Privacy Policy — 22phcom

This Privacy Policy ("Policy") is issued by 22phcom ("we", "us", "our", "the Platform"), the operator of the online gaming platform accessible at https://22phcom.app. This Policy explains how we collect, use, store, share, and protect the personal information of all individuals who access or use 22phcom, including registered players and casual visitors.

22phcom is committed to protecting the privacy of every user in accordance with Republic Act No. 10173, known as the Data Privacy Act of 2012 (DPA), and its implementing rules and regulations as enforced by the National Privacy Commission (NPC) of the Philippines. We are likewise guided by PAGCOR's data governance requirements applicable to licensed online gaming operators.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, which together form the complete framework governing your relationship with 22phcom.

22phcom collects personal data that is necessary, proportionate, and relevant to the purpose for which it is collected. The following table outlines the categories of personal data we hold and why we hold them:

We do not collect sensitive personal information as defined under the DPA (such as health records, political opinions, or religious beliefs) unless specifically required for a regulatory compliance purpose and only with your explicit consent.

22phcom collects personal data through the following methods:

• Direct registration: When you create your 22phcom account, you provide your name, mobile number, date of birth, and preferred payment method. This is the primary source of identity and contact data.
• KYC document submission: When you submit a Philippine government-issued ID for identity verification, we collect the information visible on that document. Documents are processed securely and are not retained beyond what is required for verification and regulatory record-keeping.
• Deposit and withdrawal transactions: Payment data is captured when you initiate cashier transactions via GCash, Maya, BPI, BDO, Metrobank, InstaPay, PesoNet, GrabPay, QR Ph, or 7-Eleven CLiQQ. We receive transaction reference data from payment gateways — we do not store full bank account numbers or GCash PINs.
• Platform usage: As you browse and play on 22phcom, we automatically collect technical data including your IP address, device fingerprint, session duration, and pages visited. This data is captured via server logs and first-party analytics tools.
• Live chat and support interactions: When you contact our 24/7 support team, the conversation is recorded for quality assurance and dispute resolution purposes.
• Cookies and similar technologies: We use cookies, localStorage, and session tokens to maintain your login state, remember your preferences, and monitor for suspicious activity. See Section 7 for full details.
• Third-party verification services: In cases where additional identity verification is required under PAGCOR's KYC framework, we may use accredited third-party identity verification providers operating under equivalent data protection standards.

22phcom uses your personal data strictly for the purposes described below. We do not use your data in ways that are incompatible with these stated purposes without first obtaining your additional consent:

• Account management: To create, maintain, and administer your 22phcom player account, including processing deposits, managing your balance, and executing withdrawals to your registered GCash or bank account.
• Identity and age verification: To confirm that you are at least 21 years old and to verify your identity in compliance with PAGCOR's mandatory KYC requirements for Philippine online gaming operators.
• Anti-money laundering (AML) compliance: To monitor transactions for patterns consistent with money laundering or terrorist financing as required under Republic Act No. 9160 (Anti-Money Laundering Act) and PAGCOR regulations. Suspicious transaction reports (STRs) may be filed with the Anti-Money Laundering Council (AMLC) where required by law.
• Customer support: To respond to your inquiries, resolve disputes, process bonus claims, and manage any complaints or formal grievances you raise with 22phcom.
• Security and fraud prevention: To detect, investigate, and prevent unauthorized access to your account, bonus abuse, chip-dumping, bot usage, and other prohibited activities described in our Terms & Conditions.
• Responsible gaming: To monitor your gaming activity for indicators of problem gambling, enforce self-exclusion requests, apply deposit limits you have set, and comply with PAGCOR's responsible gaming framework.
• Regulatory reporting: To produce reports required by PAGCOR, the NPC, the AMLC, and other competent Philippine regulatory authorities in connection with our licensed gaming operations.
• Marketing communications: To send you relevant bonus offers, promotional updates, and platform news — but only where you have opted in to receive such communications. You may withdraw your marketing consent at any time via your account settings or by contacting support.
• Platform improvement: To analyze aggregated, anonymized usage data to improve game performance, optimize the user interface, and develop new features that better serve Filipino players.

Under the Data Privacy Act of 2012, 22phcom processes your personal data on the following lawful bases:

• Consent (Section 12(a) DPA): For marketing communications, optional cookies, and any processing that goes beyond what is strictly necessary to operate your account. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Contractual necessity (Section 12(b) DPA): Processing required to fulfill the player agreement between you and 22phcom — including account creation, deposit processing, game access, and withdrawal execution.
• Legal obligation (Section 12(c) DPA): Processing required to comply with PAGCOR licensing conditions, AMLC reporting obligations, NPC data governance requirements, and applicable Philippine tax laws.
• Legitimate interests (Section 12(f) DPA): Processing necessary for 22phcom's legitimate interests in platform security, fraud prevention, responsible gaming monitoring, and service improvement — where these interests are not overridden by your rights and freedoms as a data subject.

