phkay Privacy Policy

1. Introduction

This Privacy Policy ("Policy") is issued by phkay ("phkay," "we," "us," "our"), the operator of the online gaming platform accessible at phkay.cam. This Policy describes how phkay collects, uses, processes, discloses, and protects the personal data of players, visitors, and registered users ("you," "your," "Data Subject") of the phkay platform.

phkay operates in the Philippines and is committed to protecting the privacy and personal data of Filipino players in accordance with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), and the relevant issuances of the National Privacy Commission ("NPC").

By registering a phkay account, accessing the phkay website, or using any phkay service, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, please discontinue use of the phkay platform immediately.

2. Data Controller

phkay is the personal information controller ("PIC") for the personal data collected through the phkay platform. As the PIC, phkay determines the purposes and means of processing your personal data and is responsible for ensuring that processing activities comply with the DPA and applicable regulations.

phkay has designated a Data Protection Officer ("DPO") to oversee data privacy compliance and serve as the primary point of contact for privacy-related matters. You may reach the phkay DPO through the contact details provided in Section 16 of this Policy.

3. Personal Data We Collect

phkay collects personal data from you directly, automatically, and from third-party sources. The categories of data we collect include:

phkay does not intentionally collect sensitive personal information (as defined under the DPA) unless required for identity verification or fraud prevention purposes, in which case it is handled with the additional safeguards required by law.

4. How We Use Your Personal Data

phkay processes your personal data for the following purposes:

• Account management: Creating, maintaining, and securing your phkay player account;
• Identity verification (KYC): Confirming your identity and age eligibility before processing withdrawals;
• Payment processing: Facilitating deposits and withdrawals through your registered payment method;
• Service delivery: Operating games, crediting winnings, applying bonuses, and maintaining gameplay records;
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, money laundering, and unauthorized access;
• Regulatory compliance: Fulfilling obligations under Philippine gaming regulations, anti-money laundering (AML) laws, and the DPA;
• Responsible gaming: Monitoring gameplay patterns to identify potential problem gambling and applying responsible gaming measures;
• Customer support: Responding to your inquiries, resolving disputes, and providing assistance;
• Platform improvement: Analysing usage patterns, troubleshooting technical issues, and improving the phkay user experience;
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in.

5. Legal Basis for Processing

phkay processes your personal data on the following legal bases under the DPA:

• Consent: Where you have provided explicit consent for a specific processing activity, such as receiving marketing communications;
• Contractual necessity: Where processing is necessary to fulfill our obligations under the phkay Terms & Conditions to which you are a party, including account management and payment processing;
• Legal obligation: Where processing is required to comply with applicable Philippine laws, including AML regulations and gaming authority requirements;
• Legitimate interests: Where processing is necessary for phkay's legitimate business interests — such as fraud prevention, security monitoring, and platform analytics — provided those interests are not overridden by your fundamental rights.

Where phkay relies on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

6. Data Sharing & Disclosure

phkay does not sell or rent your personal data to third parties. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Payment processors: GCash, Maya, BPI, BDO, UnionBank, and other payment service providers to facilitate your deposits and withdrawals. These providers process your financial data solely to execute transactions on your behalf;
• KYC and identity verification providers: Third-party identity verification services used to confirm your identity and age during KYC processing;
• Game content providers: Licensed game software providers (such as JILI Gaming) may receive limited technical session data to operate games within the phkay platform. They do not receive your identity or financial data;
• Regulatory and law enforcement authorities: Philippine gaming regulators, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and law enforcement agencies where disclosure is required by applicable law or court order;
• IT and cloud service providers: Infrastructure, hosting, and security service providers who process data on phkay's behalf under strict data processing agreements consistent with the DPA;
• Professional advisors: Legal counsel, auditors, and compliance consultants bound by confidentiality obligations.

All third parties with whom phkay shares personal data are required to process that data solely for the purposes specified, maintain appropriate security standards, and comply with applicable Philippine data protection law.

7. Cross-Border Data Transfers

Some of phkay's service providers and technology partners may be located outside the Philippines. Where personal data is transferred to a country that does not provide an equivalent level of data protection, phkay implements appropriate safeguards in accordance with the DPA's requirements for cross-border transfers, including standard contractual clauses and processor agreements that impose binding data protection obligations on the receiving party.

phkay will not transfer your personal data to a foreign jurisdiction unless we are satisfied that adequate protections are in place and that such transfer is compliant with the DPA and NPC guidelines. You may request information about specific transfer safeguards by contacting the phkay DPO.

8. Data Retention

phkay retains your personal data for the period necessary to fulfill the purposes for which it was collected, subject to applicable legal requirements. Our standard retention periods are as follows:

• Active account data: Retained for the duration of your account and for a minimum of 5 years following account closure, to meet AML record-keeping requirements;
• KYC and identity documents: Retained for 5 years from the date of submission or account closure, whichever is later, as required by Philippine AML regulations;
• Transaction and financial records: Retained for a minimum of 5 years in compliance with the Anti-Money Laundering Act (AMLA) and its amendments;
• Support communications: Retained for 3 years following resolution of the relevant matter;
• Marketing preferences and consent records: Retained for the duration of your account plus 2 years following account closure or consent withdrawal;
• Technical and log data: Typically retained for 12 months, unless required longer for security investigations.

