How phfin Approaches Your Privacy
Data Privacy Act Compliant
phfin processes all personal data in strict compliance with Republic Act No. 10173, the Data Privacy Act of 2012, and its Implementing Rules and Regulations. Your data rights as a Filipino data subject are fully recognized and honored by phfin.
No Data Selling — Ever
phfin does not sell, rent, or trade your personal information to third parties for marketing or commercial purposes. Your data is used exclusively to operate and improve the phfin platform and to meet our legal and regulatory obligations.
256-Bit Encryption
All data transmitted between your device and phfin's servers is protected by industry-standard 256-bit SSL/TLS encryption. Sensitive personal information stored in phfin's systems is encrypted at rest using AES-256, the same standard used by Philippine banks.
Your Rights, Your Control
As a phfin data subject, you have the right to access, correct, delete, and port your personal data. You may also object to certain processing activities and withdraw consent where consent is the legal basis for processing. All requests are honored free of charge.
Clear Retention Limits
phfin retains your personal data only for as long as necessary to fulfill the purposes described in this Policy, or as required by applicable law. Data that is no longer needed is securely deleted or anonymized within defined timeframes.
Breach Notification
In the unlikely event of a personal data breach that poses a real risk to affected players, phfin will notify impacted individuals and the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, as required by the Data Privacy Act.
1. Overview and Scope
Who this Policy applies to and what it covers.
This Privacy Policy (hereinafter "Policy") is issued by phfin Casino (hereinafter "phfin", "We", "Us", or "Our"), operator of the online gaming platform accessible at https://phfin.cam and associated mobile applications. This Policy describes how phfin collects, uses, stores, discloses, and protects the personal information of all individuals who interact with the phfin platform, including registered players, visitors to the phfin website, and applicants for a phfin account (collectively, "Data Subjects" or "You").
This Policy is issued in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations (IRR), as enforced by the National Privacy Commission (NPC) of the Philippines. phfin is registered with the NPC as a personal information controller.
By accessing the phfin platform, registering an account, or otherwise providing personal information to phfin, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.
Note for Filipino Players: phfin serves players across the Philippines — from Manila, Makati, and Quezon City to Cebu, Davao, Iloilo, and beyond. Regardless of where in the Philippines you are accessing phfin, this Policy applies in full. Your rights as a data subject under Philippine law are the same whether you are playing from a condo in BGC or a home in Zamboanga City.
2. Personal Data We Collect
The categories of information phfin may hold about you.
phfin collects personal data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed. The categories of personal data we may collect include:
| Data Category | Examples | Collection Point |
|---|---|---|
| Identity Data | Full name, date of birth, nationality, government ID number (SSS, PhilSys, driver's license, passport) | Registration, KYC verification |
| Contact Data | Mobile phone number, email address, home address | Registration, account updates |
| Financial Data | GCash number, PayMaya number, bank account details (BDO, BPI, Metrobank), transaction history | Deposit and withdrawal flows |
| Account Data | Username, encrypted password, account preferences, bonus history, VIP tier | Registration, platform use |
| Gaming Data | Game history, bet amounts, win/loss records, session durations, game preferences | Gameplay activity |
| Technical Data | IP address, device type, browser type and version, operating system, screen resolution | Automatic collection on site visit |
| Communication Data | Support chat transcripts, email correspondence, feedback submissions | Customer support interactions |
| Verification Data | Selfie photographs, copies of government-issued ID documents | KYC identity verification |
phfin does not intentionally collect sensitive personal information as defined under Section 3(l) of the Data Privacy Act (such as health data, political affiliations, or religious beliefs) unless specifically required for a legal or regulatory purpose, in which case explicit consent will be sought.
3. How We Collect Your Data
The methods and sources through which phfin obtains personal information.
phfin collects personal data through the following channels:
- Directly from You: When you register a phfin account, complete identity verification, make deposits or withdrawals, contact phfin support, respond to surveys, or participate in promotions;
- Automatically: When you visit or interact with the phfin website or mobile application, technical data is collected automatically via cookies, web beacons, server logs, and similar tracking technologies (see Section 7);
- From Payment Processors: phfin receives transaction confirmation data from GCash, PayMaya, and partner banks to verify deposits and process withdrawals;
- From Identity Verification Services: phfin may use third-party KYC service providers to verify the authenticity of identity documents submitted during account verification;
- From Regulatory Authorities: PAGCOR and other competent authorities may share information with phfin in connection with regulatory compliance, investigations, or licensing conditions.
4. Legal Basis for Processing
The lawful grounds under the Data Privacy Act that authorize phfin to process your personal data.
phfin processes your personal data on one or more of the following legal bases as recognized under the Data Privacy Act of 2012:
- Consent: You have given clear and freely-given consent to the processing of your personal data for specific purposes, such as receiving promotional communications from phfin. You may withdraw consent at any time without affecting the lawfulness of prior processing;
- Contractual Necessity: Processing is necessary for the performance of the contract between phfin and you (i.e., the phfin Terms & Conditions), including account management, deposit and withdrawal processing, and game facilitation;
- Legal Obligation: Processing is required for phfin to comply with applicable legal obligations, including PAGCOR licensing conditions, Anti-Money Laundering (AML) requirements under Republic Act No. 9160 (as amended), and tax reporting obligations;
- Legitimate Interests: Processing is necessary for phfin's legitimate business interests — including fraud prevention, platform security, and responsible gaming monitoring — provided these interests are not overridden by your rights and freedoms.
