Privacy Policy

phamco ("phamco," "we," "us," or "our") is the operator of the online gaming platform accessible at phamco.org. phamco is a digital gaming brand designed and built specifically for Filipino players across the Philippines, including Metro Manila, Cebu City, Davao City, Quezon City, Makati, Pasig, Iloilo, and beyond.

For the purposes of the Republic of the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, phamco acts as the Personal Information Controller (PIC) with respect to the personal data of all registered players and website visitors. As PIC, phamco determines the purposes and means by which your personal data is collected and processed.

phamco has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with RA 10173 and all applicable National Privacy Commission (NPC) issuances. Contact details for our DPO are provided in Section 14 of this Privacy Policy.

phamco collects the following categories of personal data from players and platform visitors. We only collect data that is necessary, relevant, and proportionate to the purposes described in this Privacy Policy.

We do not collect sensitive personal information — such as health data, biometric data, or political affiliations — unless required by applicable law (for example, in connection with responsible gaming self-exclusion requests) and only with your explicit consent where required.

phamco collects personal data through the following means:

• Direct Interactions: When you register a phamco account, complete our KYC verification process, make a deposit or withdrawal, contact our support team, or respond to a promotional offer, you directly provide us with personal data.
• Automated Technologies: As you use the phamco platform, we automatically collect Technical Data (as described in Section 2) through cookies, server logs, and similar tracking technologies. Please refer to Section 7 for full details on our cookie practices.
• Payment Processors: When you use GCash, PayMaya, BPI, BDO, Metrobank, or 7-Eleven to fund your phamco peso wallet, we receive transaction confirmation data from those providers to record the deposit or withdrawal in your account.
• Identity Verification Providers: To comply with KYC requirements and confirm that all players are 21 years of age or older, phamco may engage third-party identity verification services. These providers process identity documents on phamco's behalf under strict data processing agreements.
• Game Providers: Third-party game developers such as JILI may transmit game session data to phamco in connection with the delivery of their games on the phamco platform.

phamco processes your personal data for the following purposes. Each purpose is supported by a lawful basis as detailed in Section 5.

• Account Registration & Management: To create and maintain your phamco player account, including storing your login credentials and account preferences.
• Identity & Age Verification (KYC): To confirm that you are at least 21 years of age and to verify your identity in compliance with PAGCOR-aligned standards and Philippine anti-money laundering requirements.
• Payment Processing: To process your PHP deposits and withdrawal requests via GCash, PayMaya, BPI, BDO, Metrobank, or 7-Eleven, and to maintain accurate transaction records.
• Gaming & Platform Services: To deliver games, calculate and credit winnings, apply bonuses, and personalise your phamco gaming experience.
• Customer Support: To respond to your queries, resolve disputes, and handle complaints submitted through live chat, email, or any other support channel.
• Security & Fraud Prevention: To detect and prevent unauthorised account access, fraudulent transactions, money laundering, and other prohibited conduct as described in phamco's Terms & Conditions.
• Responsible Gaming: To monitor gaming behaviour, action responsible gaming tool requests (such as deposit limits or self-exclusion), and comply with any regulatory requirements relating to player protection.
• Legal Compliance: To comply with phamco's legal obligations under Philippine law, including reporting obligations to PAGCOR-aligned regulatory bodies and the Anti-Money Laundering Council (AMLC).
• Platform Improvement & Analytics: To analyse aggregated, anonymised usage data for the purpose of improving platform performance, game selection, and user experience.
• Marketing Communications: Where you have given your consent, to send you promotional offers, bonus notifications, and phamco news via email or SMS. You may withdraw consent for marketing communications at any time.

Under the Data Privacy Act of 2012, phamco relies on the following lawful bases for processing your personal data:

• Contractual Necessity: Processing your Identity Data, Contact Data, Financial Data, and Gaming Data is necessary for the performance of the player agreement between you and phamco — i.e., to provide you with access to the phamco platform and Services.
• Legal Obligation: Processing for KYC verification, anti-money laundering compliance, age verification (21+), and regulatory reporting is required for phamco to comply with its legal obligations under Philippine law.
• Legitimate Interests: Processing Technical Data for platform security, fraud prevention, and aggregate analytics is necessary for phamco's legitimate interests in maintaining a safe and reliable platform, provided those interests are not overridden by your data protection rights.
• Consent: Processing for marketing communications and for the use of non-essential cookies is based on your freely given, informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

phamco does not sell, rent, or trade your personal data. We may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment Service Providers: GCash, PayMaya, BPI, BDO, Metrobank, and 7-Eleven receive limited financial data necessary to process your PHP transactions. These providers operate under their own privacy policies and are responsible for their own data processing.
• Identity Verification Providers: Third-party KYC and age-verification service providers process your identity documents on phamco's behalf under binding data processing agreements. They are prohibited from using your data for any other purpose.
• Game Providers: Third-party developers such as JILI receive anonymised or pseudonymised session data in connection with the delivery of their games on the phamco platform. No directly identifying information is shared with game providers beyond what is technically necessary.
• Regulatory Authorities: phamco may disclose personal data to PAGCOR-aligned regulatory authorities, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or law enforcement agencies where required by law or court order.
• IT & Security Service Providers: Cloud hosting, cybersecurity, and platform infrastructure providers may have access to personal data solely for the purpose of delivering and securing the phamco platform, under strict contractual obligations.
• Professional Advisers: Lawyers, auditors, and compliance consultants may receive personal data as necessary in the course of providing professional services to phamco, subject to confidentiality obligations.

phamco uses cookies and similar technologies (such as web beacons and local storage objects) to enhance your experience on the platform. Below is a summary of the types of cookies we use:

