39ph Privacy Policy

For the purposes of this Privacy Policy, the data controller is the operator of the 39ph Platform, accessible at https://39ph.asia (hereinafter referred to as "39ph," "we," "us," or "our"). 39ph is the entity responsible for deciding how and why your personal data is collected and processed in connection with the gaming services offered on the Platform.

39ph operates in compliance with the Philippine Amusement and Gaming Corporation (PAGCOR) regulatory framework and the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations issued by the National Privacy Commission (NPC).

This Privacy Policy applies to all personal data collected by 39ph in connection with:

• Registration and maintenance of your 39ph Account;
• Use of any game, feature, promotion, or service on the Platform;
• Financial transactions including deposits and withdrawals;
• Communications between you and 39ph's support team;
• Your use of the 39ph website, including passive data collected through cookies and analytics tools.

This Policy applies to all 39ph users, including registered Account holders and unregistered visitors to the Platform. It applies regardless of the device, browser, or network used to access 39ph.

This Policy should be read alongside the 39ph Terms & Conditions, which govern the overall contractual relationship between you and 39ph.

39ph collects the following categories of personal data in connection with the operation of the Platform:

39ph does not knowingly collect sensitive personal information as defined under RA 10173 (such as racial or ethnic origin, health information, religious affiliation, or political views) except where strictly required for regulatory compliance (e.g., responsible gaming assessments or AML investigations). Where such data must be collected, specific consent will be sought.

39ph collects personal data through the following means:

• Directly from you — when you complete the Account registration form, submit KYC documents, initiate a deposit or withdrawal, contact support, or update your Account profile;
• Automatically — when you use the Platform, our systems automatically collect technical data including your IP address, device identifiers, browser type, session duration, pages visited, and cookie data (see Section 7);
• From payment service providers — when you make a deposit or withdrawal via GCash, PayMaya, BPI, BDO, Metrobank, or another approved payment channel, the relevant provider may share transaction reference data with 39ph to confirm the transaction status;
• From identity verification services — where 39ph uses a third-party KYC provider to validate government-issued ID documents, that provider may return verification outcome data to 39ph;
• From regulatory and law enforcement bodies — where required by applicable Philippine law, 39ph may receive or be required to share data with PAGCOR, the Anti-Money Laundering Council (AMLC), or other competent authorities.

Under the Data Privacy Act of 2012, 39ph must have a lawful basis for each processing activity. The table below sets out the primary purposes for which 39ph processes your personal data and the corresponding legal basis.

Where 39ph relies on consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent for marketing communications, update your preferences in Account Settings or contact support.

39ph may share your personal data with the following categories of third parties:

• Game software providers (e.g., Evolution Gaming, Pragmatic Play, PG Soft and others) — limited to session identifiers and wallet transaction data required to deliver and authenticate game sessions. These providers operate under their own privacy frameworks and are contractually bound to process your data only as directed by 39ph.
• Payment service providers (GCash, PayMaya, BPI, BDO, Metrobank, and approved cryptocurrency processors) — transaction reference data shared for the sole purpose of processing deposits and withdrawals.
• KYC and identity verification providers — identity document data shared for the purpose of verifying your age and identity as required by PAGCOR regulations.
• IT and infrastructure providers — hosting, database, and cybersecurity providers who process data on behalf of 39ph under strict data processing agreements.
• Regulatory and law enforcement authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, Philippine courts, or any competent authority, where 39ph is required to disclose data by law, court order, or regulatory directive.
• Professional advisers — lawyers, auditors, and accountants retained by 39ph, subject to professional confidentiality obligations.

In the event of a merger, acquisition, or sale of all or substantially all of 39ph's assets, your personal data may be transferred to the acquiring entity, provided that the acquirer agrees to process the data in accordance with this Privacy Policy and applicable Philippine law.

39ph uses cookies and similar tracking technologies on the Platform to improve performance, personalise your experience, and gather analytics data. A cookie is a small text file placed on your device by a web server when you visit a website.

39ph uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include session authentication cookies and security tokens. These cannot be disabled without breaking core Platform functionality.
• Performance & Analytics Cookies: Used to collect aggregated, anonymised data about how users interact with the Platform — which pages are visited most, how long sessions last, and where users navigate from. This data helps 39ph improve the Platform.
• Functional Cookies: Store your preferences such as language, display settings, and responsible gaming tool configurations so they persist between sessions.
• Marketing Cookies: Used to deliver relevant promotional content within the Platform. These are only placed with your consent and can be disabled in your browser or via the cookie preferences panel.

You can manage cookie preferences through your browser settings. Blocking certain categories of cookies may affect Platform functionality. Clearing cookies will log you out of the Platform.

39ph implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction:

• All data transmitted between your device and 39ph servers is encrypted via 256-bit SSL/TLS;
• Passwords are stored as one-way cryptographic hashes using modern hashing algorithms; plaintext passwords are never stored;
• Access to personal data within 39ph's organisation is restricted to personnel who require it for legitimate operational purposes, under the principle of least privilege;
• Two-Factor Authentication (2FA) is available to all Account holders and is strongly recommended;
• Automated systems monitor for anomalous login patterns, unusual transaction behaviour, and attempted intrusions;
• Security patches and updates are applied on a regular cycle.

While 39ph takes all reasonable steps to protect your data, no internet transmission or electronic storage system is completely impenetrable. In the event of a personal data breach that poses a real risk to your rights and freedoms, 39ph will notify affected users and the National Privacy Commission within 72 hours of becoming aware of the breach, in accordance with NPC Circular 16-03.

39ph retains personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required or permitted by applicable Philippine law. The following general retention periods apply:

• Active Account data: Retained for the duration of your Account relationship with 39ph and for a period of five (5) years following Account closure, to comply with PAGCOR reporting obligations, anti-money laundering record-keeping requirements under RA 9160, and tax regulations.
• KYC documents: Retained for five (5) years from the date of submission or Account closure, whichever is later, as required under AMLC regulations.
• Financial transaction records: Retained for five (5) years from the date of each transaction.
• Support communications: Retained for two (2) years from the date of the last interaction, or longer where required for dispute resolution.
• Marketing preference records: Retained until you withdraw consent or close your Account, plus one (1) year to demonstrate consent compliance.
• Technical and analytics data: Retained in anonymised or aggregated form indefinitely; identifiable technical data (e.g., IP logs) retained for thirteen (13) months.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked back to you.

Under the Data Privacy Act of 2012 and NPC implementing regulations, you have the following rights with respect to your personal data held by 39ph:

• Right to Access: You may request a copy of the personal data 39ph holds about you, the purposes for which it is processed, and the categories of recipients to whom it has been disclosed.
• Right to Rectification: You may request correction of any personal data that is inaccurate or incomplete. For basic profile data, you can update information directly in Account Settings.
• Right to Erasure (Right to be Forgotten): You may request deletion of your personal data. Note that 39ph may be required by law to retain certain data (e.g., AML records) even after a deletion request, in which case processing will be restricted to those mandatory purposes only.
• Right to Object: You may object to processing based on legitimate interest, including direct marketing. Where you object to marketing, 39ph will cease that processing immediately.
• Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format (e.g., CSV or JSON) for transfer to another service provider.
• Right to Block or Restrict Processing: You may request restriction of processing in certain circumstances, such as while a rectification request is being assessed.
• Right to Complain: If you believe 39ph has processed your data in breach of the Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any of these rights, submit a request to 39ph's Data Protection Officer (DPO) via the contact details in Section 15. 39ph will respond within fifteen (15) business days of receiving a complete and properly verified request, in accordance with NPC guidelines.

The Platform is not directed at, nor intended to be used by, any person under the age of twenty-one (21) years, consistent with PAGCOR regulations governing casino-style online gambling in the Philippines. Age verification is a mandatory step in the 39ph KYC process.

If a parent or guardian believes that their child under 21 has provided personal data to 39ph, please contact the DPO immediately using the details in Section 15. 39ph will take prompt action to verify the situation and, where confirmed, delete the minor's data from its systems and close any associated Account.

Certain service providers used by 39ph — including game studios, cloud infrastructure providers, and analytics platforms — may process data outside the Philippines. Where personal data is transferred to entities in other countries, 39ph ensures that appropriate safeguards are in place in accordance with NPC Circular 16-02 on cross-border data transfer, including:

• Contractual clauses requiring the overseas recipient to provide a level of protection equivalent to the Data Privacy Act of 2012;
• Transfer only to countries with adequate data protection frameworks recognised as equivalent by the NPC, where applicable; or
• Binding corporate rules where data is transferred within a corporate group subject to this Policy.

By using the 39ph Platform, you acknowledge that your data may be transferred to and processed in countries outside the Philippines, subject to the safeguards described above.

The 39ph Platform may contain references to game providers and services operated by third parties. These third-party services have their own privacy policies, and 39ph accepts no responsibility or liability for the privacy practices of those parties. This Privacy Policy applies solely to data processing by 39ph in connection with the 39ph Platform at https://39ph.asia.

39ph reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance issued by the National Privacy Commission. The "Last updated" date at the top of this page will reflect the date of the most recent revision.

Where changes are material — meaning they significantly affect your rights or the way we use your data — 39ph will notify registered Account holders by email to their registered address prior to the change taking effect. For minor or clarificatory changes, the updated Policy will be published on this page without separate notice.

Continued use of the 39ph Platform after the effective date of any Privacy Policy update constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must discontinue use and request Account closure.

For questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact 39ph's Data Protection Officer (DPO):

• Data Protection Officer — 39ph
• Email: [email protected] (subject: "Privacy Request")
• Live Chat: Available 24/7 on the 39ph Platform
• Response time: Within 15 business days for data subject requests; 72 hours for data breach notifications

If you are not satisfied with 39ph's response to your privacy complaint, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC) via the NPC's official complaint process.