5. How phfin Uses Your Personal Data
The specific purposes for which phfin processes the personal information it holds about you.
phfin uses your personal data strictly for the following purposes:
- Account Management: Creating, maintaining, and administering your phfin player account, including processing your registration, verifying your identity, and managing your account preferences;
- Transaction Processing: Facilitating deposits via GCash, PayMaya, and bank transfers, and processing withdrawal requests to your registered payment accounts;
- Game Provision: Delivering casino games, sports betting, bingo, and other gaming services that constitute the core phfin product offering;
- Regulatory Compliance: Meeting phfin's obligations under PAGCOR regulations, AML laws, the Data Privacy Act, and other applicable Philippine legislation, including maintaining required records and filing mandatory reports;
- Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, unauthorized account access, money laundering, and other illegal conduct on the phfin platform;
- Responsible Gaming: Monitoring gaming patterns to identify potential problem gambling behavior and administering responsible gaming tools including deposit limits, cooling-off periods, and self-exclusion;
- Customer Support: Responding to your queries, complaints, and support requests, and maintaining records of communications for quality assurance and dispute resolution;
- Marketing Communications: Where you have opted in, sending you personalized promotions, bonus offers, and news about phfin Casino. You may opt out at any time;
- Platform Improvement: Analyzing aggregated and anonymized usage data to improve the phfin user experience, fix technical issues, and develop new features.
phfin will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or establishing a new lawful basis for processing.
6. Data Sharing and Disclosure
Who phfin shares your data with and under what circumstances.
phfin does not sell your personal data. phfin may share personal data with the following categories of recipients only to the extent necessary and on a strict need-to-know basis:
- PAGCOR and Regulatory Bodies: phfin is required by its operating license to share certain player data with PAGCOR and cooperate with investigations conducted by PAGCOR or other competent Philippine government authorities;
- Anti-Money Laundering Council (AMLC): phfin is a covered person under the Anti-Money Laundering Act and is obligated to file reports with the AMLC for covered and suspicious transactions as defined by law;
- Payment Service Providers: GCash (Mynt), PayMaya (Voyager Innovations), BDO, BPI, Metrobank, and other payment processors receive transaction data necessary to process deposits and withdrawals;
- Identity Verification Providers: Third-party KYC service providers process identity document images and selfie photographs for the purpose of verifying player identity. These providers are bound by data processing agreements with phfin;
- Technology Service Providers: Cloud hosting providers, cybersecurity firms, and other technical service providers who support the operation of the phfin platform. All such providers are contractually bound to process data only on phfin's instructions;
- Game Software Providers: Providers such as JILI, Evolution Gaming, and SA Gaming may receive minimum necessary technical data to facilitate game sessions. No more data than is required is shared;
- Law Enforcement: phfin will disclose personal data to law enforcement agencies or courts where required by a valid legal order or warrant under Philippine law.
International Transfers: Some of phfin's technology service providers and game suppliers are based outside the Philippines. Where personal data is transferred internationally, phfin ensures that appropriate safeguards are in place as required by Section 21 of the Data Privacy Act, including data processing agreements incorporating standard contractual clauses.
7. Cookies and Tracking Technologies
How phfin uses cookies and similar technologies on its platform.
The phfin website and mobile application use cookies and similar tracking technologies to provide, secure, and improve the platform. The types of cookies used by phfin are as follows:
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Essential | Required for the phfin platform to function, including session management, login authentication, and security tokens. Without these, the platform cannot operate. | No — required for function |
| Functional | Remember your preferences (language, display settings, game lobby filters) to provide a more personalized phfin experience. | Yes — via cookie settings |
| Analytical | Collect anonymized data about how players use phfin to identify popular features, diagnose technical issues, and improve the platform over time. | Yes — via cookie settings |
| Marketing | Used only with your consent to deliver personalized promotional content relevant to your phfin activity. No data is shared with third-party advertising networks. | Yes — via cookie settings or opt-out |
You may manage your cookie preferences through the cookie settings panel accessible on the phfin website or by adjusting your browser settings. Please note that disabling essential cookies will prevent you from using the phfin platform.
8. Data Security Measures
The technical and organizational safeguards phfin maintains to protect your personal data.
phfin implements comprehensive technical and organizational security measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, and destruction. These measures include:
- 256-bit SSL/TLS encryption for all data in transit between your device and phfin servers;
- AES-256 encryption for sensitive personal data stored in phfin's databases;
- Bcrypt hashing for all account passwords — phfin staff cannot view your password in plain text;
- Multi-factor authentication for all internal phfin systems that store personal data;
- Role-based access controls ensuring that phfin staff can only access personal data strictly necessary for their job function;
- Regular third-party penetration testing and vulnerability assessments of the phfin platform;
- 24/7 security monitoring and automated intrusion detection systems;
- Formal incident response procedures with defined escalation paths and regulatory notification timelines.
