phbing Privacy Policy

1. Introduction

This Privacy Policy ("Policy") is published by phbing ("phbing," "we," "our," "us"), the operator of the online gaming platform accessible at phbing.net, in accordance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR), as administered by the National Privacy Commission (NPC) of the Philippines.

This Policy applies to all personal information collected from individuals ("data subjects," "you") who access or use the phbing platform, including registered players, visitors to phbing.net, and individuals who contact phbing support. It governs how phbing processes personal information in connection with account registration, gameplay, deposits and withdrawals, customer support, responsible gaming compliance, and regulatory reporting.

By creating a phbing account, accessing the platform, or otherwise providing your personal information to phbing, you acknowledge that you have read and understood this Policy and consent to the processing of your personal information as described herein.

2. Data Controller Identity

For the purposes of the Data Privacy Act of 2012, phbing acts as the personal information controller in respect of personal data collected through the phbing platform. phbing determines the purposes and means by which personal data is processed in connection with the operation of the online casino platform.

Where phbing engages third-party service providers (such as payment processors, game studios, or KYC verification providers) to process personal data on phbing's behalf, those parties act as personal information processors subject to contractual obligations that require them to process data only on phbing's documented instructions and in accordance with appropriate security measures.

Contact information for phbing's Data Protection Officer (DPO) is provided in Section 15 of this Policy.

3. Categories of Personal Data Collected

phbing collects and processes the following categories of personal information about its players and platform users:

4. How We Collect Personal Data

4.1 Direct Collection

The majority of personal data phbing holds about you is provided directly by you during:

• Account registration at phbing.net/phbing-login;
• KYC verification document submission;
• Deposit and withdrawal requests through GCash, Maya, or Philippine banks;
• Communications with phbing customer support via live chat or email;
• Completion of responsible gaming tools such as self-exclusion or limit-setting forms.

4.2 Automated Collection

phbing automatically collects certain technical and behavioural data when you access the platform, including your IP address, device identifiers, browser information, session timestamps, pages visited, and game activity logs. This data is collected through standard web server logs, session tracking technologies, and first-party analytics tools.

4.3 Third-Party Sources

phbing may receive personal data about you from authorised third parties, including:

• Payment processors (e.g., GCash, Maya, bank clearing systems) to confirm transaction completion;
• KYC verification service providers who cross-reference identity documents against authoritative databases;
• Fraud prevention and anti-money laundering screening services;
• PAGCOR and other regulatory authorities, in connection with player exclusion registers or regulatory enquiries.

5. Purposes of Processing & Legal Bases

phbing processes personal data for the following purposes, each underpinned by a lawful basis under the Data Privacy Act of 2012:

• Account Management and Service Delivery — Processing your registration data, authentication credentials, and account settings to provide you with access to the phbing platform. Legal basis: performance of a contract (your phbing account agreement).
• Payment Processing — Processing deposits and withdrawals via GCash, Maya, BDO, BPI, Metrobank, UnionBank, 7-Eleven Cliqq, USDT TRC20, and Coins.ph. Legal basis: performance of a contract; compliance with financial regulations.
• Identity Verification (KYC) — Verifying your identity and age (21+) in compliance with PAGCOR guidelines and the Anti-Money Laundering Act (RA 9160, as amended). Legal basis: legal obligation.
• Fraud and AML Compliance — Monitoring transactions and account activity for indicators of fraud, money laundering, and terrorist financing, and reporting suspicious activity to AMLC as required. Legal basis: legal obligation.
• Responsible Gaming — Monitoring gameplay patterns for responsible gaming risk indicators, administering self-exclusion and limit tools, and supporting player protection obligations under PAGCOR's responsible gaming framework. Legal basis: legal obligation; legitimate interest.
• Customer Support — Handling enquiries, complaints, and disputes submitted through phbing's live chat and email support channels. Legal basis: performance of a contract; legitimate interest.
• Platform Security and Fraud Prevention — Detecting multi-accounting, bot activity, technical exploits, and other fraudulent or prohibited conduct. Legal basis: legitimate interest.
• Service Improvement and Analytics — Analysing aggregated, anonymised usage data to improve platform performance, game selection, and user experience. Legal basis: legitimate interest.
• Marketing Communications — Sending you promotional messages about phbing bonuses and offers by SMS to your registered number, where you have given consent. You may withdraw this consent at any time by contacting phbing support. Legal basis: consent.
• Legal and Regulatory Compliance — Meeting reporting, record-keeping, and disclosure obligations under Philippine law, PAGCOR regulations, and court orders. Legal basis: legal obligation.

