phpopen Privacy Policy

This Privacy Policy ("Policy") is published by phpopen ("we," "us," "our," or "the Platform") and applies to all personal information collected from individuals ("you," "user," or "member") who access, register with, or otherwise interact with the phpopen platform, including the website at phpopen.vip and all associated gaming, payment, and support services.

phpopen is committed to protecting the privacy and personal data of every member of the Philippine gaming community who uses our platform. We take our obligations under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations seriously, and we operate in full alignment with the regulatory guidance of the National Privacy Commission (NPC) of the Philippines.

This Policy explains what personal information phpopen collects, why we collect it, how we use and protect it, who we share it with, and what rights you have as a data subject under Philippine law. It should be read alongside the phpopen Terms & Conditions, which govern the broader contractual relationship between you and the platform.

For the purposes of the Data Privacy Act of 2012 and this Policy, phpopen is the personal information controller in respect of all personal data processed in connection with the phpopen platform.

phpopen has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and with applicable Philippine data protection law. Contact details for the phpopen DPO are provided in Section 15 of this Policy.

Where phpopen engages third-party service providers that process personal data on our behalf — such as payment processors, KYC verification providers, or cloud infrastructure providers — those parties act as personal information processors under our instruction and are bound by data processing agreements that require them to protect personal data to the same standard as phpopen.

phpopen collects the following categories of personal data from members and platform visitors:

phpopen collects personal data through the following methods:

• Direct collection: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, participating in a promotion, or contacting phpopen support.
• Automated collection: Technical and behavioral data collected automatically when you visit the phpopen website or use platform features, via server logs, session tracking technology, and cookies (see Section 8).
• Third-party sources: Identity and address verification data received from KYC verification providers and fraud screening services; payment confirmation data received from GCash, PayMaya, and banking institutions; device reputation data from fraud prevention partners.
• PAGCOR and regulatory sources: Data provided by or through PAGCOR or other Philippine gaming regulators in connection with licensing compliance, self-exclusion registries, or regulatory investigations.

phpopen processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to fulfill our obligations under the phpopen Terms & Conditions, including account management, payment processing, and game provision.
• Legal obligation: Processing required to comply with Philippine law, including anti-money laundering obligations under Republic Act No. 9160 (AMLA), PAGCOR regulatory requirements, and tax reporting obligations.
• Legitimate interests: Processing conducted for phpopen's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and platform improvement — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — including marketing communications, optional analytics participation, and certain cookie categories. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

phpopen uses the personal data we collect for the following specific purposes:

• Account creation and management: To register your phpopen account, verify your identity, maintain your account profile, and authenticate your login sessions.
• Service delivery: To enable you to use all phpopen gaming products including the live casino, slots, bingo, sports betting, and sabong sections, and to process wagers and game outcomes.
• Financial processing: To process deposits via GCash, PayMaya, BPI, BDO, Metrobank, and card payments, and to process withdrawal requests to your verified payment method.
• KYC and regulatory compliance: To verify your identity and age in accordance with PAGCOR requirements and Philippine anti-money laundering law, and to satisfy ongoing regulatory obligations.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, money laundering, bonus abuse, and other prohibited conduct.
• Responsible gaming: To monitor for indicators of problem gambling behavior and to administer responsible gaming tools including deposit limits, session alerts, and self-exclusion at your request or as required by regulation.
• Customer support: To respond to your support inquiries, resolve disputes, and maintain records of support interactions.
• Marketing communications: Where you have consented, to send you promotional offers, bonus notifications, and platform news relevant to your phpopen account. You may withdraw this consent at any time.
• Platform improvement: To analyze aggregate usage data for the purpose of improving the phpopen platform, user interface, and gaming experience.
• Legal compliance: To comply with court orders, regulatory investigations, subpoenas, and other legally binding demands from Philippine authorities.

phpopen does not sell, rent, or trade your personal information. We share your data only in the following circumstances and only to the extent strictly necessary:

• Payment processors: Financial data necessary to process deposits and withdrawals is shared with GCash, PayMaya, Visa/Mastercard networks, and your bank. These parties are independent data controllers subject to their own privacy policies and Philippine BSP regulations.
• KYC and identity verification providers: Identity documentation submitted during account registration is processed by our certified KYC technology partner to verify your identity and age. Data processed by this partner is governed by a data processing agreement with phpopen.
• Fraud prevention services: Device and behavioral data may be shared with fraud screening services to protect the platform and its members from fraudulent activity and money laundering.
• PAGCOR and Philippine gaming regulators: phpopen is required to share certain member data with PAGCOR in connection with licensing compliance, regulatory audits, and the administration of self-exclusion registries.
• Law enforcement and judicial authorities: phpopen will disclose personal data to Philippine law enforcement agencies, courts, or other government authorities when required to do so by a valid legal demand, court order, or applicable law.
• Professional advisors: Legal counsel, auditors, and accountants acting under duties of confidentiality, where access to personal data is required for the provision of their professional services to phpopen.