While phfin takes all reasonable measures to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your phfin login credentials and for immediately notifying phfin if you suspect unauthorized access to your account.
9. Data Retention
How long phfin keeps different categories of personal data.
phfin retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or for as long as required by applicable law. The following retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & Identity Data | Duration of account plus 5 years after closure | PAGCOR licensing, AML requirements |
| Financial Transaction Records | 10 years from transaction date | AMLA Section 9, PAGCOR requirements |
| KYC Verification Documents | Duration of account plus 5 years after closure | PAGCOR licensing, AMLA compliance |
| Gaming History | 5 years from date of activity | PAGCOR audit requirements |
| Support Communications | 3 years from date of last contact | Dispute resolution, quality assurance |
| Marketing Preferences | Until withdrawal of consent or account closure | Consent-based processing |
| Technical/Log Data | 90 days | Security monitoring, fraud prevention |
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized in accordance with phfin's data disposal procedures. Anonymized data may be retained for statistical analysis purposes without time limit, as it can no longer identify any individual.
10. Your Rights as a Data Subject
The rights you hold under the Data Privacy Act and how to exercise them with phfin.
As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phfin. All of these rights may be exercised free of charge by contacting phfin's Data Protection Officer as described in Section 14.
Right to Access
Request a copy of the personal data phfin holds about you and information about how it is used.
Right to Rectification
Request correction of inaccurate or incomplete personal data phfin holds about you.
Right to Erasure
Request deletion of your personal data where there is no lawful basis for phfin to continue processing it.
Right to Object
Object to the processing of your personal data for direct marketing or legitimate interest purposes.
Right to Portability
Receive your personal data in a structured, commonly used, machine-readable format for transfer to another controller.
Right to Restrict Processing
Request that phfin restrict the processing of your data in certain circumstances, such as while a rectification request is under review.
phfin will respond to all data subject rights requests within thirty (30) calendar days of receipt. Where a request is complex or involves a large volume of data, phfin may extend this period by a further thirty (30) days, with notification provided within the initial period. phfin may request proof of identity before processing a data subject rights request to prevent unauthorized access to another person's data.
If you are not satisfied with phfin's response to a data subject rights request, or if you believe phfin has processed your personal data in violation of the Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.
11. Minors and Age Restriction
phfin's position on the collection and processing of data belonging to persons under 21.
21+ Strictly Enforced: phfin Casino is intended exclusively for persons who are at least 21 years of age. phfin does not knowingly collect, process, or store personal data from individuals under 21 years of age. If phfin discovers or reasonably suspects that an account belongs to a person under 21, that account will be immediately suspended and all associated personal data will be handled in accordance with applicable law, including any required notifications to regulatory authorities.
If you are a parent or guardian and believe that a person under the age of 21 in your care has provided personal data to phfin and/or registered an account, please contact phfin's Data Protection Officer immediately at the contact details provided in Section 14. phfin will take prompt action to investigate and, where confirmed, delete the relevant data and close the account.
12. Third-Party Links
phfin's position on external websites linked from the platform.
The phfin platform may contain links to third-party websites, such as payment provider portals or regulatory body information pages. This Privacy Policy applies solely to data processed by phfin through the phfin platform. phfin is not responsible for the privacy practices of any third-party website and recommends that you review the relevant privacy policy before providing personal information on any third-party site.
13. Changes to This Privacy Policy
How phfin handles updates to this document.
phfin may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, phfin's operations, or data processing practices. The version number and "Last Updated" date at the top of this Policy identify the currently applicable version.
When material changes are made to this Policy, phfin will notify registered players via email to the address on file and/or via a prominent notice on the phfin platform at least fourteen (14) days before the changes take effect. Your continued use of the phfin platform after the effective date of updated terms constitutes acceptance of the revised Policy.
phfin maintains an archive of previous versions of this Policy, available upon request from the Data Protection Officer.
14. Contact and Data Protection Officer
How to reach phfin regarding any privacy or data protection matter.
phfin has appointed a Data Protection Officer (DPO) as required by the Data Privacy Act. The DPO is responsible for overseeing phfin's data protection strategy, ensuring compliance with the Data Privacy Act, and handling data subject rights requests and privacy complaints.
To exercise your data subject rights, submit a privacy complaint, or make any other inquiry regarding phfin's processing of your personal data, please contact the phfin DPO through any of the following channels:
phfin Casino — Data Protection Officer
Email (plain text): [email protected]
Subject line: "Data Privacy Request — [Your Full Name]"
Response Time: All privacy inquiries are acknowledged within 3 business days. Full responses are provided within 30 calendar days as required by the Data Privacy Act.
National Privacy Commission: If you are not satisfied with phfin's handling of your privacy concern, you may also lodge a complaint directly with the National Privacy Commission of the Philippines (privacy.gov.ph).
Play at phfin with Complete Confidence
phfin Casino combines PAGCOR-regulated gaming with the highest data privacy standards in the industry. Thousands of Filipino players trust us every day — from Makati to Mindanao.