6. Disclosure and Sharing of Personal Data

6.1 Service Providers

phbing shares personal data with third-party service providers who assist in operating the platform and delivering services to you. These providers are contractually required to process your data only on phbing's instructions and to maintain appropriate security measures. They include:

• Payment processing partners (GCash API, Maya, bank payment gateways);
• Game content providers (JILI Games, Pragmatic Play, PG Soft, and other certified studios) — limited to player ID, session data, and bet/win records necessary for game operation;
• KYC and identity verification service providers;
• Cloud infrastructure and hosting providers who store platform data in secured data centres;
• Customer support platform providers who facilitate live chat and ticket management.

6.2 Regulatory and Law Enforcement Authorities

phbing is legally obligated to share personal data with the following bodies where required by applicable Philippine law:

• PAGCOR — In connection with licensing compliance, player complaints, and regulatory audits;
• AMLC (Anti-Money Laundering Council) — For suspicious transaction reports (STRs) and covered transaction reports (CTRs) required under RA 9160;
• Courts and Law Enforcement — In response to valid subpoenas, court orders, or lawful requests from Philippine law enforcement agencies;
• National Privacy Commission (NPC) — In connection with data breach notifications and NPC investigations.

6.3 No Sale of Personal Data

phbing does not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes. Any data sharing beyond what is described in this Section 6 requires your prior explicit consent.

7. Cross-Border Data Transfers

Some of phbing's service providers — particularly certified game studios and certain cloud infrastructure providers — may be located outside the Philippines. Where personal data is transferred to recipients in other countries, phbing ensures that appropriate safeguards are in place to protect your data to a standard equivalent to Philippine data protection requirements.

These safeguards include:

• Data processing agreements incorporating standard contractual clauses consistent with NPC guidance;
• Transfers only to countries or organisations with adequate data protection standards as assessed by phbing's Data Protection Officer;
• Encryption of data in transit and at rest for all cross-border transfers.

Where phbing's payment partners (such as GCash and Maya) operate exclusively within the Philippines, your financial data is processed domestically and is not subject to cross-border transfer.

8. Data Retention Periods

phbing retains personal data for as long as necessary to fulfil the purposes described in this Policy and to comply with applicable legal and regulatory obligations. The following minimum retention periods apply:

• Account and registration data — Retained for the duration of your account and for a minimum of five (5) years following account closure, as required by PAGCOR and AML regulations;
• KYC / identity verification documents — Retained for a minimum of five (5) years following the last transaction on your account, or longer if required by AMLC reporting obligations;
• Financial transaction records — Retained for a minimum of five (5) years following each transaction, as required under RA 9160 and BSP regulations applicable to payment processors;
• Gameplay logs — Retained for a minimum of three (3) years for dispute resolution and responsible gaming monitoring purposes;
• Customer support records — Retained for two (2) years following the closure of the relevant support ticket;
• Marketing consent records — Retained for as long as the consent remains active, plus one (1) year following withdrawal of consent.

Upon expiry of applicable retention periods, personal data that is no longer required is either permanently deleted from phbing's systems or anonymised so that it can no longer be attributed to an identifiable individual.

9. Security Measures

phbing implements technical and organisational security measures appropriate to the risk posed by the processing of your personal data. These measures include:

• Transport Layer Security (TLS): All data transmitted between your device and phbing's servers is encrypted using TLS 1.2 or higher (256-bit SSL), preventing interception in transit;
• Encryption at Rest: Sensitive personal data — including KYC documents and financial details — is stored in encrypted form using industry-standard encryption algorithms;
• Access Controls: Access to personal data within phbing is restricted to personnel with a legitimate operational need, enforced through role-based access controls and multi-factor authentication on administrative systems;
• Penetration Testing: phbing's platform undergoes regular security assessments, including vulnerability scanning and penetration testing by qualified security professionals;
• Audit Logging: All access to personal data by phbing staff is logged and periodically reviewed to detect any unauthorised or anomalous access;
• Incident Response: phbing maintains a documented data breach response procedure, including notification protocols for the NPC and affected data subjects as required under the DPA.

