 for details on cookies.
• Third-party payment providers: Transaction confirmation data shared by GCash, Maya, BPI, BDO, and Metrobank when you initiate a deposit or withdrawal, used solely for transaction reconciliation and fraud prevention.
• Identity verification partners: KYC processing partners transmit identity verification results (approved or rejected) and document authenticity scores to 65ph. Raw document images may be processed by the KYC partner under a separate data processing agreement.
• Game providers: Certified game suppliers provide game session result data and RNG audit logs to 65ph for game integrity verification, dispute resolution, and regulatory reporting purposes.

Legal Basis & Purpose of Processing

65ph processes personal data only where there is a lawful basis to do so under the Data Privacy Act of 2012. The following table maps each processing purpose to its applicable legal basis:

Cookies & Tracking Technologies

The 65ph Platform uses cookies and similar tracking technologies to maintain session state, detect fraud, and improve the user experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during a play session. These cannot be disabled without impairing Platform functionality.
• Security Cookies: Used for fraud detection and prevention, including identifying anomalous login patterns, device fingerprinting for account protection, and CSRF protection tokens. These are set automatically and cannot be disabled.
• Functional Cookies: Used to remember your preferences such as language settings, display options, and responsible gaming alert thresholds. These may be cleared by deleting your browser cookies, which will reset your preferences to default.
• Analytics Cookies: Used to understand how Filipino players interact with the Platform — which features are most used, which pages have high exit rates, and where technical issues occur. Analytics data is processed in aggregated form and does not identify individual players in reports.

You may manage cookie preferences through your browser settings. Clearing cookies will log you out of your current session. 65ph does not use third-party advertising cookies or share cookie data with advertising networks.

Data Sharing & Third-Party Disclosure

65ph does not sell your personal data to third parties. Personal data is shared only in the following circumstances and only to the extent necessary for the stated purpose:

1. PAGCOR and Philippine Regulatory Authorities: 65ph is required by law to share player data, transaction records, and game audit logs with PAGCOR on request, and with other Philippine government agencies (including the Anti-Money Laundering Council) where legally required.
2. KYC and Identity Verification Partners: Document images and identity data submitted during KYC are processed by a certified identity verification provider operating under a data processing agreement with 65ph. The provider processes data solely for verification purposes and is prohibited from using it for any independent purpose.
3. Payment Processors: Transaction data is shared with GCash, Maya, BPI, BDO, and Metrobank for the purpose of processing deposits and withdrawals. These institutions are independent data controllers under Philippine financial regulations and their own privacy policies apply to their processing.
4. Licensed Game Providers: Basic account identifiers (not full personal details) are shared with game providers to initialise game sessions and for game audit trail purposes. Game providers are contractually prohibited from using this data beyond technical game operation.
5. Fraud Prevention Services: Device and behavioural data may be shared with fraud prevention platforms to identify and block abusive account patterns, bonus abuse, and automated bot activity.
6. Legal and Law Enforcement: Where required by a valid court order, subpoena, or legal process, 65ph may disclose personal data to law enforcement or judicial authorities. 65ph will endeavour to notify the affected player where legally permissible to do so.

Data Retention

65ph retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual. Anonymised, aggregated data may be retained for statistical and analytical purposes without limitation.

Data Security Measures

65ph implements technical and organisational security measures appropriate to the nature of the personal data processed and the risks involved. These measures include:

• Encryption in transit: All data transmitted between your device and 65ph is encrypted using 256-bit TLS/SSL — the same standard used by Philippine banks such as BPI and BDO for online banking. This applies to all pages, login requests, and API communications.
• Encryption at rest: Sensitive data fields including government ID numbers, payment account details, and KYC document images are encrypted at rest using industry-standard AES-256 encryption in 65ph's database infrastructure.
• Access controls: Access to personal data by 65ph staff is granted on a strict need-to-know basis. All internal access to player data is logged, and privileged access is subject to multi-factor authentication requirements.
• Password security: Player passwords are never stored in plaintext. 65ph uses a bcrypt-based hashing algorithm with a sufficiently high cost factor to render brute-force attacks computationally infeasible.
• Intrusion detection and monitoring: 65ph's infrastructure is monitored around the clock for anomalous access patterns, security events, and potential data breaches. Automated alerts trigger immediate review by the security team.
• Data breach notification: In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, 65ph will notify the NPC within 72 hours of becoming aware of the breach, as required by NPC Circular 16-03. Affected players will be notified without undue delay where the breach is likely to result in a high risk to their rights.

Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 65ph. These rights may be exercised by contacting the 65ph Data Protection Officer (see Section 15):

Children's Privacy — 21+ Platform

If 65ph discovers that personal data has been collected from an individual below the age of 21, the Account will be immediately suspended, all deposits will be returned through the original payment channel, and all personal data associated with the Account will be securely deleted as promptly as technically practicable, subject to any mandatory regulatory retention obligations.

Parents or guardians who believe that a minor in their household has registered on 65ph are encouraged to contact the DPO immediately via the details in Section 15 so that the matter can be investigated and resolved without delay.

Cross-Border Data Transfers

Some of 65ph's technology infrastructure, including game server hosting and certain third-party services, may involve the storage or processing of personal data outside the Philippines. Where cross-border transfers of personal data occur, 65ph ensures that adequate safeguards are in place in compliance with the Data Privacy Act of 2012 and NPC Circular 16-01 on Cross-Border Data Transfers.

Safeguards applied to cross-border transfers include:

• Data processing agreements incorporating NPC-approved standard contractual clauses with all foreign data processors;
• Transfer only to jurisdictions or processors that maintain data protection standards materially equivalent to those required under Philippine law;
• Encryption of data in transit across all international data transfers;
• Limiting cross-border transfers to the minimum personal data necessary for the processing purpose.

A list of countries to which personal data may be transferred and the applicable safeguards may be requested from the 65ph Data Protection Officer.

Marketing Communications

65ph may send you promotional communications by SMS or email — including information about new games, deposit bonuses, seasonal promotions, and platform updates — where you have given your consent at registration or subsequently opted in through your account settings.

Marketing consent at 65ph works as follows:

• Consent is obtained separately for SMS and email marketing channels at the time of registration via explicit opt-in checkboxes. Neither channel is pre-selected.
• You may withdraw consent for marketing communications at any time by updating your Communication Preferences in your account settings, or by replying STOP to any marketing SMS from 65ph.
• Withdrawal of marketing consent does not affect other communications 65ph is obligated to send you, such as transaction confirmations, security alerts, KYC status notifications, and account closure notices — these are service communications, not marketing.
• 65ph does not share your contact details with third parties for their independent marketing purposes.

Updates to This Privacy Policy

65ph may update this Privacy Policy from time to time to reflect changes in applicable Philippine law, NPC regulations, PAGCOR requirements, or changes to the Platform's data processing activities. The effective date at the top of this Policy indicates when the current version took effect.

When material changes are made to this Policy — particularly changes that affect how your data is used or shared — 65ph will provide notice to registered players by displaying a prominent notice on the Platform and, where appropriate, by sending a notification to your registered mobile number or email address.

Continued use of the 65ph Platform after the effective date of a revised Privacy Policy constitutes your acknowledgment of the updated terms. If you do not accept a revised Policy, you should close your Account and withdraw any remaining balance before the new Policy takes effect.

Contact & Data Protection Officer

For all privacy-related queries, data subject rights requests, or formal complaints regarding 65ph's data processing practices, you may contact the 65ph Data Protection Officer through the following channels:

65ph acknowledges all privacy requests within two (2) business days and provides a full response within fifteen (15) business days. Complex requests involving large volumes of data or multi-jurisdictional considerations may take up to thirty (30) business days, in which case 65ph will provide an interim acknowledgment explaining the reason for the extended timeline.