phfan Privacy Policy

This Privacy Policy ("Policy") describes how phfan ("phfan," "we," "us," or "our") collects, uses, stores, discloses, and otherwise processes the personal data of individuals ("you," "Player," "user") who access or use the phfan online gaming platform at phfan.co, including all associated features, services, and content.

This Policy applies to all personal data collected by phfan in connection with your use of the Platform — whether you are browsing as a guest, registering an Account, making a deposit, placing a wager, contacting support, or interacting with phfan through any other means. This Policy does not apply to third-party websites, services, or game providers accessible through links on the phfan Platform, each of which is governed by its own privacy practices.

By accessing phfan or creating an Account, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. If you do not agree with any part of this Policy, you must not use the phfan Platform.

For the purposes of the Data Privacy Act of 2012 and its Implementing Rules and Regulations, phfan acts as the Personal Information Controller (PIC) in respect of personal data collected from Players using the phfan Platform. As Personal Information Controller, phfan determines the purposes for which and the means by which your personal data is processed.

Where phfan engages third-party service providers (such as payment processors, KYC verification providers, customer support platforms, and cloud infrastructure providers) to process personal data on phfan's behalf, those providers act as Personal Information Processors (PIP) and process data only on phfan's documented instructions and in accordance with applicable data protection law.

phfan has designated a Data Protection Officer (DPO) responsible for overseeing phfan's compliance with the Data Privacy Act. You may contact phfan's DPO through the support channels described in Section 15 of this Policy.

phfan collects the following categories of personal data, depending on how you interact with the Platform:

phfan does not collect full payment card numbers, CVV codes, or other full payment instrument credentials directly. Payment card transactions, where applicable, are processed entirely by certified third-party payment gateways.

phfan collects personal data through the following means:

• Direct collection — information you voluntarily provide when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting support, or updating your account profile.
• Automated collection — technical data collected automatically when you access or use the phfan Platform, including through cookies, session tracking technologies, server logs, and similar tools. See Section 7 for full details on cookies.
• Third-party sources — identity and verification data received from phfan's KYC and anti-fraud service providers when processing your identity verification; transaction confirmation data received from Philippine payment processors (GCash, PayMaya, BDO, BPI, Metrobank) in connection with deposits and withdrawals.
• PAGCOR and regulatory bodies — phfan may receive or be required to share data with PAGCOR and other Philippine regulatory authorities in connection with its regulatory obligations.

Under the Data Privacy Act of 2012, phfan relies on the following lawful bases when processing your personal data:

• Contractual necessity — processing that is necessary to register your Account, manage your Wallet, process deposits and withdrawals, and deliver the phfan gaming services you have requested. Without this processing, phfan cannot provide its services to you.
• Legal obligation — processing required to comply with phfan's legal and regulatory obligations, including Anti-Money Laundering Act (AMLA) compliance, PAGCOR reporting obligations, tax obligations, and identity verification requirements.
• Legitimate interests — processing necessary for phfan's legitimate business interests, including fraud detection and prevention, platform security, responsible gaming enforcement, and improvement of Platform features, provided such interests are not overridden by your data protection rights.
• Consent — where phfan relies on your consent as the basis for processing (for example, for certain optional communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent may limit certain Platform features.

phfan uses the personal data it collects for the following purposes:

• Account creation and management — establishing and maintaining your phfan Account, verifying your identity, processing login requests, and managing account security settings including two-factor authentication.
• Payment processing — processing deposits and withdrawal requests, verifying payment instrument ownership, preventing unauthorized transactions, and maintaining financial records.
• Identity verification (KYC) — verifying your identity and age (21+) as required under PAGCOR regulatory obligations and phfan's internal compliance policies.
• Regulatory compliance — meeting phfan's obligations under the Anti-Money Laundering Act, PAGCOR regulations, and other applicable Philippine laws, including reporting obligations and record retention requirements.
• Fraud prevention and security — detecting and preventing unauthorized Account access, fraudulent transactions, bonus abuse, collusion, and other prohibited conduct as defined in the phfan Terms and Conditions.
• Responsible gaming — monitoring gaming activity for indicators of problem gambling, enabling operation of self-exclusion and deposit limit tools, and fulfilling responsible gaming obligations under the PAGCOR framework.
• Customer support — handling support inquiries, resolving disputes, responding to complaints, and maintaining records of phfan's interactions with you.
• Platform improvement — analyzing aggregated, anonymized Platform usage data to understand how Filipino players interact with phfan's features and to improve the Platform's functionality, game selection, and user experience.
• Communications — sending you transactional communications (such as deposit confirmations, withdrawal notifications, and security alerts) and, where you have opted in, promotional communications about phfan offers and features.

phfan uses cookies and similar tracking technologies on the Platform. A cookie is a small text file stored on your device by your web browser when you visit a website. phfan uses the following categories of cookies:

• Strictly necessary cookies — essential for the operation of the phfan Platform. These include session cookies that maintain your login state and remember your language and currency preferences. These cookies cannot be disabled without preventing the Platform from functioning correctly.
• Functional cookies — used to remember preferences you have set (such as game lobby filters or display settings) to improve your experience across sessions. These are not essential but improve Platform usability.
• Analytics cookies — used to collect anonymized data about how players navigate and interact with the phfan Platform, such as which pages are visited most frequently and where players encounter errors. This data helps phfan improve Platform performance and user experience.
• Security cookies — used to detect and prevent fraudulent activity, unauthorized login attempts, and other security threats. These include cookies that record device fingerprint data for suspicious login detection.

You can control and delete cookies through your browser settings. However, disabling certain cookies (particularly strictly necessary cookies) may impair the functionality of the phfan Platform, including your ability to log in and access your Account. phfan does not use third-party advertising or social media tracking cookies on the Platform.

phfan does not sell, rent, or trade your personal data. phfan may share your personal data with the following categories of recipients, strictly on a need-to-know basis and only to the extent necessary for the stated purpose:

• Payment processors — GCash (Globe Fintech Innovations, Inc.), PayMaya (Maya Bank, Inc.), BDO Unibank, Bank of the Philippine Islands, Metrobank, and other licensed Philippine payment service providers, for the purpose of processing deposit and withdrawal transactions.
• Identity verification providers — third-party KYC and anti-fraud service providers engaged by phfan to conduct identity verification and age confirmation checks in compliance with PAGCOR requirements.
• Cloud and IT infrastructure providers — hosting and server infrastructure providers who process data on phfan's behalf under strict data processing agreements.
• Customer support platforms — third-party live chat and ticketing service providers used to deliver phfan's 24/7 customer support function, operating under phfan's instructions and data protection requirements.
• Regulatory and law enforcement authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other Philippine government agencies or law enforcement bodies, where phfan is legally required or compelled to disclose personal data.
• Professional advisers — lawyers, accountants, auditors, and other professional advisers engaged by phfan, subject to applicable professional confidentiality obligations.

phfan retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. The following general retention periods apply:

• Account and identity data — retained for the duration of your active phfan Account plus a minimum of five (5) years following Account closure, in accordance with PAGCOR record-keeping requirements and AMLA obligations.
• Transaction and financial records — retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLA reporting and record retention obligations.
• KYC documents — retained for the duration of the Account relationship and for at least five (5) years following Account closure or the completion of the KYC verification process, whichever is later.
• Customer support communications — retained for a period of two (2) years from the date of the relevant interaction, unless the subject matter relates to an active dispute or regulatory inquiry.
• Gaming session data — retained for a minimum of two (2) years to support responsible gaming monitoring, dispute resolution, and regulatory audit requirements.
• Technical and log data — retained for a maximum of ninety (90) days in operational logs, unless extended retention is required for an active fraud investigation or regulatory inquiry.

When personal data is no longer required, phfan will securely delete or anonymize it in accordance with applicable data protection standards.

phfan implements technical and organizational measures designed to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction. These measures include:

• Encryption in transit — all data transmitted between your device and phfan's servers is protected by industry-standard 256-bit SSL/TLS encryption.
• Encryption at rest — sensitive personal data fields stored in phfan's databases are encrypted at rest using industry-standard encryption standards.
• Password hashing — phfan account passwords are stored as irreversible one-way cryptographic hashes. phfan employees and systems cannot read your password in plain text.
• Access controls — access to systems containing personal data is restricted to phfan personnel and authorized service providers on a strict need-to-know basis, with role-based access controls and audit logging.
• Two-factor authentication — 2FA is available for all phfan Accounts and is strongly recommended. Internal phfan systems that access personal data require mandatory 2FA for staff.
• Security monitoring — phfan employs automated systems to detect and respond to suspicious access patterns, unusual transaction volumes, and potential security incidents on a continuous basis.

