phalaro Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how phalaro ("phalaro," "we," "us," or "our") collects, uses, stores, discloses, and protects the personal information of individuals ("you," "your," or "Player") who access or use the phalaro online casino platform available at phalaro.net and any associated mobile-optimized interfaces (collectively, the "Platform").

phalaro is committed to protecting the privacy and security of your personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and all relevant issuances of the National Privacy Commission (NPC). This Policy applies to all personal data collected through your use of the Platform, including during registration, gameplay, financial transactions, customer support interactions, and marketing communications.

This Policy should be read together with phalaro's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated herein by reference. Where there is any conflict between this Policy and those documents on matters of data privacy, this Policy shall prevail.

2. Data Controller Information

For the purposes of the Philippine Data Privacy Act of 2012, phalaro acts as the Personal Information Controller (PIC) in respect of the personal data it collects and processes through the Platform. As a PIC, phalaro determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

phalaro has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data privacy laws. Contact details for the DPO are provided in Section 14 of this Policy. You may contact the DPO at any time with questions, concerns, or requests relating to your personal data.

phalaro is registered with the National Privacy Commission as required for personal information controllers processing personal data of Philippine residents.

3. Personal Data We Collect

phalaro collects the following categories of personal data in connection with your use of the Platform:

phalaro does not intentionally collect sensitive personal information (as defined under RA 10173) beyond what is strictly necessary for KYC compliance and responsible gaming obligations. Where sensitive personal information is collected, it is processed with the highest level of care and security.

4. How We Collect Your Data

phalaro collects personal data through the following means:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated technologies: Data collected automatically when you access the Platform, including through cookies, web beacons, server logs, and similar tracking technologies. This includes your IP address, device identifiers, and browsing behavior on the Platform.
• Third-party sources: Data received from identity verification service providers, payment processors (e.g., GCash, Maya), fraud prevention agencies, and regulatory bodies where permitted by law.
• KYC and compliance providers: Data obtained through third-party identity verification platforms used to confirm your identity and age in compliance with PAGCOR regulations and Philippine anti-money laundering laws.

5. Purpose & Legal Basis for Processing

phalaro processes your personal data for the following purposes, each supported by a lawful basis under the Data Privacy Act of 2012:

Where phalaro relies on your consent as the legal basis for processing (e.g., for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent, contact our support team or update your communication preferences in your account settings.

6. Sharing Your Personal Data

phalaro does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment processors and financial institutions: GCash, Maya/PayMaya, and Philippine banks (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank) for the purpose of processing your deposits and withdrawals.
• Identity verification providers: Third-party KYC and age verification service providers engaged by phalaro to confirm your identity and comply with regulatory requirements.
• Fraud prevention and security providers: Service providers that assist phalaro in detecting and preventing fraudulent activity, money laundering, and other illegal conduct on the Platform.
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities, where disclosure is required by law or regulatory obligation.
• IT and platform service providers: Cloud hosting providers, software vendors, and technical support providers who process data on phalaro's behalf under strict data processing agreements.
• Professional advisers: Lawyers, auditors, and accountants where necessary for legal compliance, dispute resolution, or business operations.

All third parties with whom phalaro shares personal data are required to maintain appropriate technical and organizational security measures and to process your data only in accordance with phalaro's instructions and applicable Philippine data privacy law.

7. Cookies & Tracking Technologies

phalaro uses cookies and similar tracking technologies (such as web beacons and pixel tags) on the Platform. Cookies are small text files placed on your device that help us recognize you, remember your preferences, and improve your experience on the Platform.

phalaro uses the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function correctly. These include session management, security tokens, and authentication cookies. These cannot be disabled without affecting Platform functionality.
• Performance and analytics cookies: Used to collect anonymized information about how players use the Platform, such as which pages are visited most frequently and how long sessions last. This data helps phalaro improve the Platform experience.
• Functional cookies: Used to remember your preferences, such as language settings and display options, to provide a more personalized experience.
• Marketing cookies: Used to deliver relevant promotional content to you based on your interests and Platform activity. These are only activated with your explicit consent.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. For more information on managing cookies in your browser, refer to your browser's help documentation.

8. Data Retention

phalaro retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and regulatory obligations. The following general retention periods apply:

• Account and KYC data: Retained for a minimum of five (5) years from the date of account closure, in compliance with the Anti-Money Laundering Act of 2001 (RA 9160, as amended) and PAGCOR record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required by Philippine financial regulations.
• Customer support communications: Retained for three (3) years from the date of the last interaction, for dispute resolution and quality assurance purposes.
• Marketing data: Retained until you withdraw your consent to receive marketing communications, after which it will be deleted or anonymized within a reasonable timeframe.
• Technical and log data: Retained for up to twelve (12) months for security monitoring and fraud prevention purposes.

Upon expiry of the applicable retention period, phalaro will securely delete or anonymize your personal data in accordance with its data disposal procedures, unless further retention is required by a specific legal obligation or ongoing regulatory investigation.

9. Data Security

phalaro implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the Platform.
• Encryption of sensitive data at rest, including financial data and KYC documents.
• Role-based access controls limiting access to personal data to authorized personnel only.
• Regular security assessments, penetration testing, and vulnerability scanning of Platform infrastructure.
• Multi-factor authentication requirements for administrative access to systems containing personal data.
• Staff training on data privacy obligations and security best practices.
• Incident response procedures for detecting, reporting, and managing personal data breaches in accordance with NPC notification requirements.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, phalaro will notify the National Privacy Commission and, where required, affected individuals within the timeframes prescribed by the Data Privacy Act of 2012 and NPC regulations.

While phalaro takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. You are responsible for maintaining the security of your phalaro account credentials and for notifying phalaro immediately if you suspect unauthorized access to your account.

10. Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phalaro. To exercise any of these rights, please contact our Data Protection Officer using the details in Section 14.

• Right to be Informed: You have the right to be informed of how your personal data is being collected and processed, including the purposes, scope, and methods of processing.
• Right to Access: You have the right to request a copy of the personal data phalaro holds about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate, incomplete, or outdated personal data phalaro holds about you.
• Right to Erasure or Blocking: You have the right to request the deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, or where processing is unlawful, subject to phalaro's legal retention obligations.
• Right to Object: You have the right to object to the processing of your personal data, including for direct marketing purposes. Where you object to processing for direct marketing, phalaro will cease such processing immediately.
• Right to Data Portability: You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another personal information controller where technically feasible.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe that phalaro has violated your data privacy rights. The NPC can be contacted through its official website at privacy.gov.ph.

phalaro will respond to all data subject rights requests within fifteen (15) business days of receipt, in accordance with NPC guidelines. In complex cases, this period may be extended by a further fifteen (15) business days, with prior notification to you.

11. Children's Privacy & Age Restriction

The phalaro Platform is strictly intended for individuals who are 21 years of age or older, in accordance with Philippine law and PAGCOR regulations governing online gambling. phalaro does not knowingly collect personal data from individuals under the age of 21.

phalaro employs age verification measures at the point of registration and during KYC verification to prevent minors from accessing the Platform. Where phalaro discovers or has reasonable grounds to believe that personal data has been collected from an individual under 21 years of age, phalaro will immediately suspend the relevant account, delete the associated personal data, and report the matter to the appropriate regulatory authorities where required.

If you are a parent or guardian and believe that a minor in your care has registered on the phalaro Platform, please contact our support team immediately using the contact details in Section 14.

12. Cross-Border Data Transfers

phalaro's primary operations and data storage infrastructure are based in the Philippines. However, in the course of providing the Platform and its associated services, your personal data may be transferred to, stored in, or processed by service providers located outside the Philippines — for example, cloud infrastructure providers or international fraud prevention services.

Where such cross-border transfers occur, phalaro ensures that appropriate safeguards are in place to protect your personal data, in accordance with Section 21 of the Data Privacy Act of 2012 and NPC guidelines on cross-border data transfers. These safeguards may include contractual clauses requiring the recipient to apply data protection standards equivalent to those required under Philippine law.

By using the phalaro Platform, you acknowledge and consent to the transfer of your personal data outside the Philippines where necessary for the purposes described in this Policy, subject to the safeguards described above.

13. Updates to This Privacy Policy

phalaro reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The date of the most recent revision is indicated at the top of this page.

Where changes to this Policy are material, phalaro will notify registered players via email or an in-platform notification prior to the changes taking effect. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgment of the revised Policy.

We encourage you to review this Policy periodically to stay informed about how phalaro protects your personal data. If you have any questions about changes to this Policy, please contact our Data Protection Officer.

14. Contact Us & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by phalaro, please contact our Data Protection Officer through the following channels:

phalaro aims to acknowledge all privacy-related requests within 48 hours and to provide a substantive response within 15 business days. For urgent data security concerns, please use the live chat channel for the fastest response.