phyaya Privacy Policy

Data Controller

phyaya, operating the online casino platform at phyaya.cam, is the data controller responsible for the collection, processing, and protection of your personal information under this Privacy Policy. phyaya processes personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and all applicable circulars, opinions, and orders issued by the National Privacy Commission of the Philippines.

phyaya has appointed a Data Protection Officer (DPO) responsible for overseeing data protection compliance and responding to data subject rights requests. Contact details for phyaya's DPO are provided in Section 10 of this Privacy Policy.

Information We Collect

phyaya collects the following categories of personal information from individuals who register an account or use the phyaya platform:

2.1 Registration Information

When you create a phyaya account, we collect:

• Full legal name (as it appears on your government-issued identification).
• Date of birth (to verify you are 21 years of age or older).
• Registered mobile number (Philippine +63 format preferred).
• Email address (for account notifications and password recovery).
• Username and encrypted password (passwords are hashed using bcrypt and never stored in recoverable plain text).
• Preferred currency (typically PHP for Philippine players).

2.2 KYC Verification Documents

In compliance with Philippine anti-money laundering regulations and PAGCOR KYC requirements, phyaya requires submission of identity verification documents before processing any withdrawal. KYC data collected includes:

• Government-issued identification document (passport, PhilSys ID, driver's licence, SSS ID, GSIS ID, PRC ID, or other valid Philippine ID).
• Identification document number and expiry date.
• Current selfie photograph for identity matching.
• Proof of address (utility bill, bank statement, or equivalent, where required by enhanced due diligence).

2.3 Payment and Transaction Information

To process deposits and withdrawals, phyaya collects:

• GCash, Maya, or bank account details you provide for withdrawals (account name, account number, or wallet number).
• Transaction history including deposit amounts, withdrawal requests, timestamps, payment methods used, and transaction status.
• Device and IP address data associated with each financial transaction (for fraud detection and AML compliance).

Note: phyaya does not directly store your complete GCash PIN, bank login password, or payment card CVV. Payment processing is handled by third-party payment providers (GCash, Maya, Philippine banks) subject to their own privacy policies and PCI-DSS compliance standards.

2.4 Gameplay and Betting Data

phyaya automatically collects data related to your use of casino games, sports betting, and platform features, including:

• Game session history (games played, bet amounts, win/loss outcomes, session timestamps).
• Sports betting activity (events wagered on, bet types, odds accepted, outcomes).
• Bonus claim history and wagering requirement progress.
• VIP tier status and cashback calculations based on verified wagering.

2.5 Technical and Device Information

To deliver the phyaya platform securely and detect fraudulent activity, we collect:

• IP address, ISP, and approximate geographic location (city/region level, not precise GPS coordinates).
• Device type, operating system, browser type, and screen resolution.
• Cookies, session tokens, and device fingerprint identifiers (see Section 6 for details).
• Clickstream data and platform navigation patterns (to improve user experience and detect bot activity).

2.6 Communications Data

phyaya retains records of communications between you and phyaya support, including live chat transcripts, email correspondence, and complaint records, for quality assurance, training, and dispute resolution purposes.

How We Use Your Data

phyaya processes your personal information for the following lawful purposes under the Data Privacy Act of 2012:

3.1 3.1 Contract Performance

phyaya processes your registration information, KYC documents, payment data, and gameplay records as necessary to perform the contract between phyaya and you as a registered player — including creating and managing your account, processing deposits and withdrawals, calculating winnings, applying bonuses, and delivering customer support.

3.2 Legal and Regulatory Compliance

phyaya is required by Philippine law to process certain personal data for regulatory compliance purposes, including:

• Identity and age verification under PAGCOR licensing requirements (21+ enforcement).
• Anti-money laundering transaction monitoring and reporting under the Anti-Money Laundering Act (Republic Act No. 9160, as amended).
• Record-keeping obligations under the Bureau of Internal Revenue (BIR) regulations applicable to gaming operators.
• Responding to lawful requests, subpoenas, and orders from the National Privacy Commission, PAGCOR, AMLC, or Philippine courts.

3.3 Fraud Prevention and Platform Security

phyaya processes IP addresses, device fingerprint data, transaction records, and gameplay patterns to detect and prevent fraud, collusion, bonus abuse, account takeovers, money laundering, and other prohibited activities. This processing is necessary for the legitimate interests of phyaya and its player community in maintaining a fair and secure gaming environment.

3.4 Responsible Gaming Safeguards

phyaya processes your account activity data, deposit history, and session behaviour to monitor for indicators of problem gambling and to enforce responsible gaming tools you have activated (deposit limits, cooling-off periods, self-exclusion). This processing is conducted in the legitimate interests of player welfare and in alignment with PAGCOR responsible gaming guidelines.

3.5 Platform Improvement and Analytics

phyaya uses aggregated, anonymised data derived from player behaviour to improve the platform's game offering, user interface, payment flows, and support quality. Individual players are not identifiable from this aggregated analytics data.

3.6 Marketing Communications

With your prior consent at registration (which you may withdraw at any time), phyaya may send you promotional communications regarding phyaya bonuses, new game launches, sports betting events, and VIP programme updates via SMS, email, or in-platform notifications. You may opt out of marketing communications at any time through your account notification settings or by contacting phyaya support.

Data Disclosure to Third Parties

phyaya does not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes. phyaya discloses personal data to third parties only in the following limited circumstances:

Recipient Category	Purpose of Disclosure	Legal Basis
Payment Processors (GCash, Maya, BPI, BDO, Metrobank)	Processing deposits and withdrawal transactions to and from your phyaya account balance.	Contract performance
KYC / Identity Verification Providers	Automated document verification and identity matching during the KYC process required before withdrawals.	Legal obligation (PAGCOR KYC requirements)
Game Content Providers	Sharing a pseudonymous player session token with licensed RNG and live dealer game studios to enable game access. No full identity data is shared with game providers.	Contract performance
Anti-Money Laundering Council (AMLC)	Mandatory reporting of covered and suspicious transactions as required by Republic Act No. 9160 and subsequent amendments.	Legal obligation
PAGCOR and Regulatory Authorities	Compliance reporting, audit responses, and responses to regulatory enquiries or directives related to phyaya's gaming operations.	Legal obligation
Fraud Detection Service Providers	Device fingerprinting, IP reputation analysis, and transaction risk scoring to prevent fraud and account takeover.	Legitimate interest (security)
Customer Support Platform Providers	Storing and managing live chat and email support ticket records to facilitate customer service delivery.	Contract performance
Philippine Courts and Law Enforcement	Responding to lawfully issued subpoenas, court orders, or valid law enforcement requests.	Legal obligation

All third-party service providers who process personal data on phyaya's behalf are bound by data processing agreements that require them to process phyaya player data only for the specific purposes listed above, to maintain adequate technical and organisational security measures, and to comply with the Data Privacy Act of 2012.

Data Security Measures

phyaya implements a layered set of technical, organisational, and administrative security measures designed to protect personal data against unauthorised access, disclosure, alteration, destruction, and accidental loss. These measures include, but are not limited to:

• Encryption in transit: All data transmitted between your device and the phyaya platform is encrypted using TLS 1.2 or higher (256-bit AES encryption).
• Encryption at rest: Personal data stored in phyaya's databases, including KYC documents and payment details, is encrypted at rest using AES-256.
• Password hashing: Account passwords are stored exclusively as one-way hashed values using bcrypt with an adaptive cost factor. phyaya staff cannot recover your plain-text password.
• Access controls: Access to personal data systems is restricted to authorised phyaya personnel on a minimum necessary basis, enforced through role-based access controls and multi-factor authentication for administrative systems.
• Network security: phyaya's platform infrastructure is protected by firewalls, intrusion detection systems, and DDoS mitigation services.
• Security auditing: phyaya conducts regular internal security reviews and periodic independent penetration testing of platform infrastructure and web applications.
• Staff training: All phyaya personnel with access to player data are required to complete data protection and security awareness training on a regular basis.

While phyaya maintains robust security measures, no internet-based platform can guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, phyaya will notify the National Privacy Commission and affected data subjects in accordance with the notification timelines prescribed by the Data Privacy Act of 2012 and NPC Circular 16-03.

Cookies & Tracking Technologies

phyaya uses cookies and similar tracking technologies (including local storage, session tokens, and device fingerprint identifiers) to operate and improve the phyaya platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for maintaining your authenticated session, preventing cross-site request forgery (CSRF), and enabling basic platform functionality. These cannot be disabled without breaking core platform features.
• Security Cookies: Used to detect and prevent fraudulent logins, account takeover attempts, and automated bot activity. These are necessary for the security of your phyaya account.
• Functional Cookies: Store your platform preferences such as language settings, game filter selections, and notification preferences. These improve your experience but are not strictly essential.
• Analytics Cookies: Collect anonymised data on how players navigate the phyaya platform — including pages visited, features used, and error events encountered — to help phyaya improve platform performance and usability.

phyaya does not use third-party advertising or tracking cookies. No data collected via phyaya cookies is shared with advertising networks, social media platforms, or data brokers.

