phmaca Privacy Policy

1. Data Controller

The data controller responsible for your personal information collected through the phmaca platform (accessible at phmaca.app) is phmaca's licensed operating entity, which holds a valid PAGCOR interactive gaming licence and is registered to conduct online gaming operations in the Philippines.

phmaca is registered with the National Privacy Commission (NPC) of the Philippines in accordance with the requirements of the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations. For all data privacy enquiries, please contact our Data Protection Officer at [email protected].

2. Personal Data We Collect

phmaca collects the following categories of personal data from Players and prospective Players:

2.1 Registration Data

• Full legal name (as it appears on your Philippine government-issued ID);
• Date of birth (for age verification — phmaca requires all Players to be 21 years of age or older);
• Philippine mobile number;
• Email address;
• Username and encrypted password (passwords are never stored in plaintext);
• Residential address in the Philippines.

2.2 Identity Verification (KYC) Data

• Copy of a valid Philippine government-issued ID (PhilSys National ID, driver's licence, passport, SSS/GSIS ID, or PRC ID);
• Selfie photograph for facial matching against the submitted ID, where required;
• Proof of address documents, where required for enhanced due diligence under PAGCOR or AMLC regulations.

2.3 Financial Data

• GCash account number linked to your phmaca wallet;
• PayMaya account details, where applicable;
• Philippine bank account details (BPI, BDO, Metrobank, or other Philippine banks) used for deposit or withdrawal;
• Transaction history: deposit amounts, withdrawal requests, and game wagering records, retained as required by PAGCOR and the Anti-Money Laundering Council (AMLC).

2.4 Technical & Usage Data

• IP address and geolocation data (used to verify Philippine residency and comply with PAGCOR jurisdiction requirements);
• Device type, operating system, and browser information;
• Session logs: login timestamps, session duration, pages visited, and features used;
• Game activity logs: games played, bet amounts, outcomes, and session history.

2.5 Communications Data

• Records of customer support interactions via live chat or email;
• Responses to surveys or promotions, where you voluntarily participate;
• Complaints and dispute records.

3. How We Collect Your Data

phmaca collects personal data through the following means:

• Directly from you — when you register an Account, complete KYC verification, make a deposit or withdrawal, contact customer support, or participate in a promotion;
• Automatically through the Platform — through cookies, server logs, and similar tracking technologies when you use the phmaca website or mobile web app;
• From payment processors — GCash, PayMaya, and Philippine banking partners transmit transaction confirmation data to phmaca for wallet reconciliation;
• From identity verification service providers — third-party KYC providers may cross-reference your submitted ID documents against Philippine government databases as permitted under applicable law.

4. Purposes of Data Processing

phmaca processes your personal data for the following purposes:

5. Legal Basis for Processing

Under the Data Privacy Act of 2012 and its Implementing Rules, phmaca processes personal data on the following legal bases:

• Contractual necessity — processing required to perform the gaming services contract between phmaca and the Player, including Account management, payments, and game delivery;
• Legal obligation — processing required to comply with PAGCOR licence conditions, Republic Act No. 9160 (Anti-Money Laundering Act) as amended, NPC registration requirements, and other applicable Philippine law;
• Legitimate interests — fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by the Player's data protection rights;
• Consent — marketing communications and non-essential cookies, where you have provided clear, informed consent that you may withdraw at any time.

6. Data Sharing & Disclosure

phmaca does not sell or rent your personal data to any third party. We share personal data only in the following circumstances:

6.1 Regulatory Authorities

phmaca is required to provide transaction records, player data, and suspicious transaction reports to PAGCOR, the Anti-Money Laundering Council (AMLC), and other Philippine government authorities, in accordance with our licence conditions and applicable law. We comply with all lawful requests from Philippine law enforcement and regulatory bodies.

6.2 Service Providers

phmaca engages third-party service providers who process data on our behalf under data processing agreements. These include KYC and identity verification providers, payment processors (GCash/PayMaya/banking partners), IT infrastructure and cloud service providers, and customer support platform operators. All service providers are contractually bound to process data only for the purposes specified by phmaca and to implement appropriate security measures.

6.3 Game Providers

Game providers (such as JILI, PG Soft, Pragmatic Play, and Evolution Gaming) receive limited technical data necessary to deliver games and verify game outcomes. They do not receive financial data or full KYC documentation unless required for specific regulatory audits.

6.4 Cross-Border Transfers

Some of phmaca's service providers and game providers are located outside the Philippines. Where personal data is transferred internationally, phmaca ensures that adequate data protection safeguards are in place, consistent with NPC guidelines on cross-border data transfers.

