phljoy Privacy Policy
Your personal data matters to us. This Privacy Policy explains exactly what information phljoy collects, why we collect it, how we use and protect it, and what rights you have as a data subject under the Philippine Data Privacy Act of 2012. We keep it plain and straight — no legal jargon overload.
How phljoy Handles Your Data
Six core principles that guide every data-related decision we make at phljoy. These are not just policy statements — they reflect how we actually operate day to day.
Collected With Purpose
phljoy only collects personal data that is directly necessary for account registration, KYC verification, transaction processing, game delivery, and regulatory compliance. We do not collect data for its own sake or sell it to unrelated third parties.
Minimal Disclosure
Your personal information is shared only with the parties that genuinely need it — payment processors like GCash and BDO for transaction handling, PAGCOR for regulatory reporting, and our vetted technology partners. We use contractual data-sharing agreements with all third parties.
Encrypted & Secured
All data stored on phljoy systems is encrypted at rest using AES-256 standards. All data transmitted between your device and our platform uses TLS 1.3 encryption. Access to player data within our organisation is strictly role-based and audited.
You Stay in Control
Under the Data Privacy Act of 2012, you have the right to access, correct, object to processing, and request deletion of your personal data held by phljoy. We provide a clear process for exercising these rights, outlined in this policy and available through our support team.
Retention Limits
phljoy does not hold your personal data longer than necessary. Retention periods are determined by regulatory requirements — PAGCOR mandates certain transaction and KYC records be retained for a minimum of five years — after which data is securely purged from our systems.
Breach Notification
In the unlikely event of a personal data breach that affects your rights and freedoms, phljoy will notify the National Privacy Commission (NPC) within 72 hours of discovery and inform affected players without undue delay, in full compliance with NPC Circular 16-03.
- 01 Data Controller
- 02 Data We Collect
- 03 How We Collect Data
- 04 Purposes & Legal Basis
- 05 Sharing Your Data
- 06 Cookies & Tracking
- 07 Data Retention
- 08 Data Security
- 09 Your Rights
- 10 Children & Minors
- 11 International Transfers
- 12 Policy Changes
- 13 Contact & DPO
01 January 2026
01 Data Controller
The data controller for personal information collected through the phljoy Platform at phljoy.net is the legal entity operating phljoy, duly licensed by the Philippine Amusement and Gaming Corporation (PAGCOR) under the Philippine Internet Gaming Operator (PIGO) framework.
As data controller, phljoy determines the purposes and means of processing your personal data and is responsible for ensuring that all processing activities comply with Republic Act No. 10173, also known as the Data Privacy Act of 2012, its Implementing Rules and Regulations, and all applicable issuances of the National Privacy Commission (NPC).
phljoy has appointed a Data Protection Officer (DPO) who is responsible for overseeing data protection strategy and implementation. You can reach our DPO through the contact details provided in Section 13 of this policy.
02 Data We Collect
phljoy collects only the personal data that is necessary to provide you with a safe, compliant, and functional gaming experience. The categories of personal data we collect are set out in the table below:
| Category | Data Points Collected | Required / Optional |
|---|---|---|
| Identity Data | Full legal name, date of birth, government ID type and number, nationality, gender | Required (KYC) |
| Contact Data | Email address, mobile number, residential address (city/province) | Required |
| Financial Data | GCash number, bank account details (BPI, BDO, Metrobank), transaction history, deposit and withdrawal amounts | Required (transactions) |
| Gaming Data | Game session logs, bet history, win/loss records, bonus usage, responsible gaming tool usage | Automatic |
| Technical Data | IP address, device type and OS, browser type, session timestamps, login history | Automatic |
| Communications Data | Live chat transcripts, support emails, feedback submissions | When you contact us |
| Marketing Preferences | Opt-in/opt-out status for promotional communications, preferred contact channel | Optional |
03 How We Collect Your Data
phljoy collects your personal data through the following methods:
- Direct submission: Information you provide when registering your phljoy Account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or responding to surveys and promotions.
- Automated collection: Technical and gaming data collected automatically when you access and use the phljoy Platform, including via cookies, web beacons, and server-side logging systems.
- Third-party sources: Identity and fraud-check data provided by our KYC verification partners and payment processors when you initiate financial transactions. phljoy only receives data from third parties that have your prior consent or a lawful basis to share it.
- Regulatory sources: In limited circumstances, phljoy may receive data from PAGCOR or other competent Philippine government authorities in connection with licensing, compliance, or investigation requirements.
