39ph Privacy Policy

This Privacy Policy ("Policy") describes how 39ph ("the Platform," "we," "us," or "our") collects, uses, stores, and discloses personal information about individuals ("you," "Player," or "User") who access or use the 39ph website and gaming services available at 39ph.app.

39ph is committed to protecting the privacy and personal data of all players in the Philippines. This Policy is drafted in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC) of the Philippines.

By registering an account on 39ph, accessing the platform, or using any of our gaming services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, please discontinue your use of the 39ph platform immediately.

For the purposes of the Data Privacy Act of 2012, 39ph acts as the personal information controller in respect of the personal data collected through the 39ph platform. As the data controller, 39ph determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out in accordance with applicable Philippine data protection law.

39ph operates under the regulatory oversight of the Philippine Amusement and Gaming Corporation (PAGCOR) and is subject to the anti-money laundering reporting obligations administered by the Anti-Money Laundering Council (AMLC) under Republic Act No. 9160 and its amendments.

If you have any questions or concerns about how 39ph processes your personal data, or if you wish to exercise any of your data subject rights, please contact our Data Protection Officer using the contact details provided in Section 14 of this Policy.

39ph collects the following categories of personal data from players and platform users:

39ph collects only the personal data that is necessary for the purposes described in this Policy. We do not collect sensitive personal information beyond what is required for identity verification and regulatory compliance.

39ph collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically when you access the 39ph platform, including through cookies, web beacons, and server logs. See Section 9 for details on cookies.
• Third-party sources: Identity verification data from KYC service providers; transaction data from payment processors such as GCash, Maya, and participating Philippine banks; fraud prevention data from security service providers.
• Regulatory sources: In limited circumstances, 39ph may receive information about players from PAGCOR or the AMLC in connection with regulatory compliance obligations.

39ph processes your personal data for the following purposes and on the following legal bases under the Data Privacy Act of 2012:

• Contract performance: To register and maintain your account, process deposits and withdrawals, deliver gaming services, and administer bonuses and promotions.
• Legal obligation: To comply with PAGCOR licensing requirements, AML obligations under Republic Act No. 9160, age verification requirements (21+), KYC regulations, and any other applicable Philippine law or regulatory directive.
• Legitimate interests: To detect and prevent fraud, money laundering, and platform abuse; to maintain the security and integrity of the 39ph platform; to improve our services through analytics; and to manage disputes and legal claims.
• Consent: To send you promotional communications about 39ph offers, new games, and platform updates, where you have opted in to receive such communications. You may withdraw this consent at any time.

39ph will not process your personal data for purposes that are incompatible with those described in this Policy without first obtaining your consent or establishing another lawful basis for processing.

39ph does not sell, rent, or trade your personal data to third parties for commercial purposes. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• PAGCOR and regulatory authorities: As required by our operating licence and applicable Philippine gaming regulations.
• Anti-Money Laundering Council (AMLC): For mandatory suspicious transaction reporting and covered transaction reporting under Republic Act No. 9160.
• Payment service providers: GCash, Maya, and participating Philippine banks (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank) for the processing of deposits and withdrawals.
• KYC and identity verification providers: Third-party service providers engaged to assist with identity document verification and fraud screening, operating under strict data processing agreements.
• Technology and infrastructure providers: Cloud hosting, platform software, and security service providers who process data on 39ph's behalf under contractual data protection obligations.
• Legal and professional advisers: Lawyers, auditors, and compliance consultants where necessary for the conduct of 39ph's business and legal obligations.
• Law enforcement and courts: Where required by a valid court order, subpoena, or lawful request from a Philippine government authority.

39ph retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and regulatory obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with PAGCOR record-keeping requirements and AML obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act.
• Gaming history: Retained for the duration of your account and for a minimum of two (2) years following account closure.
• KYC documents: Retained for a minimum of five (5) years following account closure or the completion of the relevant transaction, whichever is later.
• Support communications: Retained for a minimum of two (2) years from the date of the communication.
• Technical and usage data: Retained for up to twelve (12) months from collection, unless required for longer periods for security or fraud investigation purposes.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with 39ph's data disposal procedures.

39ph implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the 39ph platform.
• Encryption of sensitive data at rest, including identity documents and financial information.
• Role-based access controls limiting access to personal data to authorised personnel only.
• Regular security assessments, penetration testing, and vulnerability scanning of the 39ph platform.
• Multi-factor authentication requirements for access to systems containing personal data.
• Incident response procedures for the detection, investigation, and notification of personal data breaches in accordance with NPC requirements.

While 39ph takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your 39ph account credentials and for notifying 39ph immediately if you suspect any unauthorised access to your account.

39ph uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your session, and analyse platform usage. The following types of cookies are used on 39ph:

• Strictly necessary cookies: Essential for the operation of the 39ph platform, including session management, login authentication, and security functions. These cookies cannot be disabled without affecting platform functionality.
• Functional cookies: Used to remember your preferences, such as language settings and display options, to provide a more personalised experience.
• Analytics cookies: Used to collect aggregated, anonymised data about how players use the 39ph platform, helping us identify areas for improvement. No personally identifiable information is shared with analytics providers.
• Security cookies: Used to detect and prevent fraudulent activity, bot access, and other security threats to the platform.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may impair your ability to use the 39ph platform. 39ph does not use third-party advertising cookies or cross-site tracking technologies for commercial advertising purposes.

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by 39ph:

• Right to be informed: The right to be notified of how your personal data is collected and processed, as set out in this Privacy Policy.
• Right of access: The right to request a copy of the personal data that 39ph holds about you.
• Right to rectification: The right to request correction of any inaccurate or incomplete personal data held by 39ph.
• Right to erasure: The right to request deletion of your personal data, subject to 39ph's legal and regulatory retention obligations.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or on grounds relating to your particular situation.
• Right to data portability: The right to receive your personal data in a structured, commonly used format where technically feasible.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe that 39ph has processed your personal data in violation of the Data Privacy Act of 2012.

To exercise any of the above rights, please contact the 39ph Data Protection Officer using the contact details in Section 14. 39ph will respond to all data subject requests within fifteen (15) working days of receipt, or within such other period as may be prescribed by the NPC.

The 39ph platform is strictly intended for individuals who are 21 years of age or older, in accordance with PAGCOR regulations governing online gaming in the Philippines. 39ph does not knowingly collect personal data from individuals under the age of 21.

If 39ph becomes aware that personal data has been collected from a person under 21 years of age, it will take immediate steps to delete that data and close the associated account. Any funds deposited by an underage user may be forfeited in accordance with the 39ph Terms and Conditions.

If you are a parent or guardian and believe that your child has registered on the 39ph platform, please contact us immediately using the details in Section 14 so that we can take appropriate action.

39ph primarily processes personal data within the Philippines. In limited circumstances, personal data may be transferred to or processed by service providers located outside the Philippines — for example, cloud infrastructure providers or technology partners operating internationally.

Where personal data is transferred outside the Philippines, 39ph ensures that appropriate safeguards are in place to protect your data, including contractual data protection clauses that require the recipient to maintain standards equivalent to those required by the Data Privacy Act of 2012. Such transfers are carried out only to the extent necessary for the operation of the 39ph platform and in compliance with NPC guidelines on cross-border data transfers.

39ph does not transfer personal data to foreign entities for commercial purposes unrelated to the operation of the platform.

39ph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, or NPC guidance. When material changes are made, 39ph will notify registered players via the mobile number or email address associated with their account, and will update the "Last Updated" date at the top of this page.

Your continued use of the 39ph platform following the publication of an updated Privacy Policy constitutes your acknowledgment of the changes. We encourage you to review this Policy periodically to stay informed of how 39ph protects your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by 39ph, please contact our Data Protection Officer:

Data Protection Officer — 39ph
Email: privacy 39ph.app
Support: support 39ph.app
Hours: 24 hours a day, 7 days a week
Language: English (Filipino-English supported)

You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated. For further information on responsible gaming, please visit the Responsible Gaming page. For full platform terms, see the Terms & Conditions.