phhappy Privacy Policy

phhappy ("phhappy", "we", "us", "our") operates an online casino and sports betting platform accessible at phhappy.org. In the course of providing our services to Filipino players across the Philippines — from Metro Manila and Makati, to Cebu City, Davao, and Quezon City — phhappy necessarily collects and processes certain personal information about our users.

This Privacy Policy ("Policy") explains in clear terms: what personal data phhappy collects, the purposes for which it is collected, how it is stored and protected, with whom it may be shared, and the rights that each data subject holds under the Data Privacy Act of 2012 (Republic Act No. 10173, hereinafter "DPA") and its Implementing Rules and Regulations.

By creating a phhappy account, making a deposit, or using any feature of the phhappy platform, you acknowledge that you have read and understood this Privacy Policy. This Policy forms part of the phhappy Terms and Conditions, and both documents should be read together.

For the purposes of the Data Privacy Act of 2012 and this Policy, phhappy is the personal information controller ("PIC") responsible for the personal data collected and processed through the phhappy platform. As PIC, phhappy determines the purposes and means of processing personal data in connection with its online gaming services.

phhappy has designated a Data Privacy Officer (DPO) who is responsible for overseeing the platform's compliance with applicable Philippine data privacy legislation, for handling player inquiries and requests relating to personal data, and for coordinating with the National Privacy Commission (NPC) as required. Contact details for the phhappy DPO are provided in Section 15 of this Policy.

phhappy collects the following categories of personal data from players and platform visitors, depending on the nature of the interaction:

phhappy collects personal data through the following channels and mechanisms:

4.1 Direct Collection

Data you actively provide to phhappy at the time of account registration, during the KYC verification process, when submitting a deposit or withdrawal request, when contacting customer support, or when opting into a promotion. This includes your name, mobile number, payment method details, and any identity documents submitted.

4.2 Automated Collection

When you access the phhappy platform — whether on mobile, desktop, or through a saved progressive web app shortcut — certain technical data is automatically collected by our servers and analytics systems. This includes your IP address, device identifiers, browser type, and session activity. This data is used primarily for security monitoring, fraud detection, and platform performance optimization.

4.3 Third-Party Sources

Where necessary for identity verification or fraud prevention, phhappy may receive data from third-party KYC verification service providers, payment processors (such as GCash or PayMaya), or fraud risk management systems. Such data is processed only for the specific purpose for which it was shared and subject to the same protections as directly collected data.

phhappy processes personal data only for the following specified, legitimate purposes:

• Account Creation and Management: Setting up, verifying, maintaining, and managing your phhappy account, including processing login credentials and OTP verifications.
• KYC and Age Verification: Verifying that all players are aged 21 or above and confirming player identity in accordance with PAGCOR regulatory requirements and the DPA.
• Payment Processing: Facilitating deposits and withdrawals via GCash, PayMaya, BDO, BPI, Metrobank, and USDT; verifying payment method ownership; processing refunds.
• Fraud Prevention and Security: Detecting and preventing unauthorized account access, fraudulent transactions, money laundering, bonus abuse, and other prohibited activities.
• Customer Support: Responding to player inquiries, resolving disputes, investigating complaints, and providing assistance through our 24/7 live chat service.
• Regulatory Compliance: Fulfilling obligations under applicable Philippine law, PAGCOR licensing conditions, and financial reporting requirements including suspicious transaction reporting to relevant Philippine authorities.
• Responsible Gaming: Monitoring player behavior for indicators of problem gambling and facilitating the application of player-requested responsible gaming tools such as deposit limits and self-exclusion.
• Platform Improvement: Analyzing aggregated, anonymized usage data to improve game performance, user experience, and platform stability.
• Marketing Communications: Sending promotional offers and platform updates to players who have not objected to receiving such communications. Players may opt out at any time through their account notification settings.

