phream Privacy Policy

1. Who We Are (Data Controller)

phream ("phream," "we," "us," or "our") is the data controller responsible for the personal information collected through the phream online gaming platform accessible at phream.club (the "Platform"). phream operates within the PAGCOR regulatory framework and in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Republic of the Philippines, and its Implementing Rules and Regulations.

This Privacy Policy applies to all personal data processed by phream in connection with your use of the Platform, including registration, gameplay, financial transactions, customer support interactions, and marketing communications.

If you have any questions or concerns about this Privacy Policy or phream's data practices, please contact our Data Protection Officer at [email protected].

2. Personal Data We Collect

phream collects personal data that you provide directly, data generated through your use of the Platform, and in certain cases, data received from third-party sources for identity verification purposes. The categories of data phream collects include:

2.1 Registration Data

• Full legal name (as it appears on your Philippine government-issued ID)
• Date of birth (to verify you are 21 years of age or older)
• Philippine mobile number
• Email address
• Username and encrypted password
• Residential address in the Philippines

2.2 Identity Verification (KYC) Data

• Copies of government-issued Philippine identification documents (e.g., PhilSys National ID, UMID, driver's license, passport)
• Selfie or facial image (where required for liveness verification)
• Source of funds documentation (where required by anti-money laundering procedures)

2.3 Financial Data

• GCash or Maya mobile wallet number (where used for deposits or withdrawals)
• Bank account details for BPI, BDO, or Metrobank transfers (where provided)
• Transaction history including deposit amounts, withdrawal requests, and payment method used

2.4 Gaming Activity Data

• Games played, bet amounts, win and loss records, session duration
• Bonus claims and wagering activity
• Sports betting selections and outcomes

2.5 Technical & Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser information
• Session cookies and locally stored preferences
• Platform interaction logs and error reports

2.6 Communications Data

• Customer support chat and email correspondence
• Feedback, complaints, and survey responses
• Marketing communication preferences

3. How phream Uses Your Personal Data

phream processes your personal data for the following purposes:

• Account Management: To create, verify, maintain, and close your phream player account, and to authenticate your identity at login
• Service Delivery: To provide access to games, process deposits and withdrawals, award bonuses, and deliver customer support
• Legal Compliance: To fulfil obligations under PAGCOR regulations, the Anti-Money Laundering Act (AMLA), and RA 10173, including mandatory KYC checks and suspicious transaction reporting
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, bonus abuse, and other prohibited conduct
• Responsible Gaming: To monitor gaming patterns for indicators of problem gambling and to enforce self-exclusion, deposit limits, and other responsible gaming controls set by the player or required by regulation
• Platform Improvement: To analyze usage patterns, diagnose technical issues, and improve the performance and user experience of the phream Platform
• Marketing Communications: To send you promotional offers, bonus notifications, and Platform updates where you have provided consent or where permitted under applicable law. You may opt out at any time
• Dispute Resolution: To investigate and resolve complaints, chargebacks, and disputes relating to your phream account or transactions

4. Legal Basis for Processing

phream processes your personal data on the following legal bases under RA 10173 and its Implementing Rules:

• Contractual Necessity: Processing required to perform our obligations under the phream Terms and Conditions, including account creation, gameplay, and payment processing
• Legal Obligation: Processing required to comply with PAGCOR regulations, AMLA obligations, tax reporting requirements, and other applicable Philippine law
• Legitimate Interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where phream's legitimate interests are not overridden by your data protection rights
• Consent: Processing for direct marketing communications and optional data uses where we have obtained your explicit, informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing

5. Data Sharing & Disclosure

phream does not sell or rent your personal data to third parties. phream may share your personal data with the following categories of recipients under appropriate data processing agreements or legal obligations:

• Payment Service Providers: GCash (G-Xchange, Inc.), Maya (PayMaya Philippines, Inc.), and banking partners for the purpose of processing deposits and withdrawals
• Identity Verification Providers: Third-party KYC and identity verification service providers engaged to assist with RA 10173 and AMLA compliance
• Game Providers: Third-party game studios whose games are hosted on the phream Platform, to the extent necessary for game functionality and fairness auditing
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities where disclosure is required by law or regulation
• IT & Infrastructure Partners: Cloud hosting, security, and technical service providers operating under strict data processing agreements that prohibit independent use of your data
• Professional Advisors: Legal counsel, auditors, and insurers, under obligations of professional confidentiality

All third-party data processors engaged by phream are contractually bound to process your data only in accordance with phream's instructions and applicable Philippine data protection law.

6. Data Retention

phream retains your personal data for as long as your account is active and for a minimum period of five (5) years following account closure, in compliance with PAGCOR regulatory requirements and the AMLA record-keeping obligations applicable to online gaming operators in the Philippines.

Specific retention periods applicable to different data categories are as follows:

• Account and identity data: 5 years from account closure
• Financial transaction records: 5 years from the date of each transaction, as required by AMLA
• Gaming activity logs: 2 years from the date of each session
• Customer support communications: 2 years from the date of the interaction
• Marketing consent records: Until consent is withdrawn, plus 1 year

After the applicable retention period, phream will securely delete or anonymize your personal data in accordance with its data disposal procedures.

7. Cookies & Tracking Technologies

phream uses cookies and similar technologies on the Platform. The following types of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function — including session authentication, security tokens, and load balancing. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, game lobby view, and notification preferences to improve your phream experience.
• Analytics Cookies: Collect aggregated, anonymized data about how players use the Platform to help phream identify performance issues and improve the user experience. phream uses privacy-respecting analytics tools and does not share analytics data with advertising networks.

phream does not use third-party advertising or retargeting cookies that track your activity across other websites. You can manage cookie preferences through your browser settings; however, disabling strictly necessary cookies may impair your ability to use the phream Platform.

8. Data Security

phream implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and phream's servers
• Encryption of sensitive data fields (including passwords, which are stored as salted cryptographic hashes) at rest
• Role-based access controls ensuring that phream staff access only the data necessary for their specific job functions
• Regular security audits, penetration testing, and vulnerability assessments
• Multi-factor authentication for phream staff access to production systems
• Incident response procedures including breach notification protocols compliant with NPC requirements

In the event of a personal data breach that poses a risk to your rights, phream will notify the National Privacy Commission within 72 hours of becoming aware of the breach and will notify affected players where required by applicable law.

9. Your Data Subject Rights

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by phream:

• Right to Be Informed: To be informed of how your personal data is collected and processed — which this Privacy Policy fulfils
• Right of Access: To obtain a copy of the personal data phream holds about you
• Right to Rectification: To request correction of inaccurate or incomplete personal data
• Right to Erasure: To request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to retention obligations under Philippine law
• Right to Object: To object to processing of your personal data for direct marketing purposes at any time
• Right to Data Portability: To receive your personal data in a structured, commonly used format where processing is based on consent or contractual necessity
• Right to Lodge a Complaint: To file a complaint with the National Privacy Commission (NPC) if you believe phream has violated your data protection rights

To exercise any of these rights, contact phream's Data Protection Officer at [email protected] with the subject line "Data Subject Request." phream will respond within fifteen (15) business days of receiving a valid request.

10. Children's Privacy

The phream Platform is strictly for individuals who are 21 years of age or older, in compliance with Philippine gambling regulations. phream does not knowingly collect, process, or retain personal data from individuals under 21 years of age.

If phream becomes aware that personal data has been collected from a person under 21, phream will immediately delete all such data, close the associated account, and return any deposits in accordance with its underage account closure procedures. If you believe that a minor has registered on phream, please contact [email protected] immediately.

11. International Data Transfers

phream primarily processes data within the Philippines. Where personal data is transferred to service providers operating outside the Philippines — for example, cloud infrastructure providers or game studios — phream ensures that appropriate safeguards are in place in accordance with Section 21 of RA 10173 and the NPC's rules on cross-border data flows.

Such safeguards may include contractual data processing agreements incorporating the NPC's standard contractual clauses, or transfers to jurisdictions that the NPC has recognized as providing an adequate level of data protection. phream does not transfer personal data to countries that lack adequate data protection frameworks without appropriate safeguards in place.

12. Changes to This Privacy Policy

phream may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the Platform. When material changes are made, phream will notify registered users via email or an in-Platform notification prior to the changes taking effect.

The current version of this Privacy Policy is always available at phream.club/privacy-policy, with the effective date displayed at the top. Your continued use of the phream Platform after an updated Privacy Policy has been posted constitutes acceptance of the revised terms.

13. Contact & Data Protection Officer

For any privacy-related enquiries, data subject requests, or concerns about phream's data practices, please contact our Data Protection Officer:

• Email: [email protected]
• Subject line: "Privacy Enquiry" or "Data Subject Request"
• Response time: Within 15 business days for formal data subject requests; within 3 business days for general privacy enquiries

If you are not satisfied with phream's response to your privacy concern, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines, the independent regulatory authority responsible for enforcing RA 10173.