ph350 Privacy Policy

1.1 ph350 operates an online gaming platform available to eligible players in the Republic of the Philippines. In the course of operating this platform, ph350 necessarily collects and processes personal information about its players and visitors. This Policy sets out ph350's practices with respect to that personal information.

1.2 This Policy applies to all personal information collected by ph350 through: (a) the ph350.co website; (b) ph350 mobile applications; (c) customer support interactions via Live Chat, email, or any other channel; (d) payment transactions conducted through the ph350 platform; and (e) any other interaction you have with ph350.

1.3 This Policy is intended to comply with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the relevant issuances of the National Privacy Commission of the Philippines. ph350's data practices are also shaped by PAGCOR's requirements for player record-keeping and anti-money laundering compliance under Philippine law.

1.4 This Policy should be read together with ph350's Terms & Conditions and Responsible Gaming Policy, both of which are available on ph350.co.

2.1 For the purposes of the Data Privacy Act of 2012, ph350 is the personal information controller in respect of personal data collected through the ph350 platform. ph350 determines the purposes for which and the means by which personal data is processed.

2.2 ph350 has designated a Data Protection Officer (DPO) as required by the DPA. You may contact the ph350 DPO with any privacy-related enquiry or request using the contact details set out in Section 13 of this Policy.

2.3 Where ph350 engages third-party service providers to process personal data on its behalf (for example, payment processors and IT service providers), ph350 acts as the personal information controller and those service providers act as personal information processors. ph350 ensures, through contractual arrangements, that such processors apply appropriate data protection standards consistent with the DPA.

3.1 ph350 collects the following categories of personal information about registered players and, in some cases, visitors:

3.2 ph350 does not intentionally collect sensitive personal information as defined under the DPA (such as health data, religious beliefs, or political opinions) unless specifically required for responsible gaming compliance or legal obligations, in which case such collection will be disclosed to you at the time of collection.

3.3 You are under no obligation to provide personal information to ph350. However, failure to provide information that is required for registration, KYC verification, or payment processing will prevent you from accessing the relevant features of the ph350 platform.

4.1 ph350 processes your personal information only where it has a lawful basis to do so under the Data Privacy Act of 2012. The following table sets out the purposes for which ph350 processes personal data and the corresponding lawful basis:

4.2 Where ph350 relies on your consent as the lawful basis for processing (for example, for marketing communications), you have the right to withdraw that consent at any time by contacting ph350 support or adjusting your account notification preferences. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

5.1 ph350 does not sell, rent, or trade your personal information. ph350 may share your personal data with the following categories of recipients, strictly as necessary and subject to appropriate data protection safeguards:

• PAGCOR and Philippine regulatory authorities — ph350 is obligated to provide player data to PAGCOR upon request and to comply with PAGCOR's data reporting requirements. This includes reporting on player activity, betting patterns where required, and self-exclusion records.
• Philippine law enforcement and government agencies — ph350 may disclose personal data to the Anti-Money Laundering Council (AMLC), the National Bureau of Investigation (NBI), the Philippine National Police (PNP), and other competent authorities where required by law, court order, or lawful request.
• Payment processors and e-wallet providers — ph350 shares the minimum necessary financial information with licensed Philippine payment service providers (such as GCash, Maya, and InstaPay-connected banks) to process your transactions.
• Identity verification service providers — ph350 may use PAGCOR-compliant third-party KYC and identity verification services to process your government ID and verify your identity and age. These providers process your data solely on ph350's instructions.
• IT and platform service providers — ph350 uses third-party technology providers for server infrastructure, data storage, cybersecurity, and gaming software. These providers process personal data only as instructed by ph350 and are bound by data processing agreements.
• Professional advisers — ph350's legal advisers, auditors, and compliance consultants may have access to personal data where strictly necessary for the provision of their professional services, subject to professional confidentiality obligations.

5.2 ph350 requires all third parties to whom it discloses personal data to implement appropriate technical and organisational security measures and to use the data only for the specified purpose.

6.1 ph350 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

6.2 The following general retention periods apply:

• Account and identity data: Retained for the life of your account and for a minimum of five (5) years following account closure, in accordance with PAGCOR requirements and Philippine anti-money laundering law.
• Transaction and financial data: Retained for a minimum of five (5) years following each transaction, as required by the Anti-Money Laundering Act and BSP regulations applicable to payment service providers.
• Gaming activity data: Retained for the life of your account and for a minimum of three (3) years following account closure, or longer where required by PAGCOR reporting obligations.
• Communications and support records: Retained for three (3) years from the date of the communication, or longer where the communication is relevant to an ongoing dispute or legal matter.
• Responsible gaming records (including self-exclusion): Retained for the full duration of any applicable exclusion period and for a minimum of five (5) years thereafter.
• Technical and log data: Retained for twelve (12) months, unless retained longer for security investigation purposes.

6.3 Where personal data is no longer required for any lawful purpose, ph350 will securely delete or anonymise it in accordance with the DPA's requirements.

7.1 ph350 implements appropriate technical and organisational security measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and ph350's servers;
• Encryption of sensitive personal and financial data at rest within ph350's database infrastructure;
• Role-based access controls that limit employee access to personal data on a strictly need-to-know basis;
• Multi-factor authentication for ph350 staff accounts with access to personal data systems;
• Regular security audits, penetration testing, and vulnerability assessments conducted by independent security specialists;
• Intrusion detection and monitoring systems operating on a continuous basis;
• Regular staff training on data privacy and information security obligations under the DPA.

