This Privacy Policy explains how phaa ("phaa," "we," "us," or "our") collects, uses, stores, and protects the personal information of players who access and use the phaa platform at phaa.win. phaa is committed to handling your personal data with transparency, security, and full respect for your rights as a data subject under applicable Philippine law.
21+ The phaa platform is strictly for adults aged 21 and above.
phaa is the operator of the online gaming platform accessible at phaa.win (the "Platform"). phaa operates in accordance with applicable Philippine gaming regulations and is subject to the data protection requirements of the Republic of the Philippines, including the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations (the "DPA").
As the personal information controller under the DPA, phaa is responsible for determining the purposes and means by which your personal data is processed. For any privacy-related queries, data subject requests, or concerns, you may contact phaa's Data Protection Officer as follows:
phaa aims to respond to all data privacy enquiries within five (5) business days of receipt.
phaa collects the following categories of personal data from Players:
| Category | Examples of Data Collected |
|---|---|
| Identity Data | Full legal name, date of birth, gender, nationality, government-issued ID number (e.g., PhilSys ID, passport number, driver's licence) |
| Contact Data | Email address, Philippine mobile number, residential address |
| Account Data | Username, account ID, account preferences, communication preferences, responsible gaming settings |
| Financial Data | GCash reference numbers, Maya transaction IDs, bank transfer references, deposit and withdrawal history, account balance history |
| Transaction Data | Details of all bets placed, games played, bonus claims, winnings, and losses within the phaa Platform |
| Technical Data | IP address, device type, browser type and version, operating system, session timestamps, login history |
| KYC Verification Data | Copies of government-issued identification documents, selfie verification images, proof of address documents |
| Communications Data | Content of support chat transcripts, email correspondence, and feedback submitted to phaa |
phaa does not collect sensitive personal data such as racial or ethnic origin, religious beliefs, or medical history, unless specifically required by applicable law or regulatory obligations (for example, where a Player discloses a gambling addiction in the context of a self-exclusion request).
phaa collects personal data through the following means:
phaa processes your personal data for the following purposes and on the following legal bases under the DPA:
| Purpose | Legal Basis |
|---|---|
| Creating and managing your phaa account | Performance of contract |
| Processing deposits and withdrawals | Performance of contract |
| KYC identity verification and age verification (21+) | Legal obligation; compliance with gaming regulations |
| Anti-money laundering and fraud prevention screening | Legal obligation; legitimate interests |
| Delivering responsible gaming tools and monitoring for problem gambling indicators | Legal obligation; legitimate interests; vital interests of the data subject |
| Providing customer support and resolving disputes | Performance of contract; legitimate interests |
| Sending account notifications (deposit confirmations, withdrawal alerts, security alerts) | Performance of contract |
| Sending marketing communications and promotional offers | Consent (you may withdraw consent at any time) |
| Platform analytics and service improvement | Legitimate interests |
| Compliance with applicable laws and regulatory reporting obligations | Legal obligation |
Where phaa processes your personal data on the basis of legitimate interests, those interests are to operate a safe, secure, and compliant online gaming platform and to protect the interests of phaa and its Players.
phaa does not sell your personal data to third parties. phaa may share your personal data with the following categories of recipients, strictly to the extent necessary for the purposes described in this Policy:
All third parties with whom phaa shares personal data are required to maintain appropriate security measures and to use the data solely for the disclosed purpose.
6.1 Some of phaa's third-party service providers are located outside the Philippines. Where personal data is transferred outside the Philippines, phaa takes appropriate steps to ensure that an adequate level of data protection applies to such transfers, consistent with the requirements of the DPA.
6.2 phaa implements contractual safeguards — including standard data protection clauses — in agreements with recipients of personal data located in jurisdictions that may not provide an equivalent level of data protection to that afforded under Philippine law.
6.3 By registering a phaa account and using the Platform, you acknowledge that your personal data may be transferred to, stored in, and processed in jurisdictions outside the Philippines in accordance with this Policy.
7.1 phaa retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations.
7.2 Account data and transaction records are retained for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping obligations applicable under Philippine law.
7.3 KYC verification documents are retained for a minimum of five (5) years following the end of the business relationship, unless a longer period is required by applicable law.
7.4 Where a Player has exercised their right to erasure (see Section 8), phaa will delete or anonymise personal data to the extent permitted by applicable legal and regulatory obligations. Data subject to ongoing legal proceedings, regulatory investigations, or AML retention requirements may be retained beyond the standard retention period.
7.5 Self-exclusion records are retained for a minimum of five (5) years following the expiry of the exclusion period, for the purpose of preventing re-registration in contravention of the exclusion.
As a data subject under the DPA, you have the following rights in relation to your personal data held by phaa:
To exercise any of the above rights, submit your request to [email protected] with the subject line "Data Subject Rights Request." phaa will respond within fifteen (15) business days of receiving a verifiable request.
9.1 The phaa Platform uses cookies and similar tracking technologies to deliver, maintain, and improve the Platform, and to personalise the Player experience. A "cookie" is a small text file placed on your device when you visit a website.
9.2 phaa uses the following categories of cookies:
9.3 You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair the functionality of the phaa Platform and may prevent you from accessing your account.
The phaa Platform is strictly for individuals aged 21 years and above. phaa does not knowingly collect personal data from persons under the age of 21. If phaa becomes aware that personal data has been collected from a person under the age of 21, that account will be immediately closed, all funds will be returned to the source payment method, and the personal data will be deleted as soon as reasonably practicable.
If you believe that a person under 21 has registered a phaa account, please contact phaa immediately at [email protected] so that the matter can be investigated and resolved without delay.
phaa implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:
While phaa takes data security seriously and implements industry-standard protections, no online platform can guarantee absolute security. Players are advised to use strong, unique passwords for their phaa account, enable 2FA, and report any suspicious account activity to [email protected] immediately.
12.1 phaa may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, or phaa's data processing practices. Material changes will be communicated to Players via email to their registered address and/or through a prominent notice on the phaa Platform, at least seven (7) days before the changes take effect.
12.2 The most current version of this Privacy Policy is always available at phaa.win/privacy-policy. The date at the top of this document ("Last Updated") indicates when this version was last revised.
12.3 Continued use of the phaa Platform following the effective date of any revision constitutes your acknowledgement of the updated Privacy Policy.
All personal data transmitted through the phaa Platform is protected by 256-bit SSL/TLS encryption. Your account credentials, payment data, and personal information are never transmitted in plain text.
phaa does not sell, rent, or trade your personal data to third-party advertisers or data brokers. Your information is used exclusively to operate the phaa Platform and meet our legal obligations.
phaa respects your rights under the Philippines Data Privacy Act. You can access, correct, or request deletion of your data at any time by contacting our Data Protection Officer at [email protected].
phaa processes personal data in accordance with Republic Act No. 10173 (Data Privacy Act of 2012). All processing activities are documented and subject to regular internal review by our DPO.
phaa retains personal data only as long as necessary — typically 5 years post-closure for AML compliance. Data no longer required is securely deleted or anonymised per our data retention schedule.
In the event of a personal data breach, phaa has procedures to notify the National Privacy Commission and affected Players within the timeframes required by Philippine law — without unnecessary delay.
phaa takes your data seriously — and so does everything else about how we run this platform. Join thousands of Filipino players who trust phaa for secure, fair, and responsible online gaming. Deposit via GCash in seconds. Play 500+ certified games. 21+ only.
21+ For entertainment purposes only. Please gamble responsibly. phaa.win