Privacy Policy

This Privacy Policy ("Policy") describes the practices of phlro ("phlro," "we," "us," or "our") regarding the collection, use, storage, disclosure, and protection of personal information obtained from players and visitors who access or use the phlro online gaming platform at phlro.net (the "Platform").

phlro is committed to respecting and protecting the privacy rights of all individuals whose personal data we process. This Policy is issued in compliance with Republic Act No. 10173, known as the Data Privacy Act of the Philippines ("DPA"), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission ("NPC").

By registering a phlro account, accessing the Platform, or interacting with any phlro service, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree with this Policy, please do not use the Platform.

For the purposes of the Data Privacy Act of the Philippines and this Policy, phlro acts as the Personal Information Controller in respect of the personal data collected from players and visitors through the Platform.

As Personal Information Controller, phlro determines the purposes for which personal data is processed and the means by which such processing is carried out. phlro has designated a Data Protection Officer ("DPO") who is responsible for overseeing compliance with this Policy and applicable data privacy laws.

Contact details for phlro's Data Protection Officer are provided in Section 14 of this Policy. You may direct any privacy-related enquiries, requests, or complaints to the DPO at any time.

phlro collects the following categories of personal data from players and platform visitors, depending on the nature of their interaction with the Platform:

phlro does not intentionally collect sensitive personal information as defined under Section 3(l) of the Data Privacy Act (such as health, racial, or political data) unless strictly required for compliance purposes such as responsible gaming assessments or regulatory investigations, and only with your explicit consent where applicable.

phlro collects personal data through the following channels and mechanisms:

• Direct interactions: Data you provide when creating a phlro account, completing KYC verification, making a deposit or withdrawal, contacting customer support, participating in promotions, or updating your account settings.
• Automated technologies: Technical and usage data collected automatically as you navigate the Platform, using cookies, web beacons, server logs, and similar tracking technologies. Please see Section 7 for details on our cookie practices.
• Payment providers: Financial data received from our payment processing partners — including GCash, Maya, BPI, BDO, UnionBank, and Coins.ph — when you initiate a transaction on the Platform.
• Identity verification providers: Identity data confirmed through third-party KYC and anti-money laundering verification services engaged by phlro to fulfill its regulatory obligations under Philippine law.
• Fraud prevention and security partners: Technical and behavioral data received from service providers that assist phlro in detecting and preventing fraudulent activity, unauthorized access, and abuse of the Platform.

phlro processes your personal data only where a lawful basis exists under the Data Privacy Act of the Philippines. The following table outlines our primary processing purposes and their corresponding legal bases:

phlro does not sell, rent, or trade your personal data to third parties for commercial gain. We may share your personal data with the following categories of recipients only to the extent necessary for the stated purpose:

• Payment processing partners: GCash, Maya, BPI, BDO, UnionBank, Coins.ph, and USDT processing providers, to facilitate deposits and withdrawals on your account.
• KYC and identity verification providers: Third-party services that assist phlro in verifying player identity and age in compliance with PAGCOR and Philippine AML regulatory requirements.
• Fraud detection and security services: Service providers engaged to monitor Platform activity for fraudulent behavior, unauthorized access attempts, and security vulnerabilities.
• IT infrastructure and cloud service providers: Technology partners that host, maintain, and support the phlro Platform infrastructure, bound by data processing agreements that require them to protect your data to the same standard as phlro.
• Regulatory and law enforcement authorities: The Philippine Amusement and Gaming Corporation (PAGCOR), the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities, where phlro is legally required to disclose data.
• Legal and professional advisers: Lawyers, auditors, and compliance consultants engaged by phlro, subject to professional confidentiality obligations.

All third-party service providers engaged by phlro as Personal Information Processors are required to enter into data sharing or processing agreements that impose data protection obligations consistent with the Data Privacy Act of the Philippines and this Policy.

phlro uses cookies and similar tracking technologies to enhance your experience on the Platform, remember your preferences, analyze usage patterns, and support security and fraud prevention functions.

The following types of cookies are used on the phlro Platform:

• Strictly necessary cookies: Essential for the Platform to function correctly. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Enable the Platform to remember your preferences, such as language settings and responsible gaming limit configurations, across sessions.
• Analytics cookies: Allow phlro to understand how players interact with the Platform — such as which games are most visited and where users encounter difficulties — so that we can improve the experience over time. Data collected is aggregated and does not identify you personally.
• Security and fraud prevention cookies: Help phlro identify and block suspicious activity, such as login attempts from unrecognized devices or locations.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may affect your ability to log in and use the Platform. Blocking analytics or functional cookies will not prevent you from playing games but may affect personalisation features.

phlro implements a comprehensive set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our key security practices include:

• Transport Layer Security (TLS): All data transmitted between your device and phlro servers is encrypted using current TLS standards, preventing interception during transit.
• Password hashing: Account passwords are stored using industry-standard one-way cryptographic hashing algorithms. phlro personnel cannot view your password in plain text.
• Access controls: Access to systems containing personal data is restricted to phlro personnel on a strict need-to-know basis. Multi-factor authentication is required for privileged system access.
• Regular security assessments: The phlro Platform undergoes periodic vulnerability assessments and penetration testing conducted by qualified security professionals.
• Data minimization: phlro collects only the personal data that is necessary for the stated purpose. We do not retain data beyond its useful life.
• Incident response: phlro maintains a documented personal data breach response procedure. In the event of a breach affecting your data, we will notify you and the National Privacy Commission within 72 hours of becoming aware of the incident, as required under the Data Privacy Act.

While phlro takes all reasonable steps to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We encourage you to maintain the security of your own phlro account by using a strong, unique password and enabling any available account security features.

phlro retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and regulatory obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements under Republic Act No. 9160.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, as required by AMLC regulations and PAGCOR licensing conditions.
• Customer support communications: Retained for two (2) years from the date of the last interaction, or longer where a support case relates to an unresolved dispute or legal proceeding.
• Marketing consent records: Retained for the duration of your marketing consent and for three (3) years following withdrawal of consent, to demonstrate compliance with consent-based marketing requirements.
• Technical and usage data (cookies/logs): Session data is retained for up to thirteen (13) months for analytics purposes; server security logs are retained for up to twelve (12) months.

Upon expiry of the applicable retention period, phlro will securely delete or anonymize your personal data in accordance with established data disposal procedures, unless retention is required by a subsisting legal obligation or ongoing legal proceeding.

As a data subject under the Data Privacy Act of the Philippines, you are entitled to exercise the following rights in respect of personal data held by phlro:

• Right to be informed: You have the right to be told that your personal data is being or will be processed, and the details of such processing — which this Policy is designed to fulfill.
• Right of access: You may request a copy of the personal data phlro holds about you, along with information on how it is being used.
• Right to rectification: You may request correction of any inaccurate, incomplete, or outdated personal data in your phlro account.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to phlro's retention obligations under applicable law.
• Right to object: You may object to the processing of your personal data where phlro relies on legitimate interest as the legal basis, and where your individual circumstances justify such objection.
• Right to data portability: You may request that phlro provide your personal data in a structured, commonly used, and machine-readable format where technically feasible.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to lodge a complaint: You have the right to file a complaint with the National Privacy Commission if you believe phlro has violated your data privacy rights.

To exercise any of the above rights, please contact phlro's Data Protection Officer using the contact details provided in Section 14. phlro will respond to all verified requests within thirty (30) calendar days of receipt, unless a longer period is permitted by applicable law.

The phlro Platform is intended exclusively for adults who are at least 21 years of age, in accordance with applicable Philippine gaming regulations. phlro does not knowingly collect, process, or retain personal data from individuals under 21 years of age.

If phlro becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data, close the associated account, and return any unplayed deposited funds to the payment source, subject to verification. Where required by law, we will report suspected underage gambling to the appropriate Philippine authorities.

If you are a parent or guardian and believe that a minor has created a phlro account or provided personal data to phlro, please contact our support team immediately at the details provided in Section 14.

The phlro Platform is operated primarily from the Philippines, and personal data is stored on servers located within Philippine jurisdiction where practicable. However, certain service providers engaged by phlro — including cloud infrastructure, KYC verification, and fraud detection partners — may process personal data in jurisdictions outside the Philippines.

Where personal data is transferred to a jurisdiction outside the Philippines, phlro ensures that appropriate safeguards are in place to protect your data in accordance with the Data Privacy Act. Such safeguards include:

• Data processing agreements containing standard contractual clauses approved or recognized under Philippine data privacy law;
• Transfers only to jurisdictions recognized by the NPC as providing an adequate level of data protection; or
• Other lawful transfer mechanisms as permitted under the Data Privacy Act and its Implementing Rules and Regulations.

You may request further information about the specific safeguards in place for international transfers of your personal data by contacting phlro's Data Protection Officer.

phlro reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform features. The "Last Updated" date at the top of this page will be revised accordingly whenever a material change is made.

Where changes are material — meaning they significantly affect your rights or the way we process your personal data — phlro will notify registered players via the email address associated with their account at least seven (7) calendar days before the revised Policy takes effect.

Your continued use of the phlro Platform following the effective date of any revised Privacy Policy constitutes your acknowledgment of the changes. We encourage you to review this Policy periodically to stay informed about how phlro protects your personal information.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way phlro handles your personal data, you may contact us through the following channels. All privacy-related communications are handled by phlro's designated Data Protection Officer:

• Privacy & DPO Enquiries: [email protected] (subject line: "Privacy Request")
• General Customer Support (24/7): [email protected]
• Partnerships & Affiliates: [email protected]

phlro aims to respond to all data privacy requests within thirty (30) calendar days of receipt. For complex requests, we will acknowledge receipt within five (5) business days and communicate an expected timeline for full resolution.

If you are not satisfied with phlro's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines at privacy.gov.ph. We always encourage players in Manila, Cebu, Davao, Quezon City, Makati, and everywhere else in the Philippines to reach out to us first — we will do our best to resolve your concern directly.