Where we rely on legitimate interests as the legal basis for processing, we conduct a balancing test to ensure that our interests do not prejudice your fundamental rights. You may request information about any specific legitimate interests assessment by contacting our Data Protection Officer.

22phcom does not sell or rent your personal data to any third party. We share data only in the limited circumstances described below, and only to the extent strictly necessary:

• Payment processors: GCash (Mynt), Maya (PayMaya), GrabPay, QR Ph network operators, BPI, BDO, Metrobank, and 7-Eleven CLiQQ receive only the transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are subject to Philippine financial regulations including BSP oversight.
• Game providers: Licensed third-party game studios such as Jili Gaming, PG Soft, Pragmatic Play, Fachai, and CQ9 receive a pseudonymous player identifier to manage game sessions and calculate results. They do not receive your full name, government ID details, or financial account information.
• Identity verification providers: Accredited KYC/AML service providers may process copies of your government-issued ID for verification purposes. These providers are contractually bound to use your data solely for verification and to maintain equivalent data protection standards to those described in this Policy.
• Regulatory authorities: PAGCOR, the AMLC, the NPC, the Bureau of Internal Revenue (BIR), and other competent Philippine government authorities may receive data as required by law, court order, or regulatory directive. We will notify you of such disclosures where we are legally permitted to do so.
• IT and infrastructure providers: Cloud hosting, cybersecurity, and platform maintenance providers who process data on our behalf under strict data processing agreements that prohibit use of your data for any purpose other than providing services to 22phcom.
• Professional advisors: Lawyers, auditors, and compliance consultants who are bound by professional confidentiality obligations, in connection with their advisory services to 22phcom.

22phcom uses cookies and similar client-side technologies to operate the platform effectively and to protect your account security. The following types of cookies are in use on 22phcom:

• Strictly necessary cookies: These are essential for the platform to function. They maintain your login session, enforce your security settings (including 2FA state), and prevent cross-site request forgery (CSRF). These cookies cannot be disabled without breaking core platform functionality.
• Functional cookies: These remember your preferences such as preferred language, display settings, and last-accessed game category. They improve your experience but are not required for the platform to operate.
• Analytics cookies: First-party analytics tools use cookies to collect aggregated, anonymized data about how players navigate 22phcom — which pages are most visited, where users drop off in the registration flow, and how game categories perform. This data is used exclusively to improve the platform and is never shared with third-party advertisers.
• Security cookies: Device fingerprinting tokens and session identifiers used to detect unusual login activity, flag access from unrecognized devices, and power 22phcom's fraud prevention systems.

You may manage your cookie preferences through your browser settings. Most modern browsers on Android and iOS devices allow you to block or delete cookies. However, disabling strictly necessary cookies will prevent you from logging into your 22phcom account. 22phcom does not use third-party advertising cookies or cross-site tracking pixels from external ad networks.

22phcom retains your personal data for the minimum period necessary to fulfill the purposes for which it was collected, subject to our legal and regulatory obligations. The following retention periods apply:

• Active account data: Retained for the duration of your registered account with 22phcom plus a minimum of five (5) years following account closure, as required under PAGCOR licensing conditions and Philippine AML record-keeping obligations.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later, in compliance with Republic Act No. 9160 (AMLA) record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the transaction date, consistent with AMLC and BIR record-keeping requirements.
• Gaming activity records: Retained for five (5) years for PAGCOR regulatory reporting purposes and responsible gaming audit trails.
• Support and communications records: Live chat transcripts and email records retained for two (2) years from the date of the last interaction, for dispute resolution and quality assurance purposes.
• Marketing consent records: Retained until you withdraw consent plus one (1) additional year, to maintain an audit trail of your consent history.

At the end of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be associated with you as an individual. Anonymized, aggregated data may be retained indefinitely for statistical and platform improvement purposes.

