Privacy Policy — 999phl.com

1. Introduction

This Privacy Policy ("Policy") describes how 999phl.com ("the Platform", "we", "us", "our") collects, uses, stores, shares, and protects the personal information of individuals ("User", "you", "your") who access or use the 999phl.com online gaming platform available at 999phlcom.org, including all associated games, features, promotions, and support services.

999phl.com is committed to protecting the privacy and personal data of every Filipino player on the platform. This Policy is drafted in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), its Implementing Rules and Regulations ("IRR"), and the issuances of the National Privacy Commission ("NPC").

By registering an account on 999phl.com or otherwise using the platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, please do not use the 999phl.com platform.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which form part of the overall agreement between you and 999phl.com.

2. Data Controller

2.1 For the purposes of the Data Privacy Act of 2012 and this Policy, 999phl.com acts as the personal information controller ("PIC") with respect to the personal data of its registered users and platform visitors.

2.2 As the personal information controller, 999phl.com determines the purposes and means of processing personal data collected through the platform. Where third-party service providers process personal data on behalf of 999phl.com, they do so as personal information processors ("PIP") under written agreements that require them to maintain appropriate data protection standards consistent with the DPA.

2.3 Questions, requests, or complaints regarding the processing of your personal data by 999phl.com may be directed to our Data Protection Officer using the contact details provided in Section 15 of this Policy.

3. Data We Collect

3.1 Registration Data. When you create a 999phl.com account, we collect: full legal name; date of birth; gender; residential address (including city, province, and postal code); Philippine mobile number; email address; and username.

3.2 Identity Verification (KYC) Data. To comply with Philippine anti-money laundering regulations and PAGCOR requirements, we may collect: government-issued identification documents (e.g., Philippine passport, SSS ID, PhilSys National ID, driver's licence, UMID); selfie or live photo for facial verification; proof of address documents; and proof of payment method ownership.

3.3 Financial Data. We collect information related to your deposits and withdrawals, including: GCash account number; PayMaya/Maya account number; bank account details (bank name, account number, account name) for BPI, BDO, Metrobank, UnionBank, Landbank, PNB, or Security Bank; debit card details (card number, expiry date — we do not store full card numbers); and transaction history.

3.4 Gaming Activity Data. We collect records of your gaming activity on the platform, including: games played; wagers placed; game outcomes; session duration; bonus usage; and responsible gaming tool activations (deposit limits, self-exclusion requests, etc.).

3.5 Technical & Device Data. We automatically collect certain technical information when you access the platform, including: IP address; device type and model; operating system and version; browser type and version; mobile network information; and time zone and language settings.

3.6 Communications Data. We retain records of communications between you and 999phl.com, including live chat transcripts, email correspondence, and support ticket history.

3.7 Marketing Preferences. We record your preferences regarding marketing communications, including whether you have opted in to or out of promotional emails, SMS notifications, and push notifications.

4. How We Collect Data

4.1 Directly from You. The majority of personal data we hold is provided directly by you during account registration, KYC verification, deposit and withdrawal transactions, customer support interactions, and when you update your account profile.

4.2 Automatically. Certain technical and usage data is collected automatically through cookies, web beacons, and similar tracking technologies when you access the 999phl.com platform. See Section 8 for more detail on our use of cookies.

4.3 From Third Parties. We may receive personal data about you from third-party identity verification providers, payment processors, fraud prevention services, and, where applicable, from other gaming platforms under mutual exclusion arrangements.

5. How We Use Your Data

5.1 999phl.com processes your personal data for the following purposes:

5.2 999phl.com will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your consent or establishing another lawful basis for processing.

6. Legal Basis for Processing

6.1 999phl.com processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Consent — where you have given clear, informed, and freely given consent to the processing of your personal data for a specific purpose (e.g., marketing communications);
• Contractual Necessity — where processing is necessary for the performance of the contract between you and 999phl.com (i.e., the Terms & Conditions), including account management and service delivery;
• Legal Obligation — where processing is required to comply with a legal obligation applicable to 999phl.com, including obligations under the AMLA, PAGCOR regulations, and the DPA itself;
• Legitimate Interests — where processing is necessary for the legitimate interests of 999phl.com or a third party, provided those interests are not overridden by your rights and freedoms (e.g., fraud prevention, platform security, and responsible gaming monitoring).

7. Data Sharing & Disclosure

7.1 999phl.com does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your personal data only in the following circumstances:

• Service Providers. We share data with trusted third-party service providers who assist in operating the platform, including payment processors (GCash, PayMaya, banks), identity verification providers, game software providers, cloud hosting providers, and customer support platforms. All such providers are bound by data processing agreements requiring them to protect your data in accordance with the DPA.
• Regulatory Authorities. We may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other Philippine government authorities where required by law or in response to a lawful request.
• Fraud Prevention. We may share data with fraud prevention agencies and other gaming operators where necessary to detect and prevent fraudulent activity or to enforce mutual exclusion arrangements.
• Business Transfers. In the event of a merger, acquisition, or sale of all or part of 999phl.com's business, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.
• With Your Consent. We may share your data with other third parties where you have given explicit consent for us to do so.

8. Cookies & Tracking Technologies

8.1 999phl.com uses cookies and similar tracking technologies to enhance your experience on the platform, maintain session security, and analyse platform usage. The following types of cookies are used:

• Essential Cookies — Required for the platform to function correctly, including session management and security. These cannot be disabled.
• Functional Cookies — Remember your preferences (e.g., language, game settings) to personalise your experience.
• Analytics Cookies — Collect anonymised data about how users interact with the platform to help us improve performance and usability.
• Marketing Cookies — Used to deliver relevant promotional content. These are only activated where you have given consent .

8.2 You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the 999phl.com platform. Most modern browsers allow you to refuse cookies, delete existing cookies, or be notified when a new cookie is set.

8.3 In addition to cookies, 999phl.com may use web beacons (also known as pixel tags) in emails and on certain pages of the platform to track whether emails have been opened and to monitor user engagement with promotional content.

9. Data Retention

9.1 999phl.com retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

9.2 The following general retention periods apply:

• Account and KYC data — Retained for a minimum of five (5) years from the date of account closure, in accordance with AMLA record-keeping requirements.
• Transaction records — Retained for a minimum of five (5) years from the date of each transaction.
• Gaming activity data — Retained for three (3) years from the date of the relevant gaming session.
• Communications data — Retained for two (2) years from the date of the communication.
• Marketing preference data — Retained until you withdraw consent or request deletion, subject to legal retention requirements.

9.3 Where personal data is no longer required for any lawful purpose, 999phl.com will securely delete or anonymise it in accordance with the NPC's guidelines on data disposal.

10. Data Security

10.1 999phl.com implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the 999phl.com platform;
• Encryption of sensitive data at rest, including financial and identity verification data;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Regular security assessments and penetration testing of platform infrastructure;
• Two-factor authentication options for user accounts;
• Incident response procedures for detecting, reporting, and managing personal data breaches.

10.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, 999phl.com will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, and will notify affected users without undue delay, in accordance with the DPA and NPC Circular No. 16-03.

10.3 While 999phl.com takes all reasonable steps to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. You are responsible for maintaining the security of your account credentials and for notifying 999phl.com immediately if you suspect any unauthorised access to your account.

11. Your Rights

11.1 Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 999phl.com:

• Right to be Informed — You have the right to be informed of how your personal data is being collected and processed, as set out in this Policy.
• Right of Access — You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed.
• Right to Rectification — You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure — You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to applicable legal retention requirements.
• Right to Object — You have the right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.
• Right to Data Portability — You have the right to receive your personal data in a structured, commonly used, and machine-readable format where technically feasible.
• Right to Lodge a Complaint — You have the right to lodge a complaint with the National Privacy Commission if you believe your data privacy rights have been violated.

11.2 To exercise any of the rights listed above, please contact our Data Protection Officer using the details in Section 15. We will respond to all verified requests within thirty (30) days of receipt, in accordance with the DPA and NPC guidelines.

11.3 Please note that certain rights may be limited where processing is required for compliance with a legal obligation, for the performance of a contract, or for the establishment, exercise, or defence of legal claims.

12. Children's Privacy

12.1 The 999phl.com platform is strictly intended for individuals who are at least twenty-one (21) years of age, in accordance with Philippine law governing online gaming. 999phl.com does not knowingly collect personal data from individuals under the age of 21.

12.2 If 999phl.com becomes aware that personal data has been collected from an individual under the age of 21, it will take immediate steps to delete that data and close the associated account. If you believe that a minor has registered on the platform, please contact us immediately using the details in Section 15.

13. Cross-Border Data Transfers

13.1 In the course of providing its services, 999phl.com may transfer your personal data to third-party service providers located outside the Philippines, including game software providers and cloud infrastructure providers. Where such transfers occur, 999phl.com ensures that appropriate safeguards are in place to protect your personal data, consistent with the requirements of the Data Privacy Act of 2012 and NPC guidelines on cross-border data transfers.

13.2 Such safeguards may include contractual clauses requiring the recipient to maintain data protection standards equivalent to those required under Philippine law, or reliance on the recipient's adherence to internationally recognised data protection frameworks.

13.3 By using the 999phl.com platform, you consent to the transfer of your personal data to countries outside the Philippines where necessary for the provision of our services, subject to the safeguards described above.

14. Policy Updates

14.1 999phl.com reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The most current version of this Policy will always be available on this page, with the "Last Updated" date revised accordingly.

14.2 Where changes to this Policy are material, 999phl.com will notify registered users via email or in-platform notification prior to the changes taking effect. Your continued use of the 999phl.com platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

14.3 We encourage you to review this Privacy Policy periodically to stay informed about how 999phl.com is protecting your personal data.

15. Contact & Complaints

15.1 If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by 999phl.com, please contact our Data Protection Officer. Our DPO is responsible for overseeing compliance with the Data Privacy Act of 2012 and this Policy.

15.2 You may reach the 999phl.com Data Protection Officer at the following email address (plain text — not a clickable link):

[email protected]

15.3 We aim to acknowledge all data privacy requests within five (5) business days and to resolve them within thirty (30) days of receipt. For complex requests, we may extend this period by a further thirty (30) days, in which case we will notify you of the extension and the reasons for it.

15.4 If you are not satisfied with our response to your complaint or request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. Information on how to file a complaint with the NPC is available on the NPC's official website.