php22 Privacy
Policy

1. Introduction

This Privacy Policy ("Policy") describes how php22 ("php22," "we," "us," or "our") — the operator of the online gaming platform at php22.org — collects, uses, stores, discloses, and protects personal information provided by users ("Players," "you," or "your") of the php22 platform and associated services.

php22 is committed to protecting the privacy and security of all personal data it processes. This Policy is issued in accordance with Republic Act No. 10173, the Philippine Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), and the regulations of the National Privacy Commission ("NPC"). It should be read together with the php22 Terms & Conditions.

By registering an account with php22, you consent to the collection and processing of your personal data as described in this Policy. If you do not agree with this Policy, you must not use the php22 platform.

2. Data Controller

The data controller responsible for your personal information is the licensed operator of php22, operating under a valid PAGCOR (Philippine Amusement and Gaming Corporation) licence. For data privacy enquiries, the designated Data Protection Officer (DPO) can be reached at:

Email: [email protected] (subject line: Data Privacy Request)
Hours: Monday to Friday, 9:00 AM – 6:00 PM (Philippine Standard Time)

All data subject requests — including requests to access, correct, delete, or port personal data — must be directed to the DPO. php22 will acknowledge receipt within 3 business days and respond within 15 business days as required under the DPA.

3. Personal Data We Collect

php22 collects the following categories of personal data, depending on how you use the Platform:

php22 does not collect sensitive personal information (as defined in Section 3(l) of RA 10173) — such as racial origin, political affiliations, health data, or religious beliefs — except where explicitly required by PAGCOR regulations or applicable law.

4. How We Collect Your Data

php22 collects personal data through the following means:

• Direct submission: Information you provide when registering an account, completing KYC, contacting support, or filling in any form on the Platform.
• Automated collection: Technical and usage data collected automatically when you access the Platform, via cookies, server logs, and similar technologies.
• Payment processors: Transaction confirmation data shared by GCash, Maya, BPI, BDO, and other payment service providers when you make deposits or withdrawals.
• Third-party verification: Identity and age verification data from government databases or third-party KYC service providers used to verify the documents you submit.
• Game providers: Aggregated gaming activity data from certified game providers whose software is integrated into the php22 Platform.

5. Purpose and Legal Basis for Processing

php22 processes your personal data on the following legal bases as specified under the DPA:

• Performance of a contract: Processing necessary to create and manage your Account, process deposits and withdrawals, and provide the gaming services you have requested.
• Compliance with a legal obligation: Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160), the Anti-Terrorism Financing Act (RA 10168), and tax obligations under the Bureau of Internal Revenue (BIR).
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and product improvement, where our interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications and non-essential analytics, where we have obtained your explicit consent. You may withdraw consent at any time by contacting support or adjusting your Account notification preferences.

6. Data Sharing and Disclosure

php22 does not sell personal data. We share personal data only in the following circumstances:

• Service providers: Third-party vendors who process data on our behalf, including payment processors (GCash / Maya / BPI), KYC verification providers, cloud hosting services, customer support platforms, and game software providers. All service providers are bound by data processing agreements that restrict use to the specified purpose.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), the National Privacy Commission (NPC), and other competent Philippine government authorities where disclosure is required by law or regulatory direction.
• Law enforcement: Where required by valid legal process, court order, or to protect the rights, property, or safety of php22, its players, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all assets of php22, personal data may be transferred to the successor entity, subject to the same privacy protections outlined in this Policy.

7. International Data Transfers

Some of php22's service providers (e.g., cloud infrastructure, game software providers) may be located outside the Philippines. Where personal data is transferred internationally, php22 ensures that such transfers are subject to appropriate safeguards — including contractual clauses approved by the NPC or equivalent standards — to maintain a level of data protection equivalent to that provided under RA 10173.

php22 will not transfer personal data to any jurisdiction that does not provide an adequate level of protection without implementing the appropriate safeguards required under the DPA and its IRR.

