phyaya Privacy Policy

1. Introduction

This Privacy Policy ("Policy") is issued by phyaya ("phyaya," "we," "us," "our"), the operator of the online gambling platform accessible at phyaya.club and its associated mobile interfaces. This Policy governs the collection, use, storage, sharing, and protection of personal data provided by or collected from all registered players, visitors, and users of the phyaya platform ("you," "Data Subject").

phyaya is committed to protecting your privacy and processing your personal data lawfully, fairly, and transparently in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines. By registering a phyaya account or using any part of the phyaya platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read in conjunction with phyaya's Terms & Conditions and Responsible Gaming Policy.

2. Personal Data We Collect

2.1 Registration & Account Data

When you register a phyaya account, we collect the following personal data:

• Full legal name (as it appears on your government-issued ID)
• Date of birth (for age verification — 21+ requirement)
• Nationality and country of residence
• Philippine mobile number and email address
• Username and encrypted account password
• Security questions and answers (where applicable)

2.2 KYC Verification Data

To comply with PAGCOR licensing requirements and the Anti-Money Laundering Act (RA 9160, as amended), phyaya collects:

• Copies of government-issued photo ID (passport, driver's license, SSS ID, UMID, PhilSys National ID, PRC ID, or Voter's ID)
• Proof of address documents (utility bills, bank statements, or barangay certificates)
• Selfie photographs holding the submitted ID, where required for verification
• Tax Identification Number (TIN) where required for large-prize reporting

2.3 Financial Transaction Data

• GCash account number or Maya/PayMaya account linked to your phyaya wallet
• Bank account details (BPI, BDO, Metrobank) used for deposits or withdrawals
• Deposit and withdrawal amounts, dates, and transaction reference numbers
• Wallet balance history and transaction records

2.4 Gameplay & Behavioral Data

• Game history (bets placed, outcomes, winnings, losses) across all phyaya products
• Session durations, login timestamps, and active game time
• Bonus redemptions, wagering progress, and promotional participation history
• Self-imposed responsible gaming limits and self-exclusion records

2.5 Technical & Device Data

• IP address and approximate geolocation (province/city level)
• Device type, operating system, and browser version
• Mobile network operator (Globe, Smart, DITO, etc.)
• Cookie identifiers and session tokens (see Section 7)

2.6 Communication Data

• Live chat transcripts and email correspondence with phyaya's support team
• Feedback, complaints, and dispute records
• Marketing preferences and communication opt-in/opt-out records

3. How We Collect Your Data

phyaya collects personal data through the following channels:

• Directly from you: Registration forms, KYC document uploads, payment method linking, support contact, and profile updates
• Automatically during platform use: Cookies, server logs, gameplay systems, and session tracking tools embedded in the phyaya platform
• From third-party payment processors: GCash, Maya/PayMaya, BancNet, and partner banks transmit transaction confirmation data to phyaya upon completion of deposits and withdrawals
• From identity verification providers: phyaya uses accredited KYC and AML screening services to verify government IDs and screen against watchlists as required by PAGCOR and AMLC
• From game providers: JILI, PG Soft, Pragmatic Play, and other integrated game providers transmit bet result and RTP data to phyaya's platform systems

4. Legal Basis for Processing

phyaya processes your personal data on the following legal grounds under the Data Privacy Act of 2012:

5. How We Use Your Personal Data

phyaya uses the personal data collected for the following specific purposes:

• Account management: Creating, maintaining, and securing your phyaya account; verifying your identity at login; processing password resets
• Age and identity verification: Confirming that you meet the PAGCOR-mandated 21+ age requirement before granting access to real-money gambling features
• Financial services: Processing your GCash, Maya, or bank deposits and withdrawals; maintaining accurate transaction records; issuing tax documentation where legally required
• Regulatory compliance: Filing mandatory reports with PAGCOR and AMLC; responding to lawful requests from Philippine law enforcement agencies; maintaining records required by PAGCOR's audit procedures
• Fraud and security: Detecting and preventing unauthorized access, bonus abuse, multi-accounting, collusion, and money laundering activities on the phyaya platform
• Responsible gaming: Monitoring gameplay patterns for signs of problem gambling; enforcing deposit limits and self-exclusion requests; training support staff on harm identification
• Customer support: Responding to your queries, complaints, and account issues via live chat and email
• Marketing (with consent only): Sending you promotional offers, bonus notifications, and phyaya product updates via SMS or email — only where you have separately opted in. You may withdraw marketing consent at any time via your account settings or by contacting support
• Platform improvement: Analyzing aggregated and anonymized usage data to improve phyaya's game lobby, interface design, and payment flows

phyaya will not use your personal data for purposes that are incompatible with those listed above without providing prior notice and, where legally required, obtaining your separate consent.

6. Data Sharing & Third-Party Disclosure

6.1 Regulatory Bodies

phyaya is required by law to disclose player data to PAGCOR, AMLC, the Bureau of Internal Revenue (BIR), and other Philippine government agencies upon receipt of a valid legal request, court order, or as part of mandatory regulatory reporting obligations.

6.2 Payment Processors

Transaction data is shared with GCash (Mynt/G-Xchange), Maya/PayMaya (Voyager Innovations), and partner banks (BPI, BDO, Metrobank) solely to the extent necessary to process deposits and withdrawals. These entities process your data under their own privacy policies and applicable Philippine financial regulations.

6.3 KYC & AML Service Providers

phyaya engages accredited identity verification and AML screening providers to perform KYC checks on submitted documents and screen player identities against international sanctions lists and AMLC watchlists. These providers access only the data necessary for verification purposes and are contractually bound by confidentiality obligations consistent with RA 10173.