7.2 While ph350 takes these measures seriously, no data transmission over the internet or data storage system can be guaranteed to be 100% secure. You are responsible for keeping your ph350 login credentials confidential and for maintaining the security of the devices you use to access ph350.

7.3 In the event of a personal data breach that is likely to pose a risk to your rights and freedoms, ph350 will notify the National Privacy Commission of the Philippines within 72 hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with the DPA's breach notification requirements.

8.1 ph350 uses cookies and similar tracking technologies on ph350.co and in the ph350 mobile application. Cookies are small text files stored on your device that help ph350 recognise you, remember your preferences, keep your session secure, and understand how you use the platform.

8.2 ph350 uses the following categories of cookies:

• Strictly necessary cookies — Essential for the operation of the ph350 platform, including maintaining your login session, processing transactions, and ensuring platform security. These cannot be disabled.
• Functional cookies — Remember your preferences such as language settings, display options, and game lobby layout preferences to improve your experience.
• Analytics cookies — Used by ph350 to understand how players navigate and use the platform in aggregate, enabling ph350 to improve platform performance and usability. Where possible, analytics data is anonymised.
• Marketing cookies — Used only with your consent to deliver relevant promotional content and to measure the effectiveness of ph350's marketing campaigns.

8.3 You can manage your cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using ph350, though some functional features may be affected. Strictly necessary cookies cannot be disabled as they are required for the platform to operate.

9.1 As a data subject under Republic Act No. 10173, you have the following rights with respect to your personal data held by ph350:

• Right to be Informed — The right to be informed whether personal data pertaining to you is being processed, and to receive information about how it is being processed. This Policy is part of how ph350 fulfils this obligation.
• Right to Access — The right to reasonable access to your personal data upon written request, including information about the source of such data, the purposes of processing, and any recipients to whom it has been disclosed.
• Right to Correction — The right to dispute the inaccuracy or error in your personal data and to request correction. ph350 will correct inaccurate data promptly upon verification.
• Right to Erasure or Blocking — The right to suspend, withdraw, or request the removal of your personal data where it is no longer necessary for the purpose for which it was collected, except where ph350 is required to retain it under a legal obligation.
• Right to Data Portability — The right to obtain a copy of your personal data in a structured, commonly used, and machine-readable format, subject to technical feasibility.
• Right to Object — The right to object to the processing of your personal data in certain circumstances, including for direct marketing purposes. Where you object to direct marketing, ph350 will cease processing your data for that purpose immediately.
• Right to File a Complaint — The right to lodge a complaint with the National Privacy Commission of the Philippines if you believe ph350 has violated your rights under the DPA.

9.2 To exercise any of the above rights, please contact ph350's Data Protection Officer using the contact details in Section 13. ph350 will respond to your request within thirty (30) days of receipt, or within such other period as may be required by the NPC's guidelines. ph350 may ask you to verify your identity before processing your request.

9.3 Certain rights are subject to limitations and exceptions. For example, ph350 may be unable to erase personal data that it is required to retain under its PAGCOR, AMLA, or other legal obligations, even if you request erasure.

10.1 The ph350 platform is strictly for persons aged 21 years and above. ph350 does not knowingly collect personal information from persons under the age of 21. If ph350 discovers that it has inadvertently collected personal data from a person under 21, it will promptly delete such data and close the associated account.

10.2 ph350 employs age verification measures as part of the KYC process to enforce this requirement. Where ph350 has reasonable grounds to believe that an account holder may be under 21, it will suspend the account pending age verification and may request additional documentary evidence.

11.1 ph350's primary data processing infrastructure is located within the Republic of the Philippines. In certain circumstances, personal data may be transferred to or accessed by third-party service providers whose operations are located outside the Philippines — for example, global cloud infrastructure providers or international gaming software vendors.

11.2 Where such transfers occur, ph350 ensures that appropriate safeguards are in place to protect your personal data in accordance with the DPA. These safeguards may include: contractual data processing agreements incorporating the NPC's standard contractual clauses; verification that the recipient jurisdiction has an adequate level of data protection; or other mechanisms approved by the National Privacy Commission.

11.3 ph350 will not transfer your personal data to a foreign jurisdiction where such a transfer would violate Philippine law or where ph350 cannot ensure that adequate protections are in place.

12.1 ph350 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or PAGCOR regulatory requirements. The "Effective Date" at the top of this Policy indicates when the current version came into effect.

12.2 Where a change to this Policy materially affects your rights or the way ph350 uses your personal data, ph350 will notify you by posting a prominent notice on ph350.co and, where feasible, by sending a notification to your registered mobile number or email address prior to the change taking effect.

12.3 Your continued use of the ph350 platform following the effective date of any updated Privacy Policy constitutes your acknowledgment of the updated Policy. If you do not agree with any change, you should stop using ph350 and may request account closure as described in our Terms & Conditions.

13.1 For any questions, concerns, or requests relating to this Privacy Policy or ph350's data practices, please contact ph350's Data Protection Officer through the following channels:

• Live Chat: Available 24/7 via the chat icon on ph350.co. For privacy-specific matters, please select "Data Privacy / Account" as your query type.
• Email (plain text — not a link): support@ph350.co — Please include "Data Privacy Request" in the subject line.

13.2 ph350 will acknowledge your request within five (5) business days and will resolve it within thirty (30) days, unless the complexity of the request requires a longer period, in which case ph350 will notify you of the extended timeline.

13.3 If you are not satisfied with ph350's response to your privacy enquiry, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. The NPC accepts complaints at privacy.gov.ph and through its office in Manila. ph350 cooperates fully with NPC investigations and will provide any information requested by the NPC in the exercise of its regulatory functions.