96phj Privacy Policy

Introduction & Identity of the Data Controller

This Privacy Policy ("Policy") is issued by 96phj ("96phj," "We," "Us," "Our"), the operator of the online gaming platform accessible at 96phj.vip. 96phj acts as the Data Controller for all personal information collected from registered players and visitors to the 96phj platform, as defined under the Data Privacy Act of the Philippines (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations ("IRR").

96phj operates under a license issued by the Philippine Amusement and Gaming Corporation ("PAGCOR"), which requires the collection and processing of specific personal data categories as a condition of licensing and ongoing compliance with Philippine gaming law, Anti-Money Laundering regulations (Republic Act No. 9160, as amended), and responsible gaming requirements.

By registering an account at 96phj, you acknowledge that you have read, understood, and consented to the data practices described in this Policy. This Policy should be read in conjunction with the 96phj Terms and Conditions, which govern the overall contractual relationship between you and 96phj.

Personal Data We Collect

96phj collects the following categories of personal data from players and platform visitors. Collection only occurs to the extent necessary for the stated purposes and applicable legal obligations:

96phj does not collect sensitive personal information as defined under Section 3(l) of RA 10173 — such as racial or ethnic origin, political opinions, or health data — except where your government-issued Philippine ID incidentally contains such information as part of the KYC process. In such cases, the sensitive data is not processed separately from its KYC purpose.

How We Use Your Personal Data

96phj uses your personal data for the following specific purposes. Each purpose is linked to a lawful processing basis under RA 10173 (detailed in Section 4):

• Account Registration & Management: Creating and maintaining your 96phj player account, verifying your identity, managing your account credentials, processing your login sessions, and communicating account-related notifications.
• KYC Identity Verification: Confirming your legal identity, verifying your age (21+ requirement), confirming your Philippine residency, and verifying that payment accounts are held in your own name — as mandated by PAGCOR and the Anti-Money Laundering Act.
• Payment Processing: Processing deposits via GCash, Maya, BDO, BPI, and other accepted payment methods; processing withdrawal requests; maintaining transaction records required under Philippine financial regulations.
• Anti-Money Laundering Compliance: Monitoring transactions for suspicious activity patterns, conducting enhanced due diligence on high-value transactions, and reporting covered and suspicious transactions to the Anti-Money Laundering Council (AMLC) as required by law.
• Gaming Service Delivery: Providing access to all 96phj game categories, recording game outcomes, managing bonus balances, settling bets, and maintaining fair gaming records.
• Responsible Gaming: Monitoring gaming activity for indicators of problematic gambling behavior, enforcing deposit limits and self-exclusion settings, and providing responsible gaming tool functionality.
• Fraud Prevention & Security: Detecting multi-account registrations, identifying bonus abuse, preventing unauthorized account access, and investigating suspicious activity patterns.
• Customer Support: Responding to player inquiries, resolving complaints, processing account closure requests, and maintaining support records for quality assurance.
• Legal Compliance: Meeting all obligations under PAGCOR licensing conditions, the Data Privacy Act, the Anti-Money Laundering Act, and any other applicable Philippine law.
• Platform Improvement: Analyzing aggregated and anonymized usage data to improve platform performance, game library curation, and user experience for Filipino players.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have provided consent to receive such communications.

Lawful Basis for Processing Under RA 10173

All personal data processing by 96phj is conducted under one or more of the following lawful bases recognized under the Data Privacy Act of the Philippines and its Implementing Rules and Regulations:

• Consent (Section 12(a)): Where you have freely given, specific, and informed consent to processing — including marketing communications and optional platform features. Consent may be withdrawn at any time without affecting prior processing.
• Contractual Necessity (Section 12(b)): Where processing is necessary to perform the contract between you and 96phj — specifically, to provide the online gaming services you have registered for, including account management, payment processing, and game delivery.
• Legal Obligation (Section 12(c)): Where processing is required to comply with a legal obligation applicable to 96phj as a PAGCOR-licensed operator — including AML reporting obligations, KYC requirements, and PAGCOR regulatory reporting.
• Legitimate Interests (Section 12(f)): Where processing is necessary for the legitimate interests of 96phj, provided those interests are not overridden by the data subject's rights — specifically for fraud prevention, platform security, and aggregate analytics that benefit the player experience.

