phcharm Privacy Policy

This Privacy Policy ("Policy") is issued by phcharm ("phcharm", "we", "us", or "our"), the operator of the online casino and sports betting platform accessible at phcharm.bio (the "Platform"). This Policy governs how phcharm collects, processes, stores, and discloses personal data relating to registered players, prospective players, and visitors to the Platform ("you" or "your").

phcharm is committed to protecting the privacy and security of all personal information entrusted to us. We process personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations, the issuances of the National Privacy Commission ("NPC"), and all other applicable Philippine laws and regulations, including the Anti-Money Laundering Act as amended and the PAGCOR regulatory framework.

By registering a phcharm account, accessing the Platform, or using any product or service offered by phcharm, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal data as described herein. This Policy should be read alongside the phcharm Terms & Conditions, which form part of the overall agreement between you and phcharm.

For the purposes of the Philippine Data Privacy Act of 2012, phcharm acts as the Personal Information Controller ("PIC") in respect of the personal data it collects directly from you through the Platform. Where phcharm engages third-party service providers — such as payment processors, game providers, and identity verification services — who process personal data on phcharm's behalf, those parties act as Personal Information Processors ("PIP") and are bound by appropriate data processing agreements that require them to handle your data only as instructed by phcharm and in compliance with applicable Philippine data protection law.

phcharm has appointed a Data Protection Officer ("DPO") as required under RA 10173. If you have any questions, concerns, or requests relating to the processing of your personal data by phcharm, you may contact the phcharm DPO at the contact details set out in Section 15 of this Policy.

phcharm collects the following categories of personal data depending on how you interact with the Platform:

When you create a phcharm account, we collect:

• Full legal name
• Date of birth (to verify you are 21 years of age or older, as required by PAGCOR)
• Residential address (including barangay, city/municipality, province, and ZIP code)
• Email address
• Mobile phone number
• Username and encrypted password
• Preferred currency (Philippine Peso, PHP)

To comply with PAGCOR licensing requirements and AMLA obligations, phcharm conducts Know Your Customer (KYC) verification. This may require you to submit:

• Government-issued photo identification (e.g., Philippine passport, UMID, driver's license, SSS ID, PhilHealth ID, Voter's ID, or PRC ID) — including the document number, issuing authority, and expiry date
• Proof of residential address dated within 90 days (e.g., utility bill, bank statement, or barangay certificate)
• Proof of payment method ownership (e.g., GCash or PayMaya account screenshot showing your name)
• Source of funds documentation where required by regulation or internal risk assessment
• Selfie or live facial verification image, where required as part of the KYC process

• Deposit amounts, dates, and payment method references
• Withdrawal requests, amounts, and processing records
• Payment method identifiers (e.g., last four digits of a registered bank account or GCash mobile number — full card or account numbers are not stored by phcharm)
• Bonus and promotion redemption history
• Wagering history, game session logs, and win/loss records

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser information
• Session timestamps, login history, and session duration
• Pages visited, features used, and click-path data within the Platform
• Device fingerprint data used for fraud prevention and multi-account detection
• Cookie identifiers and similar tracking technology data (see Section 10)

• Records of your correspondence with phcharm customer support, including live chat transcripts, email threads, and support ticket logs
• Survey responses and feedback submitted through the Platform
• Responsible gaming tool settings and self-exclusion records

Under RA 10173, certain categories of data are classified as Sensitive Personal Information ("SPI") and are subject to heightened protection. phcharm may collect the following SPI in limited circumstances:

• Government identification numbers (e.g., SSS number, PhilHealth number, TIN) — collected only where required for KYC or tax reporting purposes
• Health or medical information — collected only where voluntarily disclosed by you in connection with a responsible gaming self-exclusion or problem gambling support request

phcharm processes SPI only on the basis of explicit consent or as required by applicable law.

phcharm collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, respond to a survey, or use any interactive feature of the Platform
• Automatically — when you access the Platform, through cookies, server logs, device fingerprinting, and similar technologies that record technical and usage data as described in Section 10
• From third-party identity verification providers — phcharm uses regulated third-party KYC and AML screening services to verify your identity documents and to screen your name against sanctions and politically exposed persons (PEP) lists as required by Philippine law
• From payment processors — when you initiate a deposit or withdrawal, our payment partners (GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, 7-Eleven, Cebuana) may share transaction confirmation data with phcharm to reconcile your account
• From game providers — licensed game providers integrated into the phcharm platform may share session-level game data with phcharm for account management, responsible gaming monitoring, and dispute resolution purposes

phcharm uses your personal data for the following purposes:

Under RA 10173, phcharm relies on the following lawful bases for processing your personal data:

• Contractual necessity — processing is necessary to perform our obligations under the phcharm Terms & Conditions, including account management, payment processing, and game delivery
• Legal obligation — processing is required to comply with applicable Philippine laws and PAGCOR regulations, including AMLA reporting obligations, age verification requirements, and tax reporting duties
• Legitimate interests — processing is necessary for phcharm's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and improving the Platform, where those interests are not overridden by your data protection rights
• Consent — where phcharm relies on your consent as the legal basis for processing (e.g., for marketing communications or for processing sensitive personal information), you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing

phcharm does not sell, rent, or trade your personal data. We may share your data in the following limited circumstances:

phcharm engages third-party service providers who process personal data on our behalf and under our instruction, subject to data processing agreements. These include:

• KYC and identity verification providers
• Payment processors (GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, 7-Eleven, Cebuana)
• Cloud hosting and infrastructure providers
• Licensed game content providers integrated into the phcharm platform
• Customer support software providers
• Analytics and fraud detection service providers

phcharm is required by law to disclose certain personal data to regulatory and government authorities, including PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), the National Privacy Commission (NPC), and law enforcement agencies, where required by applicable Philippine law or by lawful order or legal process.

