phspain
Privacy Policy

phspain ("we," "us," "our") operates the online gaming platform accessible at phspain.net, providing Filipino players with access to slots, live casino games, sports betting, bingo, sabong, and related gaming services. This Privacy Policy describes how phspain collects, uses, discloses, stores, and protects personal information provided by or generated about players ("you," "your," "Data Subject") who access or use the phspain platform.

This Privacy Policy is issued in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, its Implementing Rules and Regulations (IRR), and relevant issuances of the National Privacy Commission (NPC) of the Philippines. It is also informed by PAGCOR's player data and responsible gaming obligations applicable to licensed online gaming operators in the Philippines.

By registering for a phspain account, depositing funds, or otherwise using the phspain platform, you acknowledge that you have read this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue your use of the phspain platform.

phspain collects the following categories of personal data, depending on the nature of your interaction with the platform:

Where required by PAGCOR KYC rules or the Anti-Money Laundering Act (RA 9160 as amended), phspain may request additional documentation such as proof of address, source-of-funds declarations, or a signed self-declaration form.

phspain collects personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, participate in promotions, or submit any form on the phspain platform.
• Automatically: Through cookies, web beacons, server logs, and similar tracking technologies when you browse or interact with the phspain website or mobile application. Technical data such as your IP address, device fingerprint, and session behavior is collected automatically.
• From third-party payment providers: When you use GCash, PayMaya, ShopeePay, bank transfer services, or other integrated payment channels, relevant transaction data is shared with phspain by those providers to facilitate processing and fraud prevention.
• From identity verification providers: phspain uses licensed third-party KYC verification services to cross-check government-issued ID documents against authoritative databases. These providers supply verification results — not raw document images — back to phspain for account approval purposes.
• From analytics platforms: Aggregated, anonymized behavioral data may be received from analytics partners to help phspain understand platform usage patterns and improve user experience. This data is not linked to any identifiable individual.

phspain uses the personal data we collect for the following specific purposes. Each purpose is supported by a lawful basis as described in Section 05:

• Account creation and management: To register your phspain account, verify your identity, maintain account records, and provide you with access to the platform's gaming services.
• Payment processing: To process your deposits and withdrawals via GCash, PayMaya, bank transfer, and other supported payment channels, and to maintain accurate financial records.
• KYC and AML compliance: To fulfill our obligations under PAGCOR licensing requirements and the Anti-Money Laundering Act (RA 9160), including verifying your identity, monitoring transaction patterns, and filing suspicious transaction reports with the Anti-Money Laundering Council (AMLC) where legally required.
• Customer support: To respond to your inquiries, resolve disputes, process complaints, and improve support service quality through review of interaction records.
• Responsible gaming: To operate self-exclusion, deposit limits, session time limits, and other responsible gaming tools; to identify players who may be exhibiting problem gambling behaviors; and to fulfill PAGCOR responsible gaming reporting obligations.
• Fraud prevention and platform security: To detect, investigate, and prevent fraudulent activity, bonus abuse, multi-accounting, unauthorized access, and other threats to the integrity of the phspain platform.
• Personalization and promotions: With your consent, to send you targeted bonus offers, promotional notifications, and gaming recommendations based on your playing history and preferences, via email or in-platform messaging.
• Legal and regulatory compliance: To comply with all applicable Philippine laws, PAGCOR directives, NPC guidelines, and any court orders or legal process requiring disclosure of player data.
• Platform improvement: To analyze aggregated, anonymized usage data to improve game offerings, website performance, and the overall phspain user experience for Filipino players.

