Privacy Policy —
19ph Casino

This Privacy Policy ("Policy") describes the practices of 19ph Casino ("19ph," "we," "us," or "our") with respect to the collection, use, storage, disclosure, and protection of personal data relating to registered members, prospective members, and visitors to the 19ph platform at https://19ph.asia (the "Platform").

This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), its Implementing Rules and Regulations ("IRR"), and the issuances of the National Privacy Commission ("NPC"). 19ph is registered with the NPC as a personal information controller in accordance with applicable registration requirements.

By registering an account, accessing the Platform, or providing any personal information to 19ph, you acknowledge that you have read and understood this Policy and agree to the collection and processing of your personal data as described herein. If you do not agree, you must refrain from using the Platform.

This Policy applies to all personal data processed by 19ph in connection with the Platform and its services, regardless of whether such processing occurs in the Philippines or in any other jurisdiction where 19ph operates or engages service providers.

For the purposes of the DPA and this Policy, 19ph acts as the personal information controller with respect to all personal data collected through the Platform. This means 19ph determines the purposes and means of processing your personal data.

Where 19ph engages third-party service providers (such as payment processors, game providers, or cloud infrastructure vendors) to process personal data on its behalf, those providers act as personal information processors. 19ph remains responsible for ensuring that all processors maintain adequate data protection standards consistent with the DPA and this Policy.

19ph has appointed a Data Protection Officer ("DPO") to oversee compliance with data protection obligations. Contact details for the DPO are provided in Section 17 of this Policy.

19ph collects the following categories of personal data in connection with the operation of the Platform and the provision of gaming services:

19ph does not collect sensitive personal information as defined under Section 3(l) of the DPA (such as health records, political opinions, or sexual orientation) except where the processing of age and identity data incidentally involves sensitive information as part of mandatory KYC age verification.

19ph collects personal data through the following methods:

• Directly from you — when you complete the registration form, submit KYC documents, initiate deposits or withdrawals, contact support, or update your account preferences.
• Automatically — through server logs, cookies, web beacons, and similar tracking technologies when you access and navigate the Platform (see Section 11 for details on cookies).
• From third-party payment providers — GCash, Maya, and our banking partners may transmit transaction confirmation data to 19ph as part of the deposit and withdrawal processing workflow.
• From identity verification services — third-party KYC and AML screening providers used to verify identity documents and conduct sanctions and watchlist screening as required by Philippine AML regulations.
• From fraud prevention services — third-party systems that detect unusual login patterns, device anomalies, or transaction irregularities for the purpose of protecting member accounts and the integrity of the Platform.

19ph processes personal data for the following specific, legitimate purposes:

• Account creation and management — to register you as a member, maintain your account, and provide access to Platform services.
• Identity and age verification (KYC) — to verify that you meet the 21-year minimum age requirement and to confirm your identity as required by PAGCOR regulations and RA 9160 (AMLA).
• Payment processing — to process deposits via GCash, Maya, BPI, BDO, Metrobank, and USDT, and to process withdrawal requests to your verified payment method.
• Regulatory compliance and reporting — to comply with PAGCOR reporting obligations, AMLC covered transaction and suspicious transaction reporting, NPC breach notifications, and other applicable legal requirements.
• Fraud prevention and platform security — to detect and investigate fraudulent activity, unauthorized access, bonus abuse, and other security threats to the Platform and its members.
• Customer support — to respond to your inquiries, resolve account issues, and manage complaints through 19ph's 24/7 support team.
• Responsible gaming — to monitor gaming patterns for signs of problem gambling, apply responsible gaming tools, enforce self-exclusion, and fulfill our duty of care obligations.
• Personalization and product improvement — to improve the Platform based on usage patterns and to personalize your experience, including game recommendations and promotional offers relevant to your activity.
• Marketing communications — to send you promotional offers, bonus announcements, and platform updates, subject to your marketing preferences and applicable consent requirements.

