Privacy Policy — 36php
How We Protect Your Data

1 Scope, Identity of Controller & DPO

This Privacy Policy ("Policy") applies to all personal information collected, processed, and stored by 36php ("36php," "we," "us," "our") in connection with the online gaming platform available at 36php.org and all related sub-pages, services, and digital touchpoints (collectively, the "Platform"). This Policy covers data collected from registered players, prospective players, visitors to the Platform, and individuals who contact 36php by any means.

36php is the Personal Information Controller (PIC) as defined under Republic Act No. 10173 (Data Privacy Act of 2012) for all personal data collected through the Platform. 36php has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act, its Implementing Rules and Regulations (IRR), and applicable issuances of the National Privacy Commission (NPC). Contact details for the DPO are provided in Section 15 of this Policy.

By registering an account, accessing the Platform, or submitting any personal information to 36php, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. Where processing is based on consent, you may withdraw your consent at any time as described in Section 9, subject to applicable legal and regulatory retention obligations.

2 Categories of Personal Data We Collect

36php collects personal data that is necessary, adequate, and not excessive relative to the purposes for which it is processed. The following categories of personal data may be collected:

2.1 Registration & Identity Data

• Full legal name (as it appears on your government-issued ID);
• Date of birth (for age verification — 21+ requirement);
• Email address;
• Philippine mobile number;
• Username chosen at registration;
• Encrypted password (stored in hashed form — never in plain text).

2.2 Know Your Customer (KYC) & Verification Data

• Government-issued Philippine identification document (UMID, PhilSys National ID, driver's licence, passport, SSS ID, PRC card, or other PAGCOR-approved ID);
• Selfie photograph submitted for identity verification;
• Proof of address (where required for enhanced due diligence);
• Source-of-funds declaration (for high-value players as required by AMLC regulations).

2.3 Financial & Transaction Data

• GCash account identifier (mobile number associated with GCash);
• PayMaya / Maya account details (mobile number);
• Bank account details (account name, account number, bank name) for BPI, BDO, or Metrobank withdrawals;
• Cryptocurrency wallet address (for crypto deposit/withdrawal);
• Deposit amounts, dates, and payment method used;
• Withdrawal requests, amounts, and processing status;
• Complete transaction history on the Platform.

2.4 Gaming Activity Data

• Game session logs (game title, start/end time, bets placed, outcomes);
• Sports betting selections, stake amounts, and results;
• Bonus claims, wagering progress, and promotional participation history;
• VIP tier and loyalty points balance;
• Responsible gaming tool settings (deposit limits, self-exclusion status).

2.5 Technical & Device Data

• IP address at time of login and account activity;
• Device type, operating system, and browser type;
• Geolocation data (country/region level, to confirm Philippine-based access);
• Session duration and frequency of visits;
• Cookie identifiers and similar tracking data (see Section 6).

2.6 Communications Data

• Content of support interactions via live chat, email, or any other communication channel;
• Records of complaints and their resolution;
• Survey responses and feedback submissions.

3 How We Collect Personal Data

36php collects personal data through the following channels and methods:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, submitting an enquiry or complaint, or participating in a promotion;
• Automated collection: Technical data collected automatically when you access the Platform, including through cookies, server logs, and similar tracking technologies (described in detail in Section 6);
• Payment processors: Transaction confirmation data received from GCash, PayMaya, and Philippine banking partners when you deposit or withdraw;
• Identity verification services: Data received from third-party KYC/AML service providers engaged by 36php to assist with document verification and screening against sanction lists or fraud databases;
• Publicly available sources: Where permitted by law and relevant to regulatory compliance, information from publicly available Philippine government databases or officially published records.

4 Purposes of Processing & Legal Basis

36php processes your personal data for specific, legitimate purposes. The table below outlines the primary processing activities, their purposes, and the applicable legal basis under the Data Privacy Act of 2012:

5 Sharing & Disclosure of Personal Data

36php does not sell, rent, or trade your personal data. We share personal information only in the limited circumstances described below, and only to the extent necessary for the specified purpose:

5.1 Regulatory & Government Authorities

36php is required by law to share certain player data with Philippine government agencies including: the Philippine Amusement and Gaming Corporation (PAGCOR), the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), and the National Privacy Commission (NPC). Such disclosures are mandatory and do not require your prior consent.

5.2 Payment Service Providers

To process deposits and withdrawals, 36php shares necessary transaction data with payment service providers including GCash (G-Xchange Inc.), PayMaya Philippines Inc., and partner banks (BPI, BDO, Metrobank). These providers receive only the data necessary to process the transaction and are bound by their own privacy policies and applicable Philippine financial regulations.

