philaro Privacy Policy

1.Introduction

1.1 This Privacy Policy ("Policy") describes how philaro ("the Company," "we," "us," or "our") collects, uses, stores, shares, and protects the personal data of individuals ("you," "your," or "Player") who access or use the philaro online gaming platform available at philaro.vip and any associated mobile-optimized interfaces (collectively, "the Platform").

1.2 philaro is committed to handling your personal data responsibly, transparently, and in full compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations ("IRR"), and all applicable issuances of the National Privacy Commission ("NPC") of the Philippines.

1.3 By registering an account on the philaro Platform, making a deposit, or otherwise using our services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must not use the philaro Platform.

2.Data Controller

2.1 philaro acts as the data controller in respect of the personal data collected through the Platform. As data controller, philaro determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable Philippine data privacy law.

2.2 philaro has appointed a Data Protection Officer ("DPO") who is responsible for overseeing compliance with this Policy and with the DPA. Contact details for the DPO are provided in Section 15 of this Policy.

2.3 Where philaro engages third-party service providers to process personal data on its behalf, such providers act as data processors and are bound by contractual obligations that require them to process data only on philaro's documented instructions and to maintain appropriate security measures.

3.Data We Collect

3.1 philaro collects the following categories of personal data in connection with the operation of the Platform:

3.1 Identity & Contact Data

• Full legal name as it appears on a government-issued ID;
• Date of birth (used to verify the 21+ age requirement);
• Nationality and country of residence;
• Residential address (including barangay, city, and province for Philippine residents);
• Email address and mobile number.

3.2 Identity Verification (KYC) Data

• Copies of government-issued photo identification (e.g., Philippine passport, SSS ID, PhilHealth ID, Unified Multi-Purpose ID, or driver's license);
• Proof of address documents (e.g., utility bills, bank statements issued by BPI, BDO, or Metrobank);
• Selfie or liveness verification images where required for enhanced KYC.

3.3 Financial Data

• GCash or Maya mobile wallet identifiers (mobile number only — philaro does not store full wallet credentials);
• Bank account details provided for withdrawal processing (account name and number only);
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment method used;
• Card type (Visa or Mastercard) and last four digits where card payments are used.

3.4 Gaming & Behavioural Data

• Game session data including games played, wager amounts, win/loss records, and session duration;
• Bonus and promotion usage history;
• Responsible gaming tool settings (deposit limits, session limits, self-exclusion status);
• Customer support interaction records including chat transcripts and email correspondence.

3.5 Technical & Device Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser type;
• Unique device identifiers;
• Cookie identifiers and session tokens (see Section 8).

4.How We Collect Data

4.1 philaro collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or participate in a promotion;
• Automatically — through cookies, web beacons, and similar tracking technologies when you access and navigate the Platform (see Section 8);
• From third-party verification providers — identity verification and fraud screening services that assist philaro in confirming the accuracy of the information you provide;
• From payment processors — transaction confirmation data from GCash, Maya, and banking partners to reconcile deposits and withdrawals;
• From regulatory and law enforcement bodies — where philaro is legally required to receive or share information in connection with an investigation or compliance obligation.

5.How We Use Your Data

5.1 philaro uses your personal data for the following purposes:

6.Legal Basis for Processing

6.1 philaro processes your personal data on the following legal bases as recognized under the Philippine Data Privacy Act of 2012:

• Contractual necessity — processing is necessary to perform the contract between you and philaro (i.e., to provide the gaming services you have registered for, process your transactions, and manage your account);
• Legal obligation — processing is required to comply with applicable Philippine laws, including the Anti-Money Laundering Act (Republic Act No. 9160, as amended), PAGCOR regulations, and the Data Privacy Act itself;
• Legitimate interests — processing is necessary for philaro's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and business analytics, provided such interests are not overridden by your rights and freedoms;
• Consent — for marketing communications and certain non-essential cookies, philaro relies on your freely given, specific, and informed consent, which you may withdraw at any time.

7.Data Sharing

7.1 philaro does not sell, rent, or trade your personal data to any third party for their own commercial purposes. philaro may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Identity verification and KYC providers — third-party services that assist philaro in verifying your identity and age in compliance with regulatory requirements;
• Payment processors and financial institutions — GCash, Maya, BPI, BDO, Metrobank, Visa, and Mastercard processing partners, solely for the purpose of executing your deposit and withdrawal transactions;
• Fraud prevention and security services — providers that assist philaro in detecting and preventing fraudulent activity, money laundering, and unauthorized account access;
• Game content providers — software providers whose games are available on the philaro Platform, to the extent necessary to deliver game services and resolve disputes;
• Regulatory and law enforcement authorities — PAGCOR, the Anti-Money Laundering Council ("AMLC"), the National Privacy Commission, and other Philippine government bodies where disclosure is required by law or court order;
• Professional advisers — lawyers, auditors, and accountants bound by professional confidentiality obligations, where necessary for philaro's legal and compliance functions.

7.2 All third-party data processors engaged by philaro are required to implement appropriate technical and organizational security measures and to process personal data only in accordance with philaro's documented instructions.

