Privacy Policy

1 Introduction

36ph ("36ph," "we," "us," or "our") is committed to protecting the privacy and personal data of all individuals who access or use the 36ph website, mobile application, and associated gaming services (collectively, the "Platform"). This Privacy Policy describes how we collect, use, store, share, and protect your personal information in connection with your use of the Platform.

This Privacy Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC") of the Philippines. It applies to all personal data processed by 36ph in connection with the Platform, regardless of whether such processing occurs in the Philippines or elsewhere.

By registering for a 36ph account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Privacy Policy, you should discontinue use of the Platform immediately.

2 Data Controller

For the purposes of the Data Privacy Act of 2012 and this Privacy Policy, 36ph acts as the Personal Information Controller in respect of the personal data collected through the Platform. This means that 36ph determines the purposes and means of processing your personal data.

36ph has appointed a Data Protection Officer ("DPO") who is responsible for overseeing compliance with the DPA and this Privacy Policy. You may contact the DPO directly for any privacy-related concerns, requests, or complaints using the contact details provided in Section 15 of this Privacy Policy.

Where 36ph engages third-party service providers to process personal data on its behalf, such providers act as Personal Information Processors and are contractually bound to process personal data only in accordance with 36ph's instructions and in compliance with applicable data protection law.

3 Personal Data We Collect

36ph collects the following categories of personal data in connection with your use of the Platform:

4 How We Collect Your Data

36ph collects personal data through the following means:

• Direct Collection: Information you provide when registering for an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated Collection: Technical and usage data collected automatically when you access the Platform, including through cookies, web beacons, log files, and similar tracking technologies. See Section 8 for more details on cookies.
• Third-Party Sources: Identity verification data from KYC service providers; fraud and risk data from anti-fraud platforms; payment data from GCash, PayMaya, BDO, BPI, Metrobank, and other payment processors; and publicly available information where relevant to regulatory compliance.
• Regulatory Sources: Information received from PAGCOR, the Anti-Money Laundering Council (AMLC), or other regulatory bodies in connection with our legal obligations.

All data collection by 36ph is conducted on a lawful basis and limited to what is necessary for the purposes described in this Privacy Policy.

5 How We Use Your Personal Data

36ph uses your personal data for the following purposes:

• Account Management: To create, maintain, and manage your 36ph player account, including processing your registration, verifying your identity, and managing your account settings.
• Gaming Services: To provide access to all games and features on the Platform, process wagers, calculate and pay out winnings, and maintain accurate game records.
• Financial Transactions: To process deposits and withdrawals via GCash, PayMaya, BDO, BPI, Metrobank, and other approved payment channels, and to maintain accurate financial records.
• Regulatory Compliance: To fulfil our obligations under the DPA, AMLA, PAGCOR regulations, and other applicable Philippine laws, including KYC verification, suspicious transaction reporting, and record-keeping requirements.
• Responsible Gaming: To monitor gaming activity for signs of problem gambling, enforce self-exclusion requests, apply deposit and session limits, and comply with responsible gaming obligations.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, unauthorized account access, and other security threats.
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance.
• Marketing Communications: To send you promotional offers, bonuses, and platform updates where you have provided consent or where we have a legitimate interest in doing so. You may opt out of marketing communications at any time.
• Platform Improvement: To analyse usage patterns, conduct research, and improve the functionality, content, and user experience of the Platform.
• Legal Proceedings: To establish, exercise, or defend legal claims in connection with the Platform or your account.

6 Legal Basis for Processing

Under the Data Privacy Act of 2012, 36ph processes your personal data on the following legal bases:

• Consent: Where you have given your explicit consent to the processing of your personal data for a specific purpose, such as receiving marketing communications or the processing of sensitive personal information.
• Contractual Necessity: Where processing is necessary for the performance of the contract between you and 36ph, including account registration, game delivery, and financial transaction processing.
• Legal Obligation: Where processing is required to comply with a legal obligation applicable to 36ph, including KYC requirements, AMLA obligations, PAGCOR regulatory requirements, and tax reporting.
• Legitimate Interests: Where processing is necessary for the legitimate interests of 36ph or a third party, such as fraud prevention, platform security, and improving our services, provided that such interests are not overridden by your rights and interests.
• Vital Interests: In exceptional circumstances, where processing is necessary to protect your vital interests or those of another person.

7 Data Sharing & Disclosure

36ph does not sell, rent, or trade your personal data to third parties. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Identity Verification Providers: Third-party KYC and identity verification service providers engaged to assist with age verification (21+), document verification, and anti-fraud screening.
• Payment Processors: GCash, PayMaya, BDO, BPI, Metrobank, and other approved payment service providers for the purpose of processing deposits and withdrawals.
• Game Software Providers: Licensed game developers and platform providers whose games are made available on 36ph, to the extent necessary for game delivery and technical support.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies, where disclosure is required by law or regulatory obligation.
• Law Enforcement: Philippine law enforcement agencies and courts, where disclosure is required by a valid legal order, warrant, or subpoena.
• IT & Security Providers: Cloud hosting, cybersecurity, and IT infrastructure providers engaged to support the operation and security of the Platform.
• Professional Advisers: Legal counsel, auditors, and other professional advisers engaged by 36ph in connection with the operation of the Platform.