Under the Data Privacy Act of 2012 and its IRR, phspain relies on the following lawful bases for processing your personal data:

• Contractual necessity: Processing required to perform the contract between you and phspain — including account registration, payment processing, game delivery, and customer support — is carried out on the basis of contractual necessity.
• Legal obligation: Processing required to comply with applicable Philippine law — including PAGCOR licensing conditions, the Anti-Money Laundering Act, the Data Privacy Act itself, and NPC issuances — is carried out on the basis of legal obligation.
• Consent: Processing for marketing communications, optional analytics cookies, and certain personalization features is carried out on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time without detriment to your core account access.
• Legitimate interests: Processing for fraud prevention, platform security, aggregated analytics, and responsible gaming monitoring is carried out on the basis of phspain's legitimate interests, provided those interests are not overridden by your fundamental rights and freedoms as a Data Subject.

phspain does not process special categories of personal data (such as health data or biometric data) except where explicitly required by PAGCOR responsible gaming regulations or age verification requirements, in which case such processing is carried out under the legal obligation basis.

phspain does not sell, rent, or trade your personal data to any third party. We share personal data only in the following limited and controlled circumstances:

• Payment processors: GCash, PayMaya, ShopeePay, BPI, BDO, Metrobank, UnionBank, Visa/Mastercard acquiring banks, and cryptocurrency network operators receive the minimum data necessary to process your transactions. All payment partners are contractually obligated to handle your data securely and in accordance with applicable law.
• KYC and identity verification providers: Licensed identity verification partners receive your government-issued ID information and biographical data solely for the purpose of verifying your eligibility to hold a phspain account. Verification providers are bound by strict data processing agreements.
• PAGCOR and Philippine regulatory authorities: As a licensed operator, phspain is required to share player data — including account information, transaction records, and responsible gaming data — with PAGCOR upon request or as mandated by PAGCOR's reporting framework.
• Anti-Money Laundering Council (AMLC): phspain is required by RA 9160 (AMLA) to file Covered Transaction Reports (CTRs) and Suspicious Transaction Reports (STRs) with the AMLC where applicable thresholds or indicators are triggered.
• Law enforcement and courts: phspain will disclose personal data to law enforcement agencies, courts, or other government bodies when required to do so by a valid court order, subpoena, or other compulsory legal process under Philippine law.
• Technology and platform service providers: Third-party technology vendors — including cloud hosting providers, cybersecurity firms, and analytics platforms — may process personal data on phspain's behalf as data processors under strict data processing agreements that prohibit independent use of your data.
• Game content providers: Where required for game integrity monitoring or RNG audit purposes, limited gaming activity data may be shared with licensed game studios (such as Pragmatic Play, PG Soft, or Habanero) under the terms of their platform integration agreements.

phspain uses cookies and similar tracking technologies to operate the platform, enhance your experience, and fulfill regulatory obligations. The following categories of cookies are used:

You can manage your cookie preferences at any time through the phspain cookie preferences panel, accessible via the link in the website footer. You may also control cookies through your browser settings, though disabling strictly necessary cookies will impair platform functionality. Note that cookie opt-outs are stored per device and per browser — you will need to repeat your preference if you clear browser data or access phspain from a different device.

phspain retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account relationship with phspain, plus a minimum of five (5) years following account closure, as required by PAGCOR licensing conditions and AMLA record-keeping obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with AMLA Section 9 record-keeping requirements.
• KYC documents: Retained for the duration of the account relationship plus five (5) years, or longer if required by an ongoing legal or regulatory investigation.
• Gaming and betting history: Retained for five (5) years from account closure for audit and dispute resolution purposes.
• Customer support records: Retained for three (3) years from the date of the last interaction, unless the interaction relates to an unresolved dispute or legal matter.
• Marketing consent records: Retained for the duration of the consent plus three (3) years, to demonstrate compliance with Data Privacy Act consent requirements.
• Technical and log data: Retained for up to ninety (90) days in active systems, then archived for up to twelve (12) months for security investigation purposes before deletion.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized such that it can no longer be linked to any identifiable individual. Where anonymized data is retained for analytical purposes, it is no longer considered personal data under the Data Privacy Act.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phspain. These rights may be exercised by submitting a written request to our Data Protection Officer at [email protected]:

• Right to be informed: The right to know whether phspain holds personal data about you, and to receive a description of the data, the purposes for which it is processed, and the recipients to whom it has been disclosed.
• Right of access: The right to obtain a copy of the personal data phspain holds about you, in a commonly used electronic format where feasible.
• Right to rectification: The right to have inaccurate or incomplete personal data corrected without undue delay. Minor account details (such as contact information) can be updated directly through your account settings panel.
• Right to erasure: The right to request deletion of personal data that is no longer necessary for the purpose for which it was collected, where processing was based solely on consent (which has since been withdrawn), or where processing is unlawful. Note that this right is subject to phspain's legal retention obligations under PAGCOR and AMLA requirements.
• Right to data portability: The right to receive a structured, commonly used, and machine-readable copy of personal data you provided to phspain, and to have that data transmitted to another personal information controller where technically feasible.
• Right to object: The right to object to processing of your personal data for direct marketing purposes. Upon receipt of an objection, phspain will cease processing for that purpose immediately and without requiring justification.
• Right to damages: The right to be indemnified for damages suffered due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, in accordance with the Data Privacy Act and relevant NPC issuances.
• Right to file a complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated. The NPC can be reached at privacy.gov.ph.

phspain implements a layered security framework to protect personal data against unauthorized access, disclosure, alteration, or destruction. Our security measures include:

• Transport encryption: All data transmitted between your device and phspain servers is encrypted using TLS 1.2 or higher. The phspain website enforces HTTPS across all pages and API endpoints.
• Data-at-rest encryption: Sensitive personal data stored in phspain databases — including payment credentials and identity documents — is encrypted using AES-256 encryption.
• Access controls: Access to personal data is restricted to phspain personnel and authorized third-party processors who require it to perform their designated functions. Role-based access controls (RBAC) and multi-factor authentication (MFA) are enforced for all internal systems handling personal data.
• Penetration testing: phspain engages independent cybersecurity firms to conduct regular penetration tests and vulnerability assessments on platform infrastructure.
• Incident response: phspain maintains a documented personal data breach response plan. In the event of a breach that poses a real risk to affected Data Subjects, phspain will notify the NPC within seventy-two (72) hours of becoming aware of the breach, and will notify affected players without undue delay, consistent with Section 20(f) of the Data Privacy Act.
• Employee training: All phspain staff with access to personal data receive mandatory data privacy and security training upon onboarding and on an annual basis thereafter.

The phspain platform is strictly intended for adults aged 21 years and above, in accordance with the minimum legal age for casino-style gaming under applicable PAGCOR regulations in the Philippines. phspain does not knowingly collect, process, or retain personal data from any individual below the age of 21.

If phspain becomes aware, through our KYC verification process or any other means, that a player's account has been registered by an individual below the age of 21, the account will be immediately suspended and permanently closed. Any balance in the account will be subject to a full review before any determination regarding its disposition is made, consistent with PAGCOR guidelines on underage gambling incidents.

If you are a parent or guardian and have reason to believe that a minor in your care has accessed or registered on the phspain platform, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action without delay.

phspain reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable Philippine law or NPC regulations, changes to PAGCOR licensing requirements, changes to phspain's data processing practices, or technological or operational changes to the platform.

When material changes are made to this Privacy Policy, phspain will notify registered players via email notification sent to the address on file and/or by displaying a prominent notice on the phspain platform for a period of no less than seven (7) days before the changes take effect. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision.

Your continued use of the phspain platform following the effective date of any update to this Privacy Policy constitutes your acknowledgment of the updated terms. If any updated provision is unacceptable to you, you may close your account in accordance with the account termination procedure described in phspain's Terms & Conditions.

phspain has appointed a Data Protection Officer (DPO) in accordance with Section 21 of the Data Privacy Act of 2012 and NPC Circular No. 16-01. The DPO is responsible for overseeing phspain's compliance with data privacy obligations and serves as the primary point of contact for all data subject rights requests, privacy inquiries, and NPC correspondence.

To exercise your data subject rights, raise a privacy concern, or submit a request for information about phspain's data processing practices, please contact the Data Protection Officer using the details below:

If you are not satisfied with phspain's response to your data privacy concern, you have the right to escalate your complaint directly to the National Privacy Commission (NPC) of the Philippines. The NPC is the independent government body responsible for administering and enforcing the Data Privacy Act of 2012.

For general customer support inquiries not related to data privacy, please use the 24/7 Live Chat available on the phspain platform or email [email protected] with your account details and a description of your concern.