10. Your Data Subject Rights

Under the Data Privacy Act of 2012 and its IRR, you have the following rights in relation to your personal information held by phbing. You may exercise these rights by contacting phbing's Data Protection Officer using the details in Section 15.

phbing will respond to verifiable data rights requests within fifteen (15) calendar days from the date of receipt of a complete and valid request. Where the complexity of the request requires additional time, phbing will notify you within the initial 15-day period and provide an estimated completion date.

11. Cookies and Similar Technologies

11.1 Types of Cookies Used

phbing uses first-party cookies and similar browser-based technologies to support the operation and improvement of the platform. The cookies used by phbing fall into the following categories:

• Strictly Necessary Cookies — Required for the platform to function. These include session cookies that keep you logged in to your phbing account during a visit. These cannot be disabled without impairing platform functionality.
• Performance and Analytics Cookies — Used to collect aggregated, anonymised data about how players use phbing, such as which pages are visited most frequently and how long game sessions last. This helps phbing identify and fix usability issues.
• Functional Cookies — Used to remember your preferences, such as your preferred game lobby view or language settings.

11.2 Cookie Management

You can manage non-essential cookies through your browser settings. Most modern mobile and desktop browsers — including Chrome on Android and Safari on iOS — provide controls to view, block, or delete cookies. Blocking strictly necessary cookies will impair your ability to log in to and use phbing.

phbing does not use third-party advertising cookies or tracking pixels to serve targeted advertisements on other websites or apps.

12. Minors and Age Restriction

phbing's platform is strictly intended for adults who are at least twenty-one (21) years of age, consistent with PAGCOR's regulations for online casino gaming in the Philippines. phbing does not knowingly collect or process personal data from individuals under the age of 21.

If phbing becomes aware that personal data has been collected from an individual under 21, that data will be deleted and the associated account will be closed immediately, with any real money balance returned to the source of funds following identity verification of the registered holder.

13. Personal Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected data subjects, phbing will comply with its notification obligations under the Data Privacy Act of 2012 and the NPC's breach notification rules, which include:

• Notifying the National Privacy Commission (NPC) within 72 hours of becoming aware of a notifiable breach, to the extent feasible;
• Notifying affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms, using the contact information phbing holds for each affected individual;
• Documenting all personal data breaches, regardless of whether notification is required, in phbing's internal breach register.

Breach notifications to affected players will be sent via SMS to the registered Philippine mobile number on file. The notification will describe the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures phbing has taken or proposes to take.

14. Updates to This Privacy Policy

phbing reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, NPC guidance, PAGCOR requirements, or phbing's data processing activities. When material changes are made, phbing will notify registered players by SMS to their registered Philippine mobile number at least seven (7) days before the updated Policy takes effect.

The current version of this Policy is always accessible at phbing.net/privacy-policy. The "Last Updated" date at the top of this document reflects the date of the most recent revision. Continued use of phbing following the effective date of an updated Policy constitutes acceptance of the updated terms.

15. Contact & Data Protection Officer

phbing has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. If you wish to exercise your data subject rights, have questions about this Policy, or wish to raise a privacy concern, please contact phbing's DPO through the following channels:

• Email: [email protected] (plain text — not a clickable link) — include "Privacy / DPO" in the subject line of your message
• Live Chat: Available 24 hours a day, 7 days a week at phbing.net — request transfer to the Data Protection team

phbing's DPO is registered with the National Privacy Commission (NPC) of the Philippines in accordance with NPC Circular 16-01. Players who are not satisfied with phbing's response to a privacy concern may escalate their complaint to the NPC.

phbing's customer service team and DPO operate on Philippine Standard Time (PST, UTC+8). Written requests submitted to the DPO email address will receive an acknowledgement within two (2) business days.