philsot Casino Privacy Policy

1. Overview

philsot is committed to protecting the privacy and personal data of all players who use the philsot Platform. This Privacy Policy has been prepared in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, hereinafter "the DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines.

As a PAGCOR-licensed online casino operator, philsot is also subject to data handling obligations under PAGCOR's regulatory framework, which imposes additional requirements regarding identity verification, transaction recording, and regulatory reporting. These obligations operate in parallel with and are consistent with the DPA.

This Policy describes: the categories of personal data philsot collects; the purposes for which that data is processed; the lawful bases for processing; how long data is retained; who data may be shared with; the security measures we apply; and the rights available to you as a data subject under Philippine law.

We encourage you to read this Policy carefully. If you have any questions after reading it, please contact our Data Protection Officer using the details in Section 15.

2. Data Controller

The data controller responsible for your personal data collected through the philsot Platform is:

philsot determines the purposes and means of processing your personal data and is accordingly the "personal information controller" as that term is defined under Section 3(h) of the DPA.

3. Data We Collect

philsot collects the following categories of personal data in connection with providing, securing, and improving the Platform:

philsot does not collect special categories of personal data (as defined under Section 13 of the DPA, including racial or ethnic origin, health data, political opinions, or religious beliefs) except where strictly necessary for responsible gaming assessments, in which case explicit consent is obtained separately.

4. How We Collect Data

philsot collects personal data through the following channels and mechanisms:

4.1 Directly From You

• Registration forms when you create a philsot Account;
• KYC verification submissions, including identity document uploads and liveness checks;
• Deposit and withdrawal transactions processed through GCash, Maya, BPI, BDO, Metrobank, Visa, Mastercard, or USDT;
• Communications you send to philsot's support team via Live Chat, email, Messenger, or Viber;
• Responses to surveys, feedback forms, or responsible gaming self-assessments;
• Changes to your account profile or account settings.

4.2 Automatically Through Your Use of the Platform

• Server logs recording your IP address, login times, page navigation, and session duration;
• Cookies and similar tracking technologies as described in Section 10;
• Game engine logs capturing bet placement, game outcomes, and balance changes;
• Device fingerprinting for fraud prevention and account security purposes;
• Geolocation data at city and country level derived from your IP address.

4.3 From Third Parties

• Identity verification service providers used to process KYC documentation;
• Payment processing partners (GCash, Maya, and banking partners) for transaction confirmation;
• Fraud detection and anti-money laundering screening services;
• PAGCOR or other Philippine regulatory authorities where required for compliance purposes.

5. Purposes of Processing

philsot processes your personal data for the following specific, explicit, and legitimate purposes:

6. Legal Basis for Processing

philsot processes your personal data on one or more of the following lawful bases as set out under Section 12 of the Philippine Data Privacy Act:

• Contractual Necessity (Section 12[b]): Processing is necessary for the performance of the contract between you and philsot — specifically, to provide you with access to and use of the philsot Platform and gaming services, process your transactions, and manage your Account.
• Legal Obligation (Section 12[c]): Processing is required to comply with philsot's legal obligations under Philippine law, including PAGCOR licensing conditions, the Anti-Money Laundering Act (R.A. 9160 as amended), the Data Privacy Act, and any directive issued by Philippine regulatory authorities.
• Legitimate Interests (Section 12[f]): Processing is necessary for the legitimate interests pursued by philsot, including fraud prevention, account security, platform integrity monitoring, and responsible gaming compliance, provided these interests are not overridden by your privacy rights.
• Consent (Section 12[a]): Where philsot processes data for purposes not covered by the above bases — such as direct marketing communications or optional personalization features — we will seek your explicit and freely given consent. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

7. Data Sharing & Disclosure

philsot does not sell, rent, or trade your personal data to third-party advertisers or marketing companies. We share personal data only in the following circumstances and only to the extent necessary for the stated purpose:

7.1 Service Providers (Personal Information Processors)

philsot engages third-party service providers who process personal data on our behalf and under our instruction. These include:

• KYC and identity verification platforms;
• Payment processors and financial institutions (GCash, Maya, BPI, BDO, Metrobank, card schemes);
• Cloud infrastructure and data hosting providers;
• Game software providers (who receive anonymized session data for technical support purposes);
• Fraud detection and cybersecurity service providers;
• Customer support platform providers.

All service providers are bound by data processing agreements that require them to process data only on philsot's documented instructions, implement appropriate security measures, and not further disclose data to unauthorized third parties.

7.2 Regulatory and Legal Disclosures

philsot will disclose personal data to competent Philippine authorities when required to do so by law, including:

• PAGCOR, in connection with licensing compliance, regulatory audits, and investigations;
• The Anti-Money Laundering Council (AMLC), pursuant to R.A. 9160 and its amendments;
• Philippine courts or law enforcement agencies where disclosure is required by court order or lawful legal process;
• The National Privacy Commission (NPC), in connection with a data breach notification obligation or an NPC investigation.