Upon expiry of the applicable retention period, phkay will securely delete or anonymize your personal data in a manner that prevents reconstruction of the original information.

9. Security Measures

phkay implements technical and organizational security measures designed to protect your personal data from unauthorized access, disclosure, alteration, and destruction. Our security practices include:

• AES-256 encryption for data stored at rest on phkay servers;
• TLS 1.2+ encryption for all data transmitted between your device and phkay;
• Password hashing using bcrypt with per-user salting — phkay staff cannot view your password;
• Two-factor authentication options for phkay player accounts;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Regular penetration testing and vulnerability assessments of phkay systems;
• 24/7 intrusion detection and security monitoring;
• Isolated financial data environments with additional access logging.

Despite these measures, no system is entirely immune to security risks. In the event of a personal data breach that poses a risk to your rights and freedoms, phkay will notify the National Privacy Commission and affected data subjects in accordance with the DPA's breach notification requirements within 72 hours of becoming aware of the breach.

10. Cookies & Tracking Technologies

phkay uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small text files placed on your device that allow phkay to recognize your browser and remember certain information about your session.

phkay uses the following categories of cookies:

• Strictly necessary cookies: Essential for the operation of the phkay platform, including session management and security functions. These cannot be disabled without affecting platform functionality;
• Functional cookies: Remember your preferences such as language settings and display preferences to provide a more personalized phkay experience;
• Analytics cookies: Help phkay understand how players interact with the platform — which pages are visited most often, where users encounter errors, and how navigation flows. This data is aggregated and anonymized;
• Marketing cookies: Used only where you have provided consent, to deliver relevant promotional content about phkay offers and features.

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impair your ability to use certain phkay features. For analytics and marketing cookies, you may opt out through your phkay account settings.

11. Your Privacy Rights

Under the Data Privacy Act of 2012 and its IRR, phkay players have the following rights with respect to their personal data:

• Right to be informed: You have the right to be informed of how your personal data is collected, used, and processed, which this Policy fulfills;
• Right of access: You may request a copy of the personal data phkay holds about you, including information about how it has been used;
• Right to rectification: You may request correction of inaccurate or incomplete personal data held by phkay;
• Right to erasure: In certain circumstances, you may request deletion of your personal data. Note that some data must be retained for legal compliance and cannot be deleted on request;
• Right to data portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format;
• Right to object: You may object to processing based on legitimate interests, including profiling and direct marketing;
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without penalty;
• Right to lodge a complaint: You have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe phkay has processed your data unlawfully.

To exercise any of the above rights, contact the phkay Data Protection Officer via live chat or at the support email listed in Section 16. phkay will respond to verified data subject requests within 30 calendar days of receipt.

12. Minors & Age Policy

phkay does not knowingly collect personal data from individuals under 21 years of age. The phkay platform is strictly for adults aged 21 and above in accordance with Philippine gaming regulations. Age verification is required during account registration, and identity documents are required before any withdrawal is processed.

If phkay becomes aware that personal data has been collected from a person under the age of 21, that account will be immediately closed, all associated balances will be forfeited, and the collected personal data will be securely deleted to the extent permitted by our legal retention obligations.

If you believe a minor has registered an account on phkay, please contact our support team immediately so that we can take appropriate action.

13. Marketing Communications

phkay may send you promotional emails, SMS messages, and in-app notifications about bonuses, new game releases, and platform updates. We will only send marketing communications if you have opted in during registration or through your phkay account settings.

You may opt out of marketing communications at any time by:

• Updating your notification preferences in your phkay account settings;
• Clicking the "unsubscribe" link in any phkay promotional email;
• Contacting phkay support via live chat or email and requesting removal from marketing lists.

Opting out of marketing does not affect your ability to receive transactional communications about your account, such as deposit confirmations, withdrawal notifications, and security alerts. These service communications are sent regardless of marketing preference as they are necessary for account operation.

14. Third-Party Services & Links

The phkay platform may reference third-party services such as payment processors and game software providers. phkay is not responsible for the privacy practices of these third parties. Each third party processes data under its own privacy policy, and phkay encourages you to review those policies before using any third-party service.

All third-party processors engaged by phkay are bound by data processing agreements that require them to handle your data securely and in compliance with applicable Philippine data protection law. phkay conducts due diligence on third-party data practices before onboarding any new processor.

15. Amendments to This Policy

phkay reserves the right to update or amend this Privacy Policy at any time. When material changes are made, phkay will notify registered players via email at least 15 days before the changes take effect, and a prominent notice will be displayed on the phkay website.

The effective date at the top of this Policy indicates when it was last reviewed. Your continued use of the phkay platform after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you disagree with any changes, you should discontinue use of phkay and may request account closure in accordance with the phkay Terms & Conditions.

16. Contact Us & Privacy Complaints

For any questions, concerns, or requests related to this Privacy Policy or your personal data held by phkay, please contact our Data Protection Officer through the following channels:

• Live Chat: Available 8:00 AM – 11:00 PM PHT, daily, via the phkay website
• Support Email: [email protected]

phkay will acknowledge receipt of privacy-related requests within 5 business days and endeavor to resolve them within 30 calendar days of receipt.

If you are not satisfied with phkay's response to your privacy complaint, you have the right to escalate the matter to the National Privacy Commission of the Philippines. The NPC handles complaints regarding violations of the Data Privacy Act and can be reached through official Philippine government channels.