Privacy Policy

1. Introduction

866ph ("866ph", "We", "Us", "Our") is a Philippines-based online gaming platform operating at https://866ph.cam under the regulatory oversight of the Philippine Amusement and Gaming Corporation (PAGCOR). This Privacy Policy explains how 866ph collects, uses, stores, discloses, and protects the personal data of users ("You", "Player", "Data Subject") who access or register on the 866ph platform.

This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and the applicable issuances of the National Privacy Commission (NPC) of the Philippines. It is also consistent with our obligations as a PAGCOR-licensed online gaming operator.

This Privacy Policy should be read alongside the 866ph Terms & Conditions and Responsible Gaming Policy. Together, these three documents form the complete framework governing your relationship with 866ph. By using 866ph, you agree to all three.

2. Definitions

The following terms have the meanings set out below throughout this Privacy Policy:

• "Data Privacy Act" or "DPA" means Republic Act No. 10173 of the Philippines and its Implementing Rules and Regulations.
• "Data Controller" means 866ph, which determines the purposes and means of processing personal data collected through the platform.
• "Data Processor" means any third-party entity that processes personal data on behalf of 866ph pursuant to a written processing agreement.
• "Data Protection Officer" or "DPO" means the individual designated by 866ph to oversee compliance with the DPA and this Policy.
• "Data Subject" means the natural person to whom personal data relates — in the context of 866ph, this means you, the registered player.
• "Personal Data" means any information from which the identity of an individual can be reasonably and directly ascertained, or when put together with other information, would directly and certainly identify an individual.
• "Sensitive Personal Information" has the meaning given to it under Section 3(l) of the DPA, and includes — where applicable — government-issued ID numbers and financial information.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, and deletion.

3. Personal Data We Collect

866ph collects the following categories of personal data, depending on how you interact with the platform:

3.1 Registration & Identity Data

When you register an account on 866ph, we collect:

• Philippine mobile number (primary account identifier);
• Password (stored as a cryptographic hash — never in plain text);
• Date of birth (for age verification — 21+ requirement);
• Full legal name (collected during KYC verification);
• Residential address in the Philippines.

3.2 KYC Identity Verification Data

To complete identity verification as required by PAGCOR and the Anti-Money Laundering Act, 866ph collects:

• Copies or photographs of valid Philippine government-issued IDs (e.g., UMID, passport, driver's licence, PhilSys national ID);
• The ID number displayed on the submitted document;
• Selfie photographs where required for liveness verification;
• Proof of address documentation where requested.

3.3 Financial & Transaction Data

To process your deposits and withdrawals, 866ph collects and retains:

• GCash account details (mobile number linked to GCash);
• PayMaya account details where applicable;
• Bank account details for BPI, BDO, and Metrobank transfers;
• Transaction amounts, dates, and reference numbers for all deposits and withdrawals on 866ph;
• Balance history and cashier activity logs.

3.4 Gaming Activity Data

866ph automatically records:

• Game session records including games played, bet amounts, win/loss outcomes, and session durations;
• Sports betting selections, odds accepted, and settlement outcomes;
• Bonus claims, wagering progress, and promotional participation history;
• Responsible gaming tool settings — deposit limits, session time reminders, self-exclusion status.

3.5 Technical & Device Data

When you access 866ph, our servers automatically collect:

• IP address and approximate geographic location (province/city level);
• Device type, operating system version, and browser type;
• Session timestamps, login and logout times;
• Platform feature interactions used for security monitoring and fraud prevention.

4. How We Collect Your Data

866ph collects personal data through the following channels:

• Directly from you — via registration forms, KYC submission interfaces, cashier interactions, customer support conversations, and responsible gaming tool settings on the 866ph platform;
• Automatically — through server logs, session tracking, and cookies when you access the 866ph website;
• From payment service providers — GCash, PayMaya, and participating Philippine banks share transaction confirmation data with 866ph to verify deposits and process withdrawals;
• From KYC verification service providers — third-party identity verification tools may process your submitted ID documents and return a verification result to 866ph;
• From regulatory authorities — PAGCOR and other Philippine government agencies may share information with 866ph where required by law.

5. Purposes of Processing

866ph processes your personal data for the following purposes:

866ph does not process your personal data for automated profiling that produces legal or similarly significant effects on you without providing an opportunity for human review, in accordance with the DPA.