Under the Data Privacy Act of 2012, phhappy processes personal data on the following legal bases:

• Contractual Necessity: Processing required to perform the service agreement between phhappy and the player — including account management, payment processing, and game access.
• Legal Obligation: Processing required to comply with Philippine law, PAGCOR regulatory requirements, Anti-Money Laundering Act (AMLA) obligations, and any applicable court orders or lawful government directives.
• Legitimate Interests: Processing for fraud prevention, platform security, and aggregated analytics where these interests are not overridden by the player's data protection rights.
• Consent: Processing for optional purposes such as marketing communications, where consent has been expressly obtained and may be withdrawn at any time without affecting the provision of core services.

phhappy does not sell, rent, or trade personal data to any third party for commercial or marketing purposes. Personal data may be disclosed to the following categories of recipients only to the extent strictly necessary for the stated purpose:

7.1 Service Providers and Processors

Third-party service providers who assist phhappy in delivering its services — including KYC verification providers, payment processors (GCash, PayMaya, BDO, BPI, Metrobank), cloud hosting providers, cybersecurity vendors, and customer support platform operators — act as personal information processors under written agreements that require them to maintain confidentiality and implement appropriate security measures.

7.2 Game Content Providers

Game studios and providers (including JILI, PG Soft, Pragmatic Play, and others) receive limited, aggregated session data for game performance reporting and RNG certification purposes. No individually identifiable player data is shared with game providers beyond what is necessary for game functionality.

7.3 Regulatory and Law Enforcement Authorities

phhappy may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Philippine National Police (PNP), or other government authorities where required by law, court order, or where phhappy determines in good faith that such disclosure is necessary to: comply with a legal obligation; protect the rights or safety of phhappy, its players, or the public; or investigate and report suspected illegal activity.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of phhappy's business or assets, personal data may be transferred to the acquiring entity as part of the transaction, subject to the same privacy protections described in this Policy. Players will be notified of any such transfer that materially affects their data rights.

The phhappy platform uses cookies and similar tracking technologies to enhance your experience, maintain your session after login, and gather aggregated analytics about platform usage. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function — maintaining your logged-in session, processing your deposit confirmations, and ensuring security features like CSRF protection operate correctly. These cannot be disabled without impairing platform functionality.
• Performance and Analytics Cookies: Used to understand how players navigate the phhappy platform — which games are most popular, how long sessions last, and where users encounter technical issues. Data collected is aggregated and anonymized.
• Functional Cookies: Remember your preferences (such as language, last-visited game category, or notification settings) to provide a more personalized experience between sessions.
• Marketing Cookies: Used to display relevant promotional offers within the phhappy platform based on your game history and activity. These are only set where you have not objected to receiving promotional communications.

You may manage non-essential cookie preferences through your device browser settings or through the phhappy platform's notification preferences section. Note that disabling strictly necessary cookies will affect your ability to log in and use the platform normally.

phhappy implements a multi-layered technical and organizational security framework to protect personal data against unauthorized access, disclosure, alteration, or destruction. Key security measures in place include:

• SSL/TLS Encryption in Transit: All data exchanged between your device and phhappy's servers — including login credentials, payment details, and personal information — is encrypted in transit using 256-bit SSL/TLS protocols.
• Encryption at Rest: Personal data and KYC documents stored on phhappy's servers are encrypted at rest using AES-256 encryption. Encryption keys are managed separately from the encrypted data.
• Password Hashing: Account passwords are stored as one-way cryptographic hashes using bcrypt with appropriate salt rounds. phhappy staff cannot view or retrieve a player's password in plain text.
• Access Control: Access to personal data within phhappy's internal systems is governed by role-based access control (RBAC). Only personnel with a documented, legitimate operational need are authorized to access personal data, and all access is logged.
• Intrusion Detection and Monitoring: phhappy operates continuous security monitoring and intrusion detection systems to identify and respond to potential security incidents in real time.
• Data Breach Response: In the event of a personal data breach that poses a real risk of harm to affected players, phhappy will notify the National Privacy Commission within 72 hours of discovery, and will notify affected players without undue delay, as required under RA 10173.

phhappy retains personal data for no longer than is necessary for the purpose for which it was collected, or as required by applicable Philippine law and regulatory obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized such that it can no longer be attributed to an individual data subject. Where deletion is not technically feasible due to backup or archival system constraints, phhappy will isolate the data and prevent it from further active processing until deletion becomes practicable.