5.3 KYC & AML Service Providers

36php engages third-party identity verification and AML screening service providers to assist with the KYC process. These providers access your identity documents and personal details solely for the purpose of verification and are contractually bound to maintain confidentiality and process data only on 36php's documented instructions.

5.4 Technology & Infrastructure Providers

36php uses cloud hosting, database management, and cybersecurity service providers to operate the Platform. These providers may process personal data as part of their service delivery and are engaged under Data Processing Agreements that impose obligations consistent with the Data Privacy Act of 2012.

5.5 Legal Proceedings

Where required by a lawful court order, subpoena, or other legal process in the Philippines, 36php will disclose personal data to the extent legally required. 36php will, where legally permitted, notify the affected individual of such a requirement before disclosing their data.

6 Cookies & Tracking Technologies

6.1 What Cookies We Use

36php uses cookies and similar tracking technologies (including pixel tags and session tokens) to operate and improve the Platform. The following categories of cookies are used:

• Essential cookies: Strictly necessary for the Platform to function. These include session cookies that maintain your login state and security cookies that protect against cross-site request forgery. These cannot be disabled without breaking core Platform functionality.
• Functional cookies: Remember your preferences such as language settings, game lobby display preferences, and responsible gaming reminder settings. These improve your user experience but are not essential.
• Analytics cookies: Collect anonymised data about how visitors interact with the Platform (pages visited, session duration, error events). This data helps 36php identify technical issues and improve the Platform. Data collected by analytics cookies is aggregated and does not identify you personally.
• Security & fraud prevention cookies: Used to detect and prevent fraudulent account activity, including multiple account creation and automated bot access.

6.2 Managing Cookies

You may control non-essential cookies through your browser settings. Most major browsers allow you to view, block, or delete cookies. Note that disabling certain cookies may affect the functionality of the 36php Platform, including your ability to remain logged in across sessions. Essential security and authentication cookies cannot be disabled while using the Platform.

7 Data Retention

36php retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, taking into account legal, regulatory, accounting, and reporting obligations. The following retention periods apply:

• Account data and KYC documents: Retained for the duration of the account relationship and for a minimum of five (5) years after account closure, as required by PAGCOR and AMLC regulations;
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction, in accordance with RA 9160 (Anti-Money Laundering Act) and BIR record-keeping requirements;
• Gaming session logs: Retained for two (2) years from the date of the session for dispute resolution and audit purposes;
• Customer support communications: Retained for two (2) years from the date of the interaction;
• Marketing consent records: Retained for the duration of consent and for two (2) years thereafter as evidence of lawful processing;
• Device and access logs: Retained for twelve (12) months for security monitoring and fraud detection purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with NPC-recognised data disposal standards. Where data is anonymised, the resulting anonymised dataset is no longer considered personal data under the Data Privacy Act.

8 Security Measures

36php implements technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, and destruction. These measures include, but are not limited to:

• Encryption in transit: All data transmitted between your device and 36php servers is encrypted using TLS 1.2 or higher (256-bit SSL);
• Encryption at rest: Sensitive data fields in 36php databases are encrypted using industry-standard algorithms. Passwords are hashed using bcrypt or equivalent — they are never stored in recoverable form;
• Access controls: Access to personal data is restricted on a need-to-know basis. 36php employees who require access to personal data for legitimate operational purposes are subject to confidentiality obligations and background screening;
• Two-factor authentication: 36php offers and encourages the use of two-factor authentication (2FA) for all player accounts to prevent unauthorised login even if credentials are compromised;
• Intrusion detection: 36php operates intrusion detection and prevention systems to monitor for and respond to suspicious network activity;
• Penetration testing: 36php conducts periodic security assessments and penetration testing of the Platform to identify and remediate vulnerabilities.

9 Your Rights Under the Data Privacy Act of 2012

As a data subject under Republic Act No. 10173, you have the following rights with respect to your personal data held by 36php. These rights are subject to applicable legal and regulatory limitations:

• Right to be informed: You have the right to be informed of how your personal data is being processed, including the purposes, legal basis, and categories of data involved. This Privacy Policy fulfils this obligation.
• Right of access: You may request a copy of the personal data 36php holds about you, including information on how it is processed and to whom it has been disclosed.
• Right to rectification: You may request correction of inaccurate, outdated, or incomplete personal data. For KYC-verified data fields, supporting documentation may be required.
• Right to erasure or blocking: You may request the deletion or blocking of your personal data where it is no longer necessary for the purpose for which it was collected, where consent has been withdrawn, or where processing is unlawful. This right is subject to overriding legal retention obligations (e.g., AMLC five-year retention requirement).
• Right to object: You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interest, subject to 36php demonstrating compelling legitimate grounds.
• Right to data portability: You may request a machine-readable copy of the personal data you have provided to 36php for transmission to another Personal Information Controller, where technically feasible.
• Right to file a complaint: If you believe 36php has violated your data privacy rights, you may file a complaint with the National Privacy Commission (NPC) through its official channels.

