Privacy Policy – How phraha Protects Your Data

1

Introduction

phraha ("we," "us," or "our") is committed to protecting the privacy and personal data of all users who access or use the phraha platform at phraha.app. This Privacy Policy describes how phraha collects, uses, stores, shares, and protects your personal information in connection with your use of our platform and services.

This Privacy Policy applies to all users of the phraha platform, including registered account holders, visitors, and any individual who interacts with phraha through our website, live chat, email, or any other communication channel. By accessing or using the phraha platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

phraha operates in the Republic of the Philippines and processes personal data in accordance with Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR), as overseen by the National Privacy Commission (NPC). phraha also complies with applicable PAGCOR regulations regarding the handling of player data.

Scope: This Privacy Policy covers all personal data collected and processed by phraha in connection with the operation of the phraha platform. It does not apply to third-party websites, services, or applications that may be linked to or integrated with the phraha platform.

2

Data Controller

For the purposes of the Data Privacy Act of 2012 and this Privacy Policy, phraha acts as the personal information controller (PIC) in respect of the personal data it collects and processes from users of the phraha platform.

As the personal information controller, phraha determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out in accordance with applicable Philippine data privacy laws and regulations.

phraha has designated a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Privacy Policy and applicable data privacy laws. You may contact the phraha DPO through our support team at the contact details provided in Section 14 of this Policy.

3

Personal Data We Collect

phraha collects the following categories of personal data from users of the platform:

Category	Examples	Purpose
Identity Data	Full legal name, date of birth, government-issued ID number, nationality	Account registration, age verification, KYC compliance
Contact Data	Email address, mobile number, residential address	Account communication, support, notifications
Financial Data	GCash number, Maya account, bank account details, transaction history	Deposit and withdrawal processing, AML compliance
Technical Data	IP address, device type, browser type, operating system, session data	Platform security, fraud prevention, analytics
Usage Data	Games played, bet history, session duration, feature interactions	Service improvement, responsible gaming monitoring
Communications Data	Support chat logs, email correspondence, feedback submissions	Customer support, dispute resolution, quality assurance
Verification Documents	Copies of government-issued ID, proof of address, selfie photos	KYC verification, age verification, fraud prevention

Sensitive Personal Information: Certain data collected by phraha, such as government ID numbers and financial account details, may constitute sensitive personal information under the Data Privacy Act of 2012. phraha applies heightened security measures to the processing of such data.

4

How We Collect Your Data

phraha collects personal data through the following means:

Direct Collection: Data you provide when registering an account, completing identity verification, making deposits or withdrawals, contacting support, or participating in promotions.
Automated Collection: Technical and usage data collected automatically when you access and interact with the phraha platform, including through cookies, web beacons, and similar tracking technologies.
Third-Party Sources: Data received from identity verification service providers, payment processors, fraud prevention services, and regulatory bodies as part of our compliance obligations.
Communications: Data contained in your communications with phraha support, including live chat transcripts, emails, and feedback forms.

phraha collects only the personal data that is necessary for the purposes described in this Privacy Policy. We do not collect personal data that is excessive or irrelevant to those purposes.

5

How We Use Your Data

phraha uses your personal data for the following purposes:

Account Management: To create, maintain, and manage your phraha account, including verifying your identity and eligibility to use the platform.
Service Delivery: To provide you with access to phraha's gaming services, process your deposits and withdrawals, and deliver the features and functionality of the platform.
Legal and Regulatory Compliance: To comply with our obligations under Philippine law, including the Data Privacy Act, Anti-Money Laundering Act, and PAGCOR regulations. This includes conducting KYC checks, filing mandatory reports, and responding to lawful requests from regulatory authorities.
Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, cheating, money laundering, and other prohibited conduct on the platform.
Responsible Gaming: To monitor gaming activity for signs of problem gambling and to administer responsible gaming tools such as deposit limits, cooling-off periods, and self-exclusion.
Customer Support: To respond to your inquiries, resolve disputes, and provide technical assistance.
Platform Improvement: To analyze usage patterns, conduct research, and improve the features, performance, and user experience of the phraha platform.
Marketing Communications: To send you promotional offers, bonus notifications, and news about phraha, where you have provided your consent to receive such communications.

phraha will not use your personal data for any purpose that is incompatible with the purposes described in this Privacy Policy without first obtaining your consent or as otherwise permitted by applicable law.

