This Privacy Policy explains how phh22 collects, uses, stores, and protects your personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and the regulations of the National Privacy Commission (NPC).
phh22 processes personal data in full compliance with Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations as administered by the National Privacy Commission (NPC). A designated Data Protection Officer (DPO) oversees all personal data processing activities.
As a Philippine data subject, you hold legally enforceable rights over your personal data held by phh22 — including the rights to access, correction, erasure, data portability, and objection to processing. phh22 provides clear channels for exercising all of these rights, described in detail in this Policy.
All personal data transmitted between your device and phh22 servers is protected with 256-bit SSL/TLS encryption — the same standard used by major Philippine banks including BPI and BDO. Data at rest is stored on access-controlled, encrypted servers. phh22 maintains a documented data security incident response plan.
phh22 does not sell, rent, or trade your personal data to third-party marketers under any circumstances. Data sharing with third parties is limited strictly to what is necessary for platform operation, PAGCOR compliance, payment processing, and fraud prevention — all governed by data processing agreements and the scope described in this Policy.
phh22 retains personal data only for as long as necessary to fulfill the purposes described in this Policy, or as required by PAGCOR regulations and Philippine anti-money laundering law. Retention periods for each data category are set out in Section 6 of this Policy. Data no longer needed is securely deleted or anonymized.
In the event of a personal data security breach that is likely to result in serious harm to affected data subjects, phh22 will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected data subjects without undue delay in accordance with NPC Circular 16-03 and applicable NPC breach notification requirements.
Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights regarding your personal data held by phh22.
You have the right to obtain confirmation of whether phh22 holds personal data about you, and to receive a copy of that data in a readable format. Requests are fulfilled within 30 days of receipt.
You may request correction of inaccurate, incomplete, or outdated personal data held by phh22 at any time. You may update basic profile information directly from your Account settings, or contact the DPO for other data corrections.
You have the right to request deletion or blocking of your personal data where processing is unlawful, the data is no longer necessary, or you have withdrawn consent. Note that data required for PAGCOR compliance or legal obligations cannot be erased during applicable retention periods.
You have the right to object to phh22 processing your personal data for direct marketing, profiling, or any purpose where processing is based on legitimate interest rather than legal obligation. Objections will be assessed and honored unless phh22 has compelling legitimate grounds.
You have the right to receive personal data you have provided to phh22 in a structured, commonly used, machine-readable format, and to transmit that data to another controller where technically feasible. This right applies where processing is based on consent and is carried out by automated means.
If you believe phh22 has processed your personal data in breach of RA 10173, you have the right to lodge a complaint with the National Privacy Commission (NPC) through its official channels. phh22 encourages you to contact our DPO first to attempt resolution before escalating to the NPC.
This Privacy Policy ("Policy") is issued by phh22 ("phh22," "we," "us," or "our") and applies to all personal data collected, processed, stored, and disclosed by phh22 in connection with the operation of phh22.org and all associated services, including the online casino, sports betting platform, live dealer games, payment systems, customer support, and responsible gaming tools (collectively, the "Platform").
phh22 is committed to protecting the privacy and personal data of every individual who uses our Platform, visits our website, or interacts with our customer support team. This Policy is drafted in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, hereinafter "DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).
This Policy should be read alongside the phh22 Terms and Conditions, which govern the broader contractual relationship between phh22 and its users. In the event of any conflict between this Policy and the Terms and Conditions regarding privacy matters, this Policy shall prevail.
For the purposes of the Philippine Data Privacy Act, phh22 acts as the personal information controller (PIC) in respect of personal data collected through the Platform. phh22 determines the purposes and means of processing your personal data.
In instances where phh22 engages third-party service providers to process personal data on its behalf — such as payment processors, game studio analytics providers, or cloud hosting services — those providers act as personal information processors (PIPs) operating under written data processing agreements that require them to process data only on phh22's instructions and in compliance with the DPA.
phh22 collects personal data through several channels: the registration process, ongoing account activity, payment transactions, customer support interactions, KYC verification, and automated data collection through the Platform. The categories of data collected are as follows:
phh22 uses personal data collected through the Platform for the following specific purposes:
| Purpose | Data Categories Used | Legal Basis |
|---|---|---|
| Account creation and authentication | Registration data, device data | Contractual necessity |
| KYC identity verification (age and identity confirmation) | KYC documents, registration data | Legal obligation (PAGCOR, AMLA) |
| Processing deposits and withdrawals | Financial transaction data, KYC data | Contractual necessity |
| Providing gaming and betting services | Gaming activity data, wallet balance | Contractual necessity |
| Fraud detection and prevention | Transaction data, device data, IP address | Legitimate interest |
| Anti-money laundering compliance | Transaction data, KYC data, gaming activity | Legal obligation (RA 9160) |
| PAGCOR regulatory reporting | Transaction data, gaming activity, KYC data | Legal obligation (PAGCOR license) |
| Customer support and dispute resolution | Support data, account data, transaction data | Contractual necessity |
| Responsible gaming monitoring | Gaming activity, transaction data, session data | Legal obligation / legitimate interest |
| Platform security and abuse prevention | Device data, IP address, session data | Legitimate interest |
| Service communications (account notices, withdrawal confirmations) | Contact details, transaction data | Contractual necessity |
| Promotional communications (bonuses, offers) | Contact details, gaming preferences | Consent (opt-out available) |
Under the Philippine Data Privacy Act, phh22 relies on one or more of the following lawful bases for each processing activity:
phh22 retains personal data for no longer than necessary to fulfill the purposes for which it was collected, subject to applicable legal retention obligations. The following retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of account + 5 years after closure | PAGCOR compliance; AMLA |
| KYC identity documents | Duration of account + 5 years after closure | AMLA (RA 9160, Section 9) |
| Financial transaction records | 5 years from transaction date | AMLA; PAGCOR regulations |
| Gaming activity logs | 3 years from session date | PAGCOR compliance; dispute resolution |
| Customer support communications | 3 years from last interaction | Dispute resolution; legitimate interest |
| Self-exclusion records | Duration of exclusion + 5 years | Responsible gaming compliance |
| Technical / device logs | 90 days (rolling) | Security; fraud prevention |
| Marketing preference records | Until consent withdrawn + 12 months | Evidence of consent management |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymized such that it can no longer be associated with an identifiable individual. Where anonymized data is retained for analytical purposes, it is no longer considered personal data under the DPA.
phh22 does not sell, rent, or disclose your personal data to third parties for their own marketing purposes. phh22 may share your personal data with the following categories of recipients, strictly limited to what is necessary for the stated purpose:
phh22 engages third-party processors to provide services on phh22's behalf, including:
All third-party processors are bound by written agreements that prohibit them from using phh22 user data for any purpose other than the specific service they provide to phh22, and require them to implement appropriate security measures.
phh22 may disclose personal data to the following authorities where required by law or regulatory instruction:
In the event of a merger, acquisition, sale of assets, or other corporate restructuring that affects the phh22 platform, personal data held by phh22 may be transferred to the successor entity. In such circumstances, phh22 will notify affected users prior to any transfer and will ensure the successor entity is bound by privacy obligations no less protective than those in this Policy.
Some of phh22's third-party service providers — particularly game studio providers with server infrastructure outside the Philippines — may process personal data in countries other than the Philippines. When personal data is transferred outside the Philippines, phh22 ensures that such transfers are made in accordance with the DPA's requirements for cross-border data flows, including:
phh22 maintains a register of all cross-border data transfers and the safeguards applicable to each. Upon request, phh22 will provide further information about the specific safeguards in place for a particular transfer.
phh22 uses cookies and similar tracking technologies on phh22.org to support Platform functionality, maintain session security, and analyze usage patterns. The following categories of cookies are used:
phh22 does not use advertising or retargeting cookies that would track your activity across third-party websites for the purpose of serving advertisements.
You can manage cookie preferences through your browser settings. Blocking strictly necessary cookies will prevent you from using the Platform. Blocking other cookie categories may affect functionality but will not prevent access to phh22.org.
phh22 implements a layered set of technical and organizational security measures designed to protect personal data against unauthorized access, loss, destruction, or alteration. Key measures include:
phh22 strictly prohibits the use of its Platform by any person under the age of 21 years. This age threshold is set by PAGCOR regulation and is strictly enforced through mandatory KYC identity verification before withdrawal access is granted.
phh22 does not knowingly collect personal data from persons under the age of 21. If phh22 discovers that personal data has been collected from a person under 21 years of age, the Account will be immediately suspended, any balance will be reviewed in accordance with phh22's Terms and Conditions, and the personal data will be deleted or retained only as required by applicable legal obligations.
If you are a parent or legal guardian and have reason to believe that a person under 21 years of age has accessed phh22 using your details or otherwise, please contact phh22 support immediately via live chat or the DPO email address in Section 15.
To exercise any of the data subject rights described in this Policy and under the Philippine Data Privacy Act, you may submit a request through either of the following channels:
When submitting a data subject rights request, please provide:
phh22 aims to acknowledge requests within five (5) business days and to fulfill them within thirty (30) days of receipt. Complex or high-volume requests may take up to an additional thirty (30) days, with notice provided to you of the extension.
phh22 processes certain personal data specifically in the context of its responsible gaming obligations. This includes monitoring gaming activity patterns for indicators of problem gambling behavior, maintaining records of deposit limits and self-exclusion requests, and sharing relevant data with PAGCOR where required under the responsible gaming program.
Responsible gaming data — including self-exclusion records — is treated with heightened sensitivity. Access within phh22 is limited to the responsible gaming team and compliance officers. Responsible gaming records are retained for the periods set out in Section 6 of this Policy, as they may be required to enforce exclusion agreements and for PAGCOR reporting.
If you wish to exercise your data subject rights in relation to responsible gaming data, please note that erasure rights may be limited where retention is required by legal obligation or where the data is necessary to enforce a self-exclusion agreement that remains in effect. phh22 will explain the specific basis for any limitation at the time of your request. For full details of phh22's responsible gaming tools and resources, please visit the Responsible Gaming page.
phh22 reserves the right to amend this Privacy Policy at any time. When material amendments are made, phh22 will provide notice to registered users via:
The amended Policy will state the new effective date and will supersede prior versions from that date. phh22 will maintain archived versions of prior Policy versions, which are available upon request by contacting the DPO.
If you do not agree with a material amendment to this Policy, you have the right to close your Account and request deletion of your personal data (subject to applicable legal retention requirements) before the amended Policy takes effect. Continued use of the Platform after the effective date of an amended Policy constitutes acceptance of the amended terms.
The current version of this Privacy Policy is always accessible at phh22.org/privacy-policy.
For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by phh22, please contact phh22's designated Data Protection Officer through the following channels:
phh22 takes all data privacy enquiries seriously. Our DPO team aims to respond to all written privacy requests within five (5) business days of receipt.
phh22 is built on transparency — fair games, fair terms, and fair handling of your personal data. Join thousands of Filipino players who trust phh22 for PAGCOR-regulated online gaming with GCash and Maya withdrawals.