phopen Privacy Policy

phopen ("we," "us," or "our") operates the online gaming platform accessible at phopen.live, including all associated games, features, and services offered to registered users in the Philippines. We are committed to protecting the privacy and personal data of every player who uses our platform, and we take our obligations under Philippine data protection law seriously.

This Privacy Policy ("Policy") describes how phopen collects, uses, stores, shares, and protects your personal data when you visit our website, register an account, make deposits or withdrawals, play games, or interact with our customer support team. It also explains the rights you have over your personal data and how you can exercise those rights.

By accessing or using the phopen platform, you acknowledge that you have read, understood, and agree to the collection and use of your personal data as described in this Policy. If you do not agree with any part of this Policy, please discontinue use of the phopen platform and contact our support team to close your account.

This Policy should be read together with phopen's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

phopen collects personal data that is necessary, adequate, and not excessive in relation to the purposes for which it is collected and processed. The categories of personal data we collect include:

2.1 Registration & Identity Data

• Full legal name as it appears on your government-issued ID
• Date of birth (used to verify the 21+ age requirement under PAGCOR regulations)
• Email address and mobile number
• Username and encrypted password
• City and province of residence (e.g., Manila, Cebu, Davao, Quezon City, Makati)

2.2 KYC Verification Data

• Copies of government-issued photo identification (PhilSys National ID, passport, or driver's license)
• Proof of address documents (utility bills, bank statements)
• Selfie or liveness verification images submitted during KYC review
• Payment method ownership verification documents

2.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method references
• GCash or Maya account references (partial, for transaction matching only)
• Bank account details for BPI, BDO, or Metrobank transfers (partial account numbers only)
• Bonus and promotional credit history

2.4 Gameplay & Activity Data

• Game session logs, including games played, wager amounts, win/loss records, and session durations
• Responsible gaming tool usage (deposit limits set, cooling-off periods activated, self-exclusion requests)
• Customer support interaction records, including chat transcripts and email correspondence

2.5 Technical & Device Data

• IP address and approximate geolocation (country and city level)
• Device type, operating system, and browser information
• Cookie identifiers and session tokens (see Section 7 for full cookie details)
• Login timestamps and access logs

phopen collects personal data through the following channels:

3.1 Directly From You

The majority of your personal data is collected directly from you when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or use any feature of the phopen platform that requires you to provide information.

3.2 Automatically Through Platform Use

When you access and use the phopen platform, certain technical and behavioral data is collected automatically through cookies, web beacons, server logs, and similar tracking technologies. This includes your IP address, device information, pages visited, and gameplay activity. See Section 7 for full details on our use of cookies and tracking technologies.

3.3 From Third-Party Service Providers

phopen may receive personal data about you from trusted third-party service providers in the following circumstances:

• Payment processors (GCash, Maya, BPI, BDO, Metrobank) may share transaction confirmation data with phopen to facilitate deposit and withdrawal processing.
• KYC verification partners may share identity verification results and fraud risk scores with phopen as part of the account verification process.
• Fraud prevention services may share device fingerprint data or risk indicators to help phopen identify potentially fraudulent account activity.

phopen does not purchase personal data from data brokers or any other commercial data sources.

phopen uses your personal data only for the purposes described in this Policy. The table below summarizes the primary purposes for which we process your data and the corresponding legal basis under RA 10173:

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, phopen processes your personal data on the following legal bases:

• Contract Performance: Processing is necessary to perform the contract between you and phopen — specifically, to operate your account, process transactions, and deliver gaming services.
• Legal Obligation: phopen is required by Philippine law — including PAGCOR regulations, the Anti-Money Laundering Act (AMLA), and the Data Privacy Act itself — to collect and retain certain categories of personal data. This includes age verification, KYC documentation, and transaction records.
• Legitimate Interest: phopen processes certain data (such as technical logs and anonymized analytics) based on our legitimate interest in operating a secure, fraud-free, and well-functioning platform, provided that this interest is not overridden by your privacy rights.
• Consent: For processing activities that are not strictly necessary for contract performance or legal compliance — such as sending you promotional communications or using non-essential cookies — phopen relies on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

phopen does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share your personal data only in the following limited circumstances:

6.1 Service Providers (Personal Information Processors)

phopen engages trusted third-party service providers who process personal data on our behalf under strict data processing agreements that require them to maintain confidentiality and implement appropriate security measures. These include:

• Payment processors: GCash, Maya, BPI, BDO, and Metrobank — for processing deposits and withdrawals.
• KYC and identity verification providers — for verifying the identity and age of registered users.
• Cloud infrastructure and hosting providers — for storing platform data securely.
• Customer support platform providers — for managing live chat and email support interactions.
• Fraud detection and cybersecurity providers — for identifying and preventing fraudulent activity.

6.2 Regulatory and Law Enforcement Authorities

phopen may disclose your personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other Philippine government authorities when required to do so by law, court order, or regulatory directive. phopen will notify you of such disclosures where legally permitted to do so.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of phopen's business or assets, your personal data may be transferred to the acquiring entity as part of that transaction. phopen will notify registered users of any such transfer and ensure that the acquiring entity is bound by privacy obligations no less protective than those in this Policy.

phopen uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your login session, and analyze how the platform is used. A cookie is a small text file placed on your device by a website you visit.

7.1 Types of Cookies We Use

7.2 Managing Your Cookie Preferences

You can manage non-essential cookie preferences through the cookie settings panel available on the phopen platform. You may also configure your browser to block or delete cookies; however, disabling strictly necessary or security cookies may prevent you from logging in or using certain platform features. phopen does not use third-party advertising cookies or cross-site tracking cookies.

phopen implements a comprehensive set of technical and organizational security measures to protect your personal data from unauthorized access, disclosure, alteration, loss, or destruction. Our security framework includes:

• Encryption in Transit: All data transmitted between your device and the phopen platform is encrypted using TLS 1.3, the current industry standard for secure web communications.
• Encryption at Rest: Sensitive personal data stored on phopen's servers — including KYC documents and financial records — is encrypted using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. phopen employees and contractors are granted access only to the data necessary to perform their specific job functions.
• Two-Factor Authentication: phopen's internal systems require multi-factor authentication for all staff accessing personal data. We also strongly recommend that users enable 2FA on their own phopen accounts.
• Regular Security Audits: phopen conducts regular internal and third-party security audits and penetration tests to identify and remediate vulnerabilities in our systems.
• Data Breach Response: phopen maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, phopen will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected users without undue delay as required by RA 10173.

phopen retains your personal data for as long as is necessary to fulfill the purposes for which it was collected, to comply with our legal obligations, and to resolve disputes or enforce our agreements. The following retention periods apply:

When personal data is no longer required for any of the above purposes, phopen will securely delete or anonymize it in accordance with our data disposal procedures. Anonymized data (from which you cannot be identified) may be retained indefinitely for statistical and analytical purposes.

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by phopen. To exercise any of these rights, please contact our Data Protection Officer as described in Section 14.

• Right to Be Informed: You have the right to be informed about how your personal data is collected, used, and shared. This Privacy Policy fulfills that obligation.
• Right of Access: You have the right to request a copy of the personal data phopen holds about you, along with information about how it is being processed. phopen will respond to access requests within thirty (30) days.
• Right to Rectification: If any personal data phopen holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update most account information directly through your phopen account settings.
• Right to Erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. Note that phopen may be required to retain certain data for legal compliance purposes even after an erasure request.
• Right to Data Portability: You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interest, subject to phopen's overriding legitimate grounds.
• Right to Lodge a Complaint: If you believe phopen has violated your data privacy rights, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines at privacy.gov.ph.

The phopen platform is strictly intended for adults aged 21 years and above, in accordance with PAGCOR regulations governing online casino gaming in the Philippines. phopen does not knowingly collect, process, or retain personal data from individuals under the age of 21.

All users are required to verify their age during the KYC process before being permitted to deposit funds or participate in any real-money gaming activity. If phopen discovers or has reason to believe that a registered user is under 21 years of age, we will immediately suspend the account, freeze any associated funds pending review, and delete the personal data of the underage user in accordance with applicable law.

phopen's primary operations and data storage are based in the Philippines. However, some of our trusted third-party service providers — including cloud infrastructure and KYC verification partners — may process or store data in servers located outside the Philippines.

Where personal data is transferred outside the Philippines, phopen ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under RA 10173. These safeguards include:

• Contractual clauses in data processing agreements that require overseas processors to maintain data protection standards consistent with Philippine law.
• Transfers only to jurisdictions or processors that have been assessed as providing an adequate level of data protection.
• Regular review of overseas processors' security and compliance posture.

By using the phopen platform, you acknowledge and consent to the transfer of your personal data to overseas processors as described in this section, subject to the safeguards outlined above.

phopen reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When we make material changes to this Policy, we will:

• Post the updated Policy on this page with a revised "Last Updated" date at the top.
• Send a notification to your registered email address summarizing the key changes, at least fourteen (14) days before the changes take effect.
• Display a prominent notice on the phopen platform for a period of at least fourteen (14) days following the update.

Your continued use of the phopen platform after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should discontinue use of the platform and contact our support team to close your account before the effective date of the update.

We encourage you to review this Privacy Policy periodically to stay informed about how phopen protects your personal data. Previous versions of this Policy are available upon request by contacting our Data Protection Officer.

phopen has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with RA 10173 and this Privacy Policy. If you have any questions, concerns, or requests relating to your personal data or this Policy, please contact our DPO through the following channels:

• Email: [email protected] — use the subject line "Privacy Inquiry" or "Data Rights Request" for faster routing.
• Response Time: phopen aims to acknowledge all privacy-related inquiries within two (2) business days and to provide a substantive response within thirty (30) days.
• Mailing Address: Written correspondence may be sent to phopen's registered business address in the Philippines. Please include your registered account email and a clear description of your concern.

phopen is committed to resolving all privacy concerns fairly and transparently. We take every inquiry seriously and will work with you to address your concern in a timely and respectful manner.