Privacy Policy – philsot

1. Overview

This Privacy Policy ("Policy") describes how philsot ("philsot," "we," "us," or "our"), the operator of the online gaming platform at philsot.club ("Platform"), collects, uses, stores, discloses, and protects the personal information of individuals ("Members," "Users," or "you") who access or use the Platform.

philsot is committed to protecting the privacy and security of the personal data entrusted to it by Filipino players and all other users of the Platform. This Policy is drafted in compliance with the Republic of the Philippines Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as administered by the National Privacy Commission ("NPC"). By accessing the Platform, creating an account, or using any service offered by philsot, you acknowledge that you have read and understood this Policy and consent to the collection, processing, and use of your personal information as described herein.

2. Personal Data We Collect

philsot collects personal information through the following categories:

2.1 Registration Data. When you create a philsot account, we collect: full legal name, date of birth, email address, Philippine mobile number, and a chosen username and password (stored in hashed form — we do not store plain-text passwords).

2.2 Identity Verification (KYC) Data. Prior to processing any withdrawal, philsot is required to verify Member identity. KYC data collected includes: government-issued ID type and number, a photograph or scan of the ID, and where required, a selfie photograph for liveness verification. Accepted Philippine government IDs include PhilSys National ID, SSS/UMID, BIR ID, PRC ID, and driver's license.

2.3 Financial Data. philsot collects transactional data including deposit amounts, withdrawal requests, payment method type (e.g., GCash, Maya, BPI, BDO, Metrobank), and transaction reference numbers. philsot does not store full payment account credentials — GCash and Maya integrations use tokenized payment flows managed by the respective payment service providers.

2.4 Gaming Activity Data. We collect records of all game sessions, bets placed, game outcomes, bonus usage, and account balance history. This data is retained for regulatory compliance, dispute resolution, and responsible gaming monitoring purposes.

2.5 Technical and Device Data. When you access the Platform, we automatically collect: IP address, browser type and version, operating system, device type, referring URL, session duration, pages visited, and general geographic location derived from IP address. This data is collected via server logs and first-party analytics tools.

2.6 Communications Data. Records of communications between you and philsot's support team — including live chat transcripts and email correspondence — are retained for quality assurance and dispute resolution purposes.

3. How We Use Your Personal Data

philsot uses the personal data collected for the following purposes:

• Account Management: Creating, maintaining, and securing your philsot account; verifying your identity; processing login authentication including two-factor authentication.
• Transaction Processing: Processing deposits, withdrawals, bonus credits, and refunds; reconciling financial records; generating transaction receipts and account statements.
• Regulatory Compliance: Fulfilling obligations under the Data Privacy Act of 2012, Anti-Money Laundering Act (AMLA) as amended, and applicable PAGCOR guidelines — including mandatory Know Your Customer (KYC) verification, suspicious transaction reporting to the AMLC, and age verification.
• Responsible Gaming: Monitoring gaming activity to identify patterns consistent with problem gambling; administering self-exclusion requests and deposit limit settings; age-gating access to ensure the 21+ requirement is enforced.
• Customer Support: Responding to account inquiries, technical support requests, game dispute submissions, and complaints.
• Platform Improvement: Analysing aggregated usage data to improve Platform performance, game selection, user experience, and mobile optimization for Philippine network conditions.
• Marketing Communications: With your explicit consent, sending promotional offers, bonus notifications, and news about philsot via email or SMS. You may withdraw consent at any time by contacting support or using the unsubscribe mechanism in any marketing email.
• Fraud Prevention and Security: Detecting and investigating unauthorized account access, multi-accounting, bonus abuse, and other fraudulent activity.

4. Legal Basis for Processing

philsot processes personal data on the following lawful bases under the Data Privacy Act of 2012:

• Contractual Necessity: Processing required to perform the service agreement between philsot and the Member — including account creation, gameplay, and payment processing.
• Legal Obligation: Processing required to comply with applicable Philippine law, including AML reporting, KYC verification, and NPC compliance requirements.
• Legitimate Interest: Processing for fraud prevention, platform security, and responsible gaming monitoring, where such interests do not override the Member's fundamental privacy rights.
• Consent: Processing for marketing communications and certain optional data uses, where the Member has provided explicit, informed, and freely given consent. Consent may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

5. Data Sharing and Disclosure

philsot does not sell, rent, or trade your personal data to third parties. We share personal data only in the following circumstances:

• Payment Service Providers: GCash, Maya, BPI, BDO, and Metrobank receive transactional data necessary to process deposits and withdrawals. These providers operate under their own privacy frameworks and applicable Philippine financial regulations.
• Game Content Providers: Certified third-party game studios receive anonymised session identifiers necessary to deliver game content. No personally identifiable registration or financial data is shared with game providers.
• Regulatory Authorities: philsot will disclose personal data to the Anti-Money Laundering Council (AMLC), National Privacy Commission (NPC), or any other Philippine regulatory authority where required by law, court order, or valid legal process.
• Service Providers: philsot engages third-party service providers for technical infrastructure, identity verification, and customer support tooling. All such providers are bound by data processing agreements that prohibit independent use of Member data and require compliance with the Data Privacy Act of 2012.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of philsot's assets, Member personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

6. Cookies and Tracking Technologies

The Platform uses first-party cookies and similar technologies for the following purposes:

• Session Cookies: Maintain your authenticated session while you are logged in to philsot. These are essential for Platform functionality and expire when you close your browser or log out.
• Preference Cookies: Store your language preferences, display settings, and game lobby configuration between sessions.
• Analytics Cookies: Collect aggregated, anonymised data about Platform usage to help philsot improve performance and user experience. No personally identifiable information is included in analytics data sets.
• Security Cookies: Support fraud detection and account security functions including login anomaly detection.

