phlag Casino – Privacy Policy

phlag Casino ("phlag," "we," "us," or "our") operates the online gaming platform accessible at phlag.vip. phlag is the data controller responsible for the personal information collected through the phlag platform, including the website, any associated mobile-optimised interfaces, and all related services offered to registered users.

As a platform serving Filipino players, phlag operates within the regulatory framework applicable to online gaming in the Philippines and is committed to upholding the data privacy rights of all users in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, and its Implementing Rules and Regulations as administered by the National Privacy Commission (NPC).

This Privacy Policy applies to all personal data collected from visitors to phlag.vip, registered account holders, and any other individuals who interact with phlag's services, customer support channels, or promotional activities.

phlag collects personal data that is necessary for the provision of our gaming services, compliance with legal obligations, and the improvement of your experience on the platform. The categories of personal data we collect include:

2.1 Identity & Contact Information

• Full legal name as it appears on your government-issued identification
• Date of birth (for age verification purposes — phlag is strictly 21+ only)
• Nationality and country of residence
• Email address and mobile phone number
• Residential address (barangay, city/municipality, province, ZIP code)

2.2 Identity Verification Documents

• Copies of government-issued photo identification (e.g., Philippine passport, SSS ID, UMID, PhilSys National ID, driver's license, PRC ID, or voter's ID)
• Proof of address documents (e.g., utility bills, bank statements, barangay certificate)
• Selfie photographs submitted for liveness verification during KYC

2.3 Financial Information

• GCash or PayMaya account details (mobile number associated with the e-wallet)
• Bank account details for bank transfer transactions (account name, account number, bank name)
• Debit card details (card number, expiry date — stored in tokenised form only)
• Transaction history including deposits, withdrawals, wagers, and bonus activity

2.4 Gaming & Behavioural Data

• Game session logs, bet history, win/loss records, and game preferences
• Responsible gaming settings including deposit limits, session timers, and self-exclusion status
• Customer support interaction records, including chat transcripts and email correspondence

2.5 Technical & Device Data

• IP address and approximate geolocation derived therefrom
• Device type, operating system, browser type and version
• Cookies, session tokens, and similar tracking technologies (see Section 7)
• Login timestamps and session duration data

phlag collects personal data through the following means:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in promotions.
• Automated collection: Technical and behavioural data collected automatically when you access and use the phlag platform, including through cookies and server logs.
• Third-party sources: Identity verification data from KYC service providers; fraud and sanctions screening data from compliance databases; payment confirmation data from GCash, PayMaya, and banking partners.

phlag processes your personal data for the following specific purposes:

• Account creation and management: To register your phlag account, verify your identity, and maintain your account in good standing.
• Age verification: To confirm that you are at least 21 years of age, as required by Philippine gaming regulations. phlag does not permit access to any person under 21.
• Service delivery: To process your deposits and withdrawals, credit bonuses, record game results, and provide the full range of phlag gaming services.
• Regulatory compliance: To fulfil phlag's obligations under applicable Philippine laws and regulations, including anti-money laundering (AML) requirements under Republic Act No. 9160 (as amended), PAGCOR reporting obligations, and the Data Privacy Act of 2012.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, and other security threats to the phlag platform and its users.
• Responsible gaming: To monitor gaming behaviour for indicators of problem gambling and to enforce responsible gaming limits and self-exclusion requests made by users.
• Customer support: To respond to your enquiries, resolve disputes, and improve the quality of phlag's support services.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have provided your consent to receive such communications. You may withdraw this consent at any time.
• Platform improvement: To analyse usage patterns, identify technical issues, and improve the overall performance and user experience of the phlag platform.

Under the Data Privacy Act of 2012, phlag processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and phlag (i.e., providing the gaming services you have registered for).
• Legal obligation: Processing required to comply with applicable Philippine laws, including AML regulations, PAGCOR requirements, and tax reporting obligations.
• Legitimate interests: Processing necessary for phlag's legitimate business interests, including fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

phlag does not sell, rent, or trade your personal data to third parties for their own commercial purposes. phlag may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment processors: GCash, PayMaya/Maya, and Philippine banking partners, for the purpose of processing your deposits and withdrawals.
• KYC and identity verification providers: Third-party services engaged to verify your identity and age during the account registration and KYC process.
• AML and fraud screening services: Compliance technology providers used to screen transactions and account activity against sanctions lists and fraud databases.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies, where disclosure is required by law, regulation, or valid legal order.
• Technology and infrastructure providers: Cloud hosting, cybersecurity, and platform technology vendors engaged by phlag to operate and maintain the platform, subject to strict data processing agreements.
• Professional advisers: Legal counsel, auditors, and compliance consultants, where necessary for phlag's legal and regulatory obligations.

