Privacy Policy
phyy is committed to protecting the personal data of every Filipino player on our platform. This Privacy Policy explains what we collect, why we collect it, how we use it, and what rights you have over your own information.
How phyy Protects Your Privacy
Before diving into the full legal text, here are six core privacy commitments that define how phyy handles your personal data every single day.
Data Collected Only When Necessary
phyy only collects personal data that is strictly necessary for account registration, identity verification, payment processing, fraud prevention, and regulatory compliance. We do not collect data speculatively or for purposes unrelated to your phyy experience.
SSL Encryption on All Connections
All data transmitted between your device and phyy is encrypted using industry-standard SSL/TLS protocols. This applies to account logins, deposit transactions, withdrawal requests, and any form submission on the phyy platform.
No Sale of Personal Data
phyy does not sell, rent, or trade your personal information to unaffiliated third parties for their own marketing purposes. Your data is used solely to operate the phyy platform, meet regulatory requirements, and improve your gaming experience.
DPA 2012 Compliance
phyy processes personal data in accordance with Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), and the implementing rules of the National Privacy Commission (NPC) of the Philippines. Your rights as a data subject are fully recognised.
You Control Your Preferences
Marketing communications from phyy are opt-in. You can update your communication preferences, request access to your data, or withdraw consent for non-essential data processing at any time by contacting phyy's data privacy team.
Retention Only as Long as Required
phyy retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law — including PAGCOR's record-keeping requirements and the Anti-Money Laundering Act. Data is securely deleted when no longer needed.
Your Rights Under the Philippine Data Privacy Act
As a registered phyy player and a data subject under Republic Act No. 10173, you have specific legal rights over your personal information. phyy is obligated to respect and facilitate the exercise of these rights.
To exercise any of the rights listed here, contact phyy's Data Privacy Officer at [email protected]. phyy will acknowledge your request within 72 hours and aim to resolve it within 30 calendar days, or within any shorter period required by the NPC.
Note: Some rights may be limited where phyy has a legal obligation to retain or process your data — for example, under the Anti-Money Laundering Act or PAGCOR's record-keeping directives. In such cases, phyy will inform you of the applicable limitation and its legal basis.
Right to Be Informed
You have the right to be informed of the fact that your personal data is being collected and processed by phyy, the purpose of such processing, and the identity of any third parties your data may be shared with.
Right of Access
You have the right to obtain a copy of the personal data phyy holds about you, together with information on how that data is being processed, where it came from, and to whom it has been disclosed.
Right to Correction
If any personal data phyy holds about you is inaccurate, incomplete, or outdated, you have the right to request that it be corrected. phyy will update the relevant records and notify any third parties to whom the incorrect data was previously disclosed.
Right to Erasure or Blocking
You may request the deletion or blocking of your personal data where it is no longer necessary for the purpose it was collected, where consent has been withdrawn, or where processing is unlawful — subject to phyy's legal obligations to retain certain records.
Right to Object
You have the right to object to the processing of your personal data for direct marketing purposes at any time. Upon receiving a valid objection, phyy will cease processing your data for that purpose immediately.
Right to Data Portability
You have the right to receive a copy of the personal data you provided to phyy in a structured, commonly used, and machine-readable format, and to request that it be transmitted directly to another personal information controller where technically feasible.
Important Notice: This Privacy Policy is issued by phyy ("the Company," "we," "us," "our") and applies to all personal data collected from individuals ("you," "the Player," "data subject") who register for and use the phyy platform at phyy.org. This document forms part of phyy's Terms & Conditions. By registering an account with phyy, you acknowledge that you have read and understood this Privacy Policy.
1. Who We Are
1.1 phyy is a PAGCOR-regulated online casino and sports betting platform serving Filipino players across the Philippines. phyy operates the website at phyy.org and all associated mobile and digital properties under the phyy brand.
1.2 For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173), phyy is the Personal Information Controller in respect of all personal data collected through the phyy platform.
1.3 phyy has designated a Data Privacy Officer (DPO) responsible for overseeing the Company's compliance with the DPA and the rules of the National Privacy Commission. The DPO can be contacted at [email protected].
2. Personal Data We Collect
2.1 phyy collects the following categories of personal data from players, depending on the stage of the account lifecycle and the services used:
2.1 Identity Data
Full legal name, date of birth, nationality, gender, and government-issued identification number (e.g., PhilSys ID number, passport number, driver's licence number, UMID, or SSS ID number) as required for KYC verification.