Data Sharing & Third-Party Disclosure

96phj does not sell, rent, or trade your personal data to any third party. Data is shared only in the following limited and controlled circumstances:

• Payment Processors: GCash (GXI), Maya (PayMaya Philippines), GrabPay, BPI, BDO, Metrobank, and other payment providers receive the minimum data necessary to process your transactions. Each provider operates under their own privacy policy and applicable Philippine financial regulations.
• KYC Verification Providers: Third-party identity verification services used to validate government-issued Philippine IDs and conduct facial recognition matching during KYC. These providers process data under strict contractual data protection obligations.
• Game Software Providers: Game studios and software providers whose titles operate within the 96phj platform may receive limited technical identifiers (not full personal data) for the purpose of game session management and RNG certification compliance.
• PAGCOR: As our licensing regulator, PAGCOR may request player records, transaction data, and gaming activity logs as part of its regulatory oversight function. 96phj is legally required to provide such information on request.
• Anti-Money Laundering Council (AMLC): Covered transactions and suspicious transactions are reported to the AMLC as required under Republic Act No. 9160 and its amendments.
• Law Enforcement and Courts: 96phj will disclose personal data to Philippine law enforcement agencies, the NBI, PDEA, or courts where required by a valid legal process, court order, or search warrant issued under Philippine law.
• National Privacy Commission (NPC): The NPC may receive data breach notifications, compliance reports, and other information required under RA 10173 and its IRR.

All third-party service providers with whom 96phj shares personal data are contractually required to maintain appropriate data security standards and to process personal data only for the purposes specified in their service agreements with 96phj.

Cookies & Tracking Technologies

96phj uses cookies and similar tracking technologies on the platform for the following purposes:

• Essential Cookies: Required for the platform to function correctly. These include session authentication cookies that keep you logged in during your 96phj session, security tokens, and preference cookies that remember your display settings. These cannot be disabled without impairing platform functionality.
• Analytics Cookies: Used to understand how players interact with the 96phj platform — which pages are visited most frequently, where players encounter difficulties, and how game categories are navigated. Analytics data is aggregated and does not identify individual players.
• Fraud Detection Cookies: Technical identifiers used by 96phj's fraud prevention systems to detect unusual access patterns, multi-account registration attempts, and bot activity. These are required for platform security and cannot be disabled.
• Marketing Cookies: Where you have provided consent, marketing cookies may be used to deliver relevant promotional content and track the effectiveness of 96phj's own marketing communications. You may withdraw marketing cookie consent at any time.

Data Retention

96phj retains personal data only for as long as necessary to fulfill the purpose for which it was collected or as required by applicable Philippine law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents re-identification. Where data has been shared with third parties, 96phj will take reasonable steps to ensure those parties also delete the data in accordance with their contractual obligations.

Data Security Measures

96phj implements technical and organizational security measures appropriate to the sensitivity of the personal data processed and the risks associated with operating an online gaming platform under Philippine law. Key security measures include:

• Encryption in Transit: All data transmitted between your browser/device and 96phj servers is encrypted using TLS 1.2 or higher. The 96phj website operates exclusively over HTTPS.
• Encryption at Rest: Sensitive personal data, including KYC documents and financial data, is encrypted at rest using AES-256 encryption on 96phj's data storage infrastructure.
• Access Controls: Access to personal data systems is restricted to authorized 96phj personnel based on the principle of least privilege. Access is logged and reviewed. Access credentials for data systems are subject to multi-factor authentication requirements.
• Vendor Security: Third-party service providers with access to personal data are assessed for security compliance prior to engagement and are contractually required to maintain security standards consistent with 96phj's obligations under RA 10173.
• Penetration Testing: 96phj's platform infrastructure is subject to periodic security assessments and penetration testing by qualified security professionals.
• Incident Response: 96phj maintains an incident response procedure that activates in the event of a suspected data breach. This procedure includes containment, assessment, notification, and remediation phases aligned with NPC breach notification requirements.

No security system is completely impenetrable. While 96phj takes all reasonable precautions, we cannot guarantee absolute security of data transmitted over the internet. Players are responsible for securing their own devices and account credentials.

Your Data Subject Rights Under RA 10173

The Data Privacy Act of the Philippines grants you specific rights as a data subject. 96phj respects and facilitates the exercise of all these rights. Your rights include:

To exercise any of the above rights, please contact the 96phj Data Protection Officer using the contact details in Section 15. All data subject requests will be acknowledged within 3 business days and resolved within the timeframes required by the NPC's Circular on Data Subject Request Handling.

Children & Minors — Strict Prohibition

96phj's services are strictly prohibited for individuals below 21 years of age, as mandated by PAGCOR for all licensed online gaming operators in the Philippines. 96phj does not knowingly collect personal data from individuals under 21.

All registrations are subject to age verification through KYC identity document checking. Where 96phj discovers that personal data has been collected from an individual below the minimum age, the account will be immediately and permanently closed, all data will be deleted or anonymized to the extent permitted by AML retention requirements, and the matter may be reported to PAGCOR.

Marketing Communications & Consent

96phj may send promotional communications — including bonus offers, new game announcements, tournament invitations, and platform updates — to players who have provided explicit consent to receive such communications during registration or through account settings.

