phcsh Casino Privacy Policy

This Privacy Policy ("Policy") describes the personal data practices of phcsh ("phcsh," "we," "us," or "our") with respect to information collected from users ("you," "User," or "Player") who access and use the phcsh online gaming platform at phcsh.vip and any associated mobile interfaces or APIs (collectively, the "Platform").

phcsh is committed to handling your personal data responsibly, transparently, and in accordance with all applicable data protection laws in the Republic of the Philippines, including Republic Act No. 10173 (the Data Privacy Act of 2012), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission ("NPC"). phcsh also complies with data handling requirements imposed by the Philippine Amusement and Gaming Corporation ("PAGCOR") as part of the regulatory framework under which phcsh operates.

By registering an account on phcsh or using any of the Platform's services, you acknowledge that you have read, understood, and consent to the collection and processing of your personal data as described in this Policy. This Policy is incorporated by reference into phcsh's Terms & Conditions.

For the purposes of the Data Privacy Act of 2012 and this Policy, the personal information controller responsible for your data is the legal entity operating phcsh.vip. As the personal information controller, phcsh determines the purposes and means of processing your personal data and is accountable for all data processing activities conducted in connection with the Platform.

phcsh has designated a Data Protection Officer ("DPO") as required under the Data Privacy Act. The DPO oversees phcsh's data privacy compliance program, handles data subject access requests, and serves as the primary point of contact for the National Privacy Commission on all data protection matters.

For all privacy-related inquiries, requests to exercise your data subject rights, or data breach notifications, contact the phcsh Data Protection Officer at:

[email protected] Subject line: "Data Privacy Request – [your registered mobile number / email]"

phcsh collects personal data that is adequate, relevant, and limited to what is necessary for the specified purposes described in Section 5. The categories of data collected are as follows:

3.1 — Registration & Identity Data

3.2 — Financial & Payment Data

phcsh collects the following financial data in connection with deposit and withdrawal transactions: GCash or Maya account reference numbers, bank account numbers (for BPI, BDO, Metrobank withdrawals), transaction reference IDs issued by third-party payment processors, and deposit and withdrawal amounts with timestamps. phcsh does not store full credit card numbers. Payment data necessary for transaction processing is handled by PCI-DSS compliant payment processors.

3.3 — Gaming Activity Data

For regulatory reporting, responsible gaming monitoring, and platform improvement purposes, phcsh logs: game sessions including start time, duration, games played, wager amounts, and outcomes; sports bets placed including market, odds, and result; bonus activations and wagering progress; and session frequency and time-of-day patterns.

3.4 — Technical & Device Data

phcsh automatically collects technical data when you access the Platform, including: IP address, device type and operating system version, browser type and version, mobile network operator, screen resolution, session cookies and session tokens, and geolocation data (country/region level, used for regulatory compliance — phcsh does not collect precise GPS location).

3.5 — Communications Data

Records of your communications with phcsh customer support — including live chat transcripts, email correspondence, and support ticket content — are retained for quality assurance, dispute resolution, and compliance purposes.

phcsh collects personal data through the following channels:

• Direct collection: Information you provide during account registration, KYC verification, deposit/withdrawal forms, and communications with customer support;
• Automatic collection: Technical and device data collected automatically when you access phcsh.vip through browser logs, session cookies, and server-side logging systems;
• Payment processors: Transaction confirmation data received from GCash, Maya, BPI, BDO, Metrobank, and other payment service providers following deposit or withdrawal authorization;
• Identity verification services: Where phcsh engages a third-party KYC provider to verify the authenticity of government-issued identification documents, results of that verification are shared with phcsh to update your account status;
• Anti-fraud systems: Device fingerprinting and behavioral analytics data generated by phcsh's fraud prevention systems to detect account takeover, bonus abuse, and money laundering patterns.

phcsh processes your personal data only for specific, legitimate purposes. The table below sets out the processing purposes, the data used for each purpose, and the legal basis under the Data Privacy Act of 2012:

phcsh does not use your personal data for any purpose incompatible with the purposes listed above. Where a new purpose arises, phcsh will seek your consent or establish an alternative lawful basis before processing proceeds.

phcsh does not sell, rent, or trade your personal data to any third party for marketing, advertising, or commercial purposes. Disclosure of your data to third parties is limited to the categories described below, each subject to contractual data protection obligations or statutory requirements:

6.1 — Regulatory Authorities

phcsh is required by Philippine law and PAGCOR regulations to disclose player data to the Philippine Amusement and Gaming Corporation (PAGCOR), the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), and other competent Philippine government authorities upon receipt of a lawful request, court order, or pursuant to mandatory regulatory reporting obligations. Such disclosures are made to the minimum extent required by the applicable legal obligation.