Data Retention

phyaya retains personal data for the following periods, after which data is securely deleted or irreversibly anonymised:

• Active account holders: Personal data is retained for the full duration of your active phyaya account plus a minimum of five (5) years following account closure, as required by Philippine anti-money laundering and gaming regulation record-keeping obligations.
• KYC verification documents: Retained for a minimum of five (5) years from the date of submission, or longer if required by applicable law or an active regulatory investigation.
• Transaction records: Deposit, withdrawal, and wagering records are retained for a minimum of five (5) years from the transaction date in compliance with AMLC record-keeping requirements.
• Support communications: Live chat transcripts and email records are retained for two (2) years from the date of the communication, unless related to an unresolved dispute or legal proceeding.
• Marketing consent records: Records of your marketing consent or opt-out are retained for the duration of your account plus three (3) years, to demonstrate compliance in the event of a regulatory enquiry.
• Inactive accounts: Accounts with no login activity for twenty-four (24) consecutive months are classified as inactive. phyaya will attempt to contact you at your registered email or mobile number before initiating an inactive account data review process.

Where a legal hold is required — for example, where phyaya is party to litigation or under a regulatory investigation — relevant data will be preserved beyond the standard retention periods described above until the matter is resolved.

Your Privacy Rights

As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal information held by phyaya. phyaya will respond to all rights requests within thirty (30) calendar days of receipt, or such shorter period as may be required by applicable regulations.

• Right to be Informed: You have the right to be informed of the purposes for which phyaya collects and processes your personal data, the identity of phyaya as data controller, and the identities of any third parties to whom your data is disclosed. This Privacy Policy fulfils phyaya's obligation to inform you.
• Right of Access: You have the right to request a copy of the personal information phyaya holds about you, including the categories of data held, the purposes of processing, and details of any third parties with whom your data has been shared.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal information phyaya holds about you. For changes to your registered name or date of birth, additional KYC verification may be required.
• Right to Erasure / Right to be Forgotten: You have the right to request deletion of your personal data where phyaya no longer has a lawful basis for processing it. Note that this right is subject to phyaya's legal retention obligations under anti-money laundering, PAGCOR, and tax regulations, which may require phyaya to retain certain data for defined periods even after account closure.
• Right to Data Portability: You have the right to receive a copy of your personal data that you have provided to phyaya in a structured, commonly used, machine-readable format (such as CSV or JSON), and to request transfer of such data to another data controller where technically feasible.
• Right to Object: You have the right to object to phyaya's processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, subject to phyaya's overriding legitimate grounds.
• Right to Lodge a Complaint: If you believe phyaya has violated your data privacy rights, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

To exercise any of these rights, please contact phyaya's Data Protection Officer using the contact details in Section 10. phyaya may require identity verification before processing any data rights request to ensure the security of your personal information.

Minors' Privacy

The phyaya platform is strictly intended for individuals who are 21 years of age or older in accordance with PAGCOR guidelines. phyaya does not knowingly collect personal information from persons under 21 years of age. phyaya enforces this age restriction through mandatory KYC identity verification prior to withdrawal processing.

If phyaya becomes aware that personal information has been collected from a person under 21 years of age, phyaya will immediately close the account, void any associated transactions, and permanently delete all personal data related to that individual from phyaya's systems, subject only to any legal retention obligations that may apply.

If you are a parent or guardian and believe that a minor under your care has registered a phyaya account, please contact phyaya support immediately via live chat at phyaya.cam so that the account can be closed and the minor's data deleted without delay. phyaya takes underage access seriously and will treat all such reports as high-priority compliance matters.

Contact Our Data Protection Officer

For all data privacy matters — including rights requests, privacy complaints, questions about this Policy, or reports of potential data breaches — you may contact phyaya's Data Protection Officer through the following channels:

• Support Email: [email protected] — please include "Privacy / DPO Request" in the subject line. This address is displayed as plain text and is not a clickable link.
• Live Chat: Available 24/7 via the chat icon on every phyaya page. For DPO matters, request to speak with the Data Protection team. Response target: within 2 business hours for acknowledgement.

phyaya will acknowledge all written DPO requests within five (5) business days and provide a substantive response within thirty (30) calendar days as required by the Data Privacy Act. If additional time is needed for complex requests, phyaya will notify you within the initial 30-day window and provide an expected completion date.

Amendments to This Privacy Policy

phyaya reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in phyaya's data processing practices, applicable Philippine law, NPC guidance, or PAGCOR requirements. The most current version of this Privacy Policy will always be accessible at phyaya.cam/privacy-policy.

Where phyaya makes a material change to this Privacy Policy — including any change that affects the categories of data collected, the purposes of processing, or the rights available to you — phyaya will notify registered players via their registered email address or mobile number at least seven (7) calendar days before the amended Policy takes effect.

Your continued use of the phyaya platform after the effective date of any amendment constitutes your acknowledgment of the updated Privacy Policy. If you do not accept the amended Privacy Policy, you must cease using the phyaya platform and close your account.