phmaya Privacy Policy

This Privacy Policy ("Policy") describes how phmaya ("we," "us," or "our") collects, uses, stores, shares, and protects the personal information of individuals ("you," "user," or "data subject") who access or use the phmaya online gaming and sports betting platform available at phmaya.biz and its associated interfaces.

phmaya operates exclusively for the Philippine market under authorization from the Philippine Amusement and Gaming Corporation (PAGCOR). All data processing activities carried out by phmaya are subject to Republic Act No. 10173, known as the Data Privacy Act of 2012 ("DPA"), the Implementing Rules and Regulations issued thereunder, and all relevant issuances by the National Privacy Commission ("NPC") of the Philippines.

This Policy applies to all personal data collected by phmaya in connection with your registration, account use, deposits, withdrawals, gameplay, customer support interactions, and marketing communications. It applies regardless of whether you access phmaya from a mobile device, desktop browser, or any other interface.

For the purposes of the Data Privacy Act of 2012 and this Policy, phmaya acts as the Personal Information Controller ("PIC") in respect of your personal data. As PIC, phmaya determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is lawful, fair, and transparent.

phmaya has designated a Data Protection Officer ("DPO") who oversees compliance with the DPA and this Policy, handles data subject rights requests, and serves as the point of contact with the National Privacy Commission. The DPO's contact details are provided in Section 16 of this Policy.

phmaya collects only the personal data that is necessary for the specific purposes described in this Policy. The categories of personal data we collect include, but are not limited to, the following:

3.1 Registration and Identity Data

• Full legal name as it appears on a government-issued identification document.
• Date of birth (used to verify that you are at least 21 years of age).
• Philippine mobile number (primary account identifier and OTP channel).
• Email address (optional, used for communications and account recovery).
• Gender (optional, for profile personalization).
• Residential address (collected during KYC for regulatory compliance).

3.2 Identity Verification (KYC) Data

• Scanned or photographed copies of government-issued photo identification (UMID, Philippine passport, driver's license, PhilSys National ID, or equivalent).
• Selfie photograph taken while holding the submitted identification document.
• Any additional documentation requested by phmaya's KYC team for enhanced due diligence purposes.

3.3 Financial and Transaction Data

• GCash account number or mobile number linked to your GCash wallet.
• Maya account number or registered mobile number.
• Bank account details (account name, account number, and bank name) where bank transfer is used as a payment method.
• Transaction history — including all deposits, withdrawals, wager amounts, game outcomes, and bonus transactions.
• Payment method verification documentation where required by AMLC regulations.

3.4 Gaming and Usage Data

• Game session logs, including games played, duration, bet amounts, and outcomes.
• Login timestamps and session duration records.
• Device type, operating system, browser type, and app version.
• IP address at the time of each login and significant platform interaction.
• Responsible gaming settings and limits configured on your account.

3.5 Communications Data

• Records of all customer support interactions, including live chat transcripts, support ticket content, and email correspondence.
• Survey responses and voluntary feedback submitted to phmaya.
• Marketing preference settings and promotional opt-in or opt-out choices.

phmaya collects personal data through the following primary channels:

• Direct Collection: Information you actively provide during account registration, KYC verification, deposit or withdrawal requests, support interactions, or when completing profile fields.
• Automated Technical Collection: Data collected automatically as you use the phmaya platform, including device identifiers, IP addresses, browser characteristics, session timing data, and in-game behavior logs generated by our platform systems.
• Cookie and Tracking Technologies: Information collected via cookies, web beacons, local storage, and similar technologies placed on your browser or device when you visit phmaya.biz. See Section 8 for full details on our cookie practices.
• Payment Processor Integration: Where you authorize a transaction via GCash, Maya, or a linked bank account, phmaya receives transaction confirmation data from the relevant payment processor necessary to credit your account and maintain records.
• Third-Party Verification Services: Where phmaya uses a third-party KYC verification provider to validate your identity document, that provider may share verification outcome data with phmaya. phmaya does not receive your raw biometric data from such providers unless you explicitly submit it directly to phmaya.

Under the Philippine Data Privacy Act, phmaya processes your personal data on the basis of one or more of the following lawful grounds, depending on the specific processing activity:

Where consent is the legal basis, you have the right to withdraw your consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal. Withdrawal of consent for processing that is necessary to operate your account may result in the inability to continue providing services.

phmaya uses the personal data it collects for the following specific purposes. We do not use your data for any purpose that is incompatible with those listed below without your prior consent.

