PhilMacao Privacy Policy – How We Protect Your Personal Data

1Who We Are — PhilMacao as Data Controller

PhilMacao is the data controller for all personal information processed in connection with your use of the PhilMacao online gaming platform at philmacao.net. As data controller, PhilMacao determines the purposes and means of processing your personal data and is responsible for ensuring that processing is lawful, fair, and transparent under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

PhilMacao operates under a PAGCOR (Philippine Amusement and Gaming Corporation) licence, which imposes its own obligations regarding the collection, storage, and reporting of player data for anti-money laundering (AML) compliance, player identity verification, and responsible gaming enforcement. These regulatory obligations inform several of the data processing activities described in this Privacy Policy.

2Personal Data We Collect

PhilMacao collects the minimum personal data necessary to operate a safe, PAGCOR-compliant online gaming platform. We do not collect data we don't need. The categories of data we collect are:

Identity Data

• Full legal name (as it appears on your Philippine government-issued ID)
• Date of birth
• Gender (optional, for communication personalisation)
• Government-issued ID number and a copy of the ID document (collected during KYC)
• Selfie with ID (requested where required by PAGCOR KYC protocols)

Contact Data

• Philippine mobile number (used for OTP verification and account security)
• Email address
• Residential address (collected during KYC for proof of address)

Financial Data

• GCash account number or Maya account number linked to your PhilMacao wallet
• Bank account details (for bank transfer deposits and withdrawals via BDO, BPI, UnionBank)
• Transaction history: deposit amounts, withdrawal amounts, dates, and payment method used
• Card details (for Visa/Mastercard users — card numbers are processed via our PCI-DSS certified payment partner and are never stored on PhilMacao servers)

Technical and Usage Data

• IP address at the time of registration and each subsequent login
• Device type, operating system, and browser type
• Session duration and login timestamps
• Pages visited and features used within the PhilMacao platform
• Game history: games played, bet amounts, win/loss outcomes, session lengths
• Geolocation data (city-level, used to verify Philippines-based access)

Communications Data

• Records of correspondence with PhilMacao customer support, including chat logs and email threads
• Survey responses and feedback submitted through the PhilMacao platform
• Marketing preferences (whether you have opted in or out of promotional communications)

3How We Collect Your Personal Data

PhilMacao collects your personal data through the following channels:

• Direct collection during registration: When you create a PhilMacao account, you provide identity and contact data directly through the registration form.
• KYC document submission: When you submit identity and address verification documents in compliance with PAGCOR requirements, this data is collected and stored in your account record.
• Deposit and withdrawal transactions: Financial data is collected automatically when you initiate a deposit or withdrawal through the PhilMacao platform.
• Automated technical collection: Technical data including IP addresses, device information, and session logs are collected automatically by PhilMacao systems when you access the platform, regardless of whether you are logged in.
• Cookies and tracking technologies: PhilMacao uses cookies and similar tracking technologies on the platform. See Section 8 for full details.
• Support interactions: When you contact PhilMacao customer support via live chat or email, your communications and contact details are recorded.
• Third-party sources: In limited circumstances, PhilMacao may receive identity verification data from third-party KYC verification service providers used to cross-reference the documents you submit.

4Why We Use Your Personal Data

PhilMacao uses your personal data only for the purposes described below. We do not use personal data for purposes that are incompatible with the reasons it was originally collected.

PhilMacao will never use your personal data to make automated decisions that significantly affect you — such as determining bonus eligibility or account closure — without human review of the decision where it is challenged.

5Legal Basis for Processing

Under the Philippine Data Privacy Act, every instance of personal data processing must have a lawful basis. PhilMacao relies on the following legal bases for its data processing activities:

• Contract performance: Processing necessary to provide you with a PhilMacao account, process your bets, and pay out winnings — the core service you signed up for.
• Legal obligation: Processing required by Philippine law including the PAGCOR regulatory framework, the Anti-Money Laundering Act (Republic Act No. 9160 as amended), and the Data Privacy Act itself.
• Legitimate interest: Processing for fraud prevention, platform security, and service improvement, where PhilMacao's legitimate interest in protecting the platform and its players does not override your privacy rights.
• Consent: Processing for optional purposes such as marketing emails and promotional SMS, where you have explicitly opted in. You can withdraw this consent at any time through your PhilMacao account settings or by contacting support.