6.2 — Payment Service Providers

Transaction processing requires phcsh to share payment instructions and account identifiers with Philippine payment service providers including GCash (operated by Globe Fintech Innovations), Maya (PayMaya Philippines), and accredited banking partners (BPI, BDO, Metrobank). These processors receive only the data strictly necessary to execute and verify transactions and are bound by their own regulatory obligations under BSP supervision.

6.3 — KYC and Identity Verification Partners

Where phcsh engages a third-party identity verification provider to authenticate government-issued IDs or conduct enhanced due diligence, your identity documents and verification data are transmitted to that provider under a data processing agreement. The provider processes your data solely on phcsh's instructions and is prohibited from using it for any independent purpose.

6.4 — Game Content Providers

Game providers whose titles are accessible through the phcsh lobby (including JILI, PG Soft, and Pragmatic Play) may receive a player session token and game-specific identifiers to enable game play. These providers do not receive your personal identity information, mobile number, financial details, or any data beyond what is technically necessary to render the game session.

6.5 — Professional Advisers

phcsh's legal counsel, external auditors, and compliance consultants may access personal data to the extent necessary to provide professional services, subject to applicable professional confidentiality obligations.

phcsh retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents re-identification. Anonymized data may be retained for statistical and analytical purposes without limitation.

phcsh implements technical and organizational security measures appropriate to the sensitivity of the personal data processed and consistent with the requirements of the Data Privacy Act of 2012 and NPC Circular 16-01 (Security of Personal Data in Government Agencies; applied by phcsh as a best-practice standard for private entities).

8.1 — Technical Measures

• Transport Encryption: All data transmitted between your device and phcsh servers is encrypted using TLS 1.2 or higher (256-bit encryption), preventing interception in transit;
• Data at Rest: Sensitive data stored on phcsh servers (including identity records, payment references, and KYC documents) is encrypted at rest using AES-256;
• Access Controls: Access to personal data within phcsh's systems is restricted to authorized personnel on a need-to-know basis, enforced through role-based access controls and multi-factor authentication for internal systems;
• Password Storage: Account passwords are not stored in plain text — they are hashed using a one-way cryptographic function;
• Intrusion Detection: phcsh operates continuous network monitoring and intrusion detection systems to identify and respond to unauthorized access attempts.

8.2 — Organizational Measures

• Data protection training for all personnel with access to personal data;
• Contractual data protection obligations imposed on all third-party processors and service providers;
• Regular privacy impact assessments for new processing activities;
• A documented data breach response procedure meeting NPC notification requirements.

8.3 — Data Breach Notification

In the event of a personal data breach that is likely to result in a real risk of harm to affected data subjects, phcsh will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with Section 20(f) of the Data Privacy Act and NPC Circular 16-03.

phcsh uses cookies and similar tracking technologies on phcsh.vip to support platform functionality, maintain your session state, and analyze aggregate usage patterns. The following categories of cookies are used:

9.1 — Strictly Necessary Cookies

These cookies are essential for the Platform to function and cannot be disabled. They include session authentication tokens, security tokens that prevent CSRF attacks, and temporary cookies that maintain your login state between pages. No consent is required for strictly necessary cookies as they are required for the delivery of the service you have requested.

9.2 — Analytics Cookies

phcsh uses first-party analytics to understand how Filipino players navigate the Platform — which pages are visited most frequently, where navigation issues occur, and how features are used. This data is aggregated and anonymized and does not identify individual players. These cookies can be disabled through your browser settings, though doing so may affect platform performance.

9.3 — Preference Cookies

Preference cookies remember your settings — such as game display preferences, notification settings, and language preferences — to improve your experience on return visits. These cookies expire at the end of your browser session or after a defined period.

9.4 — Cookie Management

You can manage or delete cookies through your browser settings at any time. Deleting session cookies will sign you out of your phcsh account. For instructions on managing cookies in your specific browser, refer to your browser's help documentation. phcsh does not respond to "Do Not Track" signals at this time, but will review this position if the NPC issues specific guidance on DNT compliance for Philippine platforms.

Under the Data Privacy Act of 2012, you have the following rights as a data subject with respect to personal data that phcsh holds about you. These rights are subject to applicable legal limitations and identity verification requirements before phcsh can process a request.

