phrich Privacy Policy

phrich ("phrich," "we," "us," or "the Company") operates the online gaming platform accessible at phrich.cam. As a personal data controller under the Data Privacy Act of 2012 (Republic Act No. 10173, hereinafter "DPA") and its Implementing Rules and Regulations, phrich is responsible for ensuring that all personal data it processes is handled lawfully, fairly, transparently, and securely.

This Privacy Policy ("Policy") describes the categories of personal data phrich collects from players and visitors, the lawful bases and purposes for which that data is processed, the conditions under which it may be shared with third parties, the period for which it is retained, the security measures phrich applies to protect it, and the rights you hold as a data subject under Philippine law.

By registering an account with phrich, accessing the Platform, or otherwise providing personal information to phrich, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein, to the extent that such consent is the applicable legal basis. Where processing is carried out on other lawful bases (such as contractual necessity or legal obligation), your consent is not required, but you remain entitled to full transparency regarding that processing as provided in this Policy.

1. Scope and Application

This Policy applies to all personal data processed by phrich in connection with the operation of the Platform, including data collected from:

• Registered phrich players and account holders
• Visitors who access phrich.cam without registering an account
• Individuals who contact phrich's support team via live chat or email
• Individuals who participate in phrich promotions, surveys, or marketing communications

This Policy applies to personal data in all formats — digital, electronic, and physical records — held by or on behalf of phrich. It applies regardless of whether the data subject is located in Metro Manila, Cebu, Davao, or any other part of the Philippines, or accessing the Platform from any other location.

This Policy does not apply to the data practices of third-party service providers, game providers, payment processors, or other external parties that phrich may engage with in the course of its operations. Those parties operate under their own privacy policies, which phrich encourages you to review where applicable. phrich requires all third-party service providers to process personal data only as directed by phrich and in compliance with applicable data protection laws.

2. Legal Basis for Processing

phrich processes personal data only where a lawful basis for processing exists under the Data Privacy Act of 2012 and its Implementing Rules and Regulations. The lawful bases phrich relies upon are:

• Consent (Section 12(a), DPA): Where you have given your freely given, specific, informed, and unambiguous consent to the processing of your personal data for one or more specific purposes — for example, subscribing to phrich promotional emails or agreeing to the use of non-essential cookies.
• Contractual Necessity (Section 12(b), DPA): Where processing is necessary for the performance of a contract to which you are a party — including account registration, game play, deposits, withdrawals, and the provision of all Platform services governed by the phrich Terms and Conditions.
• Legal Obligation (Section 12(c), DPA): Where processing is necessary for compliance with a legal obligation to which phrich is subject under Philippine law — including KYC and AML obligations under Republic Act No. 9160 (Anti-Money Laundering Act), PAGCOR regulatory requirements, and the National Privacy Commission's directives.
• Legitimate Interests (Section 12(f), DPA): Where processing is necessary for the purposes of the legitimate interests pursued by phrich or a third party — such as fraud prevention, Platform security, business analytics, and the improvement of our services — provided those interests are not overridden by your fundamental rights and freedoms.

Where phrich relies on your consent as the legal basis for a specific processing activity, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

3. Personal Data We Collect

phrich collects the following categories of personal data, depending on your relationship with the Platform and the services you use:

4. How We Collect Your Data

phrich collects personal data through the following means:

4.1 Direct Collection

Data you provide directly to phrich when you register an account, complete the KYC verification process, make a deposit or withdrawal, contact our support team, participate in a promotion, respond to a survey, or communicate with phrich by any other means.

4.2 Automated Collection

Data collected automatically when you access or use the Platform — including your IP address, device identifiers, browser information, and navigation data — through cookies, server logs, analytics tools, and similar technologies. See Section 9 of this Policy for further detail on cookies and tracking.

