639ph Casino Privacy Policy

1. Who We Are (Data Controller)

639ph Casino operates the online gaming platform accessible at 639ph.org, providing casino games, slots, live dealer games, and related services to eligible Filipino players. For the purposes of the Philippine Data Privacy Act of 2012 (RA 10173), 639ph acts as the Personal Information Controller (PIC) in respect of the personal data it collects from Players and website visitors.

639ph has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with RA 10173 and this Privacy Policy. Contact details for the DPO are provided in Section 15 of this Policy.

2. Personal Data We Collect

639ph collects the following categories of personal data from Players and website visitors:

• Identity Data: Full legal name, date of birth, gender, nationality, and government-issued ID number (e.g., PhilSys National ID, passport number, driver's licence number).
• Contact Data: Philippine mobile number, email address, and residential address (including barangay, city/municipality, province, and postal code).
• Account Data: Username, encrypted password, account registration date, account status, and communication preferences.
• Financial Data: GCash account number, PayMaya account number, bank account details (account name, account number, bank name), debit card details (card number masked except last four digits, expiry date), deposit and withdrawal history, and wallet balance.
• Gaming Data: Game history, wager amounts, win/loss records, session duration, bonus usage, and responsible gaming tool settings (deposit limits, loss limits, self-exclusion status).
• KYC Verification Data: Copies of government-issued photo ID, proof of address documents, and source of funds documentation submitted during the KYC process.
• Technical Data: IP address, device type, operating system, browser type and version, screen resolution, and time zone.
• Usage Data: Pages visited on the 639ph Platform, features used, links clicked, session start and end times, and error logs.
• Communications Data: Records of your communications with 639ph customer support, including live chat transcripts and email correspondence.

639ph does not intentionally collect sensitive personal information as defined under RA 10173 (such as health data, religious beliefs, or political affiliations) unless specifically required for responsible gaming purposes (e.g., self-exclusion requests that reference a gambling disorder).

3. How We Collect Your Data

639ph collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically when you access the 639ph Platform, through cookies, server logs, and similar tracking technologies (see Section 7).
• Third-party sources: Identity verification data from KYC service providers; fraud and AML screening data from compliance service providers; payment confirmation data from GCash, PayMaya, and banking partners.

4. Legal Basis for Processing

639ph processes your personal data on the following legal bases under RA 10173:

• Contractual necessity: Processing required to perform our contract with you — i.e., to operate your 639ph account, process deposits and withdrawals, and provide gaming services.
• Legal obligation: Processing required to comply with Philippine law, including AML obligations under RA 9160 (as amended), PAGCOR regulatory requirements, and tax reporting obligations.
• Legitimate interests: Processing for fraud prevention, security monitoring, responsible gaming enforcement, and Platform improvement, where these interests are not overridden by your data protection rights.
• Consent: Processing for marketing communications and non-essential cookies, where we have obtained your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. How We Use Your Personal Data

639ph uses your personal data for the following purposes:

• To create, verify, and manage your 639ph account.
• To process deposits, withdrawals, and in-platform transactions.
• To verify your identity and age (21+) in compliance with PAGCOR requirements and RA 10173.
• To comply with AML obligations, including transaction monitoring and suspicious activity reporting.
• To detect, investigate, and prevent fraud, cheating, collusion, and other prohibited conduct.
• To enforce our Terms & Conditions and Responsible Gaming Policy, including processing self-exclusion requests.
• To provide customer support and respond to your enquiries and complaints.
• To send you transactional communications (e.g., deposit confirmations, withdrawal notifications, security alerts).
• To send you promotional communications about 639ph offers and new games, where you have consented to receive such communications.
• To analyse Platform usage and improve our services, user experience, and game offerings.
• To comply with applicable Philippine laws and regulatory requirements.

6. Sharing Your Personal Data

639ph does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your personal data only in the following circumstances:

• Service providers: We share data with carefully selected third-party service providers who process data on our behalf, including KYC verification providers, payment processors (GCash, PayMaya, banking partners), cloud hosting providers, customer support platform providers, and analytics providers. All service providers are bound by data processing agreements that restrict their use of your data to the specific services they provide to 639ph.
• Regulatory authorities: We disclose data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities when required by law or regulatory directive.
• Law enforcement: We disclose data to Philippine law enforcement agencies when required by a valid court order, subpoena, or other legal process.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of 639ph's assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.
• With your consent: We share data with third parties in any other circumstances where you have given your explicit consent.

7. Cookies & Tracking Technologies

639ph uses cookies and similar technologies (such as web beacons and local storage) on the Platform. Cookies are small text files stored on your device that help us recognise you and remember your preferences.