10 Children & Minors

The 36php Platform is strictly intended for individuals aged twenty-one (21) years and above, in compliance with PAGCOR regulations governing online gaming in the Philippines. 36php does not knowingly collect personal data from individuals under 21 years of age.

If 36php discovers or is notified that an account has been registered by a person under the age of 21, the account will be immediately suspended, all personal data associated with the account will be reviewed, and any funds in the account will be handled in accordance with PAGCOR regulations for underage accounts. The minor's personal data will be deleted to the extent permitted by applicable legal retention requirements.

11 Marketing Communications

11.1 Consent-Based Marketing

36php sends promotional and marketing communications — including bonus offers, new game announcements, and VIP programme updates — only to players who have opted in to receive such communications. Your marketing consent preference is recorded at the time of registration and can be updated at any time through your 36php account settings or by contacting support.

11.2 Withdrawing Marketing Consent

You may withdraw your consent to receive marketing communications at any time by: (a) updating your communication preferences in your 36php account settings; (b) using the unsubscribe link included in any marketing email; or (c) contacting 36php's support team or DPO directly. Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to withdrawal, and does not affect your ability to use the Platform or receive transactional communications (such as deposit confirmations and security alerts).

11.3 Responsible Gaming Messaging

All marketing and promotional communications from 36php include responsible gaming reminders in compliance with PAGCOR's responsible gaming framework. These reminders are not optional — they are included in all promotional material regardless of your marketing communication preferences.

12 Cross-Border Data Transfers

36php primarily processes personal data of Filipino players within the Philippines. Where operational requirements necessitate the transfer of personal data to service providers or infrastructure located outside the Philippines (for example, cloud hosting providers or game software providers with servers in other jurisdictions), 36php ensures the following safeguards are in place:

• The receiving jurisdiction has been assessed to provide an adequate level of data protection;
• Standard Contractual Clauses or equivalent contractual safeguards are in place between 36php and the receiving party;
• The transfer is subject to a Data Processing Agreement that requires the recipient to process data only on 36php's documented instructions and to maintain security measures consistent with this Policy;
• The transfer is documented in 36php's Personal Information Inventory as required by the NPC.

You may request information about the specific safeguards in place for any cross-border transfer involving your personal data by contacting the Data Protection Officer.

13 Third-Party Links & Services

The 36php Platform may contain links to third-party websites or references to third-party services (for example, payment service providers' own portals). This Privacy Policy applies only to data processed by 36php. When you click a link to a third-party site or use a third-party payment service, you leave the 36php Platform and the third party's own privacy policy governs the collection and use of your data from that point.

36php is not responsible for the privacy practices of third-party sites or services. We encourage you to read the privacy policy of any third-party service you use in connection with your 36php account, particularly those of your chosen payment provider (GCash, PayMaya, your bank).

14 Amendments to This Policy

36php reserves the right to update or amend this Privacy Policy at any time to reflect changes in our processing activities, legal obligations, or NPC guidance. Material changes to this Policy — particularly any change that materially affects your rights or the purposes for which we process your data — will be communicated to registered players via email to their registered address and/or via a prominent notice on the Platform prior to the change taking effect.

Where a change is mandated by law, NPC issuance, or PAGCOR regulation, the change may take effect immediately without advance notice. The "Effective Date" displayed at the top of this page reflects the date of the most recent revision. The current version of this Policy is always available at 36php.org/privacy-policy. Your continued use of the Platform following notification of changes constitutes your acceptance of the revised Policy.

15 Contact Us & Data Protection Officer

For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data by 36php — including the exercise of your rights under the Data Privacy Act of 2012 — please contact the 36php Data Protection Officer through the following channels:

We will acknowledge all data subject requests within three (3) business days and provide a substantive response within fifteen (15) business days, or such extended period as permitted by NPC guidelines for complex requests.

If you are dissatisfied with 36php's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. The NPC's contact details and complaints procedure are published on the official NPC website.