Under Republic Act No. 10173 and its Implementing Rules, every data subject — including all registered phhappy players — holds the following rights with respect to their personal data:

11.1 Right to Be Informed

You have the right to be informed of how phhappy processes your personal data before or at the time of collection. This Privacy Policy fulfills that obligation.

11.2 Right to Access

You may request a copy of the personal data that phhappy holds about you at any time. phhappy will respond to access requests within 15 business days of receipt of a verified request via the support channel.

11.3 Right to Correction

If any personal data phhappy holds about you is inaccurate, incomplete, or outdated, you have the right to request correction. For basic account information (contact number, email), you may update these directly in your Account Settings. For corrections to identity or KYC data, contact the support team.

11.4 Right to Erasure or Blocking

You have the right to request deletion or blocking of your personal data where: the data is no longer necessary for the original collection purpose; you withdraw consent (where consent was the legal basis); or the processing is unlawful. This right is subject to phhappy's legal retention obligations under PAGCOR regulations, AMLA, and other applicable Philippine laws — data required by law must be retained for the statutory period notwithstanding a deletion request.

11.5 Right to Object

You may object at any time to the processing of your personal data for direct marketing purposes. To opt out of marketing communications, adjust your notification preferences in Account Settings. Objecting to marketing will not affect the availability of phhappy's core gaming services.

11.6 Right to Data Portability

Where technically feasible, you have the right to receive your personal data in a structured, commonly used, machine-readable format for transmission to another controller.

11.7 Right to File a Complaint

If you believe phhappy has processed your personal data in violation of the Data Privacy Act of 2012, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines. Before filing a complaint with the NPC, we encourage players to first contact phhappy's Data Privacy Officer (see Section 15) to allow us to address the concern directly.

To exercise any of the rights described above, contact the phhappy Data Privacy Officer through the 24/7 live chat on the phhappy platform or by written communication to the support contact details provided. phhappy will verify your identity before processing any data subject rights request to protect against unauthorized requests.

The phhappy platform is strictly restricted to individuals aged 21 years and above. phhappy does not knowingly collect personal data from individuals under the age of 21. This age restriction applies across all phhappy services — casino games, sports betting, bingo, e-sabong, and all other platform features.

If phhappy discovers that personal data has been collected from an individual who is under 21 years of age, the Account will be immediately suspended, the collected data will be securely deleted to the extent permitted by law, and any deposits will be returned to the original payment method. The KYC verification process, which requires submission of a government-issued Philippine ID, serves as phhappy's primary age verification mechanism.

Parents and guardians who have reason to believe that a minor may have created a phhappy account should contact the support team immediately for investigation and remediation.

The phhappy platform may contain references or links to third-party payment services (such as GCash or PayMaya) that operate under their own privacy policies. When you click through to a third-party payment interface to complete a transaction, you are subject to that third party's privacy policy and terms of service, not this phhappy Privacy Policy.

phhappy is not responsible for the privacy practices, security standards, or content of third-party platforms. Players are encouraged to review the privacy policies of any third-party services they use in connection with their phhappy account, particularly payment processors and mobile wallet providers.

phhappy reserves the right to update or revise this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, platform features, or data processing practices. Material changes to this Policy will be communicated to registered players by:

• A notification within the phhappy platform dashboard;
• An SMS notification to the player's registered Philippine mobile number; or
• An email notification to the player's registered email address where one has been provided.

The "Effective Date" at the top of this Policy will be updated to reflect the most recent revision. For non-material changes (such as clarifications of existing practices or minor formatting updates), phhappy may update the Policy without specific individual notification, relying on players' responsibility to review the Policy periodically.

Continued use of the phhappy platform following the effective date of any revised Privacy Policy constitutes acceptance of the updated terms. If you do not agree with any changes, you may close your phhappy account and withdraw your remaining balance before the effective date of the revision.

For any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by phhappy, please contact us through the following channels:

• 24/7 Live Chat: Available directly on the phhappy platform — the fastest channel for privacy inquiries. Average response time is under 2 minutes.
• Email: [email protected] — for formal written privacy requests or DPO correspondence. Please include "Data Privacy Request" in your subject line.

phhappy's Data Privacy Officer will acknowledge receipt of formal data subject rights requests within 3 business days and will respond substantively within 15 business days, consistent with NPC guidelines.