80ph Privacy Policy

1 About This Privacy Policy

This Privacy Policy ("Policy") describes how 80ph ("we," "us," or "our"), the operator of the online gaming platform accessible at 80ph.cam, collects, uses, stores, discloses, and protects the personal data of individuals ("you" or "Player") who register an account, access, or otherwise interact with the 80ph platform.

This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations, as administered by the National Privacy Commission ("NPC") of the Philippines. It should be read together with the 80ph Terms & Conditions, which govern the overall use of the platform.

By registering an account on 80ph, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must not use the 80ph platform.

2 Who We Are — Data Controller

80ph is the personal information controller ("PIC") in respect of the personal data processed through the 80ph platform. As PIC, 80ph determines the purposes for which, and the means by which, your personal data is processed.

80ph operates under a license issued by the Philippine Amusement and Gaming Corporation ("PAGCOR"), which imposes additional data governance and reporting obligations on the platform in its capacity as a regulated gaming operator.

For data privacy inquiries, subject access requests, or complaints, you may contact the 80ph Data Protection Officer using the contact details set out in Section 17 of this Policy.

3 Personal Data We Collect

80ph collects only the personal data necessary to provide its services, meet its regulatory obligations, and protect the integrity of its platform. The categories of personal data we process are set out in the table below.

4 How We Collect Your Data

80ph collects personal data through the following means:

4.1 Direct Collection

Data you provide voluntarily when registering an account, completing identity verification (KYC), making deposits or withdrawal requests, participating in promotions, submitting support requests, or otherwise communicating with 80ph. This includes all form fields completed on the 80ph platform, document uploads, and any data you provide to 80ph support agents via live chat or email.

4.2 Automated Collection

Data collected automatically during your use of the 80ph platform through cookies, web beacons, device fingerprinting, and server-side logging. This includes your IP address, device identifiers, session activity data, game interaction data, and navigation patterns within the platform. For further detail on automated data collection, see Section 7 (Cookies & Tracking Technologies).

4.3 Third-Party Sources

In certain circumstances, 80ph may receive data about you from third parties, including:

• Payment Processors: GCash, PayMaya / Maya, BPI, BDO, UnionBank, Coins.ph, and other payment partners may share transaction confirmation data and account holder name information with 80ph for payment verification and fraud prevention purposes.
• Identity Verification Providers: 80ph may engage third-party KYC service providers to assist with the verification of identity documents and liveness checks. These providers share their verification outcome (pass / fail) and may share additional verification metadata with 80ph.
• PAGCOR and Regulatory Authorities: 80ph may receive player-related information from PAGCOR in connection with its regulatory oversight functions, including information relating to self-exclusion registrations in the national PAGCOR exclusion list.
• Fraud and Security Intelligence: 80ph may receive data from third-party fraud intelligence networks used to identify known fraudulent actors, cheating patterns, or multi-account networks operating across the Philippine online gaming industry.

5 Purposes of Processing & Legal Bases

80ph processes your personal data only for specified, explicit, and legitimate purposes, and only where a lawful basis for processing exists under the DPA. The primary purposes and corresponding legal bases are as follows:

• Account registration and management — Necessary for the performance of the contract between you and 80ph (the Terms and Conditions you accept at registration).
• Identity and age verification (KYC) — Compliance with a legal obligation under PAGCOR regulations and the AMLA requiring all licensed gaming operators to verify player identity and age (21+ requirement).
• Payment processing — Necessary for the performance of the contract; compliance with legal obligations under AMLA covered and suspicious transaction reporting requirements.
• Responsible gaming monitoring — Compliance with PAGCOR's Responsible Gaming Framework; legitimate interest in player welfare protection.
• Fraud detection and security — Legitimate interest of 80ph in protecting the platform, its players, and the integrity of the gaming environment from fraud, cheating, and money laundering.
• Customer support — Performance of contract; legitimate interest in resolving disputes and maintaining service quality.
• Direct marketing and promotions — Consent (you may withdraw at any time by updating notification preferences in your account settings or contacting 80ph support).
• Platform analytics and product improvement — Legitimate interest in improving the 80ph platform experience, provided that such processing does not override your fundamental rights and freedoms.
• Regulatory reporting — Compliance with legal obligations, including PAGCOR statistical reporting, AMLC transaction reporting, and NPC breach notification obligations.

6 Data Sharing & Disclosure

80ph does not sell your personal data to third parties. We do not share your data for commercial purposes unrelated to the operation of the 80ph platform. We share personal data only in the following circumstances and only to the extent necessary for the stated purpose:

6.1 Service Providers and Sub-processors

80ph engages carefully selected third-party service providers who process personal data on our behalf as personal information processors ("PIPs") under written agreements that require them to process data only on 80ph's instructions and in accordance with the DPA. These include payment processors (GCash, PayMaya, BPI/BDO InstaPay gateways), KYC verification providers, cloud infrastructure providers hosting 80ph's platform, customer support software providers, and fraud detection service providers.

