Privacy Policy
How We Protect Your Data

phstake operates the online casino and sports betting platform accessible at phstake.net. phstake is a PAGCOR-regulated gaming platform serving players across the Philippines, including Metro Manila, Cebu, Davao, Quezon City, Makati, and beyond.

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules, phstake acts as the Personal Information Controller in respect of the personal data you provide when registering for and using the phstake platform. Our designated Data Protection Officer (DPO) can be reached at [email protected].

phstake collects personal data through several channels: directly from you when you register and use the platform, automatically through your device and browser interactions, and in limited cases from third-party verification providers for KYC purposes.

Data you provide directly:

• Registration information: full name, date of birth, email address, mobile number, residential address, and government-issued Philippine ID details (e.g., PhilSys ID, passport, driver's licence, UMID).
• Financial information: GCash mobile number, Maya account details, and bank account information for deposits and withdrawals via BPI, BDO, or Metrobank.
• Responsible gaming settings: deposit limits, cool-off periods, and self-exclusion requests you configure on your account.
• Support communications: messages and attachments you send to phstake via live chat or email.

Data collected automatically:

• Technical data: IP address, device type, operating system, browser version, and unique device identifiers.
• Behavioural data: pages you visit on phstake, games you play, bets you place, session start and end times, and navigation paths through the platform.
• Cookie data: session cookies, authentication tokens, and analytics identifiers as described in Section 6 of this Policy.

Data from third parties:

• Identity verification data returned by our KYC provider when cross-checking your submitted documents against authoritative Philippine data sources.
• Fraud and AML screening data from compliance screening services used to meet PAGCOR and AMLC obligations.

phstake uses your personal data for the following specific purposes:

• Account creation and management: To register your account, verify your identity, and maintain your player profile on phstake.
• Service delivery: To process your deposits and withdrawals via GCash, Maya, and Philippine banks; to record your game and betting activity; and to calculate and credit any winnings.
• KYC and AML compliance: To fulfil phstake's obligations under PAGCOR's Know Your Customer requirements and the Anti-Money Laundering Act (RA 9160 as amended), including mandatory transaction monitoring and suspicious transaction reporting to the AMLC.
• Fraud prevention and platform security: To detect, investigate, and prevent fraudulent transactions, multi-accounting, bonus abuse, and unauthorized access to player accounts.
• Responsible gaming: To implement and monitor the deposit limits, session reminders, cool-off periods, and self-exclusion settings you configure on your account; and to identify patterns of play that may indicate problem gambling behaviour.
• Customer support: To respond to your inquiries, resolve disputes, and process any complaints you submit to phstake or escalate to PAGCOR.
• Platform improvement: To analyse aggregated usage patterns and improve the design, performance, and game offering of the phstake platform.
• Marketing communications: To send you promotional offers, bonus notifications, and tournament invitations — but only where you have opted in to receive such communications.

Under RA 10173 and its Implementing Rules and Regulations, phstake processes your personal data on the following legal grounds:

• Contractual necessity: Processing your identity, contact, and financial data is necessary to perform the contract between you and phstake — specifically, to operate and maintain your gaming account and process financial transactions.
• Legal obligation: Processing required for PAGCOR licensing compliance, AML/CTF reporting obligations under RA 9160, and data retention requirements mandated by PAGCOR and the NPC.
• Legitimate interests: Processing your technical and usage data for fraud prevention, platform security, and aggregate analytics — where those interests are not overridden by your privacy rights.
• Consent: Processing your data for optional marketing communications, where you have given a clear, specific, and freely withdrawn consent at the point of registration or through your account settings.

phstake shares your personal data only with the categories of recipients listed below, and only to the extent strictly necessary for the stated purpose:

• PAGCOR: As the regulator of phstake's gaming licence, PAGCOR may request access to player account data, transaction records, and KYC documentation for regulatory audit and compliance verification purposes.
• Anti-Money Laundering Council (AMLC): phstake is legally required to file Suspicious Transaction Reports (STRs) and Covered Transaction Reports (CTRs) with the AMLC in accordance with RA 9160. This reporting may include your identity and transaction data.
• Payment processors: GCash (GXI), Maya (PayMaya Philippines), BPI, BDO, and Metrobank receive only the transaction data necessary to process your deposits and withdrawals. These entities operate under their own PDPA-compliant privacy frameworks.
• KYC and identity verification providers: Third-party identity verification services receive your submitted documents and identity data solely for the purpose of verifying your identity against authoritative sources.
• IT and hosting providers: Cloud infrastructure and data hosting providers who process data on phstake's behalf under strict data processing agreements that prohibit independent use of your data.
• Law enforcement and courts: Philippine law enforcement agencies, courts, and government bodies when disclosure is required by law, court order, or valid legal process.

phstake uses cookies and similar tracking technologies on its platform to ensure proper functionality, maintain your authenticated session, and collect aggregate analytics data that helps us improve the platform.

