mph365 Privacy Policy

1 Introduction

mph365 ("we," "us," "our," or "the Platform") is committed to protecting the privacy and personal data of all individuals who interact with our online gaming platform. This Privacy Policy has been prepared in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy describes how mph365 collects, uses, stores, shares, and protects personal data in connection with your use of the Platform, including the website at mph365.net and the mph365 mobile application. It also describes the rights you have in relation to your personal data and how you may exercise those rights.

We encourage you to read this Privacy Policy carefully and in full. If you have any questions after reading it, please contact our Data Protection Officer using the details provided in Section 14 of this Policy.

2 Data Controller

For the purposes of the Philippine Data Privacy Act of 2012, mph365 is the personal information controller in respect of all personal data collected through the Platform. This means that mph365 determines the purposes for which, and the manner in which, your personal data is processed.

mph365 has appointed a Data Protection Officer (DPO) who is responsible for overseeing the Platform's data protection practices and ensuring compliance with applicable Philippine privacy laws. The contact details of our DPO are set out in Section 14 of this Policy.

3 Personal Data We Collect

mph365 collects personal data from you in several ways — directly when you register or interact with the Platform, automatically when you use the Platform, and from third parties where permitted by law. The categories of personal data we collect include:

3.1 Registration and Identity Data

• Full legal name as it appears on your government-issued identification
• Date of birth (used to verify that you are at least 21 years of age)
• Residential address, including barangay, city or municipality, province, and postal code
• Email address and mobile phone number
• Username and encrypted password
• Government-issued identification documents (e.g., Philippine passport, SSS ID, PhilSys National ID, driver's licence, PRC ID) submitted for KYC verification

3.2 Financial Data

• GCash or PayMaya mobile wallet account details
• Bank account details for BPI, BDO, Metrobank, or other supported banks
• Transaction history, including deposit amounts, withdrawal amounts, and dates
• Wagering history and account balance information

3.3 Technical and Usage Data

• IP address and approximate geolocation data
• Device type, operating system, and browser information
• Session duration, pages visited, and features used on the Platform
• Login timestamps and access logs
• Cookie identifiers and similar tracking data (see Section 9)

3.4 Communications Data

• Records of communications between you and mph365 support staff, including live chat transcripts, email correspondence, and support ticket records
• Responses to surveys, promotions, or feedback requests

4 How We Use Your Personal Data

mph365 uses the personal data we collect for the following purposes:

mph365 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your consent or establishing another lawful basis for the processing.

5 Legal Basis for Processing

mph365 processes your personal data on the following legal bases as recognised under the Philippine Data Privacy Act of 2012:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and mph365, including account registration, transaction processing, and the provision of gaming services.
• Legal Obligation: Processing is necessary for mph365 to comply with its legal obligations under Philippine law, including anti-money laundering regulations, KYC requirements, and regulatory reporting obligations.
• Legitimate Interests: Processing is necessary for the legitimate interests of mph365, including fraud prevention, platform security, and responsible gaming monitoring, provided that such interests are not overridden by your rights and interests.
• Consent: Where mph365 relies on your consent as the legal basis for processing — for example, for direct marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6 Sharing Your Personal Data

mph365 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your personal data only in the following circumstances and only to the extent necessary for the relevant purpose:

• Payment Processors: We share financial data with payment service providers such as GCash, PayMaya, BPI, BDO, and Metrobank to process your deposits and withdrawals. These providers are bound by their own privacy policies and applicable Philippine financial regulations.
• Identity Verification Providers: We share identity documents and personal data with third-party KYC and identity verification service providers to fulfil our regulatory obligations. These providers process data solely on our instructions.
• Regulatory and Law Enforcement Authorities: We may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, or other competent Philippine authorities where required by law or where we are legally compelled to do so.
• Technology and Infrastructure Providers: We share data with cloud hosting, cybersecurity, and platform infrastructure providers who process data on our behalf under strict data processing agreements.
• Professional Advisers: We may share data with lawyers, auditors, and other professional advisers where necessary for the conduct of our business, subject to professional confidentiality obligations.

7 International Data Transfers

mph365 primarily stores and processes personal data within the Philippines. Where it is necessary to transfer personal data to service providers or infrastructure located outside the Philippines, mph365 ensures that appropriate safeguards are in place to protect your data in accordance with the requirements of the Philippine Data Privacy Act.

Such safeguards may include contractual clauses that impose data protection obligations on the recipient, or reliance on the recipient's adherence to internationally recognised data protection standards. mph365 will not transfer your personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate protective measures.