The phpopen platform uses cookies and similar tracking technologies to provide and improve our services. The following categories of cookies are used:

You may manage your cookie preferences at any time via the cookie settings panel accessible in your phpopen account settings. Withdrawing consent for non-essential cookies will not affect the core gaming functionality of the phpopen platform.

phpopen retains personal data for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:

• Account and identity data: Retained for the duration of the active account plus a minimum of 5 years following account closure, in accordance with anti-money laundering retention requirements under Philippine law.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, in accordance with the requirements of the Anti-Money Laundering Act (Republic Act No. 9160) and BSP regulations.
• KYC documentation (government ID images): Retained for a minimum of 5 years following account closure. Biometric data used only for liveness verification during KYC is deleted within 90 days of verification completion.
• Customer support records: Retained for 3 years from the date of each interaction.
• Technical and server log data: Retained for up to 12 months for security and fraud prevention purposes, then deleted or anonymized.
• Marketing consent records: Retained for the duration of your phpopen account plus 12 months following account closure to evidence the basis for prior communications.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Anonymized data — which cannot be used to identify any individual — may be retained indefinitely for statistical and research purposes.

phpopen implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmissions between your device and the phpopen platform.
• Bcrypt password hashing — your phpopen password is never stored in readable form. Only a cryptographic hash is stored, rendering your password unrecoverable even in the event of unauthorized database access.
• Two-factor authentication (2FA) available for all phpopen accounts, providing an additional layer of login protection using your registered Philippine mobile number.
• Role-based access controls ensuring that phpopen staff can only access personal data to the extent required for their specific job function. Access to sensitive data is logged and reviewed.
• Card tokenization — Visa and Mastercard details processed through the phpopen platform are tokenized immediately. phpopen does not store full card numbers.
• Regular third-party security audits and penetration testing conducted by independent security specialists.
• Data breach response procedures in accordance with the NPC's requirements, including notification to affected data subjects and the NPC within 72 hours of discovering a breach that poses risk to individual rights.

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights in respect of your personal data held by phpopen:

To exercise any of the above rights, please contact the phpopen Data Protection Officer at the details provided in Section 15. phpopen will respond to all data subject rights requests within 30 calendar days. Complex requests may require up to an additional 30-day extension, of which you will be notified.

If you believe phpopen has not handled your personal data in accordance with this Policy or applicable Philippine law, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

The phpopen platform is strictly intended for adults aged 21 years or older in accordance with Philippine gaming law. phpopen does not knowingly collect personal data from individuals under the age of 21.

During account registration, all applicants are required to provide their date of birth, and identity verification confirms age compliance. Any account found to have been registered by a person under the age of 21 will be immediately suspended. Any personal data collected in connection with such an account will be deleted following the conclusion of any applicable regulatory review.

If you are a parent or guardian and believe that a minor in your care has registered a phpopen account, please contact the phpopen Data Protection Officer immediately at the details in Section 15.

The phpopen platform is operated primarily within the Philippines. In limited circumstances, personal data may be transferred to, or accessed by, processors or sub-processors located outside the Philippines — for example, where cloud infrastructure, fraud screening, or KYC verification services are operated from international locations.

Any transfer of personal data outside the Philippines is governed by the following safeguards in accordance with NPC guidelines:

• Transfers are made only to countries with an adequate level of data protection as recognized by the NPC, or where appropriate contractual safeguards (such as NPC-approved data processing agreements) are in place.
• All international data processing agreements include provisions requiring the recipient to apply data protection standards equivalent to those applicable under Philippine law.
• phpopen maintains a register of all cross-border data transfers and the safeguards applicable to each, available for review by the NPC upon request.

phpopen reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or platform functionality. The following notice provisions apply:

• For material changes — those that substantially affect your privacy rights or the way in which phpopen processes your personal data — phpopen will provide at least 14 days' advance notice by email to your registered phpopen address before the changes take effect.
• For non-material changes — including clarifications, formatting updates, or corrections — phpopen will update the "Last Reviewed" date at the top of this Policy without advance individual notice.
• The current version of this Policy as published at phpopen.vip/privacy-policy supersedes all prior versions at all times.

Your continued use of phpopen following the effective date of any material change constitutes your acceptance of the updated Policy. If you do not accept a material change, you may request account closure prior to the effective date by contacting phpopen support.

For any privacy-related queries, data subject rights requests, or concerns about how phpopen handles your personal data, please contact the phpopen Data Protection Officer:

phpopen's DPO will acknowledge all data privacy requests within 2 business days and provide a substantive response within 30 calendar days. If you remain unsatisfied with our response, you have the right to escalate your complaint to the National Privacy Commission of the Philippines.