phcrown Privacy Policy

01 About This Policy

This Privacy Policy ("Policy") describes how phcrown ("phcrown", "we", "us", "our") — the operator of the phcrown online casino and sports betting platform accessible at phcrown.bio — collects, uses, stores, discloses, and protects personal data relating to registered members and visitors ("you", "your") in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC) of the Philippines.

This Policy applies to all personal data processed by phcrown in connection with your use of the phcrown website, mobile interface, games, sports betting markets, and all associated services (collectively, the "Platform"). It should be read alongside the phcrown Terms & Conditions, which together form the full contractual and regulatory framework governing your phcrown membership.

By registering a phcrown account or by continuing to use the Platform after this Policy becomes effective, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not consent, you must discontinue use of the phcrown Platform immediately.

02 Data We Collect

2.1 Data You Provide Directly

When you register a phcrown account, complete KYC verification, make a deposit or withdrawal, contact our support team, or participate in a promotion, you directly provide us with personal data. This includes your full legal name, date of birth, email address, Philippine mobile number, residential address, and copies of your government-issued Philippine identification documents such as your passport, driver's license, PhilSys National ID, or UMID.

2.2 Data Collected Automatically

When you access the phcrown Platform, certain technical data is collected automatically through standard web technologies. This includes your IP address, browser type and version, operating system, device identifiers, session start and end times, pages visited within the Platform, and game or betting activity logs. This data is collected primarily for security, fraud prevention, and platform performance purposes.

2.3 Data from Payment Providers

When you make a deposit or request a withdrawal via GCash, Maya, BPI, BDO, UnionBank, GrabPay, 7-Eleven CLiQQ, Coins.ph, or USDT TRC20, phcrown receives transaction reference data from those payment providers. We do not store complete payment credentials — your GCash PIN, bank account password, or card number is never transmitted to or stored by phcrown directly.

2.4 Data from Third-Party Verification Services

As part of our KYC and AML compliance obligations under PAGCOR regulations and the Philippine Anti-Money Laundering Act, phcrown may use licensed third-party identity verification services to cross-reference the information you provide during registration against authoritative data sources. The results of such checks are stored as part of your compliance record.

03 How We Use Your Data

phcrown uses the personal data we collect for the following documented purposes:

• Account Management: Creating, maintaining, and securing your phcrown account, including password resets, two-factor authentication, and account recovery.
• Identity Verification (KYC): Verifying that you meet the 21+ age requirement and confirming your identity as required under PAGCOR regulations before processing your first withdrawal.
• Payment Processing: Facilitating deposits from and withdrawals to your preferred Philippine payment method, and maintaining transaction records as required by law.
• AML Compliance: Monitoring transaction patterns for indicators of money laundering or other financial crime as required under Republic Act No. 9160 (Anti-Money Laundering Act) and PAGCOR directives. Filing suspicious transaction reports with the Anti-Money Laundering Council (AMLC) where legally required.
• Responsible Gaming: Monitoring your gaming activity for indicators of problem gambling behavior, administering deposit limits, loss limits, self-exclusion requests, and session time controls that you set or that phcrown activates based on responsible gaming obligations.
• Customer Support: Responding to your inquiries, resolving disputes, and managing complaints through our live chat and email support channels.
• Platform Security: Detecting and preventing fraud, unauthorized account access, bonus abuse, and other prohibited conduct as defined in the phcrown Terms & Conditions.
• Promotions and Marketing: Sending you promotional offers, bonus notifications, and event announcements by email or in-platform message — but only where you have provided your consent or where we have a legitimate interest in doing so. You may opt out of marketing communications at any time.
• Legal and Regulatory Compliance: Fulfilling our obligations under Philippine law, PAGCOR regulations, and any lawful orders from competent government authorities.

04 Legal Bases for Processing

Under the Philippine Data Privacy Act, phcrown must have a lawful basis for each category of personal data processing. The primary legal bases we rely on are:

• Contractual Necessity: Processing that is required to perform the phcrown membership agreement with you — including account creation, payment processing, and game access.
• Legal Obligation: Processing required to comply with Philippine laws, including the Data Privacy Act, AMLA, and PAGCOR licensing conditions — such as KYC verification, AML monitoring, and regulatory record retention.
• Legitimate Interest: Processing for phcrown's legitimate business interests where those interests are not overridden by your data protection rights — such as fraud detection, platform security, and responsible gaming monitoring.
• Consent: Where we rely on your consent as the legal basis for processing — particularly for optional marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

05 Data Sharing & Disclosure

5.1 Third-Party Service Providers

phcrown shares personal data with carefully selected third-party service providers who assist us in operating the Platform. These include payment gateway operators (such as the operators of GCash, Maya, and other accepted payment channels), identity verification and KYC service providers, cloud hosting infrastructure providers, game software providers, and fraud prevention technology vendors. All third-party processors engaged by phcrown are contractually required to process personal data only for the specific purposes authorized by phcrown and to maintain security standards consistent with this Policy.

5.2 Regulatory Authorities

phcrown is required by Philippine law to share certain player data with regulatory and law enforcement authorities in specific circumstances. This includes disclosures to PAGCOR as part of our licensing obligations, disclosures to the Anti-Money Laundering Council (AMLC) in connection with suspicious transaction reports, and disclosures to the National Privacy Commission in the event of a notifiable data breach. phcrown will comply with all lawful orders from competent Philippine authorities requiring disclosure of personal data.

5.3 No Sale of Personal Data

phcrown does not sell, rent, or trade your personal data to any third party for marketing, advertising, or commercial purposes. Any sharing of personal data is strictly limited to what is necessary for the purposes described in this Policy or required by law.

5.4 Business Transfers

In the event that phcrown undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, personal data held by phcrown may be transferred to the acquiring entity as part of that transaction. In such circumstances, phcrown will notify affected members via their registered email address and provide information about the privacy practices of the acquiring entity prior to the transfer taking effect.

06 Cookies & Tracking Technologies

The phcrown Platform uses cookies and similar tracking technologies to enable core platform functionality, maintain your login session, remember your preferences, and analyze how the Platform is used. The categories of cookies used are:

• Strictly Necessary Cookies: Required for the Platform to function — including session authentication cookies that keep you logged in, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your preferences such as language settings, preferred payment method, and responsible gaming tool configurations.
• Analytics Cookies: Collect anonymized data about how players navigate the Platform, which pages are most visited, and where users encounter issues — used to improve the phcrown experience. No personally identifiable information is transmitted via analytics cookies.
• Security Cookies: Used by phcrown's fraud detection systems to identify patterns associated with unauthorized account access or automated bot activity.

You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to use the phcrown Platform. phcrown does not use third-party advertising or retargeting cookies.

07 Data Retention

phcrown retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. Key retention periods are as follows:

• Account Data: Retained for the duration of your active phcrown membership plus five (5) years following account closure, as required by PAGCOR and AMLA record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years following your last transaction on the Platform, in compliance with AMLA implementing rules.
• Transaction Records: Retained for five (5) years from the date of each transaction, consistent with AMLA requirements.
• Support and Dispute Records: Retained for three (3) years from the date of resolution, to support any subsequent regulatory inquiries or legal proceedings.
• Technical and Log Data: Retained for twelve (12) months from collection for security and fraud monitoring purposes, after which it is anonymized or deleted.

When personal data is no longer required and no legal retention obligation applies, phcrown will securely delete or irreversibly anonymize it in accordance with our internal data lifecycle management procedures.

08 Data Security

phcrown implements a layered set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Key security measures include:

• TLS 1.3 encryption for all data in transit between your device and phcrown servers.
• AES-256 encryption at rest for sensitive personal data stored in phcrown databases, including KYC documents and payment reference data.
• Role-based access controls (RBAC) ensuring that only personnel with a documented business need can access specific categories of personal data.
• Multi-factor authentication (MFA) enforced for all phcrown staff accessing systems that process personal data.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Comprehensive audit logging of all access to personal data, reviewed regularly by our security team.
• Incident response procedures aligned with the NPC's 72-hour breach notification requirement under the Data Privacy Act.

09 Your Privacy Rights

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules, every phcrown member has the following rights with respect to their personal data:

• Right to Be Informed: The right to be told what personal data phcrown collects, how it is used, and with whom it is shared — as provided in this Privacy Policy.
• Right to Access: The right to request a copy of the personal data phcrown holds about you, including information about the sources of that data and the purposes for which it is processed.
• Right to Correction: The right to request correction of any inaccurate, incomplete, or outdated personal data in your phcrown account. You may update many details directly through your account settings; for others, contact our Data Protection Officer.
• Right to Erasure / Right to be Forgotten: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations such as those imposed by AMLA and PAGCOR regulations.
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interest, subject to phcrown's ability to demonstrate compelling legitimate grounds.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Damages: The right to be indemnified for any damages sustained as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data, in accordance with the DPA.
• Right to File a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) at privacy.gov.ph if you believe phcrown has processed your personal data in violation of the Data Privacy Act.

To exercise any of the above rights, please submit a written request to the phcrown Data Protection Officer using the contact details in Section 13. phcrown will acknowledge your request within three (3) business days and respond substantively within thirty (30) calendar days, or within such extended period as permitted by the NPC where the request is complex or voluminous.

10 Children & Minors

The phcrown Platform is strictly intended for individuals who are twenty-one (21) years of age or older, in compliance with PAGCOR's age restriction requirements for online gaming in the Philippines. phcrown does not knowingly collect personal data from individuals under the age of 21.

If phcrown discovers or has reasonable grounds to believe that a registered account belongs to a person under the age of 21, phcrown will immediately suspend the account, initiate identity verification procedures, and where the minor status is confirmed, permanently close the account and delete any associated personal data to the extent not required to be retained for regulatory compliance purposes. Any winnings accrued during a period when the age restriction was violated may be forfeited in accordance with the phcrown Terms & Conditions.

If you are a parent or guardian and believe that your child has registered a phcrown account, please contact our Data Protection Officer immediately using the contact details provided in Section 13 so that the matter can be addressed without delay.

11 International Data Transfers

phcrown's primary data processing operations are conducted within the Philippines. However, certain third-party service providers that phcrown engages — such as cloud infrastructure providers, game software vendors, and KYC verification platforms — may process personal data in jurisdictions outside the Philippines as part of their service delivery.

Where personal data is transferred outside the Philippines, phcrown ensures that appropriate safeguards are in place to protect that data to a standard equivalent to Philippine DPA requirements. These safeguards may include contractual data processing agreements incorporating the standard contractual clauses recognized by the National Privacy Commission, or transfer to jurisdictions that have been assessed as providing an adequate level of data protection.

phcrown does not transfer personal data to countries that the NPC has identified as lacking adequate data protection frameworks without implementing the contractual safeguards described above.

12 Changes to This Policy

phcrown reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, NPC guidance, or PAGCOR regulatory requirements. When we make material changes to this Policy, we will notify you by posting a prominent notice on the phcrown Platform and, where we hold a valid email address for you, by sending a notification to your registered email address at least fourteen (14) days before the changes take effect.

The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision. We encourage you to review this Policy periodically to stay informed about how phcrown protects your personal data. Your continued use of the phcrown Platform after a revised Policy becomes effective constitutes your acceptance of the updated terms.

Where changes to this Policy require your fresh consent under the Data Privacy Act — for example, where we introduce a new purpose for processing that is materially different from those described in the version you originally consented to — we will seek that consent explicitly before proceeding with the new processing activity.

13 Contact & Data Protection Officer

phcrown has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the Philippine Data Privacy Act and this Privacy Policy. If you have any questions, concerns, or requests relating to your personal data or this Policy, please contact our DPO using the details below:

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines if you believe that phcrown has processed your personal data in violation of the Data Privacy Act. The NPC can be reached through its official website at privacy.gov.ph (please visit the NPC website directly — phcrown is not affiliated with and cannot provide a link to the NPC).