6. Legal Bases for Processing

Under the Data Privacy Act of 2012, 866ph relies on the following legal bases for processing your personal data:

• Contractual necessity: Processing is required to perform the contract between you and 866ph — i.e., to deliver the gaming services you have registered to use, process your deposits and withdrawals, and manage your account;
• Legal obligation: Processing is required to comply with 866ph's obligations under PAGCOR regulations, the Anti-Money Laundering Act (Republic Act No. 9160, as amended), and the Data Privacy Act itself — including KYC verification and mandatory transaction reporting;
• Legitimate interests: Processing is necessary for 866ph's legitimate interests in preventing fraud, maintaining platform security, and improving the player experience, provided these interests are not overridden by your data protection rights;
• Consent: Where processing is not covered by the above bases — such as the use of non-essential cookies — 866ph relies on your freely given, specific, and informed consent, which you may withdraw at any time.

7. Disclosure of Personal Data

7.1 Third-Party Service Providers

866ph engages third-party processors who assist in operating the platform. These parties access personal data only to the extent necessary to perform their contracted services and are bound by written data processing agreements that require them to protect your data in accordance with the DPA. Categories of processors include:

• Payment processors and e-wallet providers (GCash, PayMaya) for deposit and withdrawal processing;
• Philippine banks (BPI, BDO, Metrobank) for bank transfer transactions;
• KYC identity verification technology providers;
• Cloud hosting infrastructure providers — servers used by 866ph are selected for compliance with Philippine data localisation guidance where applicable;
• Customer support platform providers (live chat technology);
• Game content providers — individual game providers receive anonymised session data only, not identifiable player information.

7.2 Regulatory & Law Enforcement Disclosure

866ph will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, the Bureau of Internal Revenue, or any other Philippine government authority where such disclosure is required by law, court order, or lawful regulatory direction. 866ph will not voluntarily disclose personal data to foreign governments or regulatory bodies unless required by Philippine law or a binding international legal assistance arrangement.

7.3 No Sale of Personal Data

866ph does not sell, rent, exchange, or otherwise transfer your personal data to any third party for commercial or marketing purposes. This prohibition applies unconditionally and without exception.

8. Data Retention

866ph retains personal data only for as long as necessary to fulfil the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are:

• Account and registration data: Retained for the duration of your active account and for five (5) years following account closure, in accordance with PAGCOR's record retention requirements and the AMLA;
• KYC identity documents: Retained for five (5) years from the date of verification or account closure, whichever is later, per AMLA requirements;
• Transaction records (deposits and withdrawals): Retained for five (5) years from the transaction date, consistent with AMLA and Bureau of Internal Revenue obligations;
• Gaming session records: Retained for two (2) years from the session date for audit and dispute resolution purposes;
• Customer support interactions: Retained for two (2) years from the date of the interaction;
• Technical and device logs: Retained for ninety (90) days for security monitoring and fraud detection.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with 866ph's internal data lifecycle management procedures.

9. Data Security

866ph implements technical and organisational security measures appropriate to the risks presented by the personal data we process. These measures include:

• Transmission security: All data exchanged between your device and the 866ph platform is protected by 256-bit SSL/TLS encryption;
• Storage security: Sensitive data fields — including passwords, government ID numbers, and financial account details — are encrypted at rest using industry-standard cryptographic methods;
• Access controls: Access to personal data is restricted on a need-to-know basis. All 866ph personnel and authorised third-party processors with access to personal data are subject to confidentiality obligations;
• Authentication: Internal administrative systems require multi-factor authentication. Players are encouraged to enable two-factor authentication for their 866ph accounts;
• Monitoring & incident response: 866ph monitors its systems for security incidents and maintains a data breach response procedure consistent with the NPC's mandatory notification requirements under the DPA.

10. Cookies and Similar Technologies

10.1 What Cookies 866ph Uses

The 866ph platform uses the following categories of cookies and similar browser-based technologies:

• Strictly Necessary Cookies: Required for the platform to function. These include session cookies that keep you logged in during your 866ph gaming session and security cookies that protect against cross-site request forgery attacks. These cannot be disabled without breaking platform functionality.
• Preference Cookies: Remember your settings — such as language preference and responsible gaming tool configurations — between sessions on 866ph.
• Analytics Cookies: Aggregate, anonymised data about how players use the 866ph platform, used solely to improve the Filipino player experience. No individual-level behavioural profiling is conducted using these cookies.

