phjou Privacy Policy

1Introduction

phjou takes the privacy of its Players seriously. As an online gaming platform serving Filipino players across the Philippines — from Metro Manila to Cebu, Davao, and beyond — phjou handles a range of personal and financial data necessary to operate a regulated gaming service. This includes identity verification data required by PAGCOR licensing conditions, financial transaction data required by Anti-Money Laundering Act ("AMLA") obligations, and operational data necessary to deliver secure, personalised gaming services.

This Policy applies to all data processing activities carried out by phjou in relation to the phjou platform, mobile web experience, live chat support, email communications, and all associated player account management functions. It applies to all Players and prospective Players worldwide, with particular attention to rights afforded to data subjects under Philippine law.

2Data Controller

For the purposes of the Data Privacy Act of 2012, phjou acts as the Personal Information Controller ("PIC") in respect of personal data collected and processed through phjou.cam. phjou has appointed a Data Protection Officer ("DPO") responsible for overseeing compliance with this Policy and applicable data privacy obligations.

Contact details for phjou's Data Protection Officer are provided in Section 15 of this Policy. Players wishing to exercise their data subject rights or raise a privacy concern should direct communications to the DPO in the first instance.

3Personal Data We Collect

phjou collects the following categories of personal data, depending on how you interact with the platform:

3.1 Registration and Identity Data

• Full legal name as it appears on your government-issued identification.
• Date of birth (for age verification — players must be 21 or older under PAGCOR regulations).
• Email address and chosen username.
• Mobile number registered to your account.
• Residential address.

3.2 KYC Verification Data

• Government-issued photo identification (PhilSys National ID, Philippine passport, LTO driver's license, or other PAGCOR-accepted documents).
• Selfie photograph submitted for biometric identity confirmation.
• Secondary identification documents where requested for enhanced due diligence.

3.3 Financial and Transaction Data

• GCash number, Maya account reference, bank account details, or other payment instrument identifiers used for deposits and withdrawals.
• Records of all deposits, withdrawals, bonuses, and game wager transactions in Philippine Peso (₱).
• Source of funds declarations where required by AMLA compliance procedures.

3.4 Gaming Activity Data

• Game session logs including titles played, bet amounts, outcomes, and session duration.
• Sports betting selections, stake amounts, and market outcomes.
• Responsible gaming tool settings and usage (deposit limits, session timers, self-exclusion records).

3.5 Technical and Device Data

• IP address at time of registration and each login.
• Device type, operating system, and browser version.
• Approximate geolocation derived from IP address.
• Login timestamps and session identifiers.

3.6 Communications Data

• Live chat transcripts between you and phjou support agents.
• Email correspondence with phjou, including support requests and formal complaints.
• Survey responses and feedback submissions where voluntarily provided.

4How We Collect Your Data

phjou collects personal data through the following means:

• Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact phjou support, or respond to a survey.
• Automatically through the platform — when you access phjou.cam, our servers automatically record technical data including your IP address, device identifiers, and session activity. This data is captured through server logs, session cookies, and similar technologies described in Section 6.
• From payment service providers — when you initiate a GCash, Maya, or bank transfer transaction, the relevant payment provider confirms transaction status and payment instrument details to phjou's systems.
• From identity verification partners — phjou uses regulated third-party KYC service providers to authenticate government-issued documents submitted during verification. These providers return a verification outcome to phjou but do not store your documents on phjou's behalf beyond the verification process.
• From publicly available sources — phjou may cross-reference publicly available databases in connection with AMLA compliance checks, including politically exposed persons ("PEP") screening and sanctions list verification.

5Purpose of Processing & Legal Basis

phjou processes personal data only for lawful purposes. For each processing activity, at least one of the following legal bases under the Data Privacy Act of 2012 applies:

5.1 Contractual Necessity

Processing is necessary to fulfil phjou's obligations to you under the Terms & Conditions — including account creation, game delivery, financial transaction processing, bonus management, and customer support. Without this processing, phjou cannot provide its services to you.

5.2 Legal Obligation

Processing is required to comply with mandatory obligations under Philippine law, including:

• Identity verification and Know Your Customer requirements under PAGCOR licensing conditions.
• Anti-Money Laundering Act (Republic Act No. 9160, as amended) transaction monitoring and suspicious activity reporting obligations.
• Tax reporting obligations under the National Internal Revenue Code and applicable BIR issuances.
• Data breach notification obligations under the Data Privacy Act of 2012 and NPC Circular 16-03.