6.2 Regulatory Authorities

80ph will disclose personal data to PAGCOR, the Anti-Money Laundering Council ("AMLC"), the National Privacy Commission ("NPC"), the Bureau of Internal Revenue ("BIR"), and other Philippine government authorities where required to do so by law, valid court order, or the exercise of those authorities' regulatory powers. 80ph will disclose only the minimum data required to satisfy the regulatory or legal obligation.

6.3 Game Studio Providers

Third-party game studios whose titles are available on the 80ph platform may receive limited session and wagering data necessary for game delivery, jackpot network management, and studio audit purposes. This data is shared under contractual data protection obligations and does not include identity or financial data beyond what is technically required for game function.

6.4 Law Enforcement

Where 80ph is required by a lawful order from a Philippine law enforcement authority, or where disclosure is necessary to prevent or detect crime, protect the safety of any individual, or enforce 80ph's legal rights, 80ph may disclose personal data without prior notice to the affected individual.

7 Cookies & Tracking Technologies

80ph uses cookies and similar technologies on the platform to provide core functionality, maintain session security, detect fraud, and — with your consent — to personalize your experience and deliver relevant promotional content.

7.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in during a gaming session and security cookies used for CSRF protection and brute force prevention. These cannot be disabled without rendering the platform non-functional.
• Functional Cookies: Remember your platform preferences — such as display language, preferred game lobby view, and session timeout settings — to improve your experience on return visits.
• Analytics Cookies: Collect aggregated, anonymized data about how players navigate the platform to help 80ph identify usability issues and improve the platform. 80ph uses only privacy-compliant, Philippine-law-compatible analytics tools.
• Security and Fraud Prevention Cookies: Used to build a device fingerprint for the purpose of detecting multiple-account registrations, unusual login patterns, and known fraud indicators. These operate as a legitimate interest processing activity.

7.2 Cookie Management

You can control non-essential cookies through your browser settings. Restricting cookies may affect certain platform functions. Strictly necessary and security cookies cannot be disabled through browser settings and are required for the platform to operate safely.

8 Data Retention

80ph retains personal data for as long as is necessary to fulfil the purpose for which it was collected, and thereafter for as long as required by applicable law or regulation. The primary retention periods applicable to 80ph data are as follows:

• Account and identity data: For the duration of the active account and for a minimum of five (5) years after account closure, as required by PAGCOR regulations and the AMLA.
• Transaction and financial records: Minimum of five (5) years from the date of the transaction, as mandated by the AMLA and Bureau of Internal Revenue record-keeping requirements.
• KYC and identity documents: Minimum of five (5) years after account closure or the completion of the transaction for which they were obtained, whichever is later.
• Game session logs and wagering records: Minimum of two (2) years for standard dispute resolution purposes; five (5) years where records are material to an active regulatory investigation.
• Support communications: Minimum of two (2) years after the resolution of the relevant support interaction.
• Marketing consent records: For the duration of the account and for one (1) year after consent withdrawal or account closure, to demonstrate compliance with the DPA consent requirement.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in a manner that prevents re-identification, unless 80ph is required to retain it for a longer period due to an ongoing legal proceeding, regulatory investigation, or court order.

9 Data Security Measures

80ph implements a layered set of technical, organizational, and physical security measures designed to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include, without limitation:

• Encryption in transit: All data transmitted between your device and the 80ph platform is encrypted using TLS 1.2 or TLS 1.3 with 256-bit AES encryption.
• Encryption at rest: Sensitive personal data — including identity documents, financial records, and password hashes — is stored using industry-standard encryption algorithms.
• Access controls: Access to personal data within 80ph is restricted to personnel who need the data to perform their job functions. Role-based access control ("RBAC") is applied to all internal data systems. All data access is logged and subject to audit.
• Password security: Player passwords are stored as salted cryptographic hashes. 80ph does not store plaintext passwords and cannot retrieve your password — only reset it.
• Two-factor authentication: 80ph offers and strongly encourages two-factor authentication (2FA) via SMS OTP for all player accounts. 2FA is mandatory for withdrawal requests above certain thresholds.
• Security testing: The 80ph platform undergoes regular independent penetration testing and vulnerability assessments. Identified vulnerabilities are remediated on a risk-prioritized basis.
• Incident response: 80ph maintains a documented data breach response plan meeting NPC requirements, including designated breach response personnel and defined timelines for notification.

10 Cross-Border Data Transfers

In operating the 80ph platform, certain personal data may be processed by third-party service providers — including cloud infrastructure providers and game studios — whose systems are located outside the Republic of the Philippines. Where such cross-border data transfers occur, 80ph ensures that they are conducted in accordance with Section 21 of the DPA and the NPC's rules on cross-border data transfers.

Specifically, 80ph requires that all personal information processors engaged in cross-border processing have in place adequate data protection standards that are at least equivalent to those required by Philippine law, either by virtue of the jurisdiction's own data protection framework or by contractual data protection obligations imposed by 80ph in the applicable service agreement.

A list of the jurisdictions to which 80ph data may be transferred is available upon request from the 80ph Data Protection Officer (see Section 17).

11 Exercising Your Privacy Rights

To exercise any of the data subject rights described in this Policy — including the right to access, rectify, erase, or object to the processing of your personal data — you may submit a request to the 80ph Data Protection Officer using the contact details in Section 17.

Before processing your request, 80ph will verify your identity to ensure that personal data is not disclosed to, or acted upon at the direction of, an unauthorized party. Identity verification will typically require you to confirm details associated with your 80ph account.

80ph will respond to all valid data subject requests within fifteen (15) business days of receipt. Where a request is complex or voluminous, we may extend this period by a further fifteen (15) business days with prior written notice to you explaining the reason for the extension.

There is no charge for exercising your rights under the DPA. However, where a request is manifestly unfounded or excessive — in particular because of its repetitive character — 80ph reserves the right to charge a reasonable fee for the administrative cost of processing the request, or to refuse the request, having notified you of the basis for doing so.

12 Children and Persons Under 21

The 80ph platform is strictly for persons aged 21 years and above, consistent with Philippine law and PAGCOR regulations. 80ph does not knowingly collect personal data from individuals under the age of 21.

Where 80ph discovers that an account has been registered by a person under 21, or that personal data of a minor has been collected without appropriate consent and authority, 80ph will immediately close the relevant account, purge the data to the extent permitted by its legal obligations, and report the incident to PAGCOR as required by the platform's regulatory commitments.

13 Marketing Communications

With your consent, 80ph may send you promotional communications about bonuses, new games, platform updates, and special events via SMS, email, or in-platform notifications. Consent for marketing communications is captured at the time of account registration and can be withdrawn at any time without affecting your ability to use the platform.

To opt out of marketing communications, update your notification preferences in your 80ph account settings, or contact 80ph support at [email protected] requesting removal from marketing communications. Opt-out requests will be processed within five (5) business days. Note that even after opting out of marketing, you will continue to receive transactional and regulatory communications relating to your account — such as deposit confirmations, withdrawal notifications, KYC requests, and security alerts — as these are required for the performance of our contract with you.

14 Personal Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, 80ph will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, as required by NPC Circular 16-03 and its amendments.

Where the breach is likely to result in high risk to the affected individuals — for example, a breach of financial data or identity documents — 80ph will also notify the affected Players directly within the timeframe required by NPC rules, using the contact details associated with their accounts. The notification will include a description of the nature of the breach, the categories of data affected, the likely consequences, and the measures 80ph has taken or proposes to take to address it.

80ph maintains a documented record of all personal data breaches, including those that did not meet the NPC notification threshold, as required by the DPA's accountability principle.

15 Complaints to the National Privacy Commission

If you believe that 80ph has processed your personal data in violation of the Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. Before submitting a complaint to the NPC, you are encouraged to contact 80ph's Data Protection Officer (see Section 17) to seek resolution of the matter directly. 80ph will endeavor to respond to all privacy complaints within fifteen (15) business days.

The National Privacy Commission's official website and complaint submission procedures are available on the NPC's published government digital channels. Complaints to the NPC regarding 80ph should reference 80ph (80ph.cam) as the data controller concerned.

16 Updates to This Privacy Policy

80ph may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the services we offer. The "Effective Date" at the top of this Policy indicates when the most recent version came into effect.

Where changes are material — meaning they meaningfully alter how we collect, use, or share your personal data in a way that could affect your rights — 80ph will notify registered Players via the email address or mobile number associated with their account at least seven (7) days before the updated Policy takes effect. Your continued use of the 80ph platform after the effective date of an updated Policy constitutes your acceptance of the changes.

The current version of this Privacy Policy is always accessible at 80ph.cam/privacy-policy. We encourage you to review it periodically.

17 Contact Us — Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by 80ph, you may contact our Data Protection Officer:

• Email: [email protected] (subject line: "Privacy / DPO Request")
• Live Chat: Available 24/7 from the 80ph platform support icon
• Platform: 80ph.cam / About Us page

All data privacy inquiries directed to the 80ph Data Protection Officer are handled with confidentiality. The DPO is independent of operational and commercial functions of the platform and reports directly to senior management on data governance matters.