Categories of cookies phstake uses:

• Strictly necessary cookies: These are essential for the platform to function. They manage your login session, maintain your authentication state, and remember your language and currency preferences. These cookies cannot be disabled without breaking core platform functionality.
• Performance and analytics cookies: These collect anonymized and aggregated data about how players navigate the platform — which pages are most visited, where players encounter errors, and how game categories perform. This data is used solely to improve phstake and is never shared with advertisers.
• Responsible gaming cookies: A small set of session-scoped cookies that store your active deposit limits and session reminder settings locally to ensure they are enforced consistently across your active session.

phstake does not use third-party advertising cookies or cross-site tracking technologies. You can manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will prevent you from logging into your phstake account.

phstake applies a layered security architecture to protect your personal data at rest and in transit. The following technical and organizational measures are in place:

• Encryption in transit: All data exchanged between your device and phstake servers is encrypted using TLS 1.2 or higher. The padlock icon in your browser address bar confirms this connection is active.
• Encryption at rest: Sensitive personal data — including identity documents, financial account details, and authentication credentials — is stored using AES-256 encryption on phstake servers.
• Access controls: Access to production databases containing player data is restricted to a limited number of authorized phstake personnel on a need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA).
• Security monitoring: phstake's infrastructure is monitored 24/7 for anomalous access patterns, intrusion attempts, and data exfiltration signals. Security alerts are triaged in real time by our technical operations team.
• Penetration testing: phstake conducts independent third-party penetration testing on a regular basis to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a personal data breach, phstake will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected players without undue delay where the breach poses a high risk to their rights.

phstake primarily stores and processes player data on servers located within or serving the Philippines. In limited cases — such as where phstake uses cloud infrastructure or KYC technology providers with data centres in other jurisdictions — your personal data may be transferred outside the Philippines.

Any such international transfer is governed by a Data Sharing Agreement that requires the recipient to apply data protection standards at least equivalent to those required by RA 10173. phstake will not transfer your personal data to any jurisdiction that the National Privacy Commission has identified as providing inadequate data protection, without first implementing additional safeguards.

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by phstake. These rights can be exercised at any time by contacting our Data Protection Officer at [email protected]:

phstake will respond to rights requests within thirty (30) calendar days of receipt. Where a request is complex or you have submitted multiple requests simultaneously, we may extend this period by a further thirty (30) days and will notify you accordingly.

If you are not satisfied with phstake's response to a rights request or believe we are processing your data unlawfully, you have the right to lodge a complaint with the National Privacy Commission of the Philippines through its official government channels.

phstake is strictly an adult platform. In accordance with PAGCOR regulations and the Philippine gaming laws applicable to online casino operations, access to phstake is prohibited for any person under the age of 21 years.

phstake does not knowingly collect personal data from anyone under 21. If you are a parent or guardian and believe your child has provided personal data to phstake, contact us immediately at [email protected]. Upon verification, we will promptly delete the relevant account and all associated personal data from our systems.

phstake retains your personal data for as long as your account is active and for such additional periods as are required by law or our regulatory obligations. The specific retention periods for each category of data are set out in the table at the top of this page.

The primary driver of extended retention after account closure is phstake's obligation under PAGCOR's AML framework and RA 9160, which requires gaming operators to retain KYC documentation and transaction records for a minimum of five (5) years from the date of the last transaction. Responsible gaming records are retained for seven (7) years.

Once the applicable retention period has expired, phstake will securely delete or anonymize your personal data in a manner that prevents recovery or reconstruction. Anonymized and aggregated analytical data — from which individual players cannot be identified — may be retained indefinitely for platform improvement purposes.

If you request deletion of your account data before the minimum retention period has elapsed, phstake will restrict active processing of your data (so it is no longer used for marketing or platform improvement) but will retain the records required by law until the mandatory period expires.

phstake will only send you promotional emails, SMS messages, or push notifications if you have explicitly opted in to receive them — either during registration or through your account notification settings. Marketing communications from phstake may include bonus offers, tournament announcements, new game launches, and platform updates.

You can withdraw your consent to marketing communications at any time by:

• Clicking the "Unsubscribe" link included in every phstake promotional email;
• Adjusting your notification preferences in your phstake account settings; or
• Contacting our support team at [email protected] with a clear request to opt out.

Opting out of marketing communications will not affect the delivery of transactional messages — such as deposit confirmations, withdrawal receipts, account security alerts, and responsible gaming notifications — which are sent as a necessary part of the phstake service.

phstake reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable Philippine law, or PAGCOR regulatory requirements. When we make material changes to this Policy, we will:

• Update the "Last Revised" date at the top of this page;
• Post a prominent notice on the phstake platform for at least thirty (30) days after the change takes effect; and
• Where the change materially affects your rights, send a direct notification to the email address registered on your phstake account.

Your continued use of phstake after a revised Privacy Policy has been posted constitutes your acknowledgment of the updated terms. If you do not agree with a material change, you may close your account by contacting our support team before the change takes effect.

For any questions, concerns, or requests relating to this Privacy Policy or phstake's handling of your personal data, please contact our Data Protection Officer:

• Email: [email protected]
• Live Chat: Available 24/7 through the phstake platform
• Response Time: Within 30 calendar days of receipt

If you are not satisfied with phstake's handling of a privacy complaint, you have the right to escalate your concern to the National Privacy Commission of the Philippines (NPC) through its official government portal. You may also raise concerns about phstake's gaming conduct with PAGCOR through its official regulatory channels.