Privacy Policy — 369ph

For the purposes of the Philippine Data Privacy Act of 2012 (RA 10173) and this Privacy Policy, the data controller responsible for personal information collected through the 369ph Platform is the operator of 369ph.app, a Philippine-licensed online gaming service provider operating under PAGCOR licensing guidelines, with its principal place of business in Manila, Philippines.

References to "369ph," "we," "us," or "our" in this Privacy Policy refer to this operator. References to "you," "your," or "Player" refer to any individual who accesses the Platform, registers an account, or otherwise provides personal information to 369ph.

This Privacy Policy applies to all personal information collected through the 369ph.app website, including all game interfaces, wallet features, promotional systems, and customer support channels operated under the 369ph brand.

369ph collects personal information that is necessary to provide our Services, comply with legal obligations, and maintain the security and integrity of the Platform. The categories of personal information we collect include:

A. Registration and Identity Information

• Full legal name as it appears on a government-issued ID;
• Date of birth (used to verify the 21+ age requirement under PAGCOR regulations);
• Philippine mobile number (used as primary account identifier and for OTP verification);
• Email address (used for account communications and promotional opt-ins);
• Username and encrypted account password;
• Residential address (required for KYC verification and certain withdrawal processes).

B. Identity Verification (KYC) Documents

• Scanned or photographed copy of a government-issued ID (e.g., Philippine National ID, Passport, Driver's License, SSS, UMID, or Voter's ID);
• Selfie photograph for facial comparison against the submitted ID;
• Where required for enhanced due diligence: proof of address (e.g., utility bill, bank statement).

C. Financial and Transaction Information

• GCash wallet number and/or Maya account details used for deposits and withdrawals;
• Bank account numbers (BPI, BDO, Metrobank, UnionBank) where bank transfers are used;
• Records of all deposit transactions, including amounts, timestamps, and payment method reference numbers;
• Records of all withdrawal requests, processing status, and completion timestamps;
• Wallet balance history and transaction logs.

D. Gaming Activity Information

• Complete betting history across all games (baccarat, slots, bingo, Callbreak, Monster Hi-Lo, and all other titles);
• Session start and end times, game round records, and wagering amounts;
• Bonus and promotional activity, including bonuses claimed and wagering requirement progress;
• VIP tier status and loyalty point accumulation records.

E. Technical and Device Information

• IP address and geolocation data (country and region level) at the time of login and during active sessions;
• Device type, operating system, and browser version;
• Session identifiers, login timestamps, and security event logs;
• Cookie identifiers and similar tracking data as described in Section 9.

F. Communications and Support Data

• Records of live chat conversations between you and 369ph customer support agents;
• Email correspondence submitted to 369ph;
• Feedback, complaints, and dispute records.

369ph collects personal information through the following channels and means:

• Directly from you — during account registration, KYC submission, deposit and withdrawal processing, contact with customer support, and participation in promotions;
• Automatically through Platform use — when you access the Platform, our servers and tracking technologies automatically record technical information about your device and session, as described in Section 9;
• From payment service providers — GCash, Maya, and banking partners share transaction reference data with 369ph for the purpose of matching deposits and processing withdrawals;
• From identity verification partners — third-party KYC service providers may share verification results (pass/fail status and matched data) with 369ph as part of the onboarding process;
• From regulatory and fraud-prevention databases — in compliance with PAGCOR regulations and anti-money laundering obligations, 369ph may check player data against sanction lists, self-exclusion registers, and fraud-detection databases.

369ph uses the personal information we collect for the following purposes:

Under the Philippine Data Privacy Act of 2012 (RA 10173), 369ph processes personal information on the following legal bases:

• Contractual Necessity: Processing required to perform the contract between you and 369ph — specifically the Terms and Conditions you accepted at registration — including account creation, payment processing, and game provision;
• Legal Obligation: Processing necessary to comply with applicable Philippine law, including PAGCOR licensing requirements, RA 10173, the Anti-Money Laundering Act, and related regulations;
• Legitimate Interests: Processing conducted in pursuit of legitimate interests of 369ph that do not outweigh your privacy rights — including fraud prevention, security monitoring, and platform optimization;
• Consent: Processing for marketing communications and non-essential cookies, where we rely on your express, freely given consent which may be withdrawn at any time without affecting the lawfulness of prior processing.

369ph may share your personal information with the following categories of third parties:

• Payment Service Providers: GCash (Mynt), Maya (PayMaya Philippines), GrabPay, and InstaPay/PESONet-connected banks (BPI, BDO, Metrobank) for the purpose of processing deposits and withdrawals. These providers receive only the transaction data necessary for payment processing.
• KYC and Identity Verification Providers: Third-party identity verification services that process submitted government IDs and selfie images for the purpose of fulfilling KYC obligations. These providers process data under strict contractual data protection terms.
• Game Providers: Certain game software providers who supply live casino or slot game content may receive pseudonymized player session data (session ID, bet amounts, game outcomes) for game integrity and dispute resolution purposes.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies where disclosure is required by law, regulation, or court order.
• IT and Security Service Providers: Cloud infrastructure, cybersecurity, and fraud detection service providers that process data as data processors under contractual agreements that impose data protection obligations consistent with RA 10173.
• Professional Advisors: Legal, financial, and compliance advisors who may require access to specific personal information in the course of providing professional services to 369ph, subject to professional confidentiality obligations.

In the event of a business transfer, merger, or acquisition involving 369ph, personal information held about Players may be transferred to the successor entity, subject to equivalent data protection obligations. Players will be notified of any such transfer that materially affects their privacy rights.