6.4 Game Providers

JILI, PG Soft, Pragmatic Play, Spadegaming, and other integrated game providers receive player account identifiers and bet data necessary to facilitate gameplay and calculate results. These providers do not receive your full KYC documentation or financial account details.

6.5 No Sale of Personal Data

phyaya does not sell, rent, or trade your personal data to third parties for commercial purposes. Any data sharing with marketing partners or analytics providers is conducted on an aggregated, anonymized basis only — individual player data is never disclosed for third-party marketing without your explicit consent.

7. Cookies & Tracking Technologies

The phyaya platform uses cookies and similar tracking technologies to deliver a functional, personalized, and secure experience. Cookies are small text files stored on your device by your browser. phyaya uses the following categories of cookies:

• Strictly necessary cookies: Required for login session management, authentication tokens, and basic platform security. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Store your language preferences, responsible gaming settings, and last-visited game categories to personalize your phyaya session.
• Analytics cookies: Collect anonymized data on page visits, game lobby navigation, and feature usage to help phyaya identify platform improvements. No personally identifiable information is shared with analytics providers.
• Security cookies: Monitor for suspicious login patterns, unusual transaction behavior, and bot-like activity to protect your phyaya account.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from logging in to phyaya. For full cookie details, contact phyaya's Data Protection Officer at the address in Section 14.

8. Data Retention

phyaya retains personal data for the following periods, after which data is securely deleted or anonymized:

• Active account data: Retained for the duration of your active phyaya account plus five (5) years after account closure, as required by PAGCOR audit retention standards
• KYC documents: Retained for a minimum of five (5) years after account closure, as required by AMLC regulations under RA 9160
• Financial transaction records: Retained for ten (10) years in accordance with BIR record-keeping requirements and PAGCOR audit requirements
• Support and complaint records: Retained for three (3) years from the date of final resolution
• Marketing consent records: Retained for the duration of the marketing relationship plus two (2) years after consent withdrawal
• Self-exclusion records: Retained permanently to prevent re-registration during the exclusion period and to fulfill regulatory reporting obligations

9. Data Security

phyaya implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, and destruction. Key security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and phyaya's servers
• Encrypted password storage using industry-standard one-way hashing — phyaya employees cannot view your password
• Multi-factor authentication available for all phyaya accounts via SMS OTP or authenticator app
• Role-based access controls limiting employee access to personal data to those with a legitimate operational need
• Regular security audits and penetration testing conducted on phyaya's platform infrastructure
• Data breach response procedures compliant with NPC notification requirements under RA 10173 Section 20

In the event of a personal data breach that poses a real risk of harm to affected individuals, phyaya will notify the NPC and affected Data Subjects within seventy-two (72) hours of becoming aware of the breach, as required by the Data Privacy Act.

10. Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phyaya:

• Right to be Informed: You have the right to be informed about how phyaya collects and processes your personal data — which this Policy fulfills.
• Right of Access: You may request a copy of the personal data phyaya holds about you, including your KYC records, transaction history, and game logs.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data in your phyaya account profile.
• Right to Erasure: You may request deletion of your personal data where processing is no longer necessary, subject to phyaya's legal retention obligations under PAGCOR and AMLC regulations, which may override erasure requests.
• Right to Object: You may object to processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interest grounds.
• Right to Data Portability: You may request that phyaya provide your personal data in a structured, commonly used, machine-readable format.
• Right to Lodge a Complaint: If you believe phyaya has violated your data privacy rights, you may file a complaint with the National Privacy Commission of the Philippines via the NPC's official complaint mechanism.

To exercise any of the above rights, submit a written request to phyaya's Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request." phyaya will respond within fifteen (15) business days. Identity verification may be required before processing rights requests.

11. International Data Transfers

Some of phyaya's third-party service providers — including game providers, analytics tools, and cloud infrastructure providers — may process or store data outside the Philippines. Where such transfers occur, phyaya ensures that appropriate safeguards are in place consistent with NPC guidelines on cross-border data transfer under RA 10173, including contractual clauses that impose data protection obligations equivalent to those in Philippine law.

By using the phyaya platform, you consent to the transfer of your personal data outside the Philippines where necessary for the operational purposes described in this Policy, subject to the safeguards described above.

12. Children's Privacy

The phyaya platform is strictly intended for adults aged 21 years and above in accordance with PAGCOR's online gambling licensing requirements. phyaya does not knowingly collect personal data from individuals under 21. All registration attempts are subject to government ID-based age verification. If phyaya becomes aware that personal data has been collected from a person under 21, that account will be immediately suspended and the data deleted or reported to the appropriate authorities as required by law.

Parents and guardians who believe a minor has registered a phyaya account should contact phyaya support immediately via live chat or email.

13. Updates to This Privacy Policy

phyaya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or operational procedures. Material changes will be communicated to registered players via email to their registered address and/or a prominent notice on the phyaya website at least seven (7) days before the amended policy takes effect.

The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. Your continued use of the phyaya platform after the effective date of any amendment constitutes acceptance of the updated Privacy Policy.

14. Contact & Data Protection Officer

For any questions, concerns, or requests related to this Privacy Policy or phyaya's data processing practices, please contact phyaya's Data Protection Officer (DPO):

• Email: [email protected] (Subject: "Privacy / DPO Request")
• Live Chat: 24/7 via the phyaya website
• Postal: phyaya Data Protection Officer, Philippines (full address available to verified players on request)

phyaya's DPO is responsible for overseeing compliance with this Policy and RA 10173. Players who are unsatisfied with phyaya's response to a data rights request may escalate complaints to the National Privacy Commission of the Philippines.