10.2 Cookies 866ph Does Not Use

866ph does not use third-party advertising cookies, retargeting pixels, or any cookie-based technology that tracks your activity across other websites for commercial profiling purposes. Our cookie use is limited to what is necessary to operate and improve the 866ph platform.

10.3 Managing Cookies

You may control cookie settings through your browser preferences. Disabling strictly necessary cookies will prevent 866ph from functioning correctly. Disabling analytics or preference cookies will not affect your ability to use the platform but may degrade your experience by requiring you to re-enter preferences on each visit.

11. Children and Minors

866ph's platform is strictly available only to persons who are twenty-one (21) years of age or older. 866ph does not knowingly collect personal data from individuals under 21. If we discover that personal data from a person under 21 has been collected — whether through a false registration or any other means — we will immediately suspend the associated account and delete or quarantine the collected data in accordance with applicable law.

Age is verified as part of the mandatory KYC process using valid Philippine government-issued identification. Where 866ph has reason to suspect that a registered player may be under 21, the account will be suspended pending age verification. Parents or guardians who believe their child under 21 has registered on 866ph are encouraged to contact the 866ph DPO immediately.

12. Your Data Protection Rights

Under the Data Privacy Act of 2012, you hold the following rights in relation to the personal data 866ph holds about you:

• Right to be informed: You have the right to receive clear and accessible information about how 866ph collects and uses your personal data — which this Privacy Policy provides;
• Right of access: You may request a copy of the personal data 866ph holds about you at any time. We will respond to verified access requests within thirty (30) days;
• Right to correction: You may request that inaccurate or outdated personal data 866ph holds about you be corrected. Some corrections (e.g., name on KYC records) may require resubmission of identity documents;
• Right to erasure or blocking: You may request deletion of your personal data where processing is no longer necessary, or where your consent has been withdrawn and there is no other legal basis for continued processing. Note that 866ph may be required to retain certain data under PAGCOR and AMLA obligations even after you request deletion;
• Right to object: You may object to the processing of your personal data on grounds relating to your particular situation, in cases where 866ph relies on legitimate interests as a legal basis;
• Right to data portability: You may request that personal data you have provided to 866ph be provided to you in a structured, machine-readable format, where technically feasible;
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe 866ph has processed your personal data in breach of the DPA.

13. Cross-Border Data Transfers

866ph primarily processes and stores personal data on servers located in or accessible from the Philippines, consistent with PAGCOR regulatory requirements and Philippine data localisation guidance. Where 866ph engages third-party processors whose infrastructure is located outside the Philippines — for example, cloud hosting services or KYC technology providers — such transfers are conducted only where:

• The receiving country or organisation provides adequate data protection standards recognised under Philippine law; or
• Appropriate contractual safeguards, such as NPC-recognised standard contractual clauses, are in place between 866ph and the receiving processor; and
• The transfer is necessary to perform our services, process payments, or comply with legal obligations.

866ph maintains a Register of Data Processing Activities that documents all cross-border data flows, available for review by the NPC upon request. Players wishing to understand the geographic scope of data transfers related to their account may submit a request to the 866ph DPO.

14. Updates to This Privacy Policy

866ph reviews this Privacy Policy periodically and updates it to reflect changes in our data practices, technological developments, PAGCOR regulatory updates, or amendments to Philippine privacy law. Material changes to this Policy will be communicated to registered players by SMS notification to the mobile number registered to your 866ph account, and the updated Policy will be published on this page with a revised effective date.

Continued use of the 866ph platform following notification of a revised Privacy Policy constitutes your acceptance of the updated terms. If you disagree with a material change, you may request account closure and withdrawal of your remaining balance before the revised Policy takes effect by contacting 866ph customer support.

15. Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by 866ph, please contact:

This Privacy Policy is effective as of 1 January 2026. It supersedes all previous 866ph privacy policies and data collection notices. 866ph is registered as a Personal Information Controller with the National Privacy Commission of the Philippines.