4.3 Third-Party Sources

phrich may receive personal data about you from third parties in the following circumstances:

• From identity verification service providers engaged to assist with KYC compliance (e.g., document authentication services)
• From payment processors and e-wallet providers (GCash, PayMaya) in connection with the processing of your deposits and withdrawals — limited to transaction confirmation data and account name matching
• From fraud detection and AML screening services that cross-reference account data against sanctions lists and adverse media databases
• From PAGCOR or other regulatory authorities where required by law

5. Purposes of Processing

phrich processes your personal data for the following specific, explicit, and legitimate purposes:

• Account creation and management: Registering and maintaining your phrich account, verifying your identity, processing your login, and managing your account settings and preferences.
• Service delivery: Enabling you to access and participate in all games and services available on the Platform, processing deposits and withdrawals, applying bonuses, and providing customer support.
• Regulatory compliance: Meeting phrich's obligations under PAGCOR regulations, the Anti-Money Laundering Act (RA 9160), the Data Privacy Act (RA 10173), and other applicable Philippine laws and regulations.
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behaviors, administering player-requested responsible gaming tools (deposit limits, self-exclusion), and complying with any regulatory requirements relating to player protection.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, unauthorized access, collusion, bonus abuse, and other illegal or prohibited conduct on the Platform.
• Platform improvement: Analyzing aggregate and anonymized usage data to improve the Platform's functionality, game selection, user interface, and overall player experience.
• Marketing communications (consent-based): Sending promotional emails, SMS notifications, and personalized offers to players who have opted in to receive such communications. You may opt out at any time.
• Legal claims: Establishing, exercising, or defending legal claims arising in connection with the Platform or these Terms.

6. Disclosure of Personal Data

phrich does not sell, rent, or otherwise trade your personal data to third parties for their own commercial purposes. phrich may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements or confidentiality obligations:

6.1 Service Providers

Third-party vendors engaged by phrich to provide specific services in support of Platform operations, including cloud infrastructure providers, identity verification services, payment processors (GCash, PayMaya, BPI, BDO, Metrobank), fraud detection providers, analytics providers, and customer support technology providers. These vendors process personal data only on phrich's instructions and are contractually prohibited from using it for their own purposes.

6.2 Regulatory and Law Enforcement Authorities

phrich is required by Philippine law to disclose certain personal data and transaction records to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent authorities upon receipt of a lawful request, court order, or subpoena. phrich will comply with all such legally mandated disclosures.

6.3 Game Providers

phrich may share limited technical identifiers (such as a pseudonymous player session token) with third-party game providers to enable game session initialization, resolve disputes, and verify game outcomes. Full personal identity data is not shared with game providers.

6.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of the assets of phrich, personal data held by phrich may be transferred to the acquiring entity as part of the transaction, subject to the acquiring entity's agreement to be bound by terms consistent with this Policy and applicable Philippine data protection law.

7. Data Retention

phrich retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law, whichever is longer. The following general retention periods apply:

Upon expiry of the applicable retention period, phrich will securely delete or anonymize personal data in a manner that prevents reconstruction of the original data. Where anonymization is not technically feasible, phrich will apply appropriate technical controls to prevent further processing of the data.

8. Data Security Measures

phrich implements a comprehensive set of technical, organizational, and physical security measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include, but are not limited to:

• Encryption in transit: All data transmitted between your device and phrich servers is encrypted using Transport Layer Security (TLS) 1.2 or higher, with 256-bit encryption keys.
• Encryption at rest: Sensitive personal data stored in phrich databases — including identity documents and financial data — is encrypted at rest using AES-256 or equivalent standards.
• Password hashing: Account passwords are never stored in plain text. phrich uses a one-way cryptographic hashing algorithm with unique salting for each credential. Even phrich's own personnel cannot access your original password.
• Access controls: Access to phrich systems containing personal data is restricted to authorized personnel on a strict need-to-know basis. All access is logged and audited. Privileged access requires multi-factor authentication.
• Session management: Inactive player sessions are automatically terminated after a defined period. Concurrent session controls limit the number of simultaneous active sessions per account.
• Penetration testing: phrich engages independent security firms to conduct regular penetration testing and vulnerability assessments of the Platform's infrastructure and applications.
• Incident response: phrich maintains a data breach incident response plan. In the event of a personal data breach that poses a real risk of serious harm, phrich will notify the National Privacy Commission within 72 hours of discovery and will notify affected data subjects as required under NPC Circular 16-03.