• Right to Be Informed: You have the right to be informed of the existence of processing of your personal data, the purpose for which it is processed, the scope and method of processing, and the identity and contact details of the personal information controller — all of which are described in this Policy;
• Right to Access: You may request a copy of the personal data phcsh holds about you, including gaming history, account information, and KYC records;
• Right to Rectification: You may request correction of inaccurate or incomplete personal data in your phcsh account;
• Right to Erasure / Blocking: You may request deletion or blocking of your personal data where the processing is unlawful, the data is no longer necessary for the original purpose, or consent has been withdrawn and no other legal basis applies — subject to phcsh's statutory retention obligations under PAGCOR and AMLA regulations;
• Right to Object: You may object to processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests where your individual circumstances justify it;
• Right to Data Portability: Where technically feasible and where processing is based on consent or contract, you may request that phcsh provide your personal data in a structured, commonly used, machine-readable format;
• Right to Damages: You are entitled to compensation for any damages sustained as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data by phcsh;
• Right to Complain: You have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe that phcsh has violated your rights under the Data Privacy Act.

To exercise any of the above rights, submit a written request to the phcsh Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request." phcsh will acknowledge your request within five (5) business days and complete the request within thirty (30) days, or notify you of the reason for any extension beyond that period.

Age verification is a mandatory step in the phcsh registration process. Any person found to have provided false date-of-birth information to circumvent the 21+ requirement will have their account immediately closed, and any balance associated with that account may be forfeited in accordance with phcsh's Terms & Conditions and applicable PAGCOR regulations.

If phcsh becomes aware that personal data has been collected from a person under the age of 21 without parental consent, it will immediately delete that data and close the associated account. If you are a parent or guardian who believes that your minor child has provided personal data to phcsh, please contact our Data Protection Officer at [email protected] immediately.

Some of the third-party service providers used by phcsh — including game content providers (such as JILI and PG Soft, which operate technical infrastructure in multiple jurisdictions) and certain cloud infrastructure providers — may process or store data on servers located outside the Philippines.

Where personal data is transferred to a recipient in a country that does not have data protection laws equivalent to the Data Privacy Act of 2012, phcsh ensures that appropriate safeguards are in place, which may include: contractual clauses in data processing agreements that impose Data Privacy Act-equivalent obligations on the recipient; verification that the recipient jurisdiction's legal framework provides an adequate level of protection as assessed by the NPC; or obtaining your explicit consent to the specific transfer.

All core account, identity, and financial data is processed on servers within the Philippines or in jurisdictions with equivalent data protection standards as verified by phcsh's Data Protection Officer. Game session data transmitted to third-party game providers is limited to the minimum necessary for game rendering and is governed by contractual data protection clauses.

phcsh may send you promotional communications about bonuses, new games, and platform features via SMS to your registered mobile number or email to your registered email address. Such communications are sent only where you have provided consent during registration or have subsequently opted in through your account notification settings.

13.1 — Opt-Out

You may withdraw your consent to receive marketing communications at any time by updating your notification preferences in your phcsh account settings. Once you opt out, phcsh will cease sending marketing messages within 5 business days. Note that opting out of marketing communications does not affect the delivery of transactional messages — such as deposit confirmations, withdrawal status updates, and account security alerts — which are sent as part of the service and are not subject to opt-out.

13.2 — No Third-Party Marketing

phcsh does not share your personal data with third parties for the purpose of enabling those third parties to send you marketing communications. Your contact information and player profile are used solely for phcsh's own communications.

phcsh may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance from the NPC, changes in phcsh's data processing practices, or for other operational reasons. The date of the most recent update is displayed at the top of this page.

Where a proposed change to this Policy materially affects your rights or the manner in which phcsh processes your personal data, phcsh will notify you via SMS to your registered mobile number or by a prominent notice on the phcsh.vip platform before the change takes effect, and will seek renewed consent where the legal basis for processing requires it.

We encourage you to review this Privacy Policy periodically. Your continued use of the phcsh Platform following the effective date of any update constitutes your acceptance of the revised Policy.

For all privacy-related matters — including data subject rights requests, complaints, consent withdrawal, data breach reports, or general inquiries about phcsh's data processing practices — contact the phcsh Data Protection Officer using the details below:

Data Protection Officer — phcsh
[email protected]
Subject: "Data Privacy Request – [registered mobile or email]"
Responses within 5 business days; requests completed within 30 days

If you believe phcsh has failed to handle your personal data in accordance with the Data Privacy Act of 2012, you may file a complaint with the National Privacy Commission of the Philippines:

National Privacy Commission
3/F Core G, GSIS Headquarters Building, Financial Center, Diokno Boulevard, Pasay City, Metro Manila
Website: privacy.gov.ph  |  For online complaints, use the NPC Complaints Management System.