Privacy Policy — 69ph

This Privacy Policy ("Policy") is issued by 69ph ("the Platform," "we," "us," or "our") and applies to all personal information collected from individuals who: (a) register for and maintain a 69ph member account; (b) visit the 69ph website at https://69ph.bio; (c) interact with 69ph customer support; or (d) otherwise provide personal information to 69ph through any channel.

This Policy is designed to inform you — clearly and in plain language — about what personal data 69ph collects, why we collect it, how we use and protect it, with whom we share it, and what rights you have regarding your own information.

This Policy applies to personal data processed by 69ph in connection with the Philippine operations of the platform. It does not apply to third-party websites or services linked from the 69ph platform — those are governed by the privacy policies of the respective third parties.

For purposes of Republic Act 10173 and its Implementing Rules, 69ph is the Personal Information Controller (PIC) in respect of all personal data collected from members and visitors of the 69ph platform. As PIC, 69ph determines the purpose and means of processing your personal information and bears responsibility for ensuring that processing is carried out lawfully, fairly, and securely.

69ph has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with RA 10173 and this Policy, managing data subject rights requests, and serving as the primary contact point for the National Privacy Commission (NPC) and affected data subjects. The DPO's contact details are provided in Section 14 of this Policy.

69ph collects personal data through multiple channels — during the registration process, during ongoing account use, during identity verification, and through automated technical means. The categories of personal data collected are as follows:

69ph does not intentionally collect sensitive personal information (as defined by RA 10173) beyond what is strictly required for age verification (date of birth) and identity verification (government ID). Biometric data is not collected. Health information is not collected unless voluntarily provided in a responsible gaming context.

69ph processes your personal data only for specific, explicit, and legitimate purposes. We do not use your data in ways that are incompatible with the purposes for which it was collected. The primary purposes are:

• Account Registration & Management: Creating and maintaining your 69ph member account, verifying your identity and age (21+), and managing account settings.
• Service Delivery: Providing access to 69ph games — including Color Game, live casino, slots, bingo, and virtual sports — and processing related gaming transactions.
• Payment Processing: Processing deposits and withdrawals via GCash, Maya, BPI, BDO, Metrobank, and other accepted Philippine payment channels; reconciling financial transactions; detecting payment fraud.
• Regulatory Compliance: Meeting obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160 as amended), the Data Privacy Act (RA 10173), and all applicable Philippine laws.
• Customer Support: Responding to member inquiries, resolving disputes, processing account requests, and escalating responsible gaming concerns.
• Responsible Gaming: Monitoring gaming behavior for indicators of problem gambling; enforcing deposit limits, loss limits, and self-exclusion requests; age verification enforcement.
• Security & Fraud Prevention: Detecting, investigating, and preventing unauthorized account access, fraudulent transactions, multi-accounting, bonus abuse, and other prohibited conduct.
• Marketing Communications (with consent): Sending promotional offers, bonus notifications, and 69ph news to members who have not opted out. You may withdraw consent for marketing at any time.
• Platform Improvement: Analyzing aggregated and anonymized usage data to improve the 69ph platform, user experience, and game library.

Under RA 10173, personal data may only be processed if at least one lawful basis applies. 69ph relies on the following legal bases for processing your personal data:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and 69ph (i.e., the Terms & Conditions). This covers account creation, gameplay, payment processing, and customer support.
• Legal Obligation: Processing is required to comply with applicable laws, including PAGCOR licensing conditions, AMLA obligations, and NPC registration requirements.
• Legitimate Interests: Processing is necessary for 69ph's legitimate interests — including fraud prevention, security monitoring, and platform improvement — provided those interests do not override your fundamental rights and freedoms.
• Consent: For optional processing activities such as marketing communications, 69ph relies on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

69ph shares personal data with third parties only where strictly necessary and lawful. We do not sell personal data. The following categories of recipients may receive your personal data:

• Payment Processors: GCash (Mynt/Globe Fintech Innovations), Maya (PayMaya Philippines), BPI, BDO, Metrobank, and other approved Philippine payment service providers — for the sole purpose of processing your deposits and withdrawals.
• Gaming Software Providers: Certified game providers (e.g., Pragmatic Play, Evolution, PG Soft, Jili) — who receive the minimum data necessary to deliver their games within the 69ph platform under data processing agreements that bind them to confidentiality and security standards.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and law enforcement authorities — where 69ph is legally required to report or disclose information.
• KYC/Identity Verification Providers: Third-party identity verification services that assist 69ph in verifying the age and identity of members.
• IT Infrastructure Providers: Cloud hosting and infrastructure providers who process data on 69ph's behalf under strict data processing agreements and are contractually prohibited from using the data for their own purposes.

All third-party processors engaged by 69ph are required to process personal data only in accordance with 69ph's instructions and to maintain security measures commensurate with the sensitivity of the data they process. 69ph conducts periodic due diligence on its processors' data protection practices.

69ph retains personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable law. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that permanently prevents re-identification. Anonymized statistical data may be retained indefinitely for analytics purposes.

