989ph Privacy Policy

1. Introduction

989ph is committed to protecting the privacy and personal data of every Filipino player who uses our Platform. We operate under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as overseen by the National Privacy Commission (NPC). Our data processing activities are also subject to applicable PAGCOR regulatory requirements, including Anti-Money Laundering Act (AMLA) compliance obligations that require the collection and retention of certain player identity and transaction records.

This Policy sets out, in plain English, exactly what personal data 989ph collects from players and prospective players, the legal basis on which we process that data, how we use and protect it, the circumstances under which we may share it with third parties, how long we keep it, and how you can exercise your rights as a data subject. We have tried to write this Policy in clear, direct language rather than impenetrable legal boilerplate — because we believe every Filipino player deserves to know what happens with their information.

By accessing the 989ph Platform or creating an Account, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein, to the extent that consent is the applicable legal basis for a particular processing activity.

2. Definitions

3. Personal Data We Collect

The categories of personal data 989ph may collect and process in connection with your use of the Platform are as follows:

4. How We Collect Personal Data

989ph collects personal data through the following means:

• Directly from you — when you register an Account, complete KYC, make a deposit or withdrawal, submit a support request, or update your account settings;
• Automatically through the Platform — device identifiers, IP addresses, browser data, and session logs are collected automatically when you access the Platform, whether logged in or not;
• From payment service providers — GCash, PayMaya, BPI, BDO, Metrobank, and InstaPay share limited transaction confirmation data with 989ph to reconcile deposits and withdrawals;
• From identity verification services — 989ph may engage third-party KYC service providers to verify the authenticity of identity documents submitted by players;
• From fraud prevention and AML partners — 989ph may receive risk signals and flagged data from third-party fraud prevention tools and PAGCOR-mandated compliance systems; and
• From cookies and similar tracking technologies — as described in Section 11 of this Policy.

5. Legal Bases for Processing

Under Republic Act No. 10173, 989ph relies on the following legal bases to process your personal data:

1. Contractual necessity: Processing required to enter into and perform the Player Account Agreement with you — including registration, KYC, deposits, withdrawals, and gameplay.
2. Compliance with a legal obligation: Processing required under PAGCOR regulations, the Anti-Money Laundering Act (Republic Act No. 9160, as amended), the Philippine Data Privacy Act, and other applicable Philippine laws. This includes mandatory KYC, transaction monitoring, and regulatory reporting.
3. Legitimate interests: Processing necessary for 989ph's legitimate business interests, where those interests are not overridden by your rights — including fraud detection, security monitoring, platform analytics, and internal audit.
4. Consent: For processing activities not covered by the above bases — in particular, direct marketing communications — 989ph relies on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. How We Use Your Personal Data

989ph uses the personal data it holds about you for the following purposes:

989ph does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We do not use your data for automated profiling that produces legal or similarly significant effects without human review.

7. Data Sharing & Disclosure

989ph may share your personal data with the following categories of recipients:

• PAGCOR and other Philippine regulatory authorities: As required by our licence conditions and applicable law, including mandatory reporting of suspicious transactions to the Anti-Money Laundering Council (AMLC).
• Payment service providers: GCash (operated by Mynt / Globe Fintech), PayMaya (now Maya Bank), BPI, BDO, Metrobank, and InstaPay — only to the extent necessary to process your transactions.
• Identity verification partners: Third-party KYC service providers engaged by 989ph to verify the authenticity of Philippine government-issued identification documents.
• Game software licensors: Providers such as Pragmatic Play, PG Soft, Evolution Gaming, and others who supply game content to 989ph may receive anonymised session data for game integrity and RNG audit purposes only.
• Cloud infrastructure and hosting providers: 989ph's Platform is hosted on enterprise cloud infrastructure. Hosting providers process data on our behalf under strict data processing agreements that require them to maintain the same standard of data protection as 989ph.
• Fraud prevention and security services: Third-party tools used to detect and prevent fraudulent account activity, bonus abuse, and money laundering.
• Professional advisers: Lawyers, auditors, and insurers, strictly on a need-to-know basis and subject to professional confidentiality obligations.
• Law enforcement and courts: Where 989ph is required to disclose data by a valid court order, subpoena, warrant, or other lawful process issued by a competent Philippine authority.

8. Cross-Border Data Transfers

Some of 989ph's third-party service providers — including game software licensors and cloud infrastructure providers — may be located outside the Philippines. Where personal data is transferred to a recipient in a country that the NPC has not assessed as providing an adequate level of data protection, 989ph ensures appropriate safeguards are in place, including contractual clauses that impose the same data protection obligations on the recipient as those required under Republic Act No. 10173.