7.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of all or substantially all of philsot's assets, personal data held by philsot may be transferred to the acquiring or successor entity, subject to that entity providing equivalent privacy protections. philsot will notify affected players of any such transfer via email or prominent notice on the Platform.

8. Data Retention

philsot retains personal data only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal and regulatory obligations, or as otherwise permitted by the DPA. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized such that it can no longer be associated with an identifiable individual, unless further retention is required by a specific legal obligation or ongoing regulatory inquiry.

9. Data Security

The specific security measures philsot implements include, but are not limited to:

• Encryption in Transit: All data transmitted between your browser or device and the philsot Platform is encrypted using Transport Layer Security (TLS) 1.3 with AES-256 encryption. All pages are served over HTTPS.
• Encryption at Rest: Sensitive personal data stored in philsot's databases — including identity records and KYC documentation — is encrypted at rest using AES-256.
• Password Security: Account passwords are never stored in plaintext. They are stored as salted cryptographic hashes using industry-standard hashing algorithms. philsot staff cannot read your password.
• Access Controls: Access to personal data within philsot's systems is restricted on a need-to-know basis using role-based access controls. Access is logged and audited.
• Two-Factor Authentication: SMS-based 2FA is available to all philsot accounts and strongly recommended for enhanced account security.
• Penetration Testing: philsot conducts regular vulnerability assessments and third-party penetration tests on its Platform infrastructure.
• Data Breach Response: philsot maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in risk to the rights and freedoms of data subjects, philsot will notify the NPC within 72 hours of becoming aware of the breach, and will notify affected data subjects without undue delay, consistent with the requirements of the DPA.

While philsot takes all reasonable steps to protect your personal data, no data transmission over the internet is entirely secure. Players are responsible for maintaining the security of their own Account credentials and for notifying philsot immediately of any suspected unauthorized access.

10. Cookies & Tracking Technologies

philsot uses cookies and similar tracking technologies on the Platform. Cookies are small data files stored on your device by your browser that help us deliver and improve the Platform experience.

10.1 Types of Cookies Used

philsot does not use third-party advertising cookies or tracking pixels that share your browsing data with external advertising networks.

You may control non-essential cookies through your browser settings. Disabling essential cookies will impair your ability to use the Platform. Please note that clearing cookies will log you out of your philsot Account.

11. Your Privacy Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights as a data subject with respect to your personal data held by philsot. These rights are subject to applicable legal limitations and philsot's compliance obligations under PAGCOR regulations and the AMLA.

To exercise any of the above rights, please submit a written request to philsot's Data Protection Officer using the contact details in Section 15. philsot will respond to all data subject requests within 15 business days of receipt. Where requests are complex or numerous, the response period may be extended by a further 30 days, of which you will be notified.

Identity verification will be required before philsot processes a data subject access or erasure request, to ensure we do not disclose or delete data at the request of an unauthorized person.

12. Minors & Age Verification

philsot enforces the 21+ age requirement through mandatory KYC identity verification at Account registration. All registrations require submission of a valid Philippine government-issued ID showing date of birth. Registration is not completed and Account access is not granted until identity and age have been verified to philsot's satisfaction.

13. Cross-Border Data Transfers

Some of philsot's third-party service providers — including cloud infrastructure providers, game software suppliers, and fraud detection services — may process personal data outside the Philippines. Where such transfers occur, philsot ensures that they are conducted in compliance with Section 21 of the DPA and NPC Circular No. 16-01 governing cross-border data flows.

philsot implements the following safeguards for cross-border transfers:

• Contractual clauses in data processing agreements that impose DPA-equivalent obligations on foreign processors;
• Verification that recipient countries or organizations provide adequate data protection as assessed by the NPC or recognized international frameworks;
• Transfer Impact Assessments where required by applicable NPC guidance.

Your personal data is never transferred to a jurisdiction or recipient that does not meet philsot's data protection standards. A list of the countries where philsot's key processors are located is available upon request from the Data Protection Officer.

14. Policy Amendments

14.1  philsot reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, new regulatory requirements, or improvements to how we protect your data.

14.2  Material changes to this Privacy Policy will be communicated to registered Players via email to the address on file and/or via a prominent notice on the Platform for a minimum of 7 days before the changes take effect.

14.3  Where changes are required to comply immediately with a new NPC or PAGCOR directive, philsot may implement those changes without advance notice. The effective date of such changes will be clearly stated on this page.

14.4  The date at the top of this page reflects the date this version of the Privacy Policy was last updated. We recommend reviewing this page periodically. Continued use of the Platform after the effective date of an amendment constitutes acceptance of the revised Policy.

15. Contact & Data Protection Officer

For all privacy-related inquiries, data subject rights requests, data breach reports, and complaints, please contact philsot's designated Data Protection Officer:

If you are not satisfied with philsot's response to your privacy inquiry, you have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines, which is the competent supervisory authority for data protection matters in the Republic of the Philippines.