You can manage your cookie preferences through your browser settings at any time. Note that disabling strictly necessary cookies may prevent some parts of the phamco platform from functioning correctly. phamco does not use cookies to serve third-party advertising or to track your activity across unrelated websites.

phamco retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, or to resolve disputes. The following retention periods apply as a general guide:

• Account & Identity Data: Retained for the duration of your active phamco account, plus a minimum of five (5) years after account closure, in compliance with anti-money laundering record-keeping requirements under Philippine law.
• Financial & Transaction Data: Retained for a minimum of five (5) years from the date of each transaction, in accordance with applicable financial regulations.
• Gaming Session Data: Retained for three (3) years from the date of each session, or longer where required for ongoing dispute resolution or regulatory audit purposes.
• Communication & Support Data: Retained for two (2) years from the date of the last interaction, or until any related dispute is fully resolved.
• Marketing Consent Records: Retained for the duration of your consent plus two (2) years after withdrawal, to evidence that marketing communications were lawfully sent.
• Technical & Log Data: Retained for up to twelve (12) months, after which it is anonymised or securely deleted.

After the applicable retention period expires, phamco securely deletes or anonymises your personal data. Anonymised data — from which you can no longer be identified — may be retained indefinitely for statistical and platform improvement purposes.

phamco implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or disclosure. These measures include:

• Encryption: All personal data transmitted between your device and phamco's servers is encrypted using industry-standard TLS (Transport Layer Security) protocols. Stored personal data — including financial information — is encrypted at rest.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All phamco employees and contractors who handle personal data undergo regular privacy and security training and are bound by confidentiality obligations.
• Infrastructure Security: phamco's platform is hosted on secure cloud infrastructure with firewalls, intrusion detection systems, and regular vulnerability assessments.
• Fraud Monitoring: phamco operates continuous automated monitoring systems to detect suspicious login activity, unusual transaction patterns, and potential account compromise.
• Incident Response: phamco maintains a documented personal data breach response plan. In the event of a confirmed breach, the process described in Section 1 (breach notification) will be activated immediately.

Under the Data Privacy Act of 2012, as a data subject you are entitled to exercise the following rights with respect to your personal data held by phamco:

• Right to Be Informed: The right to be informed of how your personal data is collected, used, shared, and protected — which this Privacy Policy is designed to fulfil.
• Right to Access: The right to request a copy of the personal data phamco holds about you, along with information about how it is being processed.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data. You may update most account details directly through your phamco account settings.
• Right to Erasure ("Right to be Forgotten"): The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to phamco's legal retention obligations.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Object: The right to object to the processing of your personal data for marketing purposes or where processing is based on phamco's legitimate interests, on grounds relating to your particular situation.
• Right to Withdraw Consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe phamco has processed your personal data in breach of RA 10173.

To exercise any of the rights listed above, please contact phamco's Data Protection Officer using the details in Section 14. phamco will respond to all valid data rights requests within fifteen (15) business days of receipt, in accordance with NPC guidelines. We may request proof of identity before processing your request.

The phamco platform is strictly intended for adults aged 21 years and above, in accordance with Philippine gaming regulations. phamco does not knowingly collect, process, or retain personal data from individuals under the age of 21.

During the registration process, phamco requires all applicants to confirm that they are at least 21 years of age. This declaration is supported by our KYC identity and age verification process, which requires submission of a valid government-issued ID.

If phamco discovers or is notified that an account has been registered by a person under the age of 21, phamco will:

• Immediately suspend and close the underage account;
• Delete all personal data associated with the underage account to the extent permitted by applicable law;
• Handle any funds deposited by the underage account holder in accordance with applicable regulations; and
• Where appropriate, refer the matter to the relevant authorities.

If you are a parent or guardian and have reason to believe that a minor in your care has registered a phamco account, please contact our support team immediately at [email protected] so we can take prompt action.

phamco's primary operations and data processing activities are based in and directed at players in the Philippines. However, certain service providers — particularly cloud infrastructure and game providers — may process or store personal data on servers located outside of the Philippines.

Where personal data is transferred outside the Philippines, phamco ensures that appropriate safeguards are in place to protect your data at a standard equivalent to that required by the Data Privacy Act of 2012. Such safeguards include:

• Binding contractual clauses in Data Processing Agreements with overseas processors;
• Transfers only to jurisdictions or entities that maintain an adequate level of data protection; and
• Regular review of overseas data processing arrangements to confirm ongoing compliance.

phamco does not transfer personal data to jurisdictions that are subject to sanctions or that lack adequate data protection frameworks without implementing specific additional safeguards as required by the NPC.

phamco reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. The effective date at the top of this page will be updated to reflect the date of the most recent revision.

Where a material change is made to this Privacy Policy — such as a new category of data being collected or a new purpose for processing — phamco will provide advance notice by posting a prominent notice on the phamco platform and, where practicable, by sending an email notification to your registered email address.

Your continued use of phamco's platform and Services following the effective date of any amendment constitutes your acknowledgement of the updated Privacy Policy. If you do not agree with the amended policy, please close your account and cease using phamco's Services. For major changes, phamco may seek your renewed consent where required by law.

Previous versions of this Privacy Policy are archived and available upon written request to phamco's Data Protection Officer.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by phamco, please contact our Data Protection Officer through the following channels:

• Email: [email protected] (please include "Privacy / DPO Request" in the subject line)
• Live Chat: Available 24/7 within the phamco platform after login

phamco's DPO is available to assist all players across the Philippines — including those in Metro Manila, Cebu, Davao, and all other regions — with data rights requests, privacy queries, and complaints. We aim to acknowledge all written privacy requests within two (2) business days and to provide a substantive response within fifteen (15) business days.

If you are not satisfied with phamco's response to your privacy concern, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy was last reviewed and updated on January 1, 2026. phamco reserves the right to update this document at any time in accordance with Section 13.