Phil888 Privacy Policy — Your Data, Your Rights, Our Responsibility

1Who We Are — The Data Controller

Phil888 is the operator of the online gaming platform accessible at phil888.best. Phil888 holds a valid gaming licence issued by the Philippine Amusement and Gaming Corporation (PAGCOR) and operates in full compliance with applicable Philippine law.

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act 10173), Phil888 is the Personal Information Controller in respect of the personal data of its registered players and website visitors. This means Phil888 determines the purposes and means by which your personal data is collected and processed.

Phil888 has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with RA 10173 and the rules and regulations of the National Privacy Commission. You may contact the DPO for any data privacy concern at support@phil888.best.

2Personal Data We Collect

Phil888 collects personal data through three main channels: information you provide directly, information generated automatically when you use the platform, and information received from third-party verification and payment partners.

Information you provide directly:

• Full legal name, date of birth, nationality, and gender (collected at registration and KYC).
• Philippine mobile number and email address used for account communication and OTP authentication.
• Residential address in the Philippines (required for KYC verification).
• Government-issued Philippine identification documents — scans or photos of UMID, passport, driver's licence, PhilHealth ID, voter's ID, national ID, or postal ID.
• Selfie photograph taken at the time of identity verification.
• GCash number, Maya account details, bank account information, or card details provided for deposits and withdrawals.
• Any information voluntarily shared through customer support communications.

Information collected automatically:

• IP address and geolocation data derived from your IP address.
• Device type, operating system version, mobile carrier, and browser information.
• Session data including login and logout times, session duration, and pages visited.
• Gaming activity logs including games played, bets placed, amounts wagered, and outcomes.
• Cookie and pixel data as described in Section 5 of this policy.

Information received from third parties:

• Identity verification results from our accredited KYC/AML service partners.
• Payment confirmation and transaction reference data from GCash, Maya, GrabPay, Coins.ph, and banking partners.
• Fraud risk signals from payment processor fraud detection systems.

3How Phil888 Uses Your Personal Data

Phil888 uses the personal data it holds to deliver the gaming platform, comply with legal and regulatory obligations, and protect the integrity of the platform and the safety of all players. Specifically, we use your data to:

• Create and manage your account — your registration data is used to set up, maintain, and secure your Phil888 account.
• Verify your identity and age — KYC documents are used to confirm that you are who you say you are and that you meet the 18+ age requirement under Philippine gaming regulations.
• Process deposits and withdrawals — payment data is used to initiate, confirm, and reconcile all financial transactions between your Phil888 wallet and your GCash, Maya, or bank account.
• Comply with AML obligations — gaming activity and financial data is monitored as required under Philippine Anti-Money Laundering Act (AMLA) regulations and PAGCOR directives. Phil888 is legally required to report suspicious transactions to the Anti-Money Laundering Council (AMLC).
• Deliver responsible gaming features — your gaming activity data powers the deposit limit tracking, session monitoring, and self-exclusion enforcement tools available in your Phil888 account.
• Provide customer support — your account, transaction, and gaming data allows Phil888 support agents to assist you effectively and resolve disputes.
• Improve the platform — aggregated, anonymised data is used to understand how players use Phil888 and to make improvements to game selection, user experience, and performance.
• Send you account notifications — transactional messages such as deposit confirmations, withdrawal notifications, and security alerts are sent to your registered mobile number and email address.
• Send marketing communications — promotional emails and SMS are sent only to players who have actively opted in to marketing communications from Phil888. See Section 10 for details on how to manage your preferences.

4Legal Basis for Processing Your Data

Phil888 processes your personal data on the following legal bases as defined under RA 10173:

• Contractual necessity — processing required to fulfil the contract between you and Phil888, including account management, payment processing, and delivery of gaming services.
• Legal obligation — processing required to comply with applicable Philippine law, including PAGCOR licensing conditions, AMLA obligations, and BSP payment regulations. This includes KYC verification and AML transaction monitoring.
• Legitimate interests — processing necessary for Phil888's legitimate business interests, such as fraud detection, platform security, and abuse prevention, where these interests are not overridden by your data rights.
• Consent — processing based on your explicit opt-in, specifically for marketing communications. Consent can be withdrawn at any time without affecting the lawfulness of processing based on consent before withdrawal.

5Cookies and Tracking Technologies

Phil888 uses cookies and similar tracking technologies on the phil888.best platform. Cookies are small data files stored on your device that help the platform function correctly and allow us to understand how players interact with the site.

Phil888 uses the following categories of cookies:

• Essential cookies — required for the platform to function. These include session cookies that keep you logged in during a gaming session. Essential cookies cannot be disabled without breaking core platform functionality.
• Functional cookies — remember your preferences such as language settings and display options to improve your Phil888 experience across sessions.
• Analytics cookies — collect anonymised data about how players navigate the platform. Phil888 uses this data to identify pages with technical issues and to understand which features are most used. No personal identity is tied to analytics data.
• Security cookies — used to detect and prevent fraudulent login attempts, identify devices associated with suspicious activity, and protect your account from unauthorised access.

Phil888 does not use advertising or retargeting cookies that track your browsing activity across other websites. The platform's cookie usage is limited to what is required for operation, security, and internal analytics.

You can manage cookie preferences through your browser settings. Note that disabling essential cookies may affect your ability to use Phil888 normally.

6Sharing Your Personal Data

Phil888 does not sell, rent, or trade your personal data to any third party for commercial purposes. Personal data is shared with third parties only in the following specific and limited circumstances:

• Payment processors — GCash, Maya, GrabPay, Coins.ph, InstaPay/PESONet, BDO, BPI, UnionBank, and Visa/Mastercard payment networks receive only the transaction data necessary to process your deposit or withdrawal. These partners are bound by their own regulatory obligations under BSP oversight.
• KYC and identity verification providers — accredited Philippine identity verification service providers receive your identification documents and photos to complete the KYC process required by PAGCOR. These providers process data solely for Phil888 and on Phil888's instruction.
• PAGCOR — as Phil888's licensing authority, PAGCOR may request player data as part of its regulatory oversight function. Phil888 is legally required to cooperate fully with PAGCOR oversight activities.
• Anti-Money Laundering Council (AMLC) — Phil888 is obligated under the Anti-Money Laundering Act (RA 9160 as amended) to report covered and suspicious transactions to the AMLC. Such reporting is a legal obligation and does not require your consent.
• Law enforcement and courts — Phil888 will disclose personal data to Philippine law enforcement authorities, courts, or government agencies when required to do so by law, court order, or lawful regulatory direction.
• Professional advisers — legal, accounting, and audit professionals engaged by Phil888 may access personal data as necessary to perform their services, subject to strict confidentiality obligations.

7How Phil888 Secures Your Data

Protecting the personal and financial data of Phil888 players is a core operational responsibility. Phil888 applies the following security measures across all systems that process your data:

• 256-bit SSL/TLS encryption for all data transmitted between your device and Phil888 servers.
• Encrypted storage for personal data and payment information held at rest on Phil888 servers.
• Role-based access controls that limit staff access to personal data strictly to those with a legitimate operational need.
• Access audit logging so that every instance of staff access to personal data is recorded and available for review.
• Multi-factor authentication requirements for all staff with access to systems holding personal data.
• Regular security testing including vulnerability assessments and penetration testing of Phil888's platform and data systems.
• Incident response procedures designed to detect, contain, and respond to any personal data breach rapidly, and to notify affected players and the National Privacy Commission within the timeframes required by RA 10173.

Despite these measures, no online platform can guarantee absolute security. If you suspect that your Phil888 account has been accessed without your authorisation, contact Phil888 support immediately via live chat so your account can be secured promptly.

8Data Retention

Phil888 retains personal data only for as long as it is needed for the purpose for which it was collected, or as required by Philippine law. The key retention periods applicable to Phil888 player data are:

• Account and identity data — retained for the duration of your active account plus five years following account closure, in line with PAGCOR and AML record-keeping requirements.
• Payment and transaction records — retained for seven years following the date of the transaction, as required under BSP and AMLA record-keeping obligations.
• Gaming activity records — retained for three years following account closure.
• Customer support records — retained for three years from the date of the last interaction.
• Device and session data — retained on a rolling 13-month basis.
• Marketing preference records — retained until you change your preference or close your account.

Where a legal proceeding or investigation is ongoing at the time a retention period would otherwise expire, Phil888 will extend retention of relevant data until the matter is fully resolved.

After retention periods expire, data is securely deleted or anonymised so that it can no longer be linked to any individual player.

9Your Data Rights Under Philippine Law

As a data subject under RA 10173, you have the following rights in respect of your personal data held by Phil888: