phalaro Privacy Policy

1. Introduction

phalaro ("we," "us," or "our") is committed to protecting the privacy and personal data of all individuals who interact with our platform accessible at phalaro.vip. This Privacy Policy describes how phalaro collects, uses, discloses, stores, and safeguards personal information in connection with the operation of our online gaming platform, which is authorized and regulated by the Philippine Amusement and Gaming Corporation (PAGCOR).

This Privacy Policy applies to all phalaro players, prospective registrants, and visitors to the phalaro platform. By registering a phalaro account or using the platform, you acknowledge that you have read, understood, and agreed to the collection and use of your personal information as described in this Policy.

phalaro processes personal data in accordance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines (the "DPA"), its Implementing Rules and Regulations, and applicable PAGCOR regulatory requirements.

2. Data Controller

For the purposes of the Philippine Data Privacy Act, phalaro is the personal information controller in respect of all personal data collected through the phalaro platform. As controller, phalaro determines the purposes and means of processing your personal information.

phalaro has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the DPA and this Privacy Policy. The DPO may be contacted via the details provided in Section 15 of this Policy.

3. Personal Data We Collect

phalaro collects the following categories of personal data in connection with the provision of its services:

phalaro does not collect sensitive personal information (as defined under the DPA, including racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) except where a government-issued ID submitted for KYC purposes incidentally contains such information. Such data is processed solely for identity verification and is not used for any other purpose.

4. How We Collect Personal Data

phalaro collects personal data through the following means:

• Direct submission: Information you provide when registering a phalaro account, completing KYC verification, making a deposit or withdrawal, contacting support, or updating your account profile.
• Automated collection: Technical data collected automatically when you access the phalaro platform, including through server logs, session tracking, and similar technologies. This collection occurs each time you access the platform regardless of whether you are logged in.
• Third-party sources: Identity verification data from authorized government identity databases where required for KYC purposes; fraud prevention data from licensed anti-fraud service providers; and payment data from authorized payment processors including GCash and Maya.

5. Purpose and Legal Basis for Processing

phalaro processes your personal data for the following purposes and on the following legal bases:

Where phalaro relies on consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

6. Disclosure and Data Sharing

phalaro does not sell, rent, or trade your personal information. We may disclose your personal data to the following categories of recipients, strictly to the extent necessary for the stated purpose:

• PAGCOR and other regulatory authorities: phalaro is required by law to provide player data and transaction records to PAGCOR upon request or pursuant to reporting obligations. Data may also be disclosed to the Anti-Money Laundering Council (AMLC) where required under Republic Act No. 9160.
• Payment processors: GCash, Maya, BPI, BDO, Metrobank, and other authorized payment partners receive the minimum personal and financial data necessary to process your deposits and withdrawals.
• Game providers: Licensed game providers whose games are hosted on the phalaro platform may receive technical session data (excluding personally identifiable information) necessary to deliver and verify game outcomes.
• Identity verification services: Authorized third-party KYC providers may process your identity documents solely for the purpose of verifying your identity and age as required by PAGCOR.
• Law enforcement and courts: Where required by a valid legal order, warrant, or applicable Philippine law, phalaro may disclose personal data to law enforcement agencies or courts.
• IT and security service providers: Cloud hosting, cybersecurity, and fraud detection service providers processing data on phalaro's behalf under data processing agreements that require equivalent data protection standards.

All third-party service providers engaged by phalaro to process personal data on our behalf are contractually required to maintain appropriate security standards and to process data only in accordance with phalaro's instructions.

7. Data Retention

phalaro retains personal data for the periods necessary to fulfil the purposes for which it was collected, subject to applicable legal and regulatory minimum retention requirements:

• Account data and KYC documents: Retained for a minimum of five (5) years following account closure, as required by PAGCOR regulations and the Anti-Money Laundering Act.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, consistent with Philippine AMLA requirements.
• Gaming activity logs: Retained for a minimum of three (3) years, or as required by applicable PAGCOR directives.
• Support communications: Retained for two (2) years from the date of the most recent communication in a support thread.
• Marketing preference data: Retained until consent is withdrawn or the account is closed, whichever is earlier.

Where data is no longer required for its original purpose and no legal retention obligation applies, phalaro will securely delete or anonymize that data.