8 Data Retention

mph365 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

In general, mph365 applies the following retention periods:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with Philippine anti-money laundering regulations.
• Transaction and financial data: Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act of 2001 (Republic Act No. 9160) and its amendments.
• Communications data: Retained for up to three (3) years from the date of the communication, or longer where relevant to an ongoing dispute or regulatory investigation.
• Technical and usage data: Retained for up to two (2) years from the date of collection, unless required for longer for fraud prevention or security purposes.

When personal data is no longer required, mph365 will securely delete or anonymise it in accordance with our internal data disposal procedures.

9 Cookies and Tracking Technologies

mph365 uses cookies and similar tracking technologies on the Platform to enhance your user experience, remember your preferences, maintain your session, and analyse how the Platform is used. The types of cookies we use include:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They enable core features such as account login, session management, and security. These cookies cannot be disabled.
• Functional Cookies: These cookies allow the Platform to remember your preferences and settings, such as your preferred language and display options, to provide a more personalised experience.
• Analytics Cookies: These cookies collect information about how you use the Platform, including which pages you visit most frequently and any error messages you encounter. This data is used in aggregate form to improve the Platform.
• Marketing Cookies: Where you have given your consent, these cookies are used to deliver promotional content and offers that are relevant to your interests and usage patterns on the Platform.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the Platform. For more information on managing cookies, refer to your browser's help documentation.

10 Your Data Protection Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by mph365:

• Right to be Informed: You have the right to be informed about how your personal data is being collected and processed. This Privacy Policy fulfils that obligation.
• Right of Access: You have the right to request a copy of the personal data that mph365 holds about you, along with information about how it is being used.
• Right to Rectification: You have the right to request that mph365 correct any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to mph365's legal retention obligations.
• Right to Object: You have the right to object to the processing of your personal data where mph365 relies on legitimate interests as the legal basis for processing.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Withdraw Consent: Where mph365 processes your data on the basis of your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission of the Philippines if you believe that mph365 has not handled your personal data in accordance with applicable law.

To exercise any of the above rights, please contact our Data Protection Officer using the details provided in Section 14. mph365 will respond to all valid requests within thirty (30) days of receipt, in accordance with the requirements of the Philippine Data Privacy Act.

11 Children and Minors

The mph365 Platform is strictly intended for individuals who are at least 21 years of age. mph365 does not knowingly collect personal data from any person under the age of 21. The minimum age requirement of 21 years is a strict regulatory requirement applicable to casino-style online gaming in the Philippines.

If mph365 becomes aware that personal data has been collected from a person under the age of 21, we will immediately suspend the relevant account, delete the personal data in question, and report the matter to the relevant regulatory authority where required by law.

If you are a parent or guardian and you believe that your child has registered on the mph365 Platform, please contact us immediately using the details in Section 14 so that we can take appropriate action without delay.

12 Data Security

mph365 takes the security of your personal data seriously and implements a range of technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the mph365 Platform
• Encryption of sensitive data at rest, including financial data and identity documents
• Role-based access controls that limit access to personal data to authorised personnel only
• Regular security assessments, penetration testing, and vulnerability scanning
• Multi-factor authentication requirements for administrative access to systems holding personal data
• Incident response procedures for detecting, reporting, and responding to personal data breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, mph365 will notify the National Privacy Commission and, where required, affected individuals in accordance with the notification requirements of the Philippine Data Privacy Act and its Implementing Rules and Regulations.

While mph365 takes all reasonable steps to protect your personal data, no method of transmission over the internet or method of electronic storage is completely secure. You are responsible for maintaining the security of your account credentials and for notifying mph365 immediately if you suspect any unauthorised access to your account.

13 Changes to This Privacy Policy

mph365 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made to this Policy, mph365 will notify registered users by email or through a prominent notice on the Platform prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how mph365 is protecting your personal data. Your continued use of the Platform following the publication of any revised Privacy Policy constitutes your acknowledgement of the changes.

14 Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the way mph365 handles your personal data, please contact our Data Protection Officer. Our DPO is available to assist you with any data privacy matter, including requests to exercise your rights under the Philippine Data Privacy Act.

Data Protection Officer, mph365

Email: [email protected]

General Support: [email protected]

mph365 aims to respond to all data privacy enquiries and rights requests within thirty (30) calendar days of receipt. For complex requests, we may extend this period by a further thirty (30) days, in which case we will notify you of the extension and the reasons for it.