369ph retains personal information for as long as necessary to fulfil the purposes for which it was collected, as required by applicable law, or as necessary to establish, exercise, or defend legal claims. The following general retention periods apply:

Upon expiry of applicable retention periods, personal information will be securely deleted or anonymized so that it can no longer be associated with an individual. Where anonymization is used, the resulting data may be retained indefinitely for statistical and analytical purposes.

369ph implements a comprehensive set of technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit TLS/SSL Encryption: All data transmitted between your device and 369ph servers is encrypted using industry-standard Transport Layer Security (TLS 1.2 or higher). This applies to login credentials, payment data, and all other personal information exchanged through the Platform.
• Password Hashing: Account passwords are stored using strong one-way cryptographic hashing algorithms. 369ph never stores plaintext passwords and cannot retrieve your password — only reset it through a verified process.
• Two-Factor Authentication (2FA): Optional SMS-based 2FA is available for all 369ph accounts and is strongly recommended. 2FA requires a one-time code in addition to your password at each login, significantly reducing the risk of unauthorized account access.
• Access Controls: Access to personal information within 369ph is restricted on a strict need-to-know basis. Internal systems enforce role-based access controls (RBAC), and all staff access to personal data is logged and auditable.
• Infrastructure Security: The Platform is hosted on hardened cloud infrastructure with firewalls, intrusion detection systems, and regular security patching. Security audits and penetration testing are conducted periodically.
• Login Monitoring: Unusual login activity — such as access from new devices or IP addresses — triggers automatic security notifications to the registered mobile number on the Account.

Despite these measures, no internet transmission or electronic storage system is completely secure. In the event of a personal data breach that is likely to result in risk to your rights and freedoms, 369ph will notify affected Players and the National Privacy Commission (NPC) in accordance with the requirements of RA 10173 and its Implementing Rules and Regulations.

369ph uses cookies and similar browser-based tracking technologies to operate the Platform effectively, maintain session security, and improve the user experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for core Platform functionality — including maintaining your login session, managing wallet state, and ensuring secure authentication. These cannot be disabled without impairing Platform function.
• Functional Cookies: Used to remember your preferences, such as language settings, preferred game categories, and UI configuration choices. These persist across sessions.
• Analytics Cookies: Used to collect aggregated, anonymized data about how visitors interact with the Platform — page views, session duration, navigation paths, and feature usage. This data is used to improve Platform performance and game offerings.
• Security Cookies: Used to detect suspicious login behavior, prevent cross-site request forgery (CSRF), and support fraud prevention systems.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair core Platform functionality. Disabling analytics or functional cookies will not prevent you from accessing games or processing transactions, but may affect certain personalization features.

If 369ph discovers that personal information has been collected from an individual who is under 21 years of age, the associated account will be immediately suspended and all personal information relating to that individual will be deleted as promptly as technically feasible, subject to any overriding legal retention obligations.

If you have reason to believe that a minor has registered an account on 369ph, please contact our support team immediately at [email protected] (plain text — not a clickable link).

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal information held by 369ph:

• Right to Be Informed: The right to be told that your personal information is being or will be processed, including the purposes and scope of that processing — which this Privacy Policy fulfils.
• Right of Access: The right to request a copy of the personal information 369ph holds about you, including the purposes for which it is processed, who it is shared with, and how long it is retained.
• Right to Rectification: The right to request correction of inaccurate, incomplete, or outdated personal information held by 369ph. Certain corrections may require re-verification of identity.
• Right to Erasure (Right to be Forgotten): The right to request deletion of your personal information where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations (such as AMLA requirements).
• Right to Object: The right to object to the processing of your personal information for marketing purposes or where processing is based on legitimate interests. Objection to marketing will result in immediate cessation of promotional communications.
• Right to Data Portability: The right to receive a copy of personal information you have provided to 369ph in a structured, machine-readable format for transfer to another service provider where technically feasible.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated.

To exercise any of these rights, please contact 369ph's Data Privacy Officer through the contact details provided in Section 14. 369ph will respond to valid requests within fifteen (15) business days of receipt, subject to verification of your identity and any applicable legal limitations.

Some of the third-party service providers used by 369ph — including cloud infrastructure providers, game content providers, and KYC verification services — may process personal data outside the Philippines. Where personal information is transferred to recipients in other countries, 369ph ensures that appropriate safeguards are in place, consistent with the requirements of RA 10173 and the implementing circulars issued by the National Privacy Commission.

Such safeguards may include contractual data protection clauses, binding corporate rules, or transfers to jurisdictions recognized by the NPC as providing adequate data protection standards. By using the 369ph Platform, you acknowledge that your personal information may be processed in jurisdictions outside the Philippines as described in this section.

369ph may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform features. Material changes will be communicated to registered Players via their registered email address and/or through a prominent notice on the Platform at least 14 days before the changes take effect, where practicable.

The "Last Updated" date at the top of this page indicates when the most recent revision was made. Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should stop using the Platform and may close your Account in accordance with our Terms and Conditions.

The current version of this Privacy Policy is always available at 369ph.app/privacy-policy.

If you have any questions about this Privacy Policy, wish to exercise your data privacy rights, or need to report a suspected data breach or privacy concern, please contact 369ph's designated Data Privacy Officer (DPO):

If you are unsatisfied with 369ph's response to your privacy concern, you have the right to escalate the matter to the National Privacy Commission (NPC) of the Philippines, the authority responsible for enforcing the Data Privacy Act of 2012. The NPC's contact details and complaints procedure are available through official Philippine government information channels.