6Who PhilMacao Shares Your Data With

PhilMacao does not sell your personal data to any third party. Ever. Full stop. We share data only where it is necessary to provide you with the PhilMacao service, or where we are legally required to do so. The categories of recipients are:

• PAGCOR (Philippine Amusement and Gaming Corporation): As our licensing authority, PAGCOR may require access to player data for audit, compliance, and regulatory oversight purposes. PhilMacao is legally obligated to provide this access when directed to do so under the terms of our operating licence.
• Payment service providers: GCash, Maya, GrabPay, Coins.ph, and banking partners receive the minimum financial data necessary to process your deposit or withdrawal transaction. These providers operate under their own data privacy obligations.
• KYC verification partners: Third-party identity verification services may cross-reference the documents you submit against official data sources to confirm their authenticity. These providers are bound by data processing agreements with PhilMacao.
• Cloud infrastructure and security providers: PhilMacao uses secure cloud hosting and fraud detection services. Providers access data only as necessary to deliver those services and under strict contractual data protection obligations.
• Law enforcement and Philippine courts: PhilMacao will disclose personal data to Philippine law enforcement agencies, the AMLC (Anti-Money Laundering Council), or courts when legally compelled to do so by valid court order, subpoena, or regulatory directive.

7Data Retention

PhilMacao retains your personal data only for as long as it is necessary for the purposes it was collected and to comply with our legal obligations. Specific retention periods are:

• Active account data: Retained for the duration of your account and for 5 years after account closure, as required by PAGCOR regulations and the Anti-Money Laundering Act for transaction records.
• KYC documents: Retained for 5 years after the account relationship ends, as required by PAGCOR licence conditions.
• Financial transaction records: Retained for a minimum of 5 years in accordance with Philippine banking and AML regulations.
• Customer support records: Retained for 3 years after the last interaction, to support dispute resolution.
• Marketing preferences and consent records: Retained for 3 years after last opt-in or until consent is withdrawn, whichever is sooner.
• Technical and log data: Retained for 12 months on active systems, then archived for up to 3 years for fraud investigation purposes.

When data reaches its retention limit and no longer needs to be held for legal or regulatory purposes, PhilMacao securely deletes or anonymises it. Anonymised data (where it is no longer possible to identify you from the data) may be retained indefinitely for statistical and analytical purposes.

8Cookies & Tracking Technologies

PhilMacao uses cookies and similar tracking technologies on the platform. A cookie is a small text file placed on your device when you visit a website. PhilMacao uses the following types:

• Essential cookies: Required for the platform to function. These include session management cookies that keep you logged in during your active session, and security cookies that help prevent fraudulent account access. You cannot opt out of essential cookies while using the PhilMacao platform.
• Functional cookies: Store your preferences such as language settings, preferred payment method, and responsible gaming limit reminders. These can be disabled in your browser settings but doing so may affect your experience.
• Analytics cookies: Help PhilMacao understand how the platform is used in aggregate — which pages are visited most, where players encounter difficulties, and how game loading performance can be improved. Data collected by analytics cookies is anonymised. PhilMacao does not use third-party advertising analytics.
• Security and fraud detection cookies: Help PhilMacao identify suspicious login patterns, unusual device changes, and potential fraud indicators. These are part of the platform's security infrastructure.

You can manage cookie settings through your browser. Disabling essential cookies will prevent you from accessing the PhilMacao platform. For more information on managing cookies on common Philippine browsers (Chrome on Android, Safari on iOS), consult your browser's help section.

9Security Measures

PhilMacao takes the security of your personal data seriously. The technical and organisational measures we use to protect your information include:

• SSL/TLS encryption: All data transmitted between your device and PhilMacao servers is encrypted in transit using industry-standard TLS 1.2 or higher. The padlock in your browser confirms this is active.
• Encrypted data storage: Sensitive personal data including ID documents and financial records are encrypted at rest on PhilMacao's secure servers.
• Access control: Access to player personal data within PhilMacao is restricted on a need-to-know basis. Staff are granted only the minimum level of data access necessary for their role.
• Two-factor authentication: PhilMacao uses OTP verification via your registered Philippine mobile number for account access and withdrawal requests.
• Regular security audits: The PhilMacao platform undergoes periodic security reviews and penetration testing to identify and address vulnerabilities.
• PCI-DSS compliance: Card payment processing is handled by PCI-DSS certified payment partners. PhilMacao does not store card numbers on its own servers.

10Children's Privacy — Under-21 Policy

PhilMacao does not knowingly collect personal data from individuals under the age of 21. The PhilMacao platform is strictly for adults aged 21 and above, in compliance with Philippine gaming regulations and the PAGCOR licensing requirements applicable to online gaming platforms.

If PhilMacao becomes aware that personal data has been collected from a person under 21, the account will be immediately suspended, all data associated with the underage registration will be deleted (except where retention is required for regulatory reporting purposes), and the registration will be reported to PAGCOR as required by our operating licence.