Cross-border transfers of personal data are conducted only where necessary for the provision of Platform services, regulatory compliance, or fraud prevention, and only to the minimum extent required for those purposes.

9. Data Retention

989ph retains personal data for the following periods, unless a longer retention period is required by applicable law:

After the applicable retention period, personal data is securely and permanently deleted from 989ph's systems, or anonymised in a manner that makes re-identification impossible, in accordance with NPC-approved data disposal procedures.

10. Security Measures

989ph implements a layered, defence-in-depth approach to personal data security. Technical and organisational measures include, but are not limited to:

• Encryption in transit: All data transmitted between your device and the 989ph Platform is protected by TLS 1.3 (256-bit encryption);
• Encryption at rest: Personal data and KYC documents stored on 989ph servers are encrypted at rest using AES-256;
• Access controls: Role-based access controls ensure that 989ph personnel can access only the personal data necessary for their specific job function. All access is logged and audited;
• Multi-factor authentication: All 989ph internal systems require multi-factor authentication for access. Player Accounts include an optional 2FA feature;
• Penetration testing: Independent security testing is conducted at least annually, with critical findings remediated on a priority basis;
• Incident response: 989ph maintains a documented personal data breach response plan. In the event of a breach, 989ph will notify the NPC within 72 hours and affected players without undue delay, in accordance with Republic Act No. 10173.

11. Cookies & Tracking Technologies

989ph uses cookies and similar tracking technologies (including web beacons and session storage) on the Platform. Cookies are small text files placed on your device when you visit a website. They help the Platform function correctly and enable 989ph to understand how the Platform is used.

989ph uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function. These cannot be disabled. They include session authentication tokens, load balancing cookies, and security tokens.
• Functional cookies: Remember your preferences such as language, game lobby layout, and responsible gaming settings. These can be disabled, but doing so may affect Platform functionality.
• Analytics cookies: Collect anonymous, aggregated information about how players use the Platform — page views, session duration, game categories accessed. This data is used to improve the Platform. No personally identifiable information is included in analytics reports.
• Security and fraud detection cookies: Used to detect and prevent bot activity, fraudulent logins, and multi-account violations. These are necessary for compliance and legitimate interests and cannot be disabled.

989ph does not use third-party advertising or retargeting cookies. Your browsing activity on the 989ph Platform is not shared with advertising networks.

You can manage non-essential cookies through your browser settings. However, disabling strictly necessary or security cookies may prevent you from accessing the Platform or logging in to your Account.

12. Your Rights as a Data Subject

Under Republic Act No. 10173 and its Implementing Rules and Regulations, you have the following rights with respect to your personal data held by 989ph:

13. Children's Privacy

989ph does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the 989ph KYC process, and 989ph requires submission of a valid government-issued Philippine identification document confirming date of birth before any Account is permitted to make deposits or withdrawals.

If 989ph discovers or has reasonable grounds to believe that personal data has been collected from an individual under 21 years of age, the Account will be immediately suspended, all personal data associated with the Account will be securely deleted in accordance with applicable law, and any balance held in the Account will be processed in accordance with PAGCOR's underage account procedures.

14. Third-Party Services & Links

The 989ph Platform integrates third-party services including game software from licensed providers, payment processing through Philippine financial institutions and e-wallets, and identity verification tools. While 989ph selects these partners carefully and requires them to maintain equivalent data protection standards, their collection and use of your data is also governed by their own privacy policies.

989ph is not responsible for the privacy practices of third-party service providers operating on their own platforms. We recommend reviewing the privacy policies of GCash, PayMaya, BPI, BDO, and Metrobank separately if you have questions about how those entities handle your data in connection with transactions you conduct through their platforms.

989ph does not host advertising from third parties and does not allow third-party advertising networks to place cookies or tracking pixels on the Platform.

15. Amendments to This Policy

989ph may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR requirements, or NPC guidance. Material changes will be communicated to players by email notification to registered addresses and by a notice displayed on the Platform at least fourteen (14) days before the revised Policy takes effect.

The current version of this Policy, together with its effective date and version number, is always available at 989ph.vip/privacy-policy. Minor corrections and non-material updates may be made without advance notice. Your continued use of the Platform following any amendment constitutes acceptance of the revised Policy.

16. Contact & Data Protection Officer

If you have any questions about this Privacy Policy, want to exercise your data subject rights, or have a concern about 989ph's handling of your personal data, please contact our Data Protection Officer using the details below:

989ph's DPO is registered with the National Privacy Commission (NPC) in accordance with NPC Circular 16-01. Complaints that cannot be resolved through 989ph's internal process may be escalated to the NPC.