22phcom employs a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction:

• Encryption: All data in transit is protected using TLS 1.3 encryption. Sensitive data at rest — including KYC document references and financial records — is encrypted using AES-256. Your 22phcom account password is hashed using bcrypt with an appropriate cost factor and is never stored in recoverable plaintext.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. 22phcom staff and contractors who handle player data are subject to background checks, confidentiality agreements, and role-based access controls that limit their access to only the data necessary for their specific duties.
• Two-factor authentication: 22phcom supports SMS-based 2FA for player accounts via Globe and Smart numbers. We strongly encourage all players to enable 2FA to protect their accounts from unauthorized access.
• Penetration testing and vulnerability management: 22phcom's platform infrastructure undergoes regular security assessments and penetration tests by independent cybersecurity professionals. Critical vulnerabilities are remediated on a priority basis.
• Incident response: In the event of a personal data breach that is likely to result in risk to your rights and freedoms, 22phcom will notify affected players and the NPC in accordance with the DPA's mandatory breach notification requirements — within 72 hours of becoming aware of the breach where feasible.

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by 22phcom. To exercise any of these rights, contact our Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request — [Your Account Username]":

• Right to be informed: You have the right to know what personal data 22phcom holds about you, how it is used, and with whom it is shared. This Privacy Policy fulfills our primary obligation to inform you, and you may request additional clarification at any time.
• Right to access: You may request a copy of the personal data 22phcom holds about you. We will provide this within 15 business days of verifying your identity. Where the volume of data is significant, we may provide it in structured, machine-readable format.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. You may update basic account details (mobile number, email) directly in your account settings; changes to identity data require identity re-verification.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. This right is subject to our obligations to retain data under PAGCOR, AMLC, and BIR requirements, which take precedence during the applicable retention periods described in Section 8.
• Right to data portability: Where processing is based on consent or contract and is carried out by automated means, you may request your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) for transfer to another service.
• Right to object: You may object at any time to processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests, subject to 22phcom's ability to demonstrate compelling legitimate grounds that override your rights.
• Right to lodge a complaint: If you believe 22phcom has processed your personal data in violation of the DPA, you have the right to lodge a complaint with the National Privacy Commission of the Philippines at www.privacy.gov.ph.

We will respond to all data subject rights requests within fifteen (15) business days of receipt and identity verification. In complex cases, this period may be extended by a further fifteen (15) business days, in which case we will notify you of the extension and the reasons for it.

22phcom is strictly an adult gaming platform. The minimum age to register and play on 22phcom is 21 years old, in accordance with PAGCOR's minimum age requirements for online casino gambling in the Philippines.

22phcom does not knowingly collect personal data from individuals under the age of 21. Our registration process requires date of birth confirmation, and we conduct age verification checks as part of our KYC process. Any account found to belong to a person under 21 years of age will be immediately closed, all associated data will be deleted or rendered inaccessible, and any deposits or winnings will be handled in accordance with PAGCOR's underage gambling protocols.

22phcom primarily stores and processes personal data within the Philippines. In limited cases, certain service providers — including game studios, cloud infrastructure providers, and cybersecurity firms — may operate data centers or processing facilities outside the Philippines.

Where your personal data is transferred outside the Philippines, 22phcom ensures that at least one of the following safeguards is in place, in compliance with Section 21 of the DPA and NPC Circular No. 16-01:

• Adequacy determination: The receiving country has been determined by the NPC to offer an adequate level of data protection comparable to the DPA.
• Data Processing Agreements (DPAs): Standard contractual clauses approved by the NPC are incorporated into our agreements with international service providers, binding them to process your data only in accordance with 22phcom's instructions and to maintain security standards equivalent to the DPA.
• Binding corporate rules: Where a service provider is part of a multinational corporate group with NPC-approved binding corporate rules, those rules serve as the transfer mechanism.

You may request information about the specific safeguards applied to international transfers of your personal data by contacting our Data Protection Officer.

22phcom may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or platform features. When material changes are made, we will notify registered players by email and/or via an in-platform notification at least 7 days before the changes take effect.

The effective date of the current version of this Policy is displayed at the top of this page. The most current version will always be accessible at https://22phcom.app/privacy-policy. We encourage you to review this Policy periodically to stay informed about how 22phcom protects your personal data.

Continued use of 22phcom following the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with any revised Policy, you must discontinue use of 22phcom and may request account closure in accordance with the process described in our Terms & Conditions.

22phcom has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and the Data Privacy Act of 2012. If you have any questions about this Policy, wish to exercise your data subject rights, or want to report a privacy concern, please contact the DPO through the following channels:

• Email: [email protected] — use the subject line "Privacy / DPO Enquiry" for privacy-related correspondence. We aim to respond to all privacy queries within 5 business days.
• Live Chat: Available 24/7 via the chat widget on 22phcom. For urgent account security or suspected data breach concerns, live chat is the fastest way to reach our team.

If you are not satisfied with 22phcom's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines, which regulates compliance with the Data Privacy Act. The NPC can be reached at www.privacy.gov.ph.