36ph Privacy Policy

01Introduction

36ph ("we", "us", "our") is an online gaming platform serving Filipino players across the Philippines, including Metro Manila, Cebu, Davao, Quezon City, Iloilo, and all other regions. We are committed to protecting the privacy and personal information of every individual who interacts with our Platform.

This Privacy Policy has been prepared in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC) of the Philippines. We take our obligations under this law seriously and have appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this policy.

The personal information controller for data collected through the 36ph Platform is 36ph (referred to throughout this document as "36ph", "the Platform", or "we"). For all privacy-related inquiries, please refer to the contact details in Section 14 of this policy.

02Personal Data We Collect

36ph collects personal data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed. The categories of personal data we collect include:

We do not collect sensitive personal information — such as racial or ethnic origin, political opinions, religious beliefs, or health information — unless specifically required for a regulatory compliance purpose and only with your explicit consent.

03How We Collect Your Data

36ph collects personal data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC verification, submitting a deposit or withdrawal request, contacting support, or participating in a promotion.
• Automated collection: Technical and usage data collected automatically through cookies, server logs, and similar technologies when you access and use the Platform. This data is collected regardless of whether you are logged in.
• Third-party sources: Identity verification data from KYC service providers; payment verification data from GCash, Maya, and our banking partners; fraud and risk signals from our fraud prevention partners. All third-party data processors engaged by 36ph are contractually required to handle personal data in compliance with applicable Philippine privacy law.

04How We Use Your Personal Data

36ph uses your personal data for the following purposes:

• Account management: Creating and maintaining your 36ph player account, verifying your identity, processing authentication, and managing your account settings and preferences.
• Payment processing: Facilitating deposits via GCash, Maya, BPI, BDO, Metrobank, and other supported payment methods; processing withdrawal requests; and maintaining accurate transaction records as required by Philippine financial regulations.
• Regulatory compliance: Fulfilling obligations under Philippine anti-money laundering laws, PAGCOR regulatory requirements, and other applicable legislation — including the retention of transaction records and identity documentation for the periods prescribed by law.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, money laundering, account takeover attempts, and other unlawful conduct that may affect the integrity of the Platform or harm players.
• Responsible gaming: Monitoring gaming activity to identify patterns consistent with problem gambling behaviour, enforcing account-level deposit and loss limits, and administering self-exclusion requests in compliance with our Responsible Gaming Policy.
• Service communications: Sending account-related communications including transaction confirmations, OTPs, security alerts, and material updates to Platform terms or policies.
• Marketing: Sending promotional communications about 36ph offers, bonuses, and new game launches — only where you have provided explicit consent or where we have a legitimate interest, subject to your right to opt out at any time.
• Platform improvement: Analysing aggregated, anonymised usage data to improve Platform performance, game selection, and the overall player experience for our Filipino user base.

05Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, 36ph processes your personal data on one or more of the following legal bases:

• Consent: Where you have provided freely given, specific, informed, and unambiguous consent to the processing — for example, consent to receive marketing communications or consent to the use of non-essential cookies.
• Contractual necessity: Processing required to fulfil our contractual obligations to you under the 36ph Terms and Conditions — for example, processing a withdrawal request you have submitted.
• Legal obligation: Processing required for 36ph to comply with a mandatory legal obligation under Philippine law — for example, retaining KYC documents as required by the Anti-Money Laundering Act.
• Legitimate interests: Processing based on our legitimate interests or those of a third party, where those interests are not overridden by your data protection rights — for example, fraud detection, security monitoring, and improving our services.

06Sharing Your Data

36ph does not sell your personal data. We share personal data with third parties only in the following circumstances:

• Payment service providers: We share financial data with GCash, Maya, and our banking partners solely for the purpose of processing your requested transactions. These providers are bound by contractual data processing agreements.
• KYC and identity verification providers: We share identity documentation with regulated identity verification service providers to fulfil our KYC obligations. These providers process data on our behalf and may not use it for any independent purpose.
• Game software providers: Game studios integrated into the 36ph Platform may receive session and wagering data necessary to operate their games and detect technical issues. They do not receive your identity or financial data.
• Fraud prevention and analytics partners: Technical and usage data may be shared with fraud prevention and platform analytics providers under strict data processing agreements.
• Regulatory authorities: We may disclose personal data to PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council, or other Philippine regulatory authorities when required by law or in response to a lawful request.
• Legal proceedings: We may disclose personal data where required by a court order, subpoena, or other binding legal process issued by a Philippine court or competent authority.

All third-party service providers engaged by 36ph are subject to contractual obligations ensuring personal data is processed securely, lawfully, and only for specified purposes consistent with this Privacy Policy.

07Cookies & Tracking Technologies

36ph uses cookies and similar technologies — including web beacons, pixel tags, and local storage — to operate and improve the Platform. Cookies used on the 36ph Platform fall into the following categories:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies, load balancing tokens, and security cookies. These cannot be disabled without impairing core Platform functionality.
• Functional cookies: Remember your preferences, such as language settings and game lobby filters, to personalise your experience across sessions.
• Analytics cookies: Collect anonymised data about how players use the Platform — pages visited, session duration, error events — to help us improve the service. Aggregated data only; no individual player is identifiable from this data.
• Marketing cookies: Track interactions with promotional content to measure campaign effectiveness. Used only with your consent.

You may manage and disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of parts of the 36ph Platform. Your browser's help documentation will provide instructions for managing cookies on your specific device and browser.

08Data Retention

36ph retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by Philippine law. Our general retention principles are:

• Active account data: Retained for the duration of your active account relationship with 36ph.
• KYC and identity documentation: Retained for a minimum of five (5) years following account closure, as required under the Philippine Anti-Money Laundering Act and related AMLC regulations.
• Financial transaction records: Retained for a minimum of five (5) years, consistent with Philippine financial record-keeping requirements.
• Support communications: Retained for three (3) years following the resolution of the relevant support interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for the duration of your consent and for three (3) years following withdrawal of consent, to demonstrate compliance with consent requirements.
• Technical and usage data: Retained for up to twenty-four (24) months in identifiable form, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with industry-standard data destruction practices.

09Data Security

36ph implements technical and organisational security measures appropriate to the nature and sensitivity of the personal data we process. These measures include:

• Transport Layer Security (TLS/HTTPS) encryption for all data transmitted between your device and the 36ph Platform.
• Encryption of sensitive data fields — including passwords, payment credentials, and identity documents — at rest using AES-256 or equivalent industry-standard encryption.
• Role-based access controls ensuring that employees can only access personal data necessary for their specific job function.
• Multi-factor authentication required for all internal systems that process personal data.
• Regular security audits, penetration testing, and vulnerability assessments conducted by qualified security professionals.
• Incident response procedures, including a data breach notification process consistent with the requirements of the National Privacy Commission.

While 36ph takes all reasonable precautions to safeguard your personal data, no system connected to the internet can be guaranteed to be completely secure. You play an important role in protecting your own account by using a strong, unique password and enabling two-factor authentication.

10Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights with respect to your personal data held by 36ph:

• Right to be informed: The right to be informed about how your personal data is being collected and processed — fulfilled by this Privacy Policy.
• Right to access: The right to obtain confirmation of whether 36ph holds personal data about you and, if so, to receive a copy of that data.
• Right to rectification: The right to have inaccurate or incomplete personal data corrected. You may update certain information directly from your 36ph account settings.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations that may override this right.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes. You may opt out of marketing communications at any time through your account settings or by contacting our DPO.
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission if you believe your data privacy rights have been violated.

To exercise any of the above rights, please contact our Data Protection Officer using the details in Section 14. We will respond to all verifiable data subject requests within fifteen (15) business days.

11Children and Minors

The 36ph Platform is strictly intended for adults aged 21 and above. We do not knowingly collect personal data from individuals under 21 years of age. Account registration requires confirmation of eligibility and is subject to KYC age verification.

If 36ph becomes aware that personal data has been collected from a person under 21 years of age, we will take immediate steps to delete that data and close the associated account. If you believe a person under 21 has created a 36ph account, please contact us immediately using the details in Section 14.

12International Data Transfers

Some of 36ph's service providers and game studio partners operate servers or process data outside the Philippines. Where personal data is transferred internationally, 36ph ensures that appropriate safeguards are in place consistent with Section 21 of the Philippine Data Privacy Act, including contractual clauses requiring the recipient to apply data protection standards equivalent to those applicable under Philippine law.

By accepting this Privacy Policy, you consent to such international transfers of your personal data where necessary for the operation of the Platform, subject to the safeguards described above.

13Changes to This Privacy Policy

36ph may update this Privacy Policy from time to time to reflect changes in our data practices, applicable laws, or Platform features. When a material change is made, we will notify registered players via SMS or the email address associated with their account, with a minimum of seven (7) days' advance notice prior to the change taking effect.

The date of the most recent revision is displayed at the top of this page. We encourage you to review this Privacy Policy periodically. Your continued use of the Platform following the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms.

14Contact & Data Protection Officer

For all privacy-related requests, inquiries, or complaints — including requests to exercise your data subject rights — please contact the 36ph Data Protection Officer:

• Email: [email protected] (mark your message "Privacy / DPO Request")
• Live Chat: Available 24/7 via the 36ph website — reference "Privacy Request" when initiating the chat
• Response time: All privacy requests acknowledged within 3 business days; substantive response within 15 business days

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC). Information about how to file a complaint with the NPC is available through official Philippine government channels.