7. Cookies & Tracking Technologies

phmaca uses cookies and similar tracking technologies on the Platform. The categories of cookies used are:

• Strictly necessary cookies — essential for Platform operation, including session authentication and security tokens. These cannot be disabled.
• Functional cookies — used to remember your preferences such as language settings and lobby display options.
• Analytics cookies — used to understand how Players navigate the Platform, which games are most popular, and where technical issues occur. Analytics data is aggregated and does not identify individual players by name.
• Marketing cookies — used to deliver relevant promotional content to phmaca Players. These cookies are only set with your consent.

You may manage your cookie preferences through the phmaca cookie settings panel, accessible from the Platform footer. Disabling non-essential cookies will not affect your ability to access games or account features.

8. Data Retention

phmaca retains personal data for the following periods:

• Account and KYC data — retained for the duration of your Account and for a minimum of five (5) years following Account closure, as required by PAGCOR licence conditions and Philippine AML regulations;
• Transaction and game activity records — retained for a minimum of five (5) years from the date of the transaction, consistent with AMLC reporting obligations;
• Customer support communications — retained for three (3) years from the date of the interaction;
• Marketing consent records — retained until you withdraw consent, plus one (1) year to demonstrate the prior existence of consent;
• Technical logs — retained for twelve (12) months from generation, unless a longer retention period is required for an ongoing investigation or dispute.

Following the expiry of the applicable retention period, phmaca will securely delete or anonymise your personal data, unless a longer retention period is required by applicable Philippine law.

9. Data Security

phmaca implements the following technical and organisational security measures to protect your personal data:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phmaca servers;
• Passwords stored using bcrypt hashing — plaintext passwords are never stored or accessible to phmaca staff;
• Role-based access controls limiting employee access to personal data to the minimum necessary for their job function;
• Regular penetration testing and vulnerability assessments of the phmaca Platform;
• Segregated storage of financial data and KYC documents with enhanced access logging;
• Incident response procedures for personal data breaches, including NPC notification within the timeframes prescribed by Philippine law.

While phmaca takes every reasonable measure to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the security of your Account credentials and for logging out of shared devices after each session.

10. Your Data Rights

Under the Data Privacy Act of 2012 and applicable NPC regulations, you have the following rights in respect of your personal data held by phmaca:

• Right to be informed — the right to know how your personal data is being collected and processed, as set out in this Policy;
• Right of access — the right to request a copy of the personal data phmaca holds about you;
• Right to rectification — the right to request correction of inaccurate or incomplete personal data in your phmaca Account;
• Right to erasure — the right to request deletion of your personal data, subject to phmaca's legal retention obligations under PAGCOR and AML regulations;
• Right to object — the right to object to processing based on legitimate interests, including direct marketing;
• Right to data portability — the right to receive your personal data in a structured, commonly used format;
• Right to damages — the right to claim damages for any injury suffered as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of your personal data, subject to NPC adjudication.

To exercise any of these rights, please contact the phmaca Data Protection Officer at [email protected]. phmaca will respond to data subject requests within fifteen (15) working days. Requests that are manifestly unfounded or excessive may be declined, with written reasons provided.

If you are unsatisfied with phmaca's response to a data privacy concern, you may lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

11. Protection of Minors

The phmaca Platform is strictly for persons aged 21 years and above. phmaca does not knowingly collect personal data from persons under 21 years of age. If phmaca discovers or is notified that an Account has been registered by or for a person under 21, the Account will be immediately suspended, all associated data will be reviewed, and the matter will be reported to PAGCOR in accordance with our licence conditions.

If you believe a person under 21 has registered an Account on phmaca, please contact us immediately at [email protected].

12. Changes to This Privacy Policy

phmaca may update this Privacy Policy from time to time to reflect changes in our data practices, applicable Philippine law, or PAGCOR regulatory requirements. Material changes will be communicated to registered Players via SMS to their registered Philippine mobile number or by prominent notice on the Platform at least seven (7) calendar days before the revised Policy takes effect.

The "Last Revised" date at the top of this Policy will always indicate when the most recent update was made. Your continued use of the phmaca Platform following the effective date of a revised Privacy Policy constitutes your acknowledgement of the updated terms.

13. Contact & Data Protection Officer

For all data privacy enquiries, access requests, correction requests, or complaints, please contact phmaca's designated Data Protection Officer:

• Email: [email protected]
• Subject line: "Privacy / DPO Request – [Your Account Username]"
• Response time: Within 15 Philippine working days

For complaints that are not resolved to your satisfaction through phmaca's internal process, you may contact the National Privacy Commission (NPC) of the Philippines through their official website and complaints channels.