04 Purposes & Legal Basis for Processing
Under the Data Privacy Act of 2012, phljoy must have a lawful basis for every processing activity. The table below sets out the primary purposes for which we process your personal data and the corresponding legal basis:
| Processing Purpose | Legal Basis (DPA 2012) |
|---|---|
| Account registration and management | Performance of contract (Sec. 12[b]) |
| KYC / age and identity verification | Compliance with legal obligation (Sec. 12[c]); PAGCOR regulatory requirement |
| Processing deposits and withdrawals | Performance of contract (Sec. 12[b]) |
| Delivering games and Platform services | Performance of contract (Sec. 12[b]) |
| Anti-money laundering (AML) monitoring | Compliance with legal obligation (Sec. 12[c]); AMLA as amended |
| Fraud detection and Platform security | Legitimate interests (Sec. 12[f]) — protection of phljoy and its players |
| Responsible gaming monitoring | Legitimate interests (Sec. 12[f]); PAGCOR player protection requirements |
| Customer support and complaints handling | Performance of contract (Sec. 12[b]); legitimate interests (Sec. 12[f]) |
| Sending promotional communications | Consent (Sec. 12[a]) — opt-in basis only |
| PAGCOR regulatory reporting | Compliance with legal obligation (Sec. 12[c]) |
| Platform analytics and improvement | Legitimate interests (Sec. 12[f]) — improving service quality |
05 Sharing Your Personal Data
phljoy does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data-sharing agreements:
- Payment processors: GCash (Mynt), PayMaya (Maya Bank), BPI, BDO, and Metrobank — to process deposits, withdrawals, and fraud checks. Each processor receives only the financial data strictly necessary to complete the relevant transaction.
- KYC and identity verification partners: Third-party providers that assist with document verification, age verification, and anti-fraud screening as required by PAGCOR and the Anti-Money Laundering Council (AMLC).
- Technology and hosting providers: Cloud infrastructure and data centre operators that host phljoy systems under strict data processing agreements, including security and confidentiality obligations.
- Game content providers: RNG-certified game studios whose games are accessible through the phljoy Platform. Only session and bet data required for game operation and audit purposes is shared.
- Regulatory authorities: PAGCOR, the AMLC, the National Privacy Commission, and other competent Philippine government bodies where disclosure is required by law or regulatory instruction. phljoy will comply with lawful data requests and will inform you of such requests where legally permitted to do so.
- Professional advisors: Legal counsel, auditors, and compliance consultants under strict confidentiality obligations, where necessary for phljoy to meet its legal and business obligations.
All third-party data recipients who process personal data on phljoy's behalf operate under contractual data processing agreements that require them to process your data only as instructed by phljoy, maintain appropriate security measures, and comply with the Data Privacy Act of 2012.
06 Cookies & Tracking Technologies
phljoy uses cookies and similar tracking technologies to operate the Platform, improve your experience, and meet our security and compliance obligations. By continuing to use the phljoy Platform, you consent to our use of cookies as described in this section.
Types of Cookies Used
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Strictly Necessary | Session management, login authentication, security token validation, fraud prevention | No — essential for Platform function |
| Functional | Remembering your language preference, game settings, and notification choices | Yes, via browser settings |
| Analytics | Aggregated usage data to understand how players navigate the Platform and identify areas for improvement | Yes, via cookie consent settings |
| Performance | Monitoring page load times and technical errors to maintain Platform reliability | Yes, via cookie consent settings |
phljoy does not use third-party advertising or cross-site tracking cookies. You can manage your cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from logging in or completing transactions.
07 Data Retention
phljoy retains personal data only for as long as necessary to fulfil the purposes for which it was collected or as required by applicable law and regulation. The following retention periods apply:
- Account and KYC records: Retained for a minimum of five (5) years following Account closure or the last gaming transaction, as required by PAGCOR and AMLC regulations.
- Transaction and financial records: Retained for a minimum of five (5) years in compliance with the Anti-Money Laundering Act and PAGCOR recordkeeping obligations.
- Game session logs: Retained for three (3) years to support dispute resolution, RNG audit requirements, and responsible gaming monitoring.
- Customer support communications: Retained for two (2) years following resolution of the relevant interaction.
- Marketing preference records: Retained for the duration of your Account and for one (1) year after Account closure as evidence of consent management.
- Technical and server logs: Retained for twelve (12) months for security monitoring and fraud detection purposes.
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with phljoy's data disposal procedures. Anonymised data (from which you cannot be identified) may be retained for longer periods for statistical and platform improvement purposes.
08 Data Security
phljoy implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. Key security measures include:
- Encryption in transit: All data transmitted between your device and the phljoy Platform is encrypted using TLS 1.3 protocol. We enforce HTTPS across the entire Platform.
- Encryption at rest: Personal and financial data stored on phljoy servers is encrypted using AES-256 standards.