phlag uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyse usage patterns. The categories of cookies used by phlag are as follows:

• Strictly necessary cookies: Essential for the operation of the phlag platform, including session management, authentication, and security. These cannot be disabled without affecting core platform functionality.
• Functional cookies: Used to remember your preferences, such as language settings and responsible gaming limits, to provide a more personalised experience.
• Analytics cookies: Used to collect aggregated, anonymised data about how users interact with the phlag platform, helping us identify areas for improvement. These are only set with your consent.
• Marketing cookies: Used to deliver relevant promotional content to you based on your interests and activity on phlag. These are only set with your explicit consent.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may impair your ability to use the phlag platform. For more information on managing cookies in popular Philippine mobile browsers, please refer to your browser's help documentation.

phlag retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following retention periods:

• Active account data: Retained for the duration of your phlag account and for a period of five (5) years following account closure, in compliance with AML record-keeping requirements under Philippine law.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of submission, or longer if required by applicable regulatory obligations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with AMLC and PAGCOR requirements.
• Customer support records: Retained for three (3) years from the date of the last interaction, unless a longer period is required for dispute resolution or legal proceedings.
• Marketing consent records: Retained for as long as you remain subscribed to phlag marketing communications, plus one (1) year following withdrawal of consent.

Upon expiry of the applicable retention period, phlag will securely delete or anonymise your personal data in accordance with its data disposal procedures.

phlag implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the phlag platform.
• AES-256 encryption for sensitive data stored in phlag's databases, including payment details and identity documents.
• Multi-factor authentication (MFA) options for phlag account access.
• Role-based access controls limiting phlag staff access to personal data on a strict need-to-know basis.
• Regular penetration testing and vulnerability assessments conducted by independent cybersecurity specialists.
• 24/7 security monitoring and intrusion detection systems.

Despite these measures, no internet-based platform can guarantee absolute security. phlag encourages you to use a strong, unique password for your phlag account, enable two-factor authentication where available, and notify phlag immediately if you suspect any unauthorised access to your account.

As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phlag:

• Right to be informed: You have the right to be informed of how your personal data is collected, used, and shared — which is the purpose of this Privacy Policy.
• Right of access: You may request a copy of the personal data phlag holds about you, along with information about how it is being processed.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data phlag holds about you.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to phlag's legal retention obligations.
• Right to object: You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, subject to phlag's overriding legal obligations.
• Right to data portability: You may request that phlag provide your personal data in a structured, commonly used, and machine-readable format where technically feasible.
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe phlag has processed your personal data in violation of the Data Privacy Act of 2012.

To exercise any of the above rights, please contact phlag's Data Protection Officer using the contact details provided in Section 14 of this Privacy Policy. phlag will respond to all verified data subject requests within thirty (30) calendar days of receipt.

The phlag platform is strictly intended for individuals aged 21 years and above. phlag does not knowingly collect personal data from any person under the age of 21. If phlag becomes aware that personal data has been collected from a person under 21, phlag will immediately suspend the associated account, delete the personal data in question, and report the matter to the relevant authorities where required by law.

If you are a parent or guardian and believe that a minor has registered on phlag or submitted personal data to phlag without your knowledge, please contact our Data Protection Officer immediately using the details in Section 14. phlag takes underage access extremely seriously and will act promptly on all such reports.

phlag primarily stores and processes personal data within the Philippines. In certain circumstances, personal data may be transferred to, or accessed by, service providers located outside the Philippines — for example, cloud infrastructure providers or international KYC verification services.

Where such cross-border transfers occur, phlag ensures that appropriate safeguards are in place to protect your personal data, including contractual clauses that impose data protection obligations equivalent to those required under the Data Privacy Act of 2012. phlag will not transfer your personal data to a jurisdiction that does not provide an adequate level of data protection without your explicit consent or a valid legal basis for the transfer.

phlag may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, phlag will notify registered users via the email address associated with their account and will display a prominent notice on the phlag platform prior to the changes taking effect.

The date of the most recent revision is shown at the top of this page. Your continued use of the phlag platform after the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms. We encourage you to review this Privacy Policy periodically to stay informed about how phlag protects your personal data.

phlag has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. If you have any questions, concerns, or requests relating to your personal data or this Privacy Policy, please contact the phlag DPO through the following channels:

• DPO Email: [email protected]
• General Support Email: [email protected]
• Live Chat: Available 24/7 within the phlag platform

phlag aims to acknowledge all privacy-related enquiries within forty-eight (48) hours and to resolve them fully within thirty (30) calendar days. If you are not satisfied with phlag's response, you have the right to escalate your complaint to the National Privacy Commission of the Philippines.