5.3 Legitimate Interests

Processing is carried out in pursuit of phjou's legitimate interests, where those interests are not overridden by your rights and freedoms. Legitimate interests include fraud prevention, platform security monitoring, responsible gaming analysis, and product improvement through aggregated, anonymised usage analytics.

5.4 Consent

For processing activities not covered by the above legal bases — in particular, direct marketing communications sent to your registered email address — phjou will seek your explicit, freely given, and informed consent. You may withdraw consent for marketing communications at any time as described in Section 13.

6Cookies & Similar Tracking Technologies

phjou uses cookies and similar browser storage technologies to operate its platform effectively. Cookies are small text files placed on your device that enable the platform to remember your session, preferences, and usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies — Required for the platform to function. These include session authentication tokens that keep you logged in during a gaming session. They cannot be disabled without preventing access to phjou.
• Functional Cookies — Store your language preferences, display settings, and game lobby layout choices so they persist across sessions.
• Performance & Analytics Cookies — Collect anonymised data about how Players navigate phjou.cam, which pages load slowly, and which features are most used. This data is used exclusively to improve platform performance. It is not linked to your identity.
• Security Cookies — Assist with fraud detection, bot prevention, and suspicious login activity identification.

phjou does not deploy third-party advertising or behavioural tracking cookies. You may manage cookie preferences through your browser settings, though disabling strictly necessary cookies will affect platform functionality.

7Sharing Your Data with Third Parties

phjou does not sell, rent, or trade your personal data. We share data only with third parties as strictly necessary for the following purposes, and only with partners who are contractually bound to process data securely and only as instructed by phjou:

• Payment Processors — GCash, Maya/PayMaya, GrabPay, BancNet-connected banks, and other payment service providers receive transaction data necessary to complete your deposit or withdrawal request.
• KYC and Identity Verification Providers — Regulated third-party verification services that authenticate your government-issued identification documents. These providers operate under their own NPC-compliant privacy frameworks.
• Game Software Providers — Casino software licensors may receive anonymised session identifiers and game outcome data for integrity verification purposes. They do not receive your full personal profile.
• Cloud Infrastructure Providers — phjou's platform is hosted on enterprise cloud infrastructure. Hosting providers act as Personal Information Processors under agreements that prohibit independent use of your data.
• Regulatory and Law Enforcement Authorities — PAGCOR, the Anti-Money Laundering Council ("AMLC"), the National Privacy Commission, and competent Philippine courts may receive data where required by a lawful order, regulatory obligation, or legal process. phjou will notify you of such disclosures to the extent permitted by law.
• Fraud Prevention Services — Regulated fraud screening services may receive limited transactional data in connection with anti-fraud checks. No data is disclosed to marketing or data brokerage services.

8International Data Transfers

phjou's primary data processing infrastructure is located within the Philippines. However, some third-party service providers — particularly cloud infrastructure partners and game software licensors — may process or store data on servers located outside the Philippines.

Where personal data is transferred outside the Philippines, phjou ensures that appropriate safeguards are in place in accordance with Section 21 of the Data Privacy Act of 2012 and NPC guidelines on cross-border data flows. These safeguards include contractual data processing agreements that impose obligations on receiving parties equivalent to those applicable under Philippine law.

Players may request information about specific cross-border transfer arrangements applicable to their data by contacting phjou's Data Protection Officer at the details set out in Section 15.

9Data Retention

phjou retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, or as required by applicable Philippine law. The following indicative retention periods apply:

• Account and KYC Data — Retained for the duration of your active phjou Account plus a minimum of five (5) years following account closure, consistent with AMLA record-keeping requirements.
• Financial Transaction Records — Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act and applicable BSP regulations.
• Gaming Session Logs — Retained for a period sufficient to support dispute resolution and PAGCOR compliance audits, typically three (3) years.
• Support Communications — Live chat transcripts and email records are retained for two (2) years from the date of the interaction to support quality assurance and dispute resolution.
• Technical and Device Data — Server access logs are retained for twelve (12) months for security and fraud investigation purposes.
• Marketing Consent Records — Retained for as long as you remain subscribed plus a reasonable period thereafter as evidence of consent.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in a manner that prevents re-identification. Anonymised, aggregated data may be retained indefinitely for analytical purposes.