While phfan takes all reasonable precautions to protect your personal data, no security system is entirely infallible. In the event of a personal data breach that is likely to cause serious harm to you, phfan will notify the National Privacy Commission and affected individuals in accordance with the requirements of the Data Privacy Act of 2012.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phfan. To exercise any of these rights, contact phfan's support team as described in Section 15:

phfan will respond to verified data rights requests within thirty (30) days of receipt, or within the extended timeframe permitted by the Data Privacy Act where the request is complex or numerous. phfan may ask you to verify your identity before processing a data rights request. Where phfan is unable to fulfil a request — for example, because of a legal retention obligation — phfan will explain the reason in its response.

If you are dissatisfied with phfan's response to a data rights request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph).

phfan is strictly an adults-only platform. Access to the phfan Platform is permitted only to individuals who are 21 years of age or older, as required under the PAGCOR regulatory framework for online casino gaming in the Philippines.

phfan does not knowingly collect, process, or store personal data from individuals under the age of 21. Age is verified during the Account registration process, and identity verification (KYC) documents are required to confirm that all Players meet the minimum age requirement before any real-money gaming activities are permitted.

If phfan becomes aware that personal data has been collected from an individual who is under 21 years of age, phfan will: (a) immediately suspend the associated Account; (b) delete all personal data collected from that individual; and (c) return any deposited funds to the originating payment method to the extent technically possible. If you are a parent or guardian and believe your child has accessed phfan, please contact phfan's support team immediately.

phfan processes your gaming activity data — including session duration, wager frequency, deposit patterns, and loss thresholds — as part of its responsible gaming obligations under the PAGCOR framework. This processing is carried out to detect early indicators of problem gambling behavior and to enable phfan to provide timely interventions, such as responsible gaming alerts, cooling-off prompts, or account restriction recommendations.

When you use phfan's responsible gaming tools — such as setting deposit limits, activating a cooling-off period, or requesting self-exclusion — the relevant data and instructions are recorded and enforced within your Account. Self-exclusion records are maintained for the duration of the exclusion period and are not subject to erasure requests during that period, as their retention is necessary to give effect to the exclusion.

phfan may, in accordance with PAGCOR requirements, share limited responsible gaming data with PAGCOR and with other licensed gaming operators for the purpose of enforcing cross-platform self-exclusion arrangements. For more information on phfan's responsible gaming tools and commitments, visit the phfan Responsible Gaming page.

phfan reserves the right to update this Privacy Policy at any time to reflect changes in its data processing practices, legal requirements, or Platform features. When material changes are made, phfan will post the updated Policy on the phfan Platform with a revised Effective Date and, where practicable, will notify you by email to your registered address or by notice within the phfan Platform.

Your continued use of the phfan Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the changes, you should cease using phfan and may request Account closure in accordance with the phfan Terms and Conditions. phfan recommends that you review this Policy periodically.

For any questions, concerns, or requests relating to this Privacy Policy or the personal data phfan holds about you — including requests to exercise your data rights under Section 11 — please contact phfan through the following channels. Email addresses are displayed as plain text and are not clickable links:

• Live Chat: Available 24/7 inside your phfan Account — the fastest channel for general queries and straightforward data rights requests.
• Email: [email protected] — for formal data rights requests, privacy complaints, and inquiries requiring a written record. phfan targets a first response within 2 business hours and will complete the substantive response within 30 days as required by the PDPA.

When submitting a data rights request, please provide: your full name as registered on your phfan Account, the specific right you wish to exercise, and sufficient detail to allow phfan to identify and action your request. phfan will ask you to verify your identity before processing the request.

If you are not satisfied with phfan's handling of a privacy complaint or data rights request, you have the right to file a complaint with the National Privacy Commission of the Philippines. The NPC's contact information is publicly available on its official website.