24ph Privacy Policy

24ph (referred to in this Policy as "24ph", "we", "our", or "us") operates the online gaming platform accessible at 24ph.asia. 24ph is the Personal Information Controller (PIC) in respect of the personal data collected through the Platform, as defined under Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations.

Our designated Data Protection Officer (DPO) may be contacted via the email address published in the Contact section of this Policy and on the 24ph Platform. The DPO is responsible for overseeing compliance with the DPA, responding to data subject rights requests, and liaising with the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy applies to all personal data collected by 24ph through:

• The 24ph website at 24ph.asia and any subdomains;
• The 24ph player account registration and verification process;
• Payment and withdrawal processing interactions;
• Customer support communications via live chat, email, or telephone;
• Marketing and promotional communications where you have given consent.

This Policy does not apply to third-party websites, applications, or services linked to or referenced on the 24ph Platform. 24ph is not responsible for the privacy practices of any third-party operator.

24ph collects personal data that is adequate, relevant, and not excessive in relation to the purposes for which it is processed. The categories of personal data we collect include:

24ph collects personal data through the following methods:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or participate in a promotion;
• Automatically — through cookies, log files, and similar tracking technologies when you access the 24ph Platform (see Section 11 for details);
• From third parties — from identity verification service providers during the KYC process, from payment processors confirming transaction details, or from fraud detection partners flagging suspicious activity.

24ph processes personal data only where a valid legal basis exists under the Data Privacy Act of 2012. The legal bases we rely upon are:

• Consent — for marketing communications and optional personalisation features. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Contract performance — to fulfil our obligations under the Terms & Conditions, including account management, game delivery, and payment processing.
• Legal obligation — to comply with PAGCOR regulatory requirements, Anti-Money Laundering Act obligations (Republic Act No. 9160 as amended), and lawful orders from the AMLC, NPC, or courts.
• Legitimate interests — for fraud prevention, security monitoring, platform performance analytics, and responsible gaming monitoring, where these interests are not overridden by your privacy rights.

24ph uses the personal data we collect for the following purposes:

• To create, verify, and maintain your 24ph player account;
• To process deposits and withdrawals in Philippine Peso via GCash, Maya, BPI, BDO, QR Ph, and GrabPay;
• To verify your identity and age (21+ requirement) through the KYC process in accordance with PAGCOR compliance obligations;
• To detect, investigate, and prevent fraud, money laundering, and other prohibited conduct;
• To monitor gameplay and account activity for responsible gaming purposes, including identifying problem gambling indicators;
• To provide 24/7 customer support in English through live chat and email;
• To send transactional notifications (deposit confirmations, withdrawal updates, OTP codes);
• To send marketing communications where you have opted in, which may include promotion alerts, bonus offers, and platform updates;
• To improve Platform performance, fix bugs, and conduct internal analytics.

24ph does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review.

24ph does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We disclose personal data only in the following circumstances:

• Payment service providers: GCash (GXI), Maya Philippines, BPI, BDO, and other payment processors receive the minimum financial data required to execute your transaction.
• KYC and identity verification providers: Third-party identity verification platforms receive your KYC documents for automated and manual verification. These providers are bound by confidentiality agreements and data processing agreements with 24ph.
• Game software providers: Game providers such as Evolution, Pragmatic Play, JILI Games, and others receive a session token and anonymised player identifier to deliver game sessions. They do not receive your full name or financial data.
• Regulatory authorities: PAGCOR, the AMLC, the NPC, and other Philippine government bodies may receive personal data pursuant to their lawful oversight and enforcement functions. Such disclosures are mandatory and do not require your consent.
• Service providers acting as processors: IT infrastructure providers, cloud hosting operators, cybersecurity vendors, and customer support platform providers who process data on our behalf under written data processing agreements and are prohibited from using it for their own purposes.
• Business transfers: In the event of a merger, acquisition, or asset sale involving 24ph, your personal data may be transferred as part of that transaction, subject to the same privacy protections described in this Policy.

Some of the third-party service providers 24ph works with operate infrastructure outside the Philippines. Where personal data is transferred to servers or processors outside Philippine territory, 24ph ensures that such transfers are made only to countries or organisations that provide an adequate level of data protection, or that appropriate contractual safeguards (such as Standard Contractual Clauses) are in place, as required under Section 21 of the Data Privacy Act of 2012 and the NPC's cross-border data transfer guidelines.

By using the 24ph Platform, you acknowledge and agree to such transfers where they are necessary for the delivery of the services described in this Policy.

24ph retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following retention periods apply:

• Account and KYC data: Retained for a minimum of five (5) years following account closure, in compliance with AMLC record-keeping requirements under the Anti-Money Laundering Act.
• Transaction records: Retained for five (5) years from the date of each transaction.
• Gaming history: Retained for three (3) years from account closure for dispute resolution purposes.
• Customer support communications: Retained for two (2) years from the date of the last interaction.
• Marketing consent records: Retained for the duration of your account and for two (2) years following account closure as evidence of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with NPC guidelines on data disposal.

24ph implements a layered security framework to protect your personal data against unauthorised access, disclosure, alteration, and destruction:

• Encryption in transit: All data transmitted between your device and 24ph servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Encryption at rest: Sensitive data fields — including KYC documents and financial data — are encrypted at rest using AES-256.
• Access controls: Access to personal data is restricted on a need-to-know basis. 24ph staff receive role-based permissions and all access is logged and audited.
• Two-factor authentication: Administrative access to data systems requires multi-factor authentication. Player accounts support OTP-based two-factor authentication.
• Penetration testing: 24ph commissions independent security assessments on a regular schedule to identify and remediate vulnerabilities.

In the event of a personal data breach that is likely to result in significant harm to data subjects, 24ph will notify the NPC and affected players within 72 hours of becoming aware of the breach, as required under the DPA and NPC Circular No. 16-03.

24ph uses cookies and similar tracking technologies (including session tokens, local storage, and device fingerprinting) to operate the Platform. The types of cookies used are:

• Strictly necessary cookies: Required for login sessions, security tokens, and load balancing. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Used to remember your preferences such as language and display settings between sessions.
• Analytics cookies: Used to collect anonymised data about how players navigate the Platform, which games are most used, and where errors occur. This data informs Platform improvements.
• Security cookies: Used to detect bots, fraudulent login attempts, and unusual access patterns.

You may control non-essential cookies through your browser settings. Disabling functional or analytics cookies will not prevent you from using the Platform but may affect some personalisation features. Instructions for managing cookies are available in your browser's Help section.

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 24ph:

• Right to be informed: The right to know what personal data we hold about you, how it is used, and with whom it is shared — as described in this Policy.
• Right of access: The right to request a copy of the personal data we hold about you.
• Right to rectification: The right to have inaccurate or incomplete personal data corrected.
• Right to erasure (right to be forgotten): The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to overriding legal retention obligations (e.g., AMLC requirements).
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or processing based on legitimate interests where your interests, rights, or freedoms override those interests.
• Right to data portability: The right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to file a complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated.

To exercise any of the above rights, contact the 24ph Data Protection Officer via the email address shown in Section 16. We will respond within ten (10) business days of receiving a verifiable request. We may need to verify your identity before processing your request.

The 24ph Platform is strictly restricted to individuals who are at least twenty-one (21) years of age, in accordance with PAGCOR regulations governing online gaming in the Philippines. 24ph does not knowingly collect personal data from individuals under 21 years of age.

If we become aware that personal data has been collected from a minor, we will immediately close the relevant account, void any associated transactions, and securely delete the personal data collected. If you have reason to believe that a minor has registered on the 24ph Platform, please contact us immediately via the details in Section 16.

Where you have provided consent during registration or through your account settings, 24ph may contact you with promotional communications including bonus offers, new game announcements, and platform updates. These communications are delivered via SMS to your registered Philippine mobile number and/or via in-platform notifications.

You may withdraw consent for marketing communications at any time by:

• Updating your communication preferences in your 24ph account settings; or
• Contacting 24ph customer support and requesting removal from marketing lists.

Withdrawal of marketing consent does not affect the delivery of transactional notifications (OTP codes, deposit confirmations, withdrawal updates) which are necessary for the operation of your account and are not subject to marketing opt-out.

24ph reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or Platform features. Where changes are material, we will notify registered players via SMS to the registered mobile number or via an in-platform notification at least seven (7) days before the revised Policy takes effect.

The "Last updated" date at the top of this page indicates when this Policy was most recently revised. Your continued use of the 24ph Platform after the effective date of an updated Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically.

For questions about this Privacy Policy, to exercise your data privacy rights, or to report a concern about how 24ph handles your personal data, please contact our Data Protection Officer:

• Email: [email protected] (plain text — not a clickable link)
• Subject line: "Data Privacy Request – [your registered mobile number]"
• Response time: We aim to acknowledge all privacy requests within two (2) business days and resolve them within ten (10) business days.

If you are dissatisfied with our response to a privacy complaint, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC). Information on how to file an NPC complaint is available on the NPC's official government website.