PH Saya Privacy
Policy

PH Saya ("we," "us," or "the Platform") is committed to protecting the privacy and personal data of all users who access or register on the ph-saya.com website and its associated mobile application. This Privacy Policy ("Policy") describes how PH Saya collects, uses, stores, shares, and protects your personal information in connection with your use of our gaming platform.

This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations, as enforced by the National Privacy Commission of the Philippines. It applies to all personal data collected from players, prospective players, and visitors to the PH Saya platform, regardless of whether they are located in Metro Manila, Cebu, Davao, Quezon City, or any other part of the Philippines.

This Policy should be read together with our Terms and Conditions, which govern your overall use of the PH Saya platform. Where this Policy uses terms defined in the Terms and Conditions, those definitions apply here as well.

For the purposes of the Data Privacy Act of 2012, PH Saya acts as the Personal Information Controller in respect of all personal data collected through the platform. This means PH Saya determines the purposes and means by which your personal data is processed.

PH Saya has appointed a Data Protection Officer ("DPO") who is responsible for overseeing compliance with this Policy and applicable data protection legislation. You may contact the DPO directly for any privacy-related enquiries, requests, or complaints using the contact details provided in Section 13 of this Policy.

PH Saya collects personal data through several channels, including account registration, identity verification, payment processing, and your ongoing use of the platform. The categories of data we collect are set out below.

We do not collect sensitive personal information beyond what is strictly required for identity verification and regulatory compliance. We do not collect data relating to racial or ethnic origin, political opinions, religious beliefs, or health information unless specifically required by applicable law.

PH Saya uses your personal data only for the purposes for which it was collected. The primary purposes are as follows:

• Account Management: To create, maintain, and administer your PH Saya player account, including authentication and access control.
• Identity Verification (KYC): To verify your identity and age (21+) in compliance with Philippine gaming regulations and anti-money laundering requirements.
• Payment Processing: To process deposits and withdrawals through GCash, PayMaya, BPI, BDO, Metrobank, and other supported Philippine payment channels.
• Platform Operation: To deliver gaming services, record game outcomes, calculate winnings, and maintain accurate account balances.
• Regulatory Compliance: To meet obligations under Philippine gaming regulations, anti-money laundering laws, and tax reporting requirements.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, and other prohibited conduct on the platform.
• Responsible Gaming: To monitor gaming behaviour and apply responsible gaming tools such as deposit limits, cooling-off periods, and self-exclusion where appropriate.
• Customer Support: To respond to your enquiries, complaints, and support requests in a timely and effective manner.
• Platform Improvement: To analyse usage patterns and technical performance data to improve the PH Saya platform and user experience.
• Legal Obligations: To comply with court orders, regulatory investigations, or other lawful requests from competent Philippine authorities.

PH Saya does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review, except where required by law or expressly consented to by you.

Under the Data Privacy Act of 2012, PH Saya processes your personal data on the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between you and PH Saya — specifically, to operate your account and deliver gaming services.
• Legal Obligation: Processing is required to comply with applicable Philippine laws, including anti-money laundering regulations, gaming licensing requirements, and tax obligations.
• Legitimate Interests: Processing is necessary for PH Saya's legitimate interests in fraud prevention, platform security, and service improvement, provided these interests are not overridden by your rights and freedoms.
• Consent: Where processing is not covered by the above bases — for example, for certain marketing communications — we will seek your explicit consent and provide a clear mechanism to withdraw it at any time.

PH Saya does not sell, rent, or trade your personal data to any third party. We may share your data only in the following limited circumstances:

• Payment Processors: We share necessary financial data with Philippine payment service providers (e.g., GCash, PayMaya, BPI, BDO, Metrobank) solely to process your transactions.
• KYC & Identity Verification Providers: We engage accredited third-party identity verification services to assist with KYC compliance. These providers process your data under strict confidentiality agreements.
• Regulatory Authorities: We may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, or other competent Philippine authorities when required by law or regulatory directive.
• Technology Service Providers: We engage cloud hosting, cybersecurity, and platform infrastructure providers who process data on our behalf as Personal Information Processors under binding data processing agreements.
• Legal Proceedings: We may disclose personal data where required by a valid court order, subpoena, or other lawful legal process issued by a Philippine court or authority.

All third parties with whom PH Saya shares personal data are required to maintain appropriate technical and organisational security measures and to process data only for the specified purpose and in accordance with applicable Philippine data protection law.

PH Saya retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with PH Saya's data disposal procedures. Anonymised data may be retained indefinitely for statistical and analytical purposes.

PH Saya uses cookies and similar technologies on the platform to ensure proper functionality, maintain session security, and analyse platform performance. The types of cookies we use are described below:

• Essential Cookies: Required for the platform to function correctly. These include session authentication tokens and security cookies. They cannot be disabled without affecting platform functionality.
• Performance Cookies: Used to collect anonymised data about how players interact with the platform, such as pages visited and error messages encountered. This data helps us improve the platform experience.
• Preference Cookies: Used to remember your platform settings and preferences, such as language selection and display options, across sessions.

PH Saya does not use advertising cookies, cross-site tracking cookies, or any third-party marketing pixels. You may manage cookie preferences through your browser settings. Note that disabling essential cookies may impair your ability to log in or use certain platform features.

PH Saya implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data in transit between your device and PH Saya servers.
• AES-256 encryption for sensitive data stored at rest, including financial information and identity documents.
• Multi-factor authentication requirements for account access and administrative systems.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Role-based access controls ensuring that PH Saya staff can only access personal data necessary for their specific job function.
• Continuous monitoring of platform systems for anomalous activity, intrusion attempts, and data breach indicators.
• Documented incident response procedures in compliance with NPC breach notification requirements.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, PH Saya will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay, in accordance with the Data Privacy Act of 2012.

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by PH Saya:

• Right to Be Informed: You have the right to be informed about how your personal data is collected and processed, as set out in this Policy.
• Right of Access: You have the right to request a copy of the personal data PH Saya holds about you, along with information about how it is being used.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on legitimate interests, including profiling for direct marketing purposes.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where technically feasible.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission of the Philippines if you believe your data rights have been violated.

To exercise any of the above rights, please contact PH Saya's Data Protection Officer using the details in Section 13. We will respond to all verified data rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 30 days, with prior notice to you.

PH Saya is strictly an adult gaming platform. Access is limited to individuals who are 21 years of age or older in accordance with Philippine gaming regulations. PH Saya does not knowingly collect personal data from individuals under the age of 21.

If we become aware that personal data has been collected from a person under 21 years of age, we will immediately suspend the associated account, delete the personal data in question, and void any associated transactions or balances. If you believe that a minor has registered on PH Saya, please contact our support team immediately so that we can take appropriate action.

PH Saya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. When material changes are made, we will notify registered players via email or an in-platform notification at least fourteen (14) days before the changes take effect.

The effective date at the top of this Policy will be updated each time a revision is made. We encourage you to review this Policy periodically to stay informed about how PH Saya protects your personal data. Your continued use of the platform following notification of changes constitutes your acceptance of the revised Policy.

Previous versions of this Privacy Policy are available upon request by contacting our Data Protection Officer.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by PH Saya, please contact our Data Protection Officer:

Data Protection Officer — PH Saya
Email: [email protected]

General Support: [email protected]

Our DPO is available Monday to Friday, 9:00 AM to 6:00 PM Philippine Standard Time (PST). We aim to acknowledge all privacy-related enquiries within two (2) business days and to provide a substantive response within thirty (30) calendar days.