We use the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function. These include session cookies that keep you logged in and security cookies that prevent cross-site request forgery. These cannot be disabled.
• Functional cookies: Remember your preferences (e.g., language, game settings) to personalise your experience. These are enabled by default but can be disabled in your browser settings.
• Analytics cookies: Help us understand how Players use the Platform so we can improve it. We use anonymised, aggregated analytics data only. These require your consent.

639ph does not use third-party advertising or retargeting cookies. You can manage or delete cookies through your browser settings at any time. Disabling strictly necessary cookies may affect the functionality of the Platform.

8. Data Retention

639ph retains your personal data for the following periods:

• Account data and gaming records: Retained for a minimum of five (5) years after account closure, as required by PAGCOR regulations and AML obligations under RA 9160.
• KYC documents: Retained for a minimum of five (5) years after the end of the business relationship, in accordance with AML regulations.
• Financial transaction records: Retained for a minimum of five (5) years after the transaction date, for tax and regulatory compliance purposes.
• Customer support communications: Retained for three (3) years after the resolution of the relevant enquiry or complaint.
• Marketing consent records: Retained until you withdraw consent, plus an additional one (1) year to demonstrate compliance with consent requirements.
• Technical and usage data (logs): Retained for twelve (12) months from the date of collection, after which they are anonymised or deleted.

When your personal data is no longer required for the purposes for which it was collected, and no legal retention obligation applies, 639ph will securely delete or anonymise it in accordance with our data disposal procedures.

9. Data Security

639ph implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption: All personal data is encrypted at rest using AES-256 encryption and in transit using TLS 1.3 or higher.
• Access controls: Access to personal data is restricted to authorised 639ph personnel and service providers on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication.
• Network security: The 639ph Platform is protected by firewalls, intrusion detection systems, and regular vulnerability assessments and penetration testing.
• Secure development: 639ph follows secure software development practices, including code reviews and security testing, to minimise vulnerabilities in the Platform.
• Staff training: All 639ph personnel with access to personal data receive regular data protection and security awareness training.
• Incident response: 639ph maintains a documented data breach response plan and will notify affected Players and the NPC in accordance with applicable requirements in the event of a breach.

While 639ph takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is 100% secure. You are responsible for maintaining the security of your 639ph account credentials. Please refer to Section 5 of our Terms & Conditions for account security best practices.

10. International Data Transfers

639ph's primary data processing infrastructure is located within the Philippines. However, some of our third-party service providers — including cloud hosting providers and KYC verification services — may process your data in other countries. Where such transfers occur, 639ph ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses that require the recipient to protect your data to a standard equivalent to that required under RA 10173.
• Transfers only to countries or organisations that the NPC has determined provide an adequate level of data protection.
• Your explicit consent, where required by applicable law.

By using the 639ph Platform, you acknowledge that your personal data may be transferred to and processed in countries outside the Philippines, subject to the safeguards described above.

11. Your Data Protection Rights

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights in respect of your personal data held by 639ph:

• Right to be informed: The right to be informed of how your personal data is being collected and processed — which is the purpose of this Privacy Policy.
• Right of access: The right to request a copy of the personal data 639ph holds about you, along with information about how it is being processed.
• Right to rectification: The right to request correction of any inaccurate or incomplete personal data 639ph holds about you.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to 639ph's legal retention obligations.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another data controller.
• Right to withdraw consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data protection rights have been violated.

To exercise any of these rights, please contact 639ph's Data Protection Officer using the contact details in Section 15. We will respond to your request within fifteen (15) business days of receipt. We may need to verify your identity before processing your request.

Please note that some rights are subject to limitations under RA 10173 — for example, the right to erasure does not apply where 639ph is required to retain your data by law (such as AML retention requirements).

12. Children and Minors

The 639ph Platform is strictly intended for individuals who are 21 years of age or older, in accordance with Philippine gaming regulations. 639ph does not knowingly collect personal data from individuals under the age of 21.

If 639ph becomes aware that personal data has been collected from a person under 21 years of age, we will immediately terminate the associated account, return any deposited funds to the originating payment method, and securely delete the personal data collected, subject to any legal retention obligations.

If you are a parent or guardian and believe that your child under 21 has registered an account on the 639ph Platform, please contact us immediately using the details in Section 15 so that we can take appropriate action.

13. Third-Party Links

The 639ph Platform may contain links to third-party websites or services, such as game provider information pages. This Privacy Policy applies only to the 639ph Platform and does not cover the privacy practices of any third-party websites. 639ph is not responsible for the content or privacy practices of third-party sites. We encourage you to review the privacy policies of any third-party sites you visit.

14. Changes to This Privacy Policy

639ph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will notify registered Players via email or an in-platform notification at least seven (7) days before the changes take effect.

The effective date at the top of this document indicates when the current version was last updated. We encourage you to review this Privacy Policy periodically to stay informed about how 639ph protects your personal data. Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the changes.

15. Contact Us & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by 639ph, please contact our Data Protection Officer through the following channels: