plushph Privacy Policy

1. Data Controller

plushph ("plushph," "we," "us," "our") is the personal information controller responsible for personal data collected through the plushph Platform accessible at plushph.win. plushph operates under a licence issued by the Philippine Amusement and Gaming Corporation (PAGCOR) and is subject to the data privacy obligations imposed by Republic Act No. 10173, its Implementing Rules and Regulations (IRR), and the orders and guidelines of the National Privacy Commission (NPC).

For all data privacy-related inquiries or to exercise your rights under the Data Privacy Act, contact our Data Protection Officer (DPO) via our 24/7 live support channel or at the email address specified in Section 13 of this Policy.

2. Information We Collect

plushph collects personal information through multiple touchpoints, including account registration, KYC submission, gameplay activity, customer support interactions, and technical usage data. The categories of personal data we collect are:

Category	Examples	Source
Identity Data	Full legal name, date of birth, government ID number, ID document images	Provided by you at registration and KYC
Contact Data	Mobile number (Philippine), email address, home address	Provided by you at registration
Financial Data	GCash/Maya account number, bank account details, transaction history, deposit and withdrawal records	Provided by you and generated by platform activity
Gaming Data	Game history, bet amounts, session durations, bonus usage, responsible gaming settings	Generated automatically by the platform
Technical Data	IP address, device type, operating system, browser, referring URL, login timestamps	Collected automatically via server logs and cookies
Communications Data	Live chat transcripts, email correspondence, support ticket content	Generated through your interactions with plushph support

plushph does not collect sensitive personal information (as defined under the DPA) beyond what is strictly necessary for KYC compliance and PAGCOR's mandatory player due diligence requirements. We do not collect biometric data beyond identity document photographs submitted for KYC purposes.

3. Legal Basis for Processing

plushph processes your personal data on the following lawful bases as recognised under the Data Privacy Act and its IRR:

• Contractual Necessity: Processing is necessary to perform the contract between you and plushph — specifically, to operate your account, process transactions, and provide gaming services.
• Legal Obligation: Processing is required to comply with plushph's legal obligations under the Anti-Money Laundering Act (AMLA), PAGCOR licensing conditions, tax reporting obligations, and NPC data governance requirements.
• Legitimate Interests: Processing is necessary for plushph's legitimate interests, including fraud detection, platform security, responsible gaming monitoring, and business analytics — where such interests are not overridden by your fundamental rights.
• Consent: Where we send direct marketing communications, we rely on your freely given, specific, informed consent. You may withdraw this consent at any time through your Account Settings or by contacting our DPO.

4. How We Use Your Information

plushph uses your personal data for the following specific purposes:

• To create, verify, and administer your plushph player account, including identity verification and age verification (21+ requirement under Philippine law).
• To process deposits, withdrawals, and other financial transactions through GCash, Maya, BPI, BDO, and other supported Philippine payment channels.
• To comply with AMLA obligations — including transaction monitoring, suspicious transaction reporting to the Anti-Money Laundering Council (AMLC), and customer due diligence requirements.
• To provide customer support in Tagalog and English, resolve disputes, and investigate complaints.
• To administer promotional offers, bonuses, and loyalty programmes on the plushph Platform.
• To monitor gameplay for responsible gaming purposes, including detecting problem gambling indicators and administering self-imposed limits and exclusions.
• To ensure platform security, detect fraud and collusion, and enforce our Terms & Conditions.
• To conduct statistical analysis and improve the plushph Platform experience.
• To send service notifications, security alerts, and — where consented — promotional communications.

5. Data Sharing & Disclosure

plushph does not sell your personal data to third parties. We may share your information with the following categories of recipients under strict data processing agreements or legal obligations:

• PAGCOR: As our licensing authority, PAGCOR may require access to player data for compliance audits and regulatory examinations.
• AMLC and law enforcement: Where required by AMLA, court order, or valid legal process issued by Philippine authorities.
• Payment service providers: GCash, Maya (PayMaya), BPI, BDO, Metrobank, UnionBank, Coins.ph, and crypto payment processors, solely for transaction processing.
• KYC and identity verification providers: Third-party services engaged to validate government-issued identification documents.
• Game content providers: Licensed game studios (such as PG Soft, Jili, Pragmatic Play) receive pseudonymised player identifiers necessary to operate RNG-certified game sessions.
• Cloud infrastructure and hosting providers: plushph's Platform is hosted on infrastructure providers who process data on our behalf under data processing agreements consistent with DPA requirements.

All third-party service providers who handle personal data on behalf of plushph are bound by contractual data protection obligations no less protective than those required by Philippine law.

6. Cookies & Tracking Technologies

The plushph Platform uses cookies and similar tracking technologies to operate essential Platform functions, maintain your login session, remember your preferences, and analyse anonymous usage patterns that help us improve the Platform experience.

The types of cookies we deploy include:

• Strictly Necessary Cookies: Required for Platform operation, session authentication, and security. These cannot be disabled without breaking Platform functionality.
• Functional Cookies: Remember your language preferences, game lobby layout, and responsible gaming settings.
• Analytics Cookies: Collect anonymised data on page visits, navigation paths, and feature usage to support Platform improvement. No personally identifiable information is included in analytics data.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to log in to and use the plushph Platform.

7. Data Retention

plushph retains your personal data for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal retention obligations:

• Account data and KYC records: Retained for a minimum of five (5) years after account closure, as required by AMLA and PAGCOR regulations.
• Financial transaction records: Retained for a minimum of five (5) years in compliance with AMLA record-keeping requirements.
• Gaming session logs: Retained for a minimum of three (3) years for dispute resolution and regulatory audit purposes.
• Customer support records: Retained for three (3) years from the date of the last interaction.
• Marketing consent records: Retained until withdrawal of consent and for one (1) year thereafter as evidence of consent management.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with NPC guidelines on data disposal.

8. Data Security

plushph implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the plushph Platform.
• Hashing of account passwords using industry-standard cryptographic algorithms — plushph staff cannot read your password in plain text.
• Multi-factor authentication options for player accounts, including SMS OTP to Philippine mobile numbers.
• Role-based access controls limiting staff access to personal data on a need-to-know basis.
• Regular security assessments and penetration testing of the Platform infrastructure.
• A documented data breach response procedure compliant with NPC 72-hour breach notification requirements.

9. Your Rights as a Data Subject

Under Republic Act No. 10173, you have the following rights with respect to your personal data held by plushph:

• Right to be Informed: The right to know how your personal data is collected and processed, as described in this Policy.
• Right of Access: The right to request a copy of the personal data plushph holds about you.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected.
• Right to Erasure / Right to be Forgotten: The right to request deletion of your personal data, subject to our legal retention obligations under AMLA and PAGCOR regulations, which may override erasure requests.
• Right to Data Portability: The right to receive a structured, machine-readable copy of your personal data for transfer to another controller where technically feasible.
• Right to Object: The right to object to processing based on legitimate interests, including direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, the right to withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe plushph has violated your data privacy rights.

To exercise any of these rights, contact our Data Protection Officer via live chat or the email address in Section 13. plushph will respond to valid data subject requests within fifteen (15) days as required by the DPA IRR.

10. Children's Privacy

The plushph Platform is strictly restricted to individuals aged 21 years and above. plushph does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data of an individual under the minimum age has been collected, we will take immediate steps to delete that data and close the associated account. If you believe a minor has registered on the plushph Platform, please notify us immediately via live chat support.

11. International Data Transfers

plushph's primary data infrastructure is located in the Asia-Pacific region. Where personal data is transferred to or accessed from outside the Philippines — for example, by cloud infrastructure providers or game content providers whose systems are hosted in other jurisdictions — plushph ensures that adequate safeguards are in place consistent with NPC guidelines on cross-border data transfers, including contractual clauses that impose obligations equivalent to Philippine data privacy standards.

12. Policy Amendments

plushph reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. The updated Policy will be published on the Platform with a revised "Last Updated" date. Where amendments materially affect your rights or our processing activities, plushph will provide notice via your registered email address where reasonably practicable. Continued use of the Platform following the effective date of amendments constitutes acceptance of the revised Policy.

13. Contact & Complaints

For any questions about this Privacy Policy, to exercise your data subject rights, or to raise a data privacy concern, please contact plushph's Data Protection Officer:

• Live Chat: 24/7 support available on the plushph Platform (Tagalog and English)
• Email: [email protected] — subject line: "Data Privacy Request"

If you are not satisfied with our response, you have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines through their official channels.