10Your Data Subject Rights

Under the Data Privacy Act of 2012, you hold the following rights in relation to personal data phjou holds about you. These rights may be exercised by contacting phjou's Data Protection Officer as described in Section 15.

phjou will respond to verifiable data subject requests within twenty (20) business days of receipt, in accordance with NPC guidelines. Where requests are complex or numerous, phjou may extend this period by a further twenty (20) business days and will notify you accordingly.

Identity verification may be required before processing a data subject request to protect against unauthorised disclosure to third parties.

11Data Security Measures

phjou implements technical and organisational measures proportionate to the risks presented by its processing activities. These include:

• Encryption in Transit — All data exchanged between your device and phjou servers is encrypted using TLS 1.2 or higher. Connections over unencrypted HTTP are automatically redirected to HTTPS.
• Encryption at Rest — Sensitive personal data stored in phjou's databases — including KYC documents and financial records — is encrypted at rest using AES-256 or equivalent standards.
• Access Controls — Internal access to Player personal data is restricted on a strict need-to-know basis. All access by phjou staff is logged and subject to regular audit review.
• Two-Factor Authentication — Players may enable two-factor authentication on their phjou accounts, adding a second layer of protection against unauthorised access.
• Security Monitoring — phjou maintains continuous monitoring for anomalous login activity, suspicious transactions, and attempts to access systems without authorisation.
• Breach Response — phjou maintains a documented data breach response procedure aligned with NPC Circular 16-03. In the event of a breach likely to affect your rights and freedoms, you will be notified within seventy-two (72) hours of our becoming aware of it, where required.

12Children and Minors

phjou's services are strictly restricted to individuals who are at least twenty-one (21) years of age, as required by PAGCOR regulations. phjou does not knowingly collect personal data from individuals under the age of 21.

If phjou discovers or is notified that an Account holder is under the age of 21, the account will be immediately and permanently closed. Any funds deposited will be returned to the originating payment method following identity verification, and all personal data associated with the underage Account will be deleted to the extent not required to be retained by applicable law.

13Marketing Communications

phjou may send promotional communications to your registered email address regarding bonuses, new game releases, sports betting promotions, and platform updates, subject to your having provided consent to receive such communications.

You may withdraw your consent to marketing communications at any time by:

• Clicking the "Unsubscribe" link included in any marketing email from phjou; or
• Updating your communication preferences in the Notifications section of your phjou Account settings; or
• Contacting phjou's Data Protection Officer as described in Section 15.

Withdrawal of marketing consent does not affect your continued receipt of transactional communications — such as deposit confirmations, withdrawal notifications, and security alerts — which are necessary to operate your account and cannot be opted out of while your account remains active.

phjou does not engage in SMS marketing without your prior explicit consent. phjou does not purchase marketing lists or send unsolicited bulk communications.

14Changes to This Privacy Policy

phjou reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The updated Policy will be published at phjou.cam/privacy-policy with a revised "Last Updated" date.

Where changes are material — meaning they affect your rights, the purposes for which we process your data, or the third parties with whom we share it — phjou will provide advance notice via your registered email address no less than fourteen (14) days before the changes take effect.

Your continued use of phjou following the effective date of an updated Policy constitutes your acknowledgement of the changes. If you do not accept the updated Policy, you should cease using phjou and request account closure. Your data subject rights under the Data Privacy Act of 2012 remain unaffected regardless of changes to this Policy.

15Contact Us & Data Protection Officer

For all data privacy enquiries — including the exercise of data subject rights, questions about this Policy, reporting a suspected breach, or raising a privacy concern — please contact phjou's Data Protection Officer using the following details. Contact information is provided as plain text only and should be copied manually into your email application:

• Data Protection Officer: phjou Privacy Office
• Email: [email protected] (subject line: "Privacy / DPO Request")
• Live Chat: Available 24/7 from your logged-in phjou Account dashboard.
• Response Time: Within twenty (20) business days for formal data subject requests.

If you believe phjou has failed to address your privacy concern adequately, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. Information about the NPC complaints process is available on the NPC's official website.