8.Cookies & Tracking Technologies

8.1 philaro uses cookies and similar tracking technologies on the Platform to ensure the Platform functions correctly, to remember your preferences, to keep your session secure, and to analyze how the Platform is used so we can improve it.

8.2 The following categories of cookies are used on the philaro Platform:

• Strictly necessary cookies — essential for the Platform to function. These include session authentication tokens and security cookies. They cannot be disabled without impairing Platform functionality.
• Functional cookies — used to remember your preferences such as language settings and responsible gaming tool configurations.
• Analytics cookies — used to collect aggregated, anonymized data about how players navigate the Platform, which pages are visited most frequently, and where errors occur. This data helps philaro improve the user experience.
• Marketing cookies — used only with your explicit consent to deliver relevant promotional content. You may opt out of marketing cookies at any time through your browser settings or the philaro cookie preference center.

8.3 You can control and manage cookies through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to use the philaro Platform, including the ability to log in and maintain a secure session.

9.Data Retention

9.1 philaro retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods required by Philippine law and regulation:

• Account and KYC records — retained for a minimum of five (5) years from the date of account closure, in accordance with PAGCOR licensing requirements and the Anti-Money Laundering Act;
• Financial transaction records — retained for a minimum of five (5) years from the date of each transaction;
• Gaming session records — retained for a minimum of three (3) years from the date of each session;
• Customer support records — retained for a minimum of two (2) years from the date of the last interaction;
• Marketing consent records — retained for the duration of your consent and for one (1) year following withdrawal of consent, as evidence of compliance.

9.2 Upon expiry of the applicable retention period, philaro will securely delete or anonymize your personal data in accordance with industry-standard data destruction practices.

10.Data Security

10.1 philaro implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and philaro's servers;
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records;
• Multi-factor authentication options for player accounts;
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• 24/7 security monitoring and intrusion detection systems;
• Documented incident response procedures in compliance with NPC breach notification requirements.

10.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, philaro will notify the National Privacy Commission within 72 hours of becoming aware of the breach and will notify affected players without undue delay, in accordance with the DPA and NPC Circular No. 16-03.

11.Your Rights Under the Data Privacy Act

11.1 As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by philaro:

• Right to be informed — the right to know that your personal data is being collected and processed, and to receive clear information about how it is used;
• Right of access — the right to request a copy of the personal data philaro holds about you and information about how it is processed;
• Right to rectification — the right to request correction of any inaccurate or incomplete personal data held by philaro;
• Right to erasure or blocking — the right to request deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, subject to philaro's legal retention obligations;
• Right to object — the right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests;
• Right to data portability — the right to receive your personal data in a structured, commonly used, and machine-readable format where technically feasible;
• Right to lodge a complaint — the right to lodge a complaint with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated.

11.2 To exercise any of the above rights, please submit a written request to the philaro Data Protection Officer at the contact details provided in Section 15. philaro will respond to all verified requests within thirty (30) calendar days of receipt. philaro may request proof of identity before processing any data subject request.

12.Children's Privacy

12.1 The philaro Platform is strictly intended for individuals aged 21 years and above. philaro does not knowingly collect personal data from individuals under the age of 21. The minimum legal age for participation in real-money online gaming in the Philippines is 21 years, as prescribed under applicable PAGCOR regulations.

12.2 If philaro becomes aware that personal data has been collected from an individual under the age of 21, philaro will immediately suspend the associated account, delete the personal data in question, and report the matter to the relevant regulatory authorities where required by law.

12.3 If you are a parent or guardian and believe that a minor has registered on the philaro Platform, please contact philaro support immediately at the details provided in Section 15.

13.Cross-Border Data Transfers

13.1 philaro primarily stores and processes personal data within secure data center facilities. Where it is necessary to transfer personal data to service providers or partners located outside the Philippines — for example, to international game content providers or cloud infrastructure providers — philaro ensures that such transfers are conducted in compliance with the DPA and NPC regulations governing cross-border data flows.

13.2 philaro implements appropriate safeguards for cross-border transfers, which may include contractual clauses approved by the NPC, binding corporate rules, or transfers to jurisdictions that the NPC has recognized as providing an adequate level of data protection.

13.3 You may request information about the specific safeguards in place for any cross-border transfer of your personal data by contacting the philaro DPO.

14.Changes to This Privacy Policy

14.1 philaro reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The updated Policy will be published on the Platform with a revised effective date.

14.2 Where changes are material — meaning they significantly affect your rights or the way philaro processes your personal data — philaro will provide advance notice to registered players via email or in-Platform notification at least fourteen (14) days before the changes take effect.

14.3 Your continued use of the philaro Platform following the publication of an updated Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with any amendment, you may close your account in accordance with the philaro Terms & Conditions.

15.Contact & Data Protection Officer

15.1 If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by philaro, please contact our Data Protection Officer using the details below:

• Data Protection Officer: philaro DPO
• Email: [email protected]
• Response Time: philaro aims to acknowledge all privacy-related enquiries within 5 business days and to provide a substantive response within 30 calendar days.

15.2 If you are not satisfied with philaro's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. The NPC is the independent regulatory body responsible for administering and enforcing the Data Privacy Act of 2012 in the Philippines.

15.3 philaro is committed to working constructively with the NPC and with individual players to resolve any data privacy concerns promptly and fairly.