In the event of a merger, acquisition, restructuring, or sale of all or part of phcharm's business, your personal data may be transferred to the acquiring entity as part of that transaction, subject to the same privacy protections described in this Policy.

phcharm may share your personal data with third parties for other purposes where you have given your explicit consent. You may withdraw such consent at any time.

phcharm retains your personal data for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable Philippine law. The following general retention periods apply:

Following the expiry of the applicable retention period, phcharm will securely delete or anonymise your personal data so that it can no longer be associated with you as an individual.

phcharm implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• TLS 1.2 or higher encryption for all data transmitted between your device and the phcharm platform
• AES-256 encryption for sensitive data stored at rest on phcharm servers
• Multi-factor authentication options for player accounts
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis
• Regular third-party penetration testing and vulnerability assessments
• Intrusion detection and monitoring systems operating 24/7
• Formal data breach response procedures, including NPC notification within 72 hours of discovery of a notifiable breach

While phcharm takes all reasonable steps to protect your data, no internet-based transmission or electronic storage method is 100% secure. You are responsible for maintaining the security of your phcharm login credentials and for notifying phcharm immediately if you suspect any unauthorised access to your account.

phcharm uses cookies, web beacons, pixel tags, and similar technologies to deliver, secure, and improve the Platform. A cookie is a small text file stored on your device when you visit the phcharm website. The following types of cookies are used:

You can manage or disable non-essential cookies through your browser settings at any time. Note that disabling functional or analytics cookies may affect your experience on the phcharm platform. phcharm does not use third-party advertising cookies or cross-site tracking cookies for external ad targeting purposes.

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phcharm:

• Right to be Informed — You have the right to be informed of how your personal data is collected, used, and disclosed by phcharm. This Policy fulfils that obligation.
• Right to Access — You may request a copy of the personal data phcharm holds about you, including information about the purposes for which it is processed and the third parties to whom it has been disclosed.
• Right to Correction — You may request that phcharm correct any inaccurate or incomplete personal data held about you. You may also update certain information directly from your phcharm account settings.
• Right to Erasure — You may request that phcharm delete your personal data where it is no longer necessary for the purposes for which it was collected, subject to phcharm's overriding legal obligations to retain certain data under AMLA and PAGCOR regulations.
• Right to Data Portability — You may request a copy of your personal data in a structured, commonly used, machine-readable format, where technically feasible.
• Right to Object — You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, subject to phcharm's overriding legal obligations.
• Right to Lodge a Complaint — If you believe phcharm has processed your personal data in violation of RA 10173, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any of the above rights, please contact the phcharm Data Protection Officer using the details in Section 15. phcharm will respond to verified data subject requests within 15 business days of receipt. We may require you to verify your identity before processing certain requests to protect against unauthorised access.

The phcharm Platform is strictly intended for users who are 21 years of age or older, in compliance with PAGCOR's minimum age requirement for online casino-style gambling in the Philippines. phcharm does not knowingly collect personal data from individuals under the age of 21.

Age verification is conducted as part of the phcharm account registration and KYC process. Where phcharm discovers that personal data has been collected from a person under 21 years of age, we will immediately deactivate the associated account, delete or anonymise the personal data where retention is not required by law, and return any deposits to the source payment method.

phcharm's primary operations, data storage, and processing infrastructure are located within the Philippines. However, some of our third-party service providers — including cloud infrastructure providers, KYC verification platforms, and game content providers — may process data in other jurisdictions.

Where personal data is transferred outside of the Philippines, phcharm ensures that appropriate safeguards are in place in accordance with RA 10173 and NPC guidelines, including contractual data transfer agreements that require the recipient to apply data protection standards equivalent to those required under Philippine law. phcharm will not transfer personal data to a jurisdiction that does not provide an adequate level of protection for personal data unless appropriate contractual safeguards have been implemented.

phcharm reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, NPC guidance, PAGCOR requirements, or our data processing practices. Where a material change is made to this Policy, phcharm will notify registered players via the email address on file and/or via a prominent notice on the Platform at least 15 days before the change takes effect.

The updated Policy will display a revised "Last Updated" date at the top of this page. Your continued use of the phcharm Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree to the updated Policy, you should close your phcharm account before the effective date of the changes.

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or need to report a potential data breach or privacy concern, please contact the phcharm Data Protection Officer:

When submitting a data subject request, please include your registered phcharm username and email address, a clear description of your request, and a copy of a valid government-issued ID for identity verification purposes. phcharm will not be able to process requests where identity cannot be verified.