9. Cookies and Tracking Technologies

phrich uses cookies and similar tracking technologies on the Platform to enable core functionality, analyze usage, and (where you have consented) deliver relevant promotional content. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential to the operation of the Platform. These include session authentication cookies that keep you logged in, security tokens, and load-balancing cookies. These cookies cannot be disabled without impacting Platform functionality.
• Functional Cookies: Remember your preferences — such as your preferred language, game category, or responsible gaming settings — to provide a personalized experience. These cookies do not track you across other websites.
• Analytics Cookies: Collect aggregate, anonymized data about how players use the Platform — including pages visited, time on page, and navigation paths — to help phrich improve the user experience. phrich uses privacy-respecting analytics tools configured to anonymize IP addresses.
• Marketing Cookies (consent-based): Used to deliver personalized promotional content based on your game preferences and Platform activity. These cookies are only deployed where you have given explicit consent via the cookie consent mechanism.

You may manage your cookie preferences through your browser's cookie settings at any time. Note that disabling strictly necessary cookies will affect your ability to use core Platform features, including the ability to remain logged in.

10. Your Data Subject Rights

Under the Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations, you have the following rights with respect to your personal data held by phrich. These rights may be subject to certain limitations and exceptions under Philippine law:

11. Children and Minors

The phrich Platform is strictly intended for individuals aged 21 years and above. phrich does not knowingly collect, process, or retain personal data from any person under the age of 21. The Platform employs age verification mechanisms at the point of registration, and additional identity verification may be required for players whose stated age cannot be confirmed through initial checks.

If phrich discovers or is notified that it has inadvertently collected personal data from an individual under the age of 21, phrich will take immediate steps to delete that data from its systems and terminate the associated account. If you believe that a minor has registered an account on phrich using false age information, please contact phrich's support team immediately.

Parents and guardians are encouraged to use parental control software to restrict access to online gaming platforms from devices accessible to minors.

12. Cross-Border Data Transfers

phrich primarily stores and processes personal data within the Philippines. Where phrich engages service providers — including cloud infrastructure providers, identity verification services, or analytics providers — that may process data in data centers located outside the Philippines, phrich ensures that such transfers comply with Section 21 of the Data Privacy Act and the National Privacy Commission's guidelines on cross-border data transfers.

Specifically, phrich ensures that personal data transferred outside the Philippines is protected by one or more of the following safeguards:

• Binding data processing agreements requiring the recipient to apply data protection standards equivalent to those under Philippine law
• Standard contractual clauses approved or recognized by the National Privacy Commission
• Processing within a jurisdiction that the NPC has recognized as providing an adequate level of data protection

You may obtain further information about the safeguards applied to cross-border transfers of your personal data by contacting phrich's Data Privacy Officer at the contact details provided in Section 14.

13. Changes to This Privacy Policy

phrich reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, phrich's data processing practices, or the services offered on the Platform. When material changes are made to this Policy, phrich will:

• Update the "Last Updated" date at the top of this document
• Publish the revised Policy on the Platform at phrich.cam/privacy-policy
• Where the change materially affects the processing of your personal data, notify registered players via email or an on-Platform notification at least seven (7) days before the revised Policy takes effect
• Where a change requires your consent as a new lawful basis for processing, request that consent before commencing the new processing activity

Your continued use of the phrich Platform after the effective date of any revised Privacy Policy constitutes acknowledgment of the updated Policy. If you do not agree to the revised Policy, you may request account closure in accordance with Section 10.2 of the phrich Terms and Conditions.

14. Contact and Complaints

phrich has designated a Data Privacy Officer (DPO) responsible for overseeing the Company's compliance with the Data Privacy Act of 2012 and this Privacy Policy. If you have questions about this Policy, wish to exercise your data subject rights, or wish to raise a data privacy concern, you may contact the phrich DPO through the following channels:

• Live Chat: Available 24/7 via the phrich Platform — state "Data Privacy Inquiry" at the start of your chat
• Email: [email protected] — use subject line "Data Privacy / DPO Inquiry" (plain text, not a clickable link)

phrich will acknowledge receipt of your inquiry within three (3) business days and will provide a substantive response within thirty (30) calendar days of receipt, or within forty-five (45) days where the complexity of the matter warrants an extension.

If you are not satisfied with phrich's response to your data privacy concern, or if you believe that phrich has violated your rights under the Data Privacy Act of 2012, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. Information about the NPC's complaint procedures is publicly available on the NPC's official website.