You may control cookie settings through your browser's privacy settings. Disabling session cookies will prevent you from logging in to your philsot account. Disabling other cookie categories will not affect your ability to use core Platform functionality.

7. Data Retention

philsot retains personal data for the minimum period necessary to fulfil the purposes described in this Policy, subject to the following retention schedules:

• Account Data: Retained for the duration of the Member's account plus five (5) years following account closure, consistent with AML record-keeping requirements under Philippine law.
• KYC Documentation: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Transaction Records: Retained for a minimum of five (5) years in compliance with AMLA and tax record-keeping requirements.
• Gaming Activity Logs: Retained for three (3) years for dispute resolution and responsible gaming audit purposes.
• Support Communications: Retained for two (2) years from the date of the interaction.
• Technical Logs: Retained for ninety (90) days on a rolling basis.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with philsot's data destruction procedures.

8. Data Security

philsot implements technical and organisational measures proportionate to the sensitivity of the personal data held, including:

• Transport Layer Security (TLS/HTTPS) encryption for all data in transit between your device and the Platform;
• AES-256 encryption for sensitive data at rest, including KYC documentation and financial records;
• Passwords stored as salted cryptographic hashes — philsot staff cannot retrieve plain-text passwords;
• Role-based access controls limiting staff access to personal data to those with a documented operational need;
• Regular security assessments and penetration testing of the Platform infrastructure;
• Two-factor authentication available to all Members and mandatory for all administrative staff accounts.

Despite these measures, no online platform can guarantee absolute security. In the event of a personal data breach that is likely to result in risk to your rights and freedoms, philsot will notify affected Members and the National Privacy Commission in accordance with the Data Privacy Act of 2012 and NPC Circular No. 16-03.

9. Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by philsot:

• Right to be Informed: The right to be notified of the nature and extent of personal data collected about you and the purposes for which it is processed — as fulfilled by this Policy.
• Right of Access: The right to request a copy of the personal data that philsot holds about you.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data in your account.
• Right to Erasure or Blocking: The right to request deletion or blocking of personal data where processing is unlawful or no longer necessary, subject to overriding legal retention obligations.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: The right to object to processing based on legitimate interest, including direct marketing.
• Right to Damages: The right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, or unlawfully obtained personal data, consistent with Section 16(f) of the Data Privacy Act.

To exercise any of the above rights, please contact philsot at the email address provided in Section 13. philsot will respond to verified data subject requests within fifteen (15) business days of receipt.

10. Children's Privacy and Minor Protection

The Platform is strictly intended for individuals who are twenty-one (21) years of age or older. philsot does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the mandatory KYC process prior to any withdrawal. If philsot becomes aware that personal data has been collected from an individual under 21, that account will be immediately suspended, associated data will be segregated pending deletion review, and all real-money transactions will be reversed where lawfully permissible.

Parents or guardians who believe a minor may have accessed the Platform should contact philsot immediately at the email address in Section 13 so that appropriate action can be taken without delay.

11. Cross-Border Data Transfers

philsot's primary data infrastructure is located within or proximate to the Asia-Pacific region. Where personal data is transferred outside the Philippines — including to game content providers or technical service providers operating in other jurisdictions — philsot ensures that such transfers are conducted in compliance with Section 21 of the Data Privacy Act of 2012, either through NPC-approved standard contractual clauses, adequacy assessments, or equivalent safeguards that provide a level of data protection substantially equivalent to that provided under Philippine law.

12. Policy Updates

philsot may update this Privacy Policy periodically to reflect changes in our data practices, legal obligations, or Platform functionality. The updated Policy will be posted on this page with a revised "Last updated" date. Where a change materially affects Member rights, philsot will provide advance notice via the email address registered to the affected accounts. Continued use of the Platform after the effective date of a revised Policy constitutes acceptance of the updated terms.

13. Contact and Data Privacy Officer

For questions, complaints, or data subject right requests relating to this Privacy Policy or philsot's data handling practices, please contact us using the following channels:

• Privacy and Support Email: [email protected]
• Live Chat: Available 24/7 via the chat widget on the Platform
• Response Time: Data subject requests acknowledged within 3 business days; substantive response within 15 business days

If you believe your data privacy rights have been violated and your complaint has not been satisfactorily resolved by philsot, you have the right to lodge a complaint with the National Privacy Commission of the Philippines at privacy.gov.ph.