2.2 Contact Data
Email address, mobile phone number, and residential address within the Philippines.
2.3 Financial Data
GCash mobile number, PayMaya account reference, bank account details (BPI, BDO, Metrobank), transaction history, deposit amounts, withdrawal amounts, and PHP wallet balances. phyy does not store full credit or debit card numbers on its own servers.
2.4 Identity Verification Documents
Scanned or photographed copies of government-issued ID documents, proof of address documents, and — where enhanced due diligence is triggered — source-of-funds documentation submitted in the course of PAGCOR-mandated KYC compliance.
2.5 Gaming Activity Data
Game play history, wagering records, win and loss records, bonus redemption history, session duration, and game preferences across all phyy products including slots, live dealer tables, bingo, sabong, sports betting, and fishing games.
2.6 Technical & Device Data
IP address, device type and identifier, browser type and version, operating system, screen resolution, referring URL, and session timestamps collected automatically when you access the phyy platform.
2.7 Communications Data
Records of live chat conversations with phyy support agents, email correspondence with phyy, and any feedback or complaints submitted through the phyy platform.
Sensitive Personal Information: Government-issued identification documents and financial account details are treated as sensitive personal information under the DPA. phyy applies heightened security controls to this category of data and limits access strictly to authorised compliance and KYC personnel.
3. How We Collect Your Data
3.1 phyy collects personal data through the following channels:
- Account Registration: Data entered directly by the Player when creating a phyy account, including name, email address, date of birth, and mobile number.
- KYC Submission: Identity documents and proof-of-address files uploaded by the Player in the course of mandatory identity verification.
- Cashier Transactions: Payment details captured during deposit and withdrawal processes via GCash, PayMaya, BPI, BDO, and Metrobank integrations.
- Platform Usage: Automatically collected technical and gaming activity data generated as a result of using the phyy website or app.
- Cookies and Tracking Technologies: Data collected passively through cookies, pixels, and similar technologies as described in Section 5 of this Policy.
- Customer Support Interactions: Information provided by the Player when contacting phyy's support team via live chat or email.
- Third-Party Verification Providers: Identity verification data returned by phyy's contracted KYC and AML screening service providers in the course of verifying Player identities.
4. Purpose and Legal Basis for Processing
4.1 phyy processes personal data only where there is a lawful basis to do so under the Data Privacy Act of 2012. The table below sets out the primary purposes for which phyy processes personal data and the corresponding legal basis for each purpose.
| Purpose | Legal Basis |
|---|---|
| Account registration and management | Performance of contract (Terms & Conditions) |
| Identity verification (KYC) | Legal obligation (PAGCOR / AML Act) |
| Processing deposits and withdrawals | Performance of contract |
| Fraud detection and AML screening | Legal obligation / Legitimate interests |
| Customer support and dispute resolution | Performance of contract / Legitimate interests |
| Responsible gaming monitoring | Legal obligation (PAGCOR Player Protection) |
| Platform analytics and improvement | Legitimate interests |
| Promotional and marketing communications | Consent (opt-in only) |
| Regulatory reporting to PAGCOR and NPC | Legal obligation |
4.2 Where phyy relies on consent as the legal basis for processing — primarily for marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
4.3 phyy will not use your personal data for any purpose that is incompatible with the purposes described above without first providing you with notice and, where required, obtaining your consent.
5. Cookies & Tracking Technologies
5.1 phyy uses cookies and similar tracking technologies (including pixels and local storage) on the phyy platform to ensure its proper functioning, enhance the Player experience, and collect analytics data.
5.1 Strictly Necessary Cookies
These cookies are essential for the phyy platform to function. They enable core features such as account login session management, cashier security tokens, and fraud prevention checks. These cookies cannot be disabled without impairing platform functionality.
5.2 Analytics Cookies
phyy uses analytics cookies to understand how Players interact with the platform — including which pages are visited most frequently, where errors occur, and how navigation flows are used. This data is aggregated and used to improve the phyy experience. Analytics cookies do not identify individual Players.
5.3 Preference Cookies
These cookies remember your language preferences, game lobby settings, and other personalisation choices so you do not need to re-select them each time you visit phyy.
