36php Privacy Policy

1. Who We Are

This Privacy Policy applies to the 36php online gaming platform, accessible at 36php.app ("Platform"). References to "36php," "we," "us," or "our" in this document refer to the operating entity responsible for the 36php platform and its associated services.

36php operates within the regulatory framework of the Republic of the Philippines and is subject to applicable data protection obligations under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC).

For all privacy-related inquiries, please refer to Section 14 of this Policy for contact details.

2. Personal Data We Collect

36php collects the following categories of personal data from players and platform visitors:

Category	Examples	Purpose
Identity Data	Full name, date of birth, nationality, government-issued ID number	Account registration, KYC verification, age verification
Contact Data	Email address, mobile number, residential address	Account communication, support, regulatory notices
Financial Data	GCash number, PayMaya account, bank account details (BPI, BDO, Metrobank), transaction history	Deposit processing, withdrawal verification, AML compliance
Technical Data	IP address, device type, browser, operating system, session timestamps	Security monitoring, fraud prevention, platform optimization
Usage Data	Games played, bet amounts, session duration, feature interactions	Responsible gaming monitoring, personalization, analytics
Communications Data	Support chat logs, email correspondence, feedback submissions	Customer support, dispute resolution, quality assurance
KYC Documents	Scanned government IDs, selfies, proof of address, proof of payment method	Identity verification, regulatory compliance

36php does not collect sensitive personal information such as racial or ethnic origin, political opinions, religious beliefs, or health data, except where specifically required by applicable law or regulation.

3. How We Collect Your Data

36php collects personal data through the following means:

• Direct interactions: Information you provide when registering an account, completing KYC, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated technologies: Technical and usage data collected automatically when you access the platform, including through cookies, web beacons, and server logs. See Section 7 for full details on cookies.
• Third-party sources: Identity verification data from KYC service providers; fraud screening data from security partners; payment confirmation data from GCash, PayMaya, BPI, BDO, and Metrobank.
• Publicly available sources: Information from public databases used to verify identity or screen for sanctions and politically exposed persons (PEPs) in compliance with AML obligations.

4. How We Use Your Personal Data

36php uses your personal data for the following purposes:

• Account management: Creating and maintaining your 36php account, verifying your identity, and managing your login credentials.
• Transaction processing: Processing deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and other supported payment methods in Philippine Peso (₱).
• Regulatory compliance: Fulfilling obligations under Philippine law, PAGCOR regulations, and AML/KYC requirements, including age verification to enforce the 21+ restriction.
• Security and fraud prevention: Detecting, investigating, and preventing fraudulent activity, unauthorized account access, and other security threats.
• Customer support: Responding to your inquiries, resolving disputes, and providing technical assistance.
• Responsible gaming: Monitoring gaming activity to identify potential problem gambling patterns and administering self-exclusion or deposit limit requests.
• Platform improvement: Analyzing usage data to improve game offerings, platform performance, and user experience.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates — only where you have provided consent or where permitted by applicable law.
• Legal proceedings: Establishing, exercising, or defending legal claims in connection with the 36php platform.

5. Legal Basis for Processing

36php processes your personal data on the following legal bases under the Data Privacy Act of 2012 and its Implementing Rules and Regulations:

• Contractual necessity: Processing required to perform our obligations under the Terms and Conditions you agreed to upon registration — including account management, transaction processing, and customer support.
• Legal obligation: Processing required to comply with applicable Philippine laws and regulations, including PAGCOR licensing requirements, AML obligations, and tax reporting duties.
• Legitimate interests: Processing necessary for 36php's legitimate business interests, including fraud prevention, platform security, and analytics — provided these interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Sharing Your Personal Data

36php does not sell, rent, or trade your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection agreements:

• KYC and identity verification providers: Third-party services that assist 36php in verifying player identities and screening for AML and sanctions compliance.
• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers necessary to process your deposits and withdrawals.
• Game software providers: Licensed game developers and live dealer studios whose games are hosted on the 36php platform. These providers may receive limited technical data necessary to deliver game functionality.
• IT and cloud infrastructure providers: Hosting, database, and security service providers that support the operation of the 36php platform.
• Regulatory and law enforcement authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other Philippine government bodies where disclosure is required by law or court order.
• Professional advisers: Lawyers, auditors, and consultants engaged by 36php, subject to professional confidentiality obligations.

All third-party service providers engaged by 36php are contractually required to process personal data only in accordance with 36php's instructions and applicable data protection law.