6

Legal Basis for Processing

phraha processes your personal data on the following legal bases under the Data Privacy Act of 2012:

Contractual Necessity: Processing is necessary for the performance of the contract between you and phraha — specifically, to provide you with access to the phraha platform and its services in accordance with our Terms & Conditions.
Legal Obligation: Processing is necessary for phraha to comply with its legal and regulatory obligations under Philippine law, including KYC requirements, AML reporting, and PAGCOR compliance.
Legitimate Interests: Processing is necessary for phraha's legitimate interests in operating a secure, fair, and commercially viable gaming platform, including fraud prevention, platform security, and service improvement, provided such interests are not overridden by your rights and interests.
Consent: For certain processing activities — such as sending marketing communications or using non-essential cookies — phraha relies on your freely given, specific, informed, and unambiguous consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

7

Data Sharing & Disclosure

phraha does not sell, rent, or trade your personal data to third parties for their own marketing purposes. phraha may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Privacy Policy:

Service Providers: Third-party vendors and service providers who assist phraha in operating the platform, including payment processors (GCash, Maya, banks), identity verification providers, IT infrastructure providers, and customer support platforms. These providers are contractually bound to process your data only on phraha's instructions and in accordance with applicable data privacy laws.
Regulatory and Law Enforcement Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities, where disclosure is required by law, court order, or regulatory directive.
Fraud Prevention and Security Services: Third-party fraud detection and security service providers who assist phraha in identifying and preventing fraudulent activity on the platform.
Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of phraha's business, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

Cross-Border Transfers: Where phraha transfers your personal data outside the Philippines, we ensure that appropriate safeguards are in place to protect your data in accordance with the Data Privacy Act of 2012 and NPC guidelines on cross-border data transfers.

8

Data Retention

phraha retains your personal data for as long as is necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

The following general retention periods apply:

Account Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with PAGCOR and AMLC record-keeping requirements.
Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act and its implementing regulations.
KYC and Verification Documents: Retained for a minimum of five (5) years following account closure or the completion of the relevant verification process.
Support Communications: Retained for a period of two (2) years from the date of the communication, unless a longer retention period is required for dispute resolution or legal proceedings.
Technical and Usage Data: Retained for a period of up to two (2) years for analytics and security purposes.

Upon expiry of the applicable retention period, phraha will securely delete or anonymize your personal data in accordance with its data disposal procedures.

9

Data Security

phraha implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

Transport Layer Security (TLS) encryption for all data transmitted between your device and the phraha platform.
Encryption of sensitive data at rest, including financial account details and identity documents.
Role-based access controls limiting access to personal data to authorized phraha personnel on a need-to-know basis.
Regular security assessments, vulnerability testing, and penetration testing of the phraha platform.
Multi-factor authentication requirements for access to systems containing personal data.
Incident response procedures for detecting, reporting, and responding to personal data breaches in accordance with NPC notification requirements.

While phraha takes all reasonable steps to protect your personal data, no data transmission over the internet or electronic storage system is completely secure. phraha cannot guarantee absolute security against all possible threats. You are encouraged to use a strong, unique password for your phraha account and to notify us immediately if you suspect any unauthorized access.

Data Breach Notification: In the event of a personal data breach that is likely to result in a real risk of serious harm to affected users, phraha will notify the National Privacy Commission and affected individuals in accordance with the requirements of the Data Privacy Act of 2012 and NPC Circular No. 16-03.

10

Cookies & Tracking Technologies

phraha uses cookies and similar tracking technologies to enhance your experience on the platform, analyze usage patterns, and support platform security. The following types of cookies are used:

Strictly Necessary Cookies: Essential for the operation of the phraha platform, including session management, authentication, and security functions. These cookies cannot be disabled without affecting platform functionality.
Performance and Analytics Cookies: Used to collect anonymized information about how users interact with the phraha platform, helping us identify areas for improvement and optimize platform performance.
Functional Cookies: Used to remember your preferences and settings, such as language preferences and display options, to provide a more personalized experience.
Marketing Cookies: Used to deliver relevant promotional content and measure the effectiveness of phraha's marketing activities. These cookies are only placed with your consent.

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling certain cookies may affect the functionality of the phraha platform. For detailed instructions on managing cookies in your browser, refer to your browser's help documentation.

11

Your Privacy Rights

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phraha:

Right to Be Informed: The right to be informed of how your personal data is collected, used, stored, and shared by phraha, as described in this Privacy Policy.
Right of Access: The right to request a copy of the personal data phraha holds about you, along with information about how it is being processed.
Right to Rectification: The right to request correction of any inaccurate or incomplete personal data phraha holds about you.
Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to phraha's legal and regulatory retention obligations.
Right to Object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on phraha's legitimate interests.
Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, where technically feasible.
Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe that phraha has processed your personal data in violation of the Data Privacy Act of 2012.

To exercise any of your privacy rights, please contact the phraha support team using the contact details in Section 14. phraha will respond to your request within a reasonable timeframe and in accordance with applicable legal requirements. phraha may need to verify your identity before processing your request.

12

Children's Privacy

The phraha platform is strictly intended for individuals aged 21 years and older. phraha does not knowingly collect, process, or retain personal data from individuals under the age of 21.

If phraha becomes aware that personal data has been collected from a person under the age of 21 without appropriate parental or guardian consent, phraha will take immediate steps to delete such data and close the associated account. Any winnings or balances associated with an underage account will be handled in accordance with phraha's Terms & Conditions.

If you are a parent or guardian and believe that your child under the age of 21 has provided personal data to phraha, please contact our support team immediately so that we can take appropriate action.

Age Verification: phraha employs age verification procedures during account registration and may request documentary proof of age at any time. These measures are in place to protect minors and to comply with Philippine gaming regulations.

13

Changes to This Privacy Policy

phraha reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or regulatory requirements. When material changes are made, phraha will notify you through one or more of the following methods:

A prominent notice displayed on the phraha platform.
An email notification sent to your registered email address.
An in-account notification visible upon your next login to phraha.

The "Last Updated" date at the top of this Privacy Policy reflects the date of the most recent revision. Your continued use of the phraha platform following the effective date of any amendment constitutes your acknowledgment of the updated Privacy Policy.

phraha recommends that you review this Privacy Policy periodically to stay informed of how we are protecting your personal data. If you do not agree with any changes to this Privacy Policy, you should cease using the phraha platform and may request account closure in accordance with our Terms & Conditions.

14

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way phraha handles your personal data, please contact our Data Protection Officer or support team:

Email: [email protected] (plain text — not a clickable link)
Live Chat: Available through the phraha platform after logging in to your account.

phraha aims to respond to all privacy-related inquiries within five (5) business days. For complex requests involving data access, rectification, or erasure, a longer response period may apply. phraha will keep you informed of the progress of your request throughout the process.

If you are not satisfied with phraha's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines through its official channels.

National Privacy Commission: The NPC is the Philippine government body responsible for administering and implementing the Data Privacy Act of 2012. Complaints may be filed with the NPC in accordance with its published complaint procedures.

phraha Privacy Policy

Privacy at a Glance

Philippine Law Compliance

Secure Data Storage

No Unauthorized Sharing

Your Right to Access

Transparent Cookie Use

Marketing Opt-Out

Contents