8. Security Measures

phalaro implements technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and phalaro's servers;
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records;
• Two-factor authentication for player accounts and for phalaro staff access to systems containing personal data;
• Access controls limiting personal data access to staff with a legitimate operational need;
• Regular penetration testing and vulnerability assessments by independent cybersecurity firms;
• Employee data privacy training and background screening for staff with access to personal data.

While phalaro employs industry-standard security measures, no digital platform can guarantee absolute security. You are responsible for maintaining the security of your own account credentials and for notifying phalaro immediately of any suspected unauthorized access.

9. Cookies and Tracking Technologies

phalaro uses cookies and similar tracking technologies on the platform for the following purposes:

• Essential cookies: Required for the platform to function correctly, including maintaining your login session and remembering security settings. These cannot be disabled without impairing platform functionality.
• Functional cookies: Remember your preferences such as language settings and game history to improve your phalaro experience.
• Analytics cookies: Collect anonymized data on how players use the platform to help us improve performance, navigation, and game discovery. Analytics data is not used to identify individual players.
• Security cookies: Used to detect and prevent fraudulent login attempts and bot activity on the platform.

phalaro does not use third-party advertising or behavioural tracking cookies. You may control cookie settings through your browser preferences; however, disabling essential cookies will impair your ability to use the phalaro platform.

10. Your Data Subject Rights

Under the Philippine Data Privacy Act, you have the following rights with respect to your personal data held by phalaro:

• Right to be Informed: The right to be informed of the personal data being processed, the purposes of processing, and the identity of phalaro as data controller — as provided in this Privacy Policy.
• Right of Access: The right to obtain a copy of the personal data phalaro holds about you, upon verified request.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for its original purpose, subject to applicable legal retention requirements.
• Right to Object: The right to object to processing of your personal data for direct marketing purposes or where processing is based on legitimate interest.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used format where technically feasible.
• Right to Damages: The right to claim compensation for damages suffered as a result of inaccurate, incomplete, outdated, or unlawfully processed personal data.

To exercise any of the above rights, please contact phalaro's Data Protection Officer using the contact details in Section 15. Requests will be processed within thirty (30) days. phalaro may request identity verification before processing access or deletion requests to protect against unauthorized requests by third parties.

If you believe your data privacy rights have been violated, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines through the NPC's published complaint procedures.

11. Minors and Age Restriction

The phalaro platform is strictly intended for individuals aged twenty-one (21) years or older. phalaro does not knowingly collect personal data from persons under the age of 21. Age verification is conducted as part of the mandatory KYC process before withdrawal privileges are activated.

If phalaro becomes aware that personal data has been collected from a person under the age of 21, the relevant account will be immediately suspended and all personal data collected will be deleted or anonymized, except to the extent that retention is required by law to address the underage access incident. If you believe a minor has registered a phalaro account, please contact our support team immediately.

12. Cross-Border Data Transfers

Some of phalaro's service providers — including cloud infrastructure, cybersecurity, and game platform providers — may be located outside the Philippines. Where personal data is transferred to countries outside the Philippines, phalaro ensures that appropriate safeguards are in place as required by the Data Privacy Act, including data processing agreements incorporating standard data protection clauses.

phalaro will not transfer your personal data to a country that does not provide an adequate level of protection for personal data unless appropriate contractual safeguards are in place. Upon request, phalaro can provide information on the safeguards applicable to specific international transfers.

13. Data Breach Protocol

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, phalaro will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, as required under the Data Privacy Act.

Where a breach is likely to result in a high risk to affected individuals, phalaro will also notify those individuals directly via their registered email address or mobile number, providing information on the nature of the breach, the data affected, and the steps phalaro has taken or will take to address the breach and mitigate its impact.

14. Changes to This Privacy Policy

phalaro may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or platform features. Material changes will be communicated to registered players via their registered email address and/or through a notice on the phalaro platform at least fourteen (14) days before the changes take effect.

Continued use of the phalaro platform following the effective date of any update to this Privacy Policy constitutes acceptance of the updated Policy. If you do not agree with any changes, you may close your phalaro account in accordance with the Terms and Conditions.

15. Contact and Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy or phalaro's data processing practices, please contact our Data Protection Officer:

All privacy-related requests and complaints will receive a substantive response within thirty (30) calendar days. phalaro is committed to resolving data privacy concerns promptly and transparently.

If you are not satisfied with phalaro's response to your privacy concern, you may escalate to the National Privacy Commission of the Philippines through their official published complaint channels.