All third-party service providers engaged by 36ph are contractually required to maintain the confidentiality and security of your personal data and to process it only in accordance with 36ph's instructions and applicable data protection law.

8 Cookies & Tracking Technologies

36ph uses cookies and similar tracking technologies on the Platform to enhance your experience, maintain session security, and gather analytics data. The following types of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They enable core features such as account login, session management, and security. These cookies cannot be disabled without affecting Platform functionality.
• Analytics Cookies: These cookies collect anonymised information about how visitors use the Platform, such as pages visited and time spent on each page. This data helps 36ph improve the Platform's performance and content.
• Functional Cookies: These cookies remember your preferences and settings, such as language preferences and display options, to provide a more personalised experience.
• Security Cookies: These cookies are used to detect and prevent fraudulent activity, unauthorized access, and other security threats on the Platform.

You may control non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. For more information on managing cookies, refer to your browser's help documentation.

9 Data Retention

36ph retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. The following general retention periods apply:

• Account Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with PAGCOR and AMLA record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act and applicable tax regulations.
• KYC Documentation: Retained for a minimum of five (5) years following the end of the business relationship, in accordance with AMLA obligations.
• Customer Support Records: Retained for a period of three (3) years from the date of the last interaction, for dispute resolution and quality assurance purposes.
• Technical and Usage Data: Retained for a period of up to two (2) years for analytics and security purposes, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with 36ph's data disposal procedures. Where data is anonymised, it may be retained indefinitely for statistical and analytical purposes.

10 Data Security

36ph implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the 36ph Platform.
• Strong encryption of sensitive data at rest, including financial data and identity documents.
• Role-based access controls limiting access to personal data to authorised personnel on a strict need-to-know basis.
• Regular security audits, vulnerability assessments, and penetration testing of the Platform and underlying infrastructure.
• Multi-factor authentication requirements for administrative access to systems containing personal data.
• Comprehensive incident response procedures for detecting, reporting, and managing personal data breaches.
• Regular staff training on data protection obligations and security best practices.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, 36ph will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay, in accordance with the requirements of the Data Privacy Act of 2012.

While 36ph takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is 100% secure. You are responsible for maintaining the security of your account credentials and for notifying 36ph immediately if you suspect any unauthorized access to your account.

11 Children's Privacy

The 36ph Platform is strictly intended for individuals who are at least 21 years of age. 36ph does not knowingly collect, process, or retain personal data from individuals under the age of 21.

If 36ph becomes aware that personal data has been collected from a person under 21 years of age, it will take immediate steps to delete such data and close the associated account. Any winnings or balances associated with an underage account will be forfeited.

If you are a parent or guardian and believe that your child under the age of 21 has provided personal data to 36ph, please contact our Data Protection Officer immediately using the contact details in Section 15 so that we can take appropriate action.

12 Cross-Border Data Transfers

In the course of providing the Platform and its associated services, your personal data may be transferred to, stored in, or processed in countries outside the Philippines. This may occur where 36ph engages third-party service providers, such as cloud hosting providers or game software developers, who operate in other jurisdictions.

Where personal data is transferred outside the Philippines, 36ph ensures that appropriate safeguards are in place to protect your data in accordance with the requirements of the Data Privacy Act of 2012. These safeguards may include:

• Contractual clauses requiring the recipient to process personal data in accordance with standards equivalent to those required under Philippine law.
• Transfers to countries that have been assessed as providing an adequate level of data protection.
• Other legally recognised transfer mechanisms as approved by the National Privacy Commission.

By using the 36ph Platform, you acknowledge and consent to the transfer of your personal data to other countries as described in this section, subject to the safeguards described above.

13 Exercising Your Data Subject Rights

To exercise any of your rights under the Data Privacy Act of 2012 as described in this Privacy Policy, please submit a written request to 36ph's Data Protection Officer using the contact details provided in Section 15. Your request should include:

• Your full name and registered email address.
• A clear description of the right you wish to exercise and the specific data concerned.
• A copy of a valid government-issued ID for identity verification purposes.

36ph will acknowledge receipt of your request within five (5) business days and will respond to your request within thirty (30) calendar days. In complex cases, this period may be extended by a further thirty (30) days, in which case you will be notified of the extension and the reasons for it.

36ph will not charge a fee for processing data subject rights requests, except where requests are manifestly unfounded, excessive, or repetitive, in which case a reasonable administrative fee may be applied.

If you are not satisfied with 36ph's response to your data subject rights request, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

14 Changes to This Privacy Policy

36ph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Where changes are material, 36ph will provide reasonable advance notice to registered players via email or a prominent notice on the Platform prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this Privacy Policy. Your continued use of the 36ph Platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms.

We encourage you to review this Privacy Policy periodically to stay informed about how 36ph collects, uses, and protects your personal data. If you have any questions about changes to this Privacy Policy, please contact our Data Protection Officer.

15 Contact & Data Protection Officer

If you have any questions, concerns, or complaints regarding this Privacy Policy or 36ph's data processing practices, or if you wish to exercise your data subject rights, please contact our Data Protection Officer:

Data Protection Officer, 36ph
Email: [email protected]
General Support: [email protected]
Registered Address: Philippines

For general enquiries about the Platform, please visit our FAQ page. For concerns about responsible gaming, please visit our Responsible Gaming page.

If you are not satisfied with 36ph's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act of 2012.