phboss Privacy
Policy

01 Definitions

In this Privacy Policy, the following terms carry the meanings set out below, unless the context clearly indicates otherwise:

• "phboss", "we", "us", or "our" refers to the operator of the phboss online gaming platform accessible at phboss.app.
• "Personal Information" or "Personal Data" refers to any information from which a living individual can be directly or indirectly identified, as defined under the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.
• "Sensitive Personal Information" refers to personal data about an individual's race, ethnic origin, marital status, age, colour, and religious, philosophical or political affiliations; health, education, genetic or sexual life; and financial history, in accordance with RA 10173.
• "Player" or "you" refers to any individual who visits, registers on, or uses the phboss platform, whether or not a registered account exists.
• "Account" refers to a registered player profile on phboss.app through which gaming activity and financial transactions are conducted.
• "Processing" refers to any operation performed on personal data, including collection, recording, organisation, storage, retrieval, use, disclosure, combination, erasure, or destruction.
• "NPC" refers to the National Privacy Commission of the Philippines, the regulatory body responsible for enforcing RA 10173.
• "PAGCOR" refers to the Philippine Amusement and Gaming Corporation, which regulates licensed online gaming operations in the Philippines.
• "AMLA" refers to the Anti-Money Laundering Act of 2001 (Republic Act No. 9160) and its amendments, which impose mandatory data collection and reporting obligations on regulated entities including licensed gaming operators.
• "KYC" refers to Know Your Customer procedures, encompassing identity verification, address confirmation, and payment method verification required under PAGCOR regulations and AMLA.

02 Data Controller

phboss operates as the Data Controller in respect of personal information collected through the phboss.app platform, as defined under the Data Privacy Act of 2012. This means phboss determines the purposes and means by which your personal information is collected and processed.

phboss has designated a Data Protection Officer (DPO) responsible for overseeing compliance with RA 10173 and this Privacy Policy. If you have any questions or concerns about how phboss handles your personal data, you may contact the DPO through the contact details provided in Section 16 of this Policy.

03 Information We Collect

phboss collects personal information from Filipino players for purposes directly related to the lawful operation of a PAGCOR-regulated online gaming platform. The categories of information we collect are as follows:

Registration & Identity Data

• Full legal name (as it appears on a government-issued Philippine ID)
• Date of birth (used to verify the 21+ age requirement under Philippine gaming law)
• Residential address in the Philippines (barangay, city/municipality, province)
• Valid Philippine email address
• Philippine mobile number
• Username and encrypted password (passwords are never stored in plain text)
• Nationality and citizenship status

KYC & Verification Documents

• Scanned or photographed copies of government-issued Philippine IDs (PhilSys, UMID, passport, SSS, GSIS, PRC, voter's ID, or driver's license)
• Proof of address documents (utility bills, bank statements, or Barangay clearance dated within 90 days)
• Payment method ownership evidence (e.g., GCash or Maya account name confirmation, bank statement header)
• Source of funds declaration for high-volume players, as required by AMLA regulations
• Selfie or live facial image for biometric identity verification where required

Financial & Transaction Data

• Deposit and withdrawal amounts, dates, and payment method references
• GCash, Maya, BPI, BDO, UnionBank, Metrobank, or other payment method account identifiers (not full account numbers)
• Bonus claim and wagering history
• Account balance history
• Cryptocurrency wallet addresses where USDT TRC20 or Coins.ph is used

Gaming Activity Data

• Games played, bet amounts, win/loss records, and session durations
• Responsible gaming tool settings (deposit limits, loss limits, self-exclusion status)
• Promotional offers claimed and wagering requirement completion status

Technical & Device Data

• IP address and approximate geographic location
• Device type, operating system, and browser version
• Cookie identifiers and session tokens
• Login timestamps and session duration logs
• Referral source and landing page data

Communications Data

• Customer support tickets, chat logs, and email correspondence with phboss
• Survey responses and feedback submitted voluntarily
• Marketing communication preferences and opt-in/opt-out records

04 How We Collect Data

phboss collects personal information through the following channels:

1. Directly from you — when you register an Account, complete KYC verification, make a deposit or withdrawal request, contact customer support, respond to a survey, or update your Account settings.
2. Automatically through the platform — technical data such as your IP address, device information, and session logs are collected automatically when you visit or interact with phboss.app, using cookies and similar tracking technologies (see Section 7).
3. From third-party verification services — phboss may use licensed identity verification providers to cross-reference the documents and information you submit during KYC, in compliance with PAGCOR and AMLA requirements.
4. From payment processors — when you make a deposit or withdrawal via GCash, Maya, BPI, BDO, or other supported payment channels, relevant transaction confirmation data is shared with phboss by the payment processor.
5. From PAGCOR and regulatory databases — phboss may receive notifications from PAGCOR regarding players registered on national self-exclusion lists or subject to regulatory restrictions.

05 Legal Basis for Processing

phboss processes your personal information only where a lawful basis exists under the Data Privacy Act of 2012. The applicable legal bases for our processing activities are:

06 How We Use Your Data

phboss uses the personal information we collect for the following purposes, all of which are necessary for the lawful operation of a PAGCOR-regulated online gaming platform serving Filipino players:

Platform Operations

• Creating, managing, and maintaining your phboss Account
• Processing deposits and withdrawals through GCash, Maya, BPI, BDO, and other supported Philippine payment methods
• Enabling you to play slots, live casino, sports betting, bingo, and other phboss games
• Applying and tracking bonus offers, wagering requirements, and VIP program points

Legal & Regulatory Compliance

• Verifying that you meet the 21+ age requirement under Philippine gaming law
• Completing KYC verification as required by PAGCOR and AMLA regulations
• Monitoring transactions for anti-money laundering (AML) red flags and submitting mandatory reports to the Anti-Money Laundering Council (AMLC) where required by law
• Checking player status against PAGCOR's national self-exclusion register
• Responding to lawful requests from PAGCOR, the NPC, the AMLC, or other Philippine government authorities

Security & Fraud Prevention

• Detecting and preventing fraudulent Account activity, unauthorized access, and bonus abuse
• Identifying and blocking duplicate accounts and prohibited conduct as defined in the phboss Terms and Conditions
• Monitoring for patterns indicative of collusion, match-fixing, or automated bot activity

Customer Support

• Responding to support enquiries, complaints, and dispute resolution requests
• Maintaining records of communications for quality assurance and regulatory audit purposes

Marketing (Consent-Based Only)

• Sending promotional offers, new game announcements, and bonus notifications to players who have opted in to marketing communications
• Personalising on-platform promotions based on your gaming preferences and activity history

07 Cookies & Tracking Technologies

phboss uses cookies and similar tracking technologies to ensure the platform functions correctly, to protect security, and to improve your experience as a Filipino player on our platform. When you visit phboss.app, the following categories of cookies may be placed on your device:

Essential Cookies

These cookies are strictly necessary for the phboss platform to operate. They maintain your login session, remember your preferences, and protect against cross-site request forgery (CSRF) attacks. Essential cookies cannot be disabled without breaking core platform functionality.

Analytics Cookies

Analytics cookies help phboss understand how players navigate the platform — which games are most popular, which pages generate the most support enquiries, and where technical issues occur. This data is aggregated and anonymised where possible. phboss uses this information to improve platform performance and the player experience.

Security Cookies

Security cookies support phboss's fraud detection and account security systems. They help identify unusual login patterns, detect multiple account attempts, and flag potentially automated activity that may indicate bot usage.

Marketing Cookies (Consent Required)

Where you have provided consent, marketing cookies allow phboss to show you relevant promotional content within the platform based on your gaming history and preferences. You may withdraw your consent to marketing cookies at any time through your Account settings or by contacting phboss support.

08 Data Sharing & Disclosure

phboss does not share your personal information with third parties except in the limited circumstances described below. All third parties with whom phboss shares data are required to handle that data in accordance with RA 10173 and applicable data protection standards.

Regulatory & Law Enforcement Authorities

phboss is legally required to share certain player information with Philippine government authorities including PAGCOR, the AMLC (Anti-Money Laundering Council), the National Privacy Commission, and law enforcement agencies, where required by law or by a valid legal order.

Identity Verification Providers

phboss engages licensed identity verification service providers to assist with KYC document checks and age verification. These providers process only the minimum personal data necessary to complete verification and are bound by strict data processing agreements consistent with RA 10173.

Payment Processors

When you make a deposit or withdrawal, relevant transaction data is shared with your chosen payment provider (e.g., GCash, Maya, BPI, BDO, UnionBank, Metrobank). phboss shares only the information required to process the transaction. Each payment provider operates under its own privacy policy and data protection obligations.

Game Content Providers

Some games available on phboss are supplied by licensed third-party game studios. Aggregated, non-personally-identifiable gameplay data may be shared with these providers for purposes of game performance monitoring and licensing compliance. Individual player identities are not disclosed to game content providers.

Professional Advisors

phboss may share relevant personal data with legal counsel, auditors, and compliance advisors where necessary for the legitimate operation of the business, subject to professional confidentiality obligations.

09 International Data Transfers

The phboss platform primarily serves Filipino players and stores personal data within systems that are accessible from the Philippines. Where phboss engages third-party service providers — such as identity verification platforms or cloud infrastructure providers — whose data processing operations may be located outside the Philippines, phboss ensures that adequate data protection safeguards are in place in accordance with the NPC's rules on cross-border data transfers.

Such safeguards include:

• Binding contractual clauses requiring the third-party recipient to apply data protection standards equivalent to those required under RA 10173
• Transfer only to jurisdictions recognised by the NPC as providing an adequate level of data protection
• Data Processing Agreements (DPAs) with all third-party processors that handle phboss player data

Where phboss transfers your data internationally, only the minimum information necessary for the specific processing purpose is transferred. phboss does not transfer Sensitive Personal Information outside the Philippines except where strictly required by PAGCOR or AMLA regulatory obligations.

10 Data Retention

phboss retains personal information for the minimum period necessary to fulfil the purposes for which it was collected, subject to legal and regulatory retention requirements. The following retention periods apply:

Upon expiry of the applicable retention period, phboss will securely delete or anonymise your personal data so that it can no longer be used to identify you. Where anonymisation is not technically feasible, the data will be securely destroyed.

11 Your Rights Under RA 10173

As a data subject under the Data Privacy Act of 2012, you have the following rights in respect of your personal information held by phboss. To exercise any of these rights, please contact the phboss Data Protection Officer using the details in Section 16.

phboss will respond to all rights requests within 30 calendar days of receipt. Where a request is complex or phboss receives a high volume of requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it. There is no fee for exercising your rights under RA 10173 in ordinary circumstances.

12 Data Security

phboss implements a comprehensive set of technical and organisational security measures to protect your personal information against unauthorised access, loss, alteration, disclosure, or destruction. Our security framework includes:

• SSL/TLS Encryption: All data transmitted between your device and phb oss.app is encrypted using industry-standard TLS 1.2 or higher, protecting your personal and financial data in transit.
• Password Hashing: Account passwords are stored using strong one-way cryptographic hashing algorithms. phboss never stores passwords in plain text and support staff cannot view your password.
• Access Controls: Access to personal data within phboss's systems is restricted on a strict need-to-know basis. Only authorised personnel with a legitimate operational reason may access player data, and all such access is logged and auditable.
• Two-Factor Authentication (2FA): phboss offers 2FA on player Accounts to provide an additional layer of protection against unauthorised login attempts.
• Intrusion Detection: phboss operates continuous monitoring systems to detect and respond to unauthorised access attempts, unusual login patterns, and potential data breach indicators.
• Secure Data Storage: Personal data, including KYC documents, is stored in encrypted form in access-controlled environments. Physical security controls are maintained at all data processing facilities.
• Third-Party Security Assessments: phboss periodically engages qualified independent security professionals to conduct vulnerability assessments and penetration tests of our platform infrastructure.
• Data Breach Response: In the event of a personal data breach that is likely to result in risk to your rights and freedoms, phboss will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected players without undue delay in accordance with NPC Circular No. 16-03.

13 Children & Minors

phboss strictly prohibits the use of its platform by any person under the age of 21 years, in compliance with Philippine gaming law and PAGCOR regulations. The phboss platform is intended exclusively for adult Filipino players who have reached the legally mandated minimum age for casino-style gambling in the Philippines.

phboss does not knowingly collect personal information from individuals under 21 years of age. Age verification is a mandatory step in the Account registration process. Where phboss discovers that personal data has been collected from a person who is under 21 years of age, we will immediately suspend the Account, forfeit any balance in accordance with our Terms and Conditions, and delete the personal data of the underage individual as promptly as permitted by law.

If you have reason to believe that a minor has registered an Account on phboss, please report this to our Data Protection Officer immediately using the contact details in Section 16. phboss takes underage gambling prevention very seriously and will act on all such reports without delay.

14 Third-Party Links

The phboss platform may from time to time contain references to third-party services such as payment providers (GCash, Maya, BPI, BDO) or game content studios. Where links to third-party websites or services appear, please be aware that phboss has no control over the data practices of those third parties and is not responsible for their privacy policies or data handling procedures.

We recommend that you review the privacy policy of any third-party service you use in connection with your phboss Account, particularly your chosen payment provider, to understand how they collect and process your personal information. phboss's Privacy Policy applies solely to data processed by phboss through the phboss.app platform.

15 Changes to This Privacy Policy

phboss reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or NPC guidance. When we make material changes to this Policy, we will take the following steps to notify you:

• Post the updated Privacy Policy on phboss.app with a revised "Last Updated" date at the top of the document
• Display a prominent notice on the phboss platform informing active players of the update
• Where the change materially affects your rights or how we use your personal data, we will send a direct notification to the email address registered to your phboss Account

Your continued use of the phboss platform following the effective date of any updated Privacy Policy constitutes your acknowledgment of and agreement to the revised terms. If you do not agree to the updated Privacy Policy, you should cease using the platform and may close your Account in accordance with the phboss Terms and Conditions.

We encourage you to review this Privacy Policy periodically to stay informed about how phboss protects your personal information. Previous versions of the Privacy Policy are available upon request by contacting our Data Protection Officer.

16 Contact & Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or the way phboss handles your personal information, you may contact our Data Protection Officer through the following channel:

If you are not satisfied with phboss's response to your privacy concern, you have the right to lodge a complaint directly with the National Privacy Commission of the Philippines (NPC). The NPC is the independent regulatory body responsible for enforcing the Data Privacy Act of 2012. Further information about filing a complaint with the NPC is available on the NPC's official website.

phboss takes all privacy complaints seriously and is committed to resolving data subject concerns promptly, fairly, and in accordance with our obligations under RA 10173 and applicable NPC regulations.