• Account Creation and Management: To create and maintain your phmaya member account, verify your identity and age, manage your account settings, and provide you access to the platform's features.
• Transaction Processing: To process your deposits and withdrawal requests, maintain accurate transaction records, and facilitate communication with payment processors including GCash, Maya, and partner banks.
• PAGCOR and Regulatory Compliance: To fulfill phmaya's ongoing obligations under its PAGCOR license, including record-keeping of gaming activity, player identification, and reporting requirements as mandated by Philippine gaming law.
• Anti-Money Laundering (AML) Compliance: To monitor transactions for suspicious activity as required under Republic Act 9160, as amended, and to report to the Anti-Money Laundering Council where legally required.
• Responsible Gaming Compliance: To implement and monitor responsible gaming limits and self-exclusion requests, and to identify players who may be exhibiting signs of problem gambling behavior in accordance with PAGCOR's responsible gaming requirements.
• Security and Fraud Prevention: To detect and prevent fraudulent account activity, unauthorized access, bonus abuse, multi-accounting, and other prohibited conduct as defined in the Terms & Conditions.
• Customer Support: To respond to your enquiries, resolve disputes, and maintain records of your support interactions for quality assurance and compliance purposes.
• Platform Improvement: To analyze aggregate usage patterns, improve game performance, optimize the cashier flow, and develop new features based on how Filipino players interact with the platform.
• Marketing and Promotions: To send promotional offers, bonus announcements, and phmaya news to members who have opted in to marketing communications. You may withdraw consent for marketing at any time through your account settings or by contacting support.

phmaya does not sell your personal data. We share your personal data with third parties only in the following strictly defined circumstances:

7.1 Payment Processors

To process deposits and withdrawals, phmaya shares necessary transaction data with GCash (G-Xchange Inc.), Maya (PayMaya Philippines Inc.), and partner banking institutions including BPI, BDO, and Metrobank. Data shared is limited to what is required to authenticate and complete the specific transaction.

7.2 KYC Verification Providers

phmaya may engage PAGCOR-approved third-party identity verification service providers to assist with KYC document authentication. These providers act as Personal Information Processors under phmaya's supervision and are bound by data processing agreements that require compliance with the DPA.

7.3 Game Software Providers

Game providers (such as Pragmatic Play, PG Soft, and others) that supply games through phmaya's platform may receive anonymized or pseudonymized session data necessary to operate and audit their game content. These providers do not receive personally identifiable information beyond what is strictly necessary for game operation and fairness auditing.

7.4 Regulatory and Law Enforcement Authorities

phmaya will disclose personal data to PAGCOR, the Anti-Money Laundering Council, the National Privacy Commission, law enforcement agencies, or courts of law where required to do so by applicable Philippine law, regulatory requirement, valid legal process, or lawful court order. phmaya will not disclose data to such bodies beyond what is required by the specific legal obligation.

7.5 Professional Advisors

phmaya may share personal data with legal counsel, auditors, or other professional advisors where necessary to obtain professional advice, in connection with a legal proceeding, or for regulatory audit purposes. Such advisors are bound by professional confidentiality obligations.

7.6 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of phmaya's business or assets, your personal data may be transferred to the acquirer or successor entity, subject to the acquirer being bound by data protection obligations at least equivalent to those in this Policy. Affected members will be notified prior to their data being transferred.

phmaya uses cookies and similar tracking technologies to operate the platform, improve user experience, maintain security, and — where you have consented — deliver relevant promotional content.

You may manage your cookie preferences through your browser settings. Note that disabling essential cookies will prevent you from logging in to your phmaya account. Analytics and preference cookies can be disabled without affecting core functionality. Cookie consent choices can also be updated via the cookie settings panel accessible from the phmaya footer.

phmaya retains personal data only for as long as necessary to fulfill the stated purpose or to comply with a legal retention obligation. The following retention principles apply:

• Active Account Data: Personal data associated with an active phmaya account is retained for the duration of your account's existence and for a minimum period thereafter as required by PAGCOR regulations and the DPA.
• Financial Transaction Records: All financial transaction records — including deposits, withdrawals, and wager history — are retained for a minimum of five (5) years from the transaction date, in accordance with PAGCOR licensing requirements and anti-money laundering obligations under RA 9160.
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years following account closure, as required by AMLC regulations. Biometric data, where collected, is retained only for the period necessary to complete verification and then securely deleted.
• Customer Support Records: Support interaction records are retained for a period of three (3) years to facilitate dispute resolution and regulatory audit requirements.
• Marketing Data: Data held solely for marketing communications is deleted within 30 days of your withdrawal of marketing consent, except where retention is required for a different lawful purpose.
• Analytics Data: Aggregated, anonymized analytics data may be retained indefinitely as it no longer constitutes personal data once anonymization removes the ability to identify any individual.