8. Data Retention

php22 retains personal data for as long as necessary to fulfil the purposes set out in this Policy, unless a longer retention period is required or permitted by law. Specific retention periods are as follows:

• Account and KYC data: Retained for the duration of the account plus 5 years following account closure, in compliance with PAGCOR licensing requirements and AML obligations under RA 9160.
• Transaction records: Retained for 5 years from the date of the transaction, as required by the BIR and AMLC.
• Gaming activity logs: Retained for 2 years from the date of the session.
• Support communications: Retained for 2 years from the date of last interaction.
• Marketing consent records: Retained until consent is withdrawn, plus 1 year.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. Anonymised aggregate data (from which individuals cannot be identified) may be retained indefinitely for analytics purposes.

9. Cookies and Tracking Technologies

php22 uses cookies and similar technologies (web beacons, pixel tags, local storage) to operate the Platform, remember your preferences, and analyse usage. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These cannot be disabled. Examples: session authentication tokens, CSRF protection cookies.
• Functional cookies: Enhance Platform functionality by remembering your preferences (e.g., language settings, last game played). These may be disabled but doing so may affect functionality.
• Analytics cookies: Collect aggregated information about how Players use the Platform (e.g., pages visited, time on page). Used to improve the php22 experience. These are only set with your consent.
• Security cookies: Used to detect fraudulent activity, bot traffic, and unauthorised access attempts.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from accessing authenticated areas of the Platform.

10. Your Rights as a Data Subject

Under RA 10173, you have the following rights regarding your personal data held by php22:

• Right to be informed: The right to know that your personal data is being collected and processed, and the purpose thereof — as set out in this Policy.
• Right of access: The right to request a copy of the personal data php22 holds about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure: The right to request deletion of your personal data, subject to php22's legal retention obligations.
• Right to object: The right to object to processing based on legitimate interests, including direct marketing.
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission at privacy.gov.ph if you believe your data rights have been violated.

To exercise any of these rights, contact the php22 DPO at [email protected] with the subject line "Data Privacy Request" and your registered mobile number or email for identity verification. php22 will not charge a fee for data subject requests unless they are manifestly unfounded or excessive.

11. Children's Privacy and Age Restriction

The php22 Platform is strictly for adults aged 21 years and above, in compliance with PAGCOR regulations. php22 does not knowingly collect personal data from persons under 21. If you are under 21, you are prohibited from using php22 and must not submit any personal information.

If php22 becomes aware that personal data has been collected from a person under 21, that Account will be closed immediately and all personal data will be deleted without undue delay. If you believe a minor may have registered on php22, please contact support at [email protected] immediately.

12. Security Measures

php22 implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Key measures include:

• TLS 1.3 encryption for all data in transit between your device and php22 servers.
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records.
• Multi-factor authentication for administrative access to production systems.
• Regular penetration testing and security audits by independent third-party security firms.
• Access controls ensuring that only authorised personnel with a legitimate need can access personal data, on a least-privilege basis.
• Automated monitoring systems for anomalous access patterns and potential data breaches.

While php22 implements industry-standard security measures, no system is completely impenetrable. Players are encouraged to use strong, unique passwords for their php22 accounts and to enable two-factor authentication (2FA) in Account settings to reduce the risk of unauthorised access.

13. Third-Party Links

The php22 Platform may contain references to third-party services (e.g., GCash, Maya payment screens) that are operated by separate entities with their own privacy policies. php22 is not responsible for the privacy practices of third-party services. When you are redirected to a third-party service (e.g., to complete a GCash payment), their privacy policy governs the processing of any data you provide on their platform.

14. Amendments to this Policy

php22 reserves the right to amend this Privacy Policy at any time to reflect changes in law, regulatory requirements, or Platform operations. Material changes will be communicated to Players via email to the registered address or via a prominent notice on the Platform at least 7 days before the changes take effect, except where immediate amendment is required by law.

The date of the most recent revision is indicated at the top of this Policy. Continued use of the php22 Platform after the effective date of any amendment constitutes acceptance of the revised Policy. We encourage Players to review this Policy periodically.

15. Contact and Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the php22 Data Protection Officer:

Email: [email protected] (Subject: Data Privacy Request)
Support Hours: Daily, 8:00 AM – 12:00 MN (Philippine Standard Time)

You also have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you are unsatisfied with how php22 has handled your personal data. The NPC can be reached at their official government website.

This Privacy Policy was last reviewed and updated in June 2026. The current version is always available at php22.org/privacy-policy. php22 is committed to protecting your data and upholding your rights under Philippine data privacy law.