19ph processes personal data on one or more of the following legal bases recognized under the DPA and its IRR:

• Consent — where you have given clear, informed, and freely given consent, such as for marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
• Contract — processing necessary for the performance of our agreement with you (the Terms and Conditions), including account management, payment processing, and game service delivery.
• Legal obligation — processing required to comply with applicable laws, including KYC obligations under PAGCOR regulations, AML reporting under RA 9160 as amended, and tax obligations.
• Legitimate interests — processing for fraud prevention, platform security, responsible gaming monitoring, and product improvement, where such interests are not overridden by your data protection rights.

19ph does not sell your personal data to third parties. We may share your personal data with the following categories of recipients on a strictly need-to-know basis and subject to appropriate data protection safeguards:

• Payment processors and e-wallet providers — GCash (Mynt/Globe Fintech), Maya (PayMaya Philippines), and Philippine banking institutions (BPI, BDO, Metrobank) to process your financial transactions.
• Identity verification providers — third-party KYC and AML screening services engaged to conduct identity verification and sanctions screening as required by PAGCOR and RA 9160.
• Game software providers — licensed game studios and live dealer operators whose software and services are integrated into the Platform. These providers may process gaming activity data for audit and certification purposes.
• Cloud and IT infrastructure providers — hosting, database, and content delivery network providers used to operate the Platform securely and reliably.
• Regulatory authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine authorities, where disclosure is required by law, regulation, or court order.
• Fraud prevention and security services — third-party systems used to detect and prevent unauthorized access, fraudulent transactions, and platform abuse.

All third-party processors engaged by 19ph are required to maintain confidentiality, implement appropriate security measures, and process personal data only as instructed by 19ph and for the purposes described in this Policy, consistent with DPA requirements for sub-processing arrangements.

The primary processing of personal data by 19ph occurs within the Philippines. Where 19ph engages service providers whose infrastructure is located outside the Philippines — such as certain cloud hosting or game software providers — personal data may be transferred to, stored in, or processed in jurisdictions outside the Philippines.

19ph ensures that all international transfers of personal data are conducted in compliance with Section 21 of the DPA and the NPC's regulations on cross-border data flows. Where required, 19ph implements appropriate safeguards including:

• Data processing agreements with receiving parties that incorporate DPA-equivalent data protection standards.
• Transfer impact assessments for data flows to jurisdictions without equivalent data protection laws.
• Technical encryption measures ensuring data in transit is protected against interception or unauthorized access.

You may request information about specific international transfer arrangements by contacting 19ph's Data Protection Officer as described in Section 17.

19ph retains personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. Specific retention periods applicable to 19ph are as follows:

Upon expiry of the applicable retention period, 19ph will securely destroy or anonymize personal data so that it can no longer be attributed to an identifiable individual, in accordance with NPC-approved disposal standards.

19ph implements a comprehensive set of technical, organizational, and physical security measures to protect personal data against unauthorized access, disclosure, alteration, loss, and destruction. These measures include:

• Encryption in transit: All data transmitted between your device and the 19ph Platform is encrypted using TLS 1.2 or higher (HTTPS). The Platform enforces HTTPS across all pages and API endpoints.
• Encryption at rest: Sensitive data fields including government ID numbers, financial account details, and passwords are stored using strong encryption and/or one-way hashing with salting, such that raw values are not recoverable from stored data.
• Access controls: Personal data access by 19ph staff is restricted to personnel with a genuine operational need. Role-based access controls, multi-factor authentication, and audit logging are applied to all systems containing personal data.
• Network security: The Platform infrastructure is protected by firewalls, intrusion detection systems, and regular vulnerability scanning. Web Application Firewall (WAF) protection is applied to all external-facing endpoints.
• Penetration testing: 19ph engages independent security professionals to conduct periodic penetration testing of Platform infrastructure and applications.
• Staff training: All 19ph personnel with access to personal data receive mandatory data privacy and security training upon engagement and periodically thereafter.