Marketing communications from 96phj are sent through the following channels, subject to your consent preferences:

• Email to your registered email address
• SMS to your registered Philippine mobile number
• In-platform notifications within your 96phj account dashboard

You may withdraw consent for marketing communications at any time by updating your notification preferences in your 96phj account settings, or by contacting support at [email protected]. Withdrawal of marketing consent will be processed within 5 business days and will not affect any other aspect of your account or your right to receive essential account communications (e.g., transaction confirmations, security alerts, KYC notifications).

Essential account communications — including transaction receipts, security notifications, password resets, and KYC status updates — are sent regardless of your marketing consent status, as these are necessary for account management.

Cross-Border Data Transfers

96phj's primary data storage and processing infrastructure is located in the Philippines. In certain circumstances, personal data may be transferred to or processed in other jurisdictions — for example, where game software providers, technical infrastructure partners, or KYC verification services operate data centers outside the Philippines.

Any cross-border transfer of personal data by 96phj is conducted in compliance with Section 21 of RA 10173, which requires that the recipient country or organization provides an adequate level of protection equivalent to that required under Philippine law. 96phj ensures this through:

• Contractual obligations requiring recipient parties to meet data protection standards consistent with RA 10173
• Assessment of the data protection laws of the recipient jurisdiction prior to transfer
• Limiting cross-border transfers to the minimum data necessary for the specific service purpose
• NPC registration of cross-border data transfers where required under NPC issuances

Personal Data Breach Notification

In the event of a personal data breach — defined as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data — 96phj will take the following steps:

1. Containment: Immediately activate the 96phj incident response procedure to contain the breach and prevent further unauthorized access.
2. Assessment: Assess the nature, scope, and likely impact of the breach, including the categories of personal data affected and the approximate number of data subjects involved.
3. NPC Notification: Notify the National Privacy Commission within 72 hours of becoming aware of a breach where there is a real risk of serious harm to the affected data subjects, as required under NPC Circular 16-03.
4. Player Notification: Notify affected 96phj players within a reasonable timeframe once the scope of the breach is confirmed and containment measures are in place, providing sufficient information for them to take protective action.
5. Remediation: Implement technical and organizational measures to prevent recurrence and document the breach in 96phj's personal data breach register.

Changes to This Privacy Policy

96phj reserves the right to amend this Privacy Policy at any time to reflect changes in Philippine law, NPC guidance, PAGCOR regulatory requirements, or 96phj's data practices. Material changes — those that meaningfully affect how your personal data is used or your rights as a data subject — will be communicated to registered players via email at least 14 days before taking effect.

The updated Policy will be published on this page with a revised effective date. Your continued use of the 96phj platform after the effective date of any amended Policy constitutes your acceptance of the revised data practices described therein. If you do not agree to a revised Policy, you should cease using the platform and request account closure before the effective date.

Data Protection Officer

96phj has designated a Data Protection Officer ("DPO") as required under Section 21(c) of RA 10173. The DPO is responsible for ensuring 96phj's compliance with the Data Privacy Act, its IRR, and applicable NPC issuances, and for responding to data subject rights requests and privacy inquiries.

You may contact the 96phj Data Protection Officer for privacy-related matters through the following channel:

• Email: [email protected] — please include "DPO Request" or "Privacy Inquiry" in the subject line
• Response Time: The DPO will acknowledge all privacy inquiries within 3 business days and provide a substantive response within the timeframes required by the NPC.
• Languages: Privacy inquiries may be submitted in English, Tagalog, or Cebuano.

How to Exercise Your Data Subject Rights

To submit a data subject rights request to 96phj, please follow these steps:

1. Identify Your Request: Determine the specific right you wish to exercise — access, rectification, erasure, portability, or objection (as described in Section 9).
2. Submit Your Request: Contact the 96phj Data Protection Officer at [email protected] with "Data Subject Request" in the subject line. Include your full name, registered email address, and a clear description of your request.
3. Identity Verification: To protect your data from unauthorized requests, 96phj will verify your identity before processing your request. You may be asked to confirm your registered email, mobile number, or submit a copy of a Philippine government ID. This verification step is required under RA 10173 to ensure data is only disclosed to the person it belongs to.
4. Processing: 96phj will acknowledge your request within 3 business days and process it within the applicable NPC-mandated timeframe (typically 15–30 business days depending on the type of request and its complexity).
5. Response: You will receive a response in writing (email) confirming the outcome of your request, including the specific actions taken or, where a request cannot be fully granted, a clear explanation of the applicable legal basis for any limitation.

There is no fee for submitting a data subject rights request in most circumstances. Where a request is manifestly unfounded or repetitive, 96phj may charge a reasonable administrative fee or decline the request in accordance with NPC guidelines — in which case you will be notified in writing with the reason.