If you believe a minor has created a PhilMacao account, please contact us immediately at support@philmacao.net so the situation can be investigated and resolved promptly.

11Your Data Rights Under Philippine Law

As a data subject under the Philippine Data Privacy Act, you have the following rights with respect to your personal data held by PhilMacao. These are not abstract rights — they are enforceable under Philippine law and PhilMacao is obligated to respond to valid requests:

• Right to be informed: You have the right to know what personal data PhilMacao collects about you, why it is collected, how long it will be retained, and who it may be shared with. This Privacy Policy fulfils that obligation. If you need further clarification on any point, contact our DPO.
• Right to access: You may request a copy of the personal data PhilMacao holds about you. We will provide this within 15 business days of a verified request, in a readable format.
• Right to correction: If any personal data PhilMacao holds about you is inaccurate or incomplete, you have the right to request correction. Corrections to identity documents may require you to re-submit updated KYC materials.
• Right to erasure: You may request deletion of your personal data where it is no longer needed for the purpose for which it was collected, or where you withdraw consent (for consent-based processing). PhilMacao may be unable to delete data where retention is required by Philippine law, specifically transaction records under the Anti-Money Laundering Act.
• Right to object: You have the right to object to the processing of your personal data for marketing purposes at any time. You may also object to other forms of processing based on legitimate interest, where you have grounds based on your particular situation.
• Right to data portability: You may request your personal data in a structured, commonly used, machine-readable format. This right applies primarily to data you provided directly to PhilMacao and which is processed by automated means on the basis of your consent or a contract.
• Right to lodge a complaint: If you believe PhilMacao has breached your data privacy rights under Philippine law, you may lodge a complaint with the National Privacy Commission (NPC) through their official channels.

To exercise any of these rights, send a written request to support@philmacao.net with the subject line "Data Privacy Request." You may be asked to verify your identity before the request is processed. PhilMacao will acknowledge your request within 3 business days and respond fully within 15 business days.

12International Data Transfers

Where PhilMacao uses cloud infrastructure, game software providers, or technical service providers that are based outside the Philippines, your data may be transferred to and processed in countries other than the Philippines. When this occurs, PhilMacao ensures that appropriate safeguards are in place in accordance with the Philippine Data Privacy Act's requirements for cross-border data flows.

These safeguards include data processing agreements that require recipient parties to maintain data protection standards equivalent to those required under Philippine law, and, where applicable, reliance on the adequacy of recipient country data protection frameworks as assessed by the National Privacy Commission.

PhilMacao does not transfer your personal data to jurisdictions that have no data protection framework in place without explicit contractual safeguards covering the standards in this Privacy Policy.

13Third-Party Links

The PhilMacao platform may contain links to third-party websites including payment provider portals (GCash, Maya) or PAGCOR's official regulatory pages. Once you leave the PhilMacao platform and visit a third-party site, this Privacy Policy no longer applies. Those sites operate under their own separate privacy policies, which PhilMacao has no control over.

PhilMacao recommends reviewing the privacy policy of any third-party site you visit from a PhilMacao link, particularly if you are submitting personal information to that third party. PhilMacao is not responsible for the privacy practices or content of linked external websites.

14Updates to This Privacy Policy

PhilMacao reviews this Privacy Policy regularly and updates it when our data processing practices change, when Philippine data privacy regulations are amended, or when PAGCOR issues guidance that affects how we handle player data. Material changes will be communicated to registered players through email notification or an in-platform notification on your next login.

The version of this Privacy Policy that applies to you is always the current version published at philmacao.net/privacy-policy. If you continue using the PhilMacao platform after a privacy policy update, you are considered to have accepted the revised policy. If you do not accept a material change, you may close your account by contacting support — PhilMacao will process the closure and any remaining verified balance will be returned to you.

Previous versions of the PhilMacao Privacy Policy are archived and available on request from our DPO for record-keeping transparency.

15Contact Our Data Protection Officer

For any question, concern, or formal request related to your personal data at PhilMacao, contact our Data Protection Officer directly:

• Email: support@philmacao.net — Subject: "Data Privacy Request"
• Response time: Acknowledgement within 3 business days; full response within 15 business days
• Live Chat: Available within the PhilMacao platform during operational hours for general queries. Formal data rights requests must be submitted by email for our records.

If you are not satisfied with PhilMacao's response to a data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC) through their official government channels. The NPC has jurisdiction over privacy complaints against all organisations operating in the Philippines under the Data Privacy Act.