7. Cookies & Tracking Technologies

36php uses cookies and similar tracking technologies to operate and improve the platform. The following types of cookies are used:

• Strictly necessary cookies: Essential for the platform to function. These include session authentication cookies and security tokens. These cannot be disabled without affecting platform functionality.
• Performance cookies: Collect anonymized data about how players use the platform — such as pages visited and error messages encountered — to help 36php improve performance and reliability.
• Functional cookies: Remember your preferences, such as language settings and display options, to provide a more personalized experience.
• Analytics cookies: Used to understand aggregate player behavior and platform usage patterns. Data collected is anonymized and used solely for internal analytics purposes.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the 36php platform. 36php does not use third-party advertising or behavioral tracking cookies.

8. Data Security

36php implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction:

• Encryption: All data transmitted between your device and the 36php platform is encrypted using TLS 1.3. Personal data stored on 36php servers is encrypted at rest using AES-256.
• Access controls: Access to personal data is restricted to authorized 36php personnel and service providers on a strict need-to-know basis. All access is logged and audited.
• Two-factor authentication: 36php supports and encourages the use of two-factor authentication (2FA) for player accounts to provide an additional layer of security.
• Penetration testing: The 36php platform undergoes regular security assessments and penetration testing by independent security professionals.
• Incident response: 36php maintains a documented data breach response procedure. In the event of a breach affecting your personal data, 36php will notify you and the National Privacy Commission in accordance with applicable legal requirements.

While 36php takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your 36php login credentials.

9. Data Retention

36php retains personal data for the following periods, or longer where required by applicable law:

• Account data: Retained for the duration of your active account relationship with 36php, plus a minimum of five (5) years following account closure, as required by PAGCOR regulations and AML obligations.
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction, in compliance with Philippine AML and tax regulations.
• KYC documents: Retained for a minimum of five (5) years following the end of the business relationship, or longer if required by law.
• Support communications: Retained for three (3) years from the date of the last interaction, unless a longer period is required for dispute resolution or legal proceedings.
• Marketing consent records: Retained for the duration of the consent period plus three (3) years to demonstrate compliance.

When personal data is no longer required for the purposes for which it was collected, 36php will securely delete or anonymize it in accordance with its data disposal procedures.

10. Your Data Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 36php:

• Right to be informed: The right to know what personal data 36php collects about you and how it is used — as set out in this Privacy Policy.
• Right of access: The right to request a copy of the personal data 36php holds about you, along with information about how it is processed.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data. You can update most account information directly through your 36php account settings.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to 36php's legal retention obligations.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes. You can opt out of marketing communications at any time through your account settings.
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format where technically feasible.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data rights have been violated.

To exercise any of the above rights, please contact the 36php Data Protection Officer using the details in Section 14. 36php will respond to all verified data rights requests within fifteen (15) business days.

11. Children's Privacy

The 36php platform is strictly intended for adults aged 21 years and above, in accordance with Philippine gaming regulations. 36php does not knowingly collect personal data from individuals under the age of 21.

If 36php becomes aware that personal data has been collected from a person under the age of 21, the relevant account will be immediately suspended, all associated data will be deleted, and any deposited funds will be returned to the payment source after deducting any bonus amounts credited to the account.

If you believe that a minor has registered on the 36php platform, please contact support immediately so that appropriate action can be taken.

12. International Data Transfers

36php's primary operations and data storage are based in the Philippines. In certain circumstances, personal data may be transferred to or processed by service providers located outside the Philippines — for example, cloud infrastructure providers or game software developers operating in other jurisdictions.

Where such transfers occur, 36php ensures that appropriate safeguards are in place to protect your personal data, including contractual data protection clauses consistent with the requirements of the Data Privacy Act of 2012 and NPC guidelines. 36php will not transfer personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate safeguards.

13. Changes to This Privacy Policy

36php reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. The date of the most recent revision is displayed at the top of this page.

Where changes are material, 36php will notify registered players via email or an on-platform notification prior to the changes taking effect. Your continued use of the 36php platform following the effective date of any revision constitutes your acceptance of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how 36php protects your personal data.

15. Contact & Data Protection Officer

36php has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection law. If you have any questions, concerns, or requests relating to your personal data or this Privacy Policy, please contact the 36php DPO through the live chat support feature available on the platform, or by writing to the support email address displayed in the footer of this page.

36php aims to acknowledge all privacy-related inquiries within two (2) business days and to resolve them within fifteen (15) business days. For complex requests, 36php may extend this period by a further fifteen (15) business days, with prior notice to you.

If you are not satisfied with 36php's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines, which can be reached through its official government channels.