5.4 Marketing Cookies
Where you have consented to marketing communications, phyy may use cookies to record which promotions you have been shown and whether you have interacted with them. You may withdraw consent for marketing cookies at any time by updating your preferences in the phyy account settings.
5.5 Most web browsers allow you to control cookies through their settings. Disabling strictly necessary cookies may prevent phyy from functioning correctly. Disabling analytics or preference cookies will not affect your ability to place wagers or access your account.
6. Data Sharing and Disclosure
6.1 phyy does not sell, rent, or trade your personal data to third parties for their own commercial purposes. phyy may share your personal data with the following categories of recipients, strictly for the purposes described in this Policy:
- PAGCOR and Regulatory Authorities: phyy is obligated to report certain player account data, transaction records, and AML alerts to PAGCOR and relevant Philippine government authorities in accordance with applicable regulations and Republic Act No. 9160 (Anti-Money Laundering Act).
- KYC and Identity Verification Providers: Third-party providers contracted by phyy to perform automated identity document verification and AML watchlist screening as part of the KYC process.
- Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, and any other payment service providers required to process your deposits and withdrawal requests.
- Game Software Providers: phyy's game content partners may receive limited technical data (such as session tokens or Player ID references) necessary to deliver game content. These providers do not receive your full identity or financial data.
- IT and Cybersecurity Service Providers: Contracted providers of platform hosting, cybersecurity monitoring, and technical support services who process data solely on phyy's behalf under strict data processing agreements.
- Legal and Law Enforcement: Where required by a valid court order, subpoena, or lawful request from a Philippine law enforcement or government authority, phyy may disclose personal data to comply with its legal obligations.
6.2 All third parties with whom phyy shares personal data are contractually bound to process that data only for the purposes specified by phyy, to maintain appropriate security standards, and to comply with applicable data protection law.
7. International Data Transfers
7.1 Some of phyy's contracted service providers — particularly KYC verification platforms and game software providers — may process data on servers located outside the Philippines. In such cases, phyy ensures that appropriate safeguards are in place to protect your personal data in accordance with the Data Privacy Act of 2012.
7.2 Safeguards used for international data transfers may include: contractual data processing agreements incorporating the NPC's standard data protection clauses, transfer to jurisdictions recognised by the NPC as providing an adequate level of data protection, or binding corporate rules where applicable.
7.3 phyy does not transfer personal data internationally unless there is a legitimate operational necessity to do so, and all such transfers are subject to phyy's DPO oversight.
8. Data Retention
8.1 phyy retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or for as long as required by applicable law, whichever is longer. The general retention periods applied by phyy are as follows:
| Data Category | Retention Period |
|---|---|
| Account registration data | Duration of account + 5 years after closure |
| KYC identity documents | Duration of account + 5 years after closure (AML requirement) |
| Financial transaction records | 5 years from date of transaction (AML Act) |
| Gaming activity logs | 3 years from date of activity |
| Customer support records | 3 years from last interaction |
| Marketing consent records | Until consent is withdrawn, then 1 year |
| Analytics and technical logs | 13 months on a rolling basis |
8.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the data subject's identity. Anonymised and aggregated data may be retained indefinitely for platform analytics and business reporting purposes.
9. Data Security
9.1 phyy implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:
- SSL/TLS encryption for all data transmitted between your device and phyy's servers.
- Encryption of sensitive data at rest, including KYC documents and financial account references.
- Role-based access controls ensuring that phyy personnel can only access personal data that is necessary for their specific role.
- Multi-factor authentication for phyy staff accounts with access to personal data systems.
- Regular penetration testing and vulnerability assessments of the phyy platform.
- Contractual security requirements imposed on all third-party processors handling phyy player data.
- An internal data breach response procedure aligned with the NPC's 72-hour breach notification requirement.
9.2 Despite phyy's security measures, no internet transmission or electronic storage system is completely secure. phyy encourages Players to use strong, unique passwords for their phyy accounts, enable two-factor authentication where available, and notify phyy immediately if they suspect their account has been compromised.
9.3 In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected Players, phyy will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected Players without undue delay as required by the DPA.
10. Children's Privacy
10.1 The phyy platform is strictly intended for individuals aged 21 and above. phyy does not knowingly collect personal data from any individual below the age of 21. The 21-year minimum age requirement is enforced through mandatory KYC verification during account onboarding.
10.2 If phyy becomes aware that personal data has been collected from an individual below the age of 21, the relevant account will be immediately suspended, any deposited funds will be returned in accordance with PAGCOR requirements, and all personal data associated with the underage account will be securely deleted.
10.3 Parents or guardians who believe a minor may have registered on phyy are urged to contact the phyy support team at [email protected] immediately so that the matter can be investigated and resolved promptly.
11. Marketing Communications
11.1 phyy may send you promotional communications — including bonus offers, tournament announcements, and new game launches — by email or SMS where you have provided your explicit consent to receive such communications at the time of account registration or subsequently through your account preferences.
11.2 You may withdraw consent for marketing communications at any time by:
- Clicking the "Unsubscribe" link included in any phyy marketing email.
- Updating your communication preferences in the phyy account settings dashboard.
- Contacting phyy's support team at [email protected] and requesting removal from all marketing lists.
11.3 Withdrawal of consent for marketing communications will not affect transactional communications — such as deposit confirmations, withdrawal notifications, account security alerts, and mandatory regulatory notices — which phyy may send regardless of your marketing preferences as these are necessary for the operation of your account.
12. Third-Party Links
12.1 The phyy platform may contain links to third-party websites or services operated by phyy's partners, payment providers, or game software suppliers. These links are provided for convenience and operational purposes only.
12.2 phyy does not control the privacy practices of third-party websites and is not responsible for their content or data handling. phyy encourages Players to review the privacy policies of any third-party websites they visit through links on the phyy platform. This Privacy Policy applies solely to data collected by phyy and the phyy platform.
13. Amendments to This Policy
13.1 phyy may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. The "Last Updated" date at the top of this document indicates when the most recent revision was made.
13.2 Where changes are material — for example, where phyy begins processing personal data for a new purpose or sharing data with a new category of third party — phyy will notify registered Players via email or in-platform notification before the changes take effect.
13.3 Continued use of the phyy platform after the effective date of any amendment constitutes acceptance of the revised Privacy Policy. If you do not agree with the revised Policy, you should close your phyy account and cease using the platform before the effective date of the change.
14. Complaints
14.1 If you believe that phyy has processed your personal data in a manner that is inconsistent with the Data Privacy Act of 2012 or this Privacy Policy, you have the right to lodge a complaint with phyy's Data Privacy Officer at [email protected]. phyy will acknowledge your complaint within 72 hours and aim to provide a substantive response within 30 calendar days.
14.2 If you are not satisfied with phyy's response to your complaint, you have the right to escalate the matter to the National Privacy Commission (NPC) of the Philippines through the NPC's official complaints process. The NPC is the supervisory authority responsible for enforcing the Data Privacy Act in the Philippines.
National Privacy Commission (Philippines): Players may file a complaint with the NPC if they believe their data privacy rights have not been upheld. The NPC's contact details and complaint procedures are publicly available through official Philippine government information channels.
15. Contact the Data Privacy Officer
15.1 For all data privacy enquiries, requests to exercise your data subject rights, or concerns about phyy's handling of your personal data, please contact phyy's designated Data Privacy Officer using the details below:
- Email: [email protected]
- Role: Data Privacy Officer, phyy
- Response Time: Acknowledgement within 72 hours; substantive response within 30 calendar days
- Support Hours: 24 hours a day, 7 days a week, Philippine Standard Time
15.2 When contacting the DPO to exercise a data subject right, please include your registered phyy email address, a description of your request, and a copy of a valid government-issued ID so that phyy can verify your identity before acting on the request. This verification step is required to protect your data from unauthorised access by third parties.
Regulatory Context: phyy is regulated by the Philippine Amusement and Gaming Corporation (PAGCOR) and operates in compliance with Republic Act No. 10173 (Data Privacy Act of 2012) and Republic Act No. 9160 (Anti-Money Laundering Act, as amended). phyy's data processing practices are subject to audit by PAGCOR and oversight by the National Privacy Commission.
Your Data Is Protected. Now Let's Play.
phyy takes your privacy seriously — and your gaming experience even more so. Slots, live dealer tables, bingo, sabong, and sports betting, all in one PAGCOR-regulated platform built for Filipino players. GCash and PayMaya deposits accepted. 21+ only.
Gambling involves financial risk. Play responsibly. For players 21 and above only. Regulated by PAGCOR.