69ph implements appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Key security measures in place include:

• Encryption: 256-bit SSL/TLS encryption for all data in transit; AES-256 encryption for sensitive data at rest (including financial credentials and ID documents).
• Access Controls: Role-based access control (RBAC) limiting employee access to personal data on a strict need-to-know basis; privileged access logs maintained and reviewed regularly.
• Two-Factor Authentication: SMS OTP-based 2FA for all member accounts and for 69ph administrative systems accessing personal data.
• Infrastructure Security: Regular penetration testing, vulnerability assessments, and security audits of 69ph systems; web application firewall (WAF) and DDoS protection.
• Incident Response: A documented Personal Data Breach Response Plan in compliance with NPC Circular 16-03. In the event of a breach likely to cause significant harm to data subjects, 69ph will notify affected individuals and the NPC within 72 hours of discovery.
• Staff Training: All 69ph personnel with access to personal data receive mandatory data privacy training upon onboarding and annually thereafter.

69ph uses cookies and similar tracking technologies to operate the platform, maintain your login session, remember your preferences, analyze platform performance, and detect fraud. The following types of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Remember your preferences such as language settings, last game played, and display preferences. These improve your experience but are not essential.
• Analytics Cookies: Collect anonymized or pseudonymized data about how members use the platform — which pages are visited, session duration, and navigation paths — to help 69ph improve the service.
• Security Cookies: Detect and prevent fraudulent login attempts, multi-accounting, and other prohibited activity by fingerprinting device and session characteristics.

69ph does not use third-party advertising or tracking cookies to serve targeted advertisements outside of the 69ph platform. Cookies are not used to build advertising profiles or to track your activity on other websites.

You may configure your browser to refuse cookies or to alert you when cookies are being sent. Note that disabling strictly necessary cookies will prevent you from logging in to your 69ph account. Your continued use of the 69ph platform after reviewing this Policy constitutes consent to the use of cookies as described above.

Under Republic Act 10173, you have the following rights regarding your personal data held by 69ph. These rights may be exercised by contacting the 69ph Data Protection Officer as described in Section 14:

• Right to be Informed: You have the right to know what personal data 69ph holds about you, how it is used, and with whom it is shared — which is the purpose of this Policy.
• Right of Access: You may request a copy of the personal data 69ph holds about you at any time. We will respond within 15 business days of a verified request.
• Right to Rectification: If any personal data we hold is inaccurate or incomplete, you may request correction. Identity data corrections require supporting documentation.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data. Note that this right is subject to overriding legal obligations — data required for AMLA compliance, PAGCOR records, or active dispute resolution cannot be deleted.
• Right to Object: You may object to processing of your personal data for direct marketing at any time, with immediate effect. Objecting to processing on other grounds will be assessed case-by-case.
• Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format for transfer to another controller, where technically feasible.
• Right to File a Complaint: If you believe 69ph has violated your data privacy rights, you may lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

69ph's services are strictly intended for persons aged 21 years and above, as required by applicable Philippine gaming regulations. 69ph does not knowingly collect personal data from individuals under the age of 21.

If 69ph discovers or has reason to believe that personal data has been collected from a person under 21 years of age, the relevant account will be immediately suspended, all collected personal data will be deleted in accordance with this Policy (except where mandatory legal retention applies), and the matter will be handled in compliance with PAGCOR regulations.

If you believe that a person under the age of 21 has registered with 69ph, please contact our Data Protection Officer immediately using the details provided in Section 14. 69ph takes underage gambling prevention extremely seriously and will act swiftly on all such reports.

Some of 69ph's service providers and technology partners operate outside of the Philippines. Where personal data is transferred to a recipient in a foreign country, 69ph ensures that adequate safeguards are in place in accordance with NPC guidelines on cross-border data transfers (NPC Circular 2023-04).

Safeguards employed for cross-border transfers include: (a) binding corporate rules where transfers are within a corporate group; (b) data processing agreements incorporating NPC-approved standard contractual clauses; and (c) transfers to countries with an NPC adequacy finding. No personal data is transferred to countries or organizations that cannot provide an adequate level of protection equivalent to RA 10173 standards.

Certified gaming software providers who receive game session data (such as Pragmatic Play and Evolution) operate under data processing agreements that comply with both RA 10173 and the applicable data protection laws of their respective jurisdictions (typically GDPR and MGA standards, which are recognized as providing adequate protection).

69ph may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory guidance from the National Privacy Commission. When material changes are made, 69ph will notify registered members by SMS to their registered Philippine mobile number at least 7 days before the changes take effect.

The "Last updated" date at the top of this Policy reflects the date of the most recent revision. We encourage you to review this Policy periodically. The most current version is always accessible at https://69ph.bio/privacy-policy. Your continued use of 69ph's services after the effective date of any revision constitutes acceptance of the updated Policy.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data rights, you may contact 69ph's Data Protection Officer (DPO) or our general support team using the details below.

If you are not satisfied with 69ph's response to a privacy concern, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Republic of the Philippines. The NPC's complaint procedures are publicly available on the NPC's official website.