Upon the expiry of applicable retention periods, personal data is securely deleted, destroyed, or anonymized using industry-standard data sanitization methods. Deletion requests submitted by data subjects are processed subject to applicable mandatory retention requirements — phmaya cannot delete records that it is legally required to keep.

phmaya implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include:

• Encryption in Transit: All data transmitted between your device and phmaya's servers is encrypted using TLS 1.2 or higher (256-bit SSL). No personal data is transmitted in unencrypted format.
• Encryption at Rest: Sensitive personal data held in phmaya's databases — including KYC documents, payment details, and account credentials — is stored in encrypted format using AES-256 encryption.
• Access Controls: Access to personal data is restricted to phmaya employees and contractors on a strict need-to-know basis. All access is role-based and logged. Administrative access to production systems requires multi-factor authentication.
• Penetration Testing and Vulnerability Assessments: phmaya conducts regular security assessments and penetration testing of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Incident Response Plan: phmaya maintains a documented data breach response plan and is committed to notifying the NPC and affected data subjects within 72 hours of becoming aware of a breach that is likely to cause serious harm, in accordance with NPC Circular 16-03.

As a data subject under the Philippine Data Privacy Act, you have the following rights with respect to your personal data held by phmaya. These rights are real, legally enforceable, and exercisable by contacting phmaya's Data Protection Officer as described in Section 16.

To exercise any of the above rights, submit a written request to phmaya's Data Protection Officer using the contact details in Section 16. phmaya will respond to rights requests within fifteen (15) business days of receipt. For complex requests, phmaya may extend this period by an additional fifteen (15) business days with written notification to you.

Identity verification is required before phmaya can fulfill a data subject rights request, to ensure that data is not disclosed to unauthorized parties.

If phmaya discovers or has reason to believe that a registered account belongs to a person under 21 years of age, phmaya will immediately suspend the account, conduct a review, and permanently close the account if the age violation is confirmed. Any deposited funds will be returned to the payment source following AML review.

If you are a parent or guardian and believe your child has registered on phmaya, please contact our support team or Data Protection Officer immediately. phmaya will investigate and take appropriate action, including deletion of all personal data collected from the minor, subject to mandatory regulatory retention obligations.

phmaya's primary data infrastructure is located within the Philippines or in jurisdictions offering data protection standards comparable to those required by the Philippine Data Privacy Act. Where data must be transferred to a third-party processor or partner organization located outside the Philippines — for example, a game software provider's servers — phmaya ensures that appropriate safeguards are in place, including:

• Binding data processing agreements that require the recipient to maintain data protection standards equivalent to RA 10173.
• Restricted data transfers to only the categories of personal data strictly necessary for the specific processing purpose.
• NPC notification where required under the DPA implementing rules for cross-border processing arrangements.

phmaya does not transfer your personal data to jurisdictions where the level of data protection is materially lower than that provided under Philippine law without appropriate contractual or technical safeguards in place.

The phmaya platform may contain references to third-party services — such as game provider support pages or payment processor help centers — accessed through the platform interface. This Privacy Policy applies only to personal data processed by phmaya directly. phmaya is not responsible for the privacy practices of any third-party website or service that is not operated by or on behalf of phmaya.

When you interact with a third-party service — including your GCash or Maya wallet interface during a transaction — you are subject to that party's own privacy policy and terms. phmaya recommends reviewing the privacy practices of any third-party service you use in connection with your phmaya account.

phmaya may update this Privacy Policy from time to time to reflect changes in our data processing practices, platform features, or applicable legal requirements. The effective date of the current version is displayed at the top of this page.

Where changes are material — meaning they significantly affect how phmaya processes your personal data or alter your rights under this Policy — phmaya will provide advance notice through the platform interface, by email to your registered address, or by prominent notification on phmaya.biz. Continued use of the platform after the effective date of a revised Policy constitutes your acceptance of the changes.

Previous versions of this Privacy Policy are available on request from the Data Protection Officer. phmaya recommends bookmarking this page and reviewing it periodically.

For any questions, concerns, or requests relating to this Privacy Policy or phmaya's data processing practices, or to exercise your data subject rights, please contact phmaya through the following channels:

If you are not satisfied with phmaya's response to a data subject rights request or complaint, you have the right to escalate the matter to the National Privacy Commission of the Philippines. Information on how to file a complaint with the NPC is available through official Philippine government channels.