19ph uses cookies and similar tracking technologies (including web beacons, local storage, and session tokens) on the Platform to ensure functionality, improve user experience, and collect analytics data. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function correctly, including maintaining your authenticated session, applying security tokens, and remembering your language and responsible gaming settings. These cannot be disabled without affecting Platform functionality.
• Functional cookies: Remember your preferences such as currency display, game lobby layout, and notification settings to provide a personalized experience.
• Analytics cookies: Collect aggregated and anonymized data about how members navigate and use the Platform, enabling 19ph to identify areas for improvement. Analytics data is not used to identify individual users.
• Security cookies: Used for fraud detection and prevention, including device fingerprinting for anomalous login detection and session integrity verification.

19ph does not use third-party advertising or tracking cookies for cross-site behavioural advertising. You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may prevent you from accessing authenticated areas of the Platform.

The 19ph Platform is strictly prohibited to persons under 21 years of age. 19ph does not knowingly collect personal data from individuals below the age of 21. All account registrations require completion of KYC age verification before any real-money gaming activity is permitted.

Where 19ph discovers that personal data has been collected from a person who does not meet the minimum age requirement, 19ph will:

• Immediately suspend the relevant account and notify the data subject.
• Reverse any deposits and return funds to the source payment method.
• Permanently delete all personal data associated with the underage account, subject to any legal retention obligations applicable to the circumstances.
• Report the incident to PAGCOR as required under applicable regulations.

To exercise any of your rights described in the summary section of this Policy (Right to Be Informed, Access, Rectification, Erasure, Objection, or Portability), please submit a written request to 19ph's Data Protection Officer using the contact details in Section 17.

When submitting a data rights request, please include:

• Your full registered name and registered email address or mobile number on 19ph.
• A clear description of the right you wish to exercise and the specific data or processing activity it relates to.
• A copy of a valid government-issued ID to verify your identity (this is required to prevent unauthorized processing of personal data on behalf of another person).

19ph will acknowledge your request within five (5) business days and endeavour to respond substantively within thirty (30) calendar days. Where a request is complex or involves a large volume of data, 19ph may extend the response period by a further thirty (30) days with prior notification.

Data rights requests are processed at no cost to you. However, 19ph reserves the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests, consistent with NPC guidance on handling data subject requests.

Where 19ph is unable to fulfil a data rights request — for example, due to a conflicting legal retention obligation — we will provide a written explanation of the grounds for refusal. You retain the right to lodge a complaint with the National Privacy Commission at www.privacy.gov.ph if you believe your data rights have been infringed.

In the event of a personal data breach involving your data that is likely to result in a real risk of serious harm to you, 19ph will notify you and the National Privacy Commission in accordance with Section 20(f) of the DPA and NPC Circular No. 16-03.

Notification to affected data subjects will be made without undue delay, and in any event within seventy-two (72) hours of 19ph becoming aware of the breach, except where:

• Notification is delayed at the request of law enforcement to avoid impeding an investigation.
• Notification is not required because the personal data is encrypted and the encryption key has not been compromised.

Data breach notifications from 19ph will be sent to your registered email address and will include: a description of the nature of the breach, the categories and approximate volume of data affected, the likely consequences of the breach, and the measures 19ph has taken or proposes to take to address the breach.

19ph maintains a Personal Data Breach Management Policy and an incident response team trained to detect, contain, and report data breaches in accordance with DPA requirements.

The 19ph Platform may contain references to or integrations with third-party services, including payment gateways, live game studio streams, and identity verification interfaces. These third-party services operate under their own privacy policies, which are independent of this Policy.

19ph is not responsible for the privacy practices or content of third-party services. We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of 19ph. 19ph selects service providers that maintain privacy and security standards consistent with or exceeding our own requirements, and conducts periodic due diligence reviews of critical data processors.

19ph reviews and updates this Privacy Policy periodically to reflect changes in our processing activities, applicable law, NPC guidance, and industry best practices. Where any update materially affects your rights or how we process your personal data, 19ph will provide notice of the change via email to your registered address and/or via a prominent notice on the Platform at least seven (7) calendar days before the update takes effect.

Minor updates — such as clarifications of existing provisions, corrections of typographical errors, or updates to contact details — may be made without advance notice and take effect upon publication. The "Last Updated" date at the top of this Policy reflects the date of the most recent revision.

Your continued use of the Platform following the effective date of any updated Policy constitutes your acknowledgment of and agