phcrow Privacy Policy – How We Handle Your Personal Data

1. Introduction and Scope

This Privacy Policy ("Policy") is issued by phcrow ("phcrow," "we," "us," or "our") and applies to all personal data collected, processed, stored, and used in connection with your access to and use of the phcrow online casino and sports betting platform accessible at phcrow.app (the "Platform"), including any related mobile-optimized interfaces, customer support channels, and promotional communications.

phcrow is committed to protecting the privacy and security of your personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations ("IRR"), and the issuances of the National Privacy Commission ("NPC").

By registering an account on the phcrow Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein. If you do not agree with this Policy, you should not use the phcrow Platform.

2. Data Controller Information

phcrow acts as the personal information controller ("PIC") with respect to the personal data collected through the Platform. As PIC, phcrow determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with the DPA and its IRR.

phcrow has appointed a Data Privacy Officer ("DPO") who is responsible for overseeing compliance with this Policy and applicable data privacy laws. You may contact the phcrow DPO using the contact details provided in Section 15 of this Policy.

3. Personal Data We Collect

phcrow collects the following categories of personal data in connection with your use of the Platform:

phcrow does not intentionally collect sensitive personal information as defined under the DPA (such as health data, political opinions, or religious beliefs) unless specifically required for responsible gaming assessments or as mandated by applicable law.

4. How We Collect Your Data

phcrow collects your personal data through the following means:

• Direct Collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions;
• Automated Collection: Technical data collected automatically when you access the Platform, including through cookies, web beacons, and server logs;
• Third-Party Sources: Identity verification data from KYC service providers; payment data from GCash, PayMaya, and banking partners; fraud prevention data from security service providers;
• Regulatory Sources: Information received from Philippine regulatory authorities, including the Anti-Money Laundering Council (AMLC), in connection with compliance obligations.

5. Legal Basis for Processing

phcrow processes your personal data on the following legal bases under the DPA:

• Contractual Necessity: Processing necessary to perform the contract between you and phcrow, including operating your account, processing transactions, and providing gaming services;
• Legal Obligation: Processing required to comply with applicable Philippine laws and regulations, including KYC requirements, AML obligations, and gaming regulatory requirements;
• Legitimate Interests: Processing necessary for phcrow's legitimate interests, including fraud prevention, platform security, and responsible gaming monitoring, where such interests are not overridden by your rights;
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent, including for marketing communications and certain cookie uses. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. How We Use Your Personal Data

phcrow uses your personal data for the following purposes:

• Creating, verifying, and managing your phcrow account;
• Processing deposits, withdrawals, and other financial transactions via GCash, PayMaya, BDO, BPI, and Metrobank;
• Verifying your identity and age (21+) in compliance with applicable Philippine gaming regulations;
• Providing customer support via live chat, SMS, and email;
• Monitoring gaming activity for responsible gaming purposes, including detecting signs of problem gambling;
• Detecting, investigating, and preventing fraud, money laundering, and other illegal activities;
• Complying with applicable Philippine laws, regulations, and regulatory requests;
• Improving the Platform's performance, features, and user experience;
• Sending transactional communications, including deposit confirmations, withdrawal notifications, and security alerts;
• Sending promotional communications about phcrow offers and new games, where you have consented to receive such communications;
• Resolving disputes and enforcing phcrow's Terms and Conditions.

7. Sharing and Disclosure of Personal Data

phcrow does not sell, rent, or trade your personal data to third parties for their own marketing purposes. phcrow may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment Processors: GCash, PayMaya, BDO, BPI, Metrobank, and other payment service providers, for the purpose of processing your financial transactions;
• KYC and Identity Verification Providers: Third-party service providers engaged to assist with identity verification and age verification;
• Game Software Providers: Licensed game providers whose games are available on the phcrow Platform, to the extent necessary to operate those games;
• Fraud Prevention and Security Providers: Third-party providers engaged to assist with fraud detection, cybersecurity, and platform integrity;
• Regulatory Authorities: Philippine government agencies and regulatory bodies, including the AMLC, NPC, and applicable gaming regulatory authorities, where required by law;
• Professional Advisors: Legal counsel, auditors, and other professional advisors, subject to professional confidentiality obligations;
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of phcrow's assets, your personal data may be transferred to the acquiring entity, subject to equivalent data protection commitments.

All third-party service providers engaged by phcrow are required to process your personal data only in accordance with phcrow's instructions and applicable data privacy laws.

8. Cookies and Tracking Technologies

phcrow uses cookies and similar tracking technologies (including web beacons and local storage) to operate and improve the Platform. The following types of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These cannot be disabled without affecting core functionality, such as maintaining your login session and processing transactions;
• Performance Cookies: Collect anonymous data about how players use the Platform, helping phcrow improve performance and identify issues;
• Functional Cookies: Remember your preferences, such as language settings and display options, to provide a more personalized experience;
• Analytics Cookies: Help phcrow understand aggregate usage patterns on the Platform to inform product development decisions.

You can manage or disable cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the phcrow Platform. For mobile users accessing phcrow via a mobile browser, cookie settings can be managed through your device's browser preferences.

9. Data Retention

phcrow retains your personal data for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

As a general guide, phcrow applies the following retention periods:

• Account and Identity Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with Philippine AML regulations;
• Transaction and Financial Data: Retained for a minimum of five (5) years from the date of the transaction, as required by applicable Philippine law;
• Gaming and Session Data: Retained for a minimum of two (2) years from the date of the gaming session;
• Communications Data: Retained for a minimum of two (2) years from the date of the communication;
• Technical and Log Data: Retained for up to twelve (12) months from the date of collection.

When personal data is no longer required for its original purpose and no legal retention obligation applies, phcrow will securely delete or anonymize such data.

10. Data Security

phcrow implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the phcrow Platform;
• Encryption of sensitive data at rest, including financial account details;
• Access controls limiting personal data access to authorized phcrow personnel on a need-to-know basis;
• Regular security assessments and penetration testing of the Platform;
• Employee training on data privacy and security obligations;
• Incident response procedures for detecting, reporting, and managing personal data breaches.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, phcrow will notify the National Privacy Commission and affected data subjects in accordance with the DPA and NPC Circular No. 16-03.

11. Your Rights as a Data Subject

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phcrow:

• Right to be Informed: The right to be informed of how your personal data is being collected and processed, as set out in this Policy;
• Right of Access: The right to obtain a copy of your personal data held by phcrow and information about how it is being processed;
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected or updated;
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to applicable legal retention obligations;
• Right to Object: The right to object to the processing of your personal data on grounds relating to your particular situation, including processing for direct marketing purposes;
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format;
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

To exercise any of these rights, please contact the phcrow Data Privacy Officer using the contact details in Section 15. phcrow will respond to all data subject requests within fifteen (15) business days of receipt. phcrow may request proof of identity before processing your request.

12. Children's Privacy

The phcrow Platform is strictly intended for individuals aged 21 years and above. phcrow does not knowingly collect personal data from individuals under the age of 21. If phcrow becomes aware that personal data has been collected from a person under 21, phcrow will take immediate steps to delete such data and close the associated account.

If you are a parent or guardian and believe that a minor has registered an account on the phcrow Platform, please contact phcrow support immediately at [email protected] so that appropriate action can be taken.

13. Cross-Border Data Transfers

phcrow primarily processes your personal data within the Philippines. In certain circumstances, your personal data may be transferred to, stored in, or processed by service providers located outside the Philippines, including game software providers and cloud infrastructure providers.

Where such cross-border transfers occur, phcrow ensures that appropriate safeguards are in place to protect your personal data, in accordance with Section 21 of the DPA and applicable NPC guidelines. These safeguards may include contractual clauses requiring the recipient to apply equivalent data protection standards.

14. Changes to This Privacy Policy

phcrow reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The date of the most recent revision is indicated at the top of this page.

When material changes are made to this Policy, phcrow will notify registered players via SMS to their registered Philippine mobile number or via a prominent notice displayed upon login to the Platform. Your continued use of the phcrow Platform following notification of changes constitutes your acceptance of the revised Policy.

phcrow encourages you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

15. Contact and Data Privacy Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or phcrow's data processing practices, or if you wish to exercise your rights as a data subject, please contact the phcrow Data Privacy Officer:

• Email: [email protected]
• Subject Line: Data Privacy Request – [Your Name]
• Live Chat: Available 24/7 via the phcrow Platform
• Response Time: Within 15 business days of receipt

If you are not satisfied with phcrow's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.