- Access controls: Access to personal data within phljoy is strictly role-based. Only personnel with a legitimate operational need are authorised to access player data, and all access is logged and audited.
- Two-factor authentication: phljoy's internal administrative systems require multi-factor authentication. Players are strongly encouraged to enable 2FA on their Accounts.
- Penetration testing: phljoy engages independent security specialists to conduct regular penetration testing and vulnerability assessments of Platform infrastructure.
- Incident response: phljoy maintains a documented data breach response plan. In the event of a breach affecting your personal data, phljoy will notify the NPC within 72 hours and inform affected players promptly in accordance with NPC Circular 16-03.
09 Your Rights as a Data Subject
Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phljoy. To exercise any of these rights, contact our Data Protection Officer using the details in Section 13.
Right to Be Informed
Know what data we collect, why, and how it is processed — this Privacy Policy fulfils that obligation.
Right to Access
Request a copy of the personal data phljoy holds about you in a readable format.
Right to Rectification
Request correction of any inaccurate or incomplete personal data held in your phljoy Account.
Right to Erasure
Request deletion of your data where it is no longer necessary, subject to our legal retention obligations.
Right to Object
Object to processing based on legitimate interests, including direct marketing communications.
Right to Data Portability
Receive your personal data in a structured, machine-readable format for transfer to another service.
Right to Withdraw Consent
Withdraw consent for marketing or optional processing at any time without affecting other services.
Right to Complain
Lodge a complaint with the National Privacy Commission if you believe your rights have been violated.
phljoy will respond to all data subject rights requests within fifteen (15) calendar days of receipt. Where the request is complex or involves a large volume of data, we may extend this period by a further thirty (30) days and will notify you accordingly. There is no charge for exercising your rights under normal circumstances.
Please note that certain rights are subject to limitations where phljoy has overriding legal obligations — for example, we cannot delete KYC and transaction records that are required to be retained under PAGCOR and AMLC regulations.
10 Children & Minors
phljoy strictly prohibits the use of its Platform by any person under the age of 21 years, in compliance with PAGCOR regulatory requirements for online gaming in the Philippines. phljoy does not knowingly collect personal data from individuals under the age of 21.
As part of our KYC process, all players are required to verify their identity and date of birth before being permitted to deposit real money or access Real Money Play. Any Account found to belong to a person under 21 years of age will be immediately suspended, all associated personal data reviewed, and the matter reported to PAGCOR as required by our regulatory obligations.
11 International Data Transfers
phljoy is a Philippines-based Platform and the primary processing of your personal data occurs within the Philippines. However, some of our technology partners and cloud infrastructure providers may process data in other jurisdictions, including but not limited to Singapore and other countries in the Asia-Pacific region.
Where personal data is transferred outside the Philippines, phljoy ensures that appropriate safeguards are in place to provide a level of data protection equivalent to that required under the Data Privacy Act of 2012. These safeguards include:
- Contractual data-sharing agreements incorporating the NPC's standard data protection clauses.
- Transfers only to jurisdictions or organisations that the NPC has determined provide adequate protection, or where the recipient has implemented binding corporate rules or equivalent frameworks.
- Technical and organisational measures (including encryption) applied to data before and during transfer.
You may request details of the specific safeguards applied to any international transfer of your personal data by contacting our Data Protection Officer.
12 Changes to This Privacy Policy
phljoy may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. The date at the top of this document indicates when the policy was last revised.
Where changes are material — meaning they significantly affect how we process your personal data or your rights as a data subject — phljoy will notify registered players via email or in-platform notification at least fourteen (14) days before the changes take effect, giving you time to review the updated policy and, where applicable, withdraw consent if you do not agree.
Your continued use of the phljoy Platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the revised terms. We encourage you to review this policy periodically. The current version is always available at phljoy.net/privacy-policy.
13 Contact & Data Protection Officer
If you have any questions, concerns, or requests relating to this Privacy Policy or the way phljoy processes your personal data, please contact our Data Protection Officer through the following channels:
- Email: [email protected] — please include "Privacy / DPO Request" in your subject line along with your registered username and a clear description of your request.
- Live Chat: Available 24/7 through the phljoy Platform. For data subject rights requests, our support team will escalate your query to the DPO team within one (1) business day.
phljoy is committed to resolving all privacy-related concerns promptly and transparently. If you are not satisfied with our response, you have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines. The NPC's complaint procedures and contact details are available at the NPC's official website.
A Platform That Respects Your Privacy
phljoy is PAGCOR-regulated, DPA 2012-compliant, and built for Filipino players who value both great gaming and genuine data protection. GCash deposits, 24/7 Filipino support, and your data handled the right way.