phsuper Privacy Policy

1. Introduction and Identity of the Data Controller

phsuper ("phsuper," "we," "us," or "our") is the data controller responsible for the personal data of users ("Player," "you," or "your") collected through the phsuper online gaming platform available at https://phsuper.co and any associated mobile applications or services (collectively, the "Platform").

This Privacy Policy describes the categories of personal data phsuper collects, the purposes and legal bases for processing that data, the parties with whom it may be shared, the measures taken to protect it, and the rights available to you as a data subject under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC) of the Philippines.

For any privacy-related inquiries, please contact phsuper's Data Protection Officer at: [email protected] (mark subject line "Data Privacy Inquiry").

2. Personal Data We Collect

phsuper collects personal data through multiple channels in the ordinary course of operating the Platform. The categories of data collected are as follows:

phsuper does not knowingly collect personal data from individuals under 21 years of age. If we become aware that personal data has been collected from an underage individual, we will take immediate steps to delete that data and close the associated account.

3. Legal Bases and Purposes for Processing

phsuper processes personal data under the following legal bases as recognized by the Data Privacy Act of 2012:

• Contractual necessity: To create and administer your phsuper account, process deposits and withdrawals, verify your identity, and provide access to the Platform's gaming services.
• Legal obligation: To comply with Philippine AML (Anti-Money Laundering Act), PAGCOR regulatory requirements, KYC obligations, tax reporting requirements, and any lawful order from Philippine government authorities.
• Legitimate interests: To detect and prevent fraud, protect platform security, conduct analytics to improve phsuper products and services, enforce Terms and Conditions, and manage responsible gaming obligations.
• Consent: To send marketing communications (e.g., promotional emails, SMS notifications about bonuses and new games) where you have opted in. You may withdraw this consent at any time from your account notification settings.

4. Sharing of Personal Data

phsuper does not sell your personal data. We may share your personal data with the following categories of third parties solely for the purposes described in this Policy:

• Payment processors: GCash (GXI), Maya (Voyager Innovations), BPI, BDO, Metrobank, and other licensed Philippine financial institutions, strictly for processing transactions.
• Game content providers: Licensed game studios and RNG certification bodies, where necessary to operate and audit game outcomes.
• Identity verification providers: Third-party KYC service providers engaged for document verification and liveness checks during account setup and withdrawal clearance.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and any other Philippine government body where phsuper is under a legal obligation to disclose.
• IT and security service providers: Cloud hosting, cybersecurity monitoring, and fraud prevention vendors operating under binding data processing agreements with phsuper.

All third-party processors engaged by phsuper are contractually required to process personal data only on phsuper's documented instructions and to maintain appropriate technical and organizational security measures.

5. Data Retention

phsuper retains personal data for as long as necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods:

• Account and identity data: Retained for the duration of your active phsuper account, plus a minimum of five (5) years after account closure, in compliance with AML record-keeping obligations under the AMLA (Republic Act No. 9160, as amended).
• Transaction records: Minimum five (5) years from the date of each transaction.
• Gaming activity logs: Retained for three (3) years for responsible gaming monitoring and dispute resolution purposes.
• Marketing consent records: Retained until consent is withdrawn, plus one (1) year for audit purposes.
• Support communications: Retained for three (3) years from the date of the interaction.

When personal data is no longer required, phsuper will securely delete or anonymize it in accordance with applicable data destruction standards.

6. Cookies and Tracking Technologies

The phsuper Platform uses cookies and similar tracking technologies to operate essential platform functions, maintain login sessions, detect fraud, and analyze aggregated usage patterns. The cookies used by phsuper fall into the following categories:

• Strictly necessary cookies: Required for the Platform to function. These cannot be disabled without breaking core functionality such as login session persistence and payment flow security.
• Analytics cookies: Used to measure page performance and user journey patterns in aggregate, anonymized form. This data is used to improve phsuper's platform and does not identify individual users.
• Security cookies: Used to detect and prevent fraudulent login attempts, CSRF attacks, and session hijacking.

phsuper does not use third-party advertising or behavioral tracking cookies. You may manage cookie preferences through your browser settings, though disabling strictly necessary cookies will impair Platform functionality.

7. Your Rights as a Data Subject

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights with respect to your personal data held by phsuper:

• Right to be informed: To know whether phsuper holds your personal data and how it is processed, as described in this Policy.
• Right of access: To request a copy of the personal data phsuper holds about you.
• Right to rectification: To request correction of inaccurate or incomplete personal data.
• Right to erasure or blocking: To request deletion or suspension of processing of your personal data where it is no longer necessary, where consent has been withdrawn, or where processing is unlawful — subject to overriding legal retention obligations.
• Right to object: To object to processing based on legitimate interests, including direct marketing.
• Right to data portability: To receive your personal data in a structured, commonly used, and machine-readable format.
• Right to lodge a complaint: To file a complaint with the National Privacy Commission of the Philippines at www.privacy.gov.ph if you believe your rights under the DPA have been violated.

To exercise any of the above rights, submit a written request to phsuper's Data Protection Officer at [email protected] (subject line: "Data Subject Rights Request"). phsuper will respond within fifteen (15) business days. We may require identity verification before processing your request.

8. Security Measures

phsuper implements a layered security framework to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Security measures include:

• 256-bit TLS/SSL encryption for all data in transit between your device and phsuper servers.
• Encryption at rest for sensitive data fields including payment information and government ID numbers.
• Role-based access controls limiting employee access to personal data on a need-to-know basis.
• Two-factor authentication for all phsuper administrative system access.
• Continuous security monitoring, intrusion detection systems, and regular third-party penetration testing.
• Incident response procedures aligned with NPC notification requirements for personal data breaches.

In the event of a personal data breach that poses a real risk of serious harm to affected data subjects, phsuper will notify the National Privacy Commission and affected users within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular No. 16-03.

9. Cross-Border Data Transfers

Where phsuper engages service providers (such as cloud infrastructure or game content providers) that process data outside the Philippines, such transfers are governed by appropriate contractual safeguards, including data processing agreements that impose obligations equivalent to those required under the Data Privacy Act of 2012. phsuper does not authorize any cross-border transfer of personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate transfer mechanisms.

10. Changes to This Privacy Policy

phsuper may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or business operations. Material changes will be communicated to registered phsuper players via email or in-platform notification at least fourteen (14) days before the updated policy takes effect. The "Last Updated" date at the top of this page will reflect the date of the most recent revision. Continued use of the phsuper Platform following notification of changes constitutes acceptance of the revised Privacy Policy.

11. Contact and Data Protection Officer

For all privacy-related inquiries, data subject rights requests, or complaints regarding phsuper's data processing practices, please contact phsuper's designated Data Protection Officer:

Data Protection Officer — phsuper
Email: [email protected] (Subject: "Data Privacy Inquiry")

Alternatively, you may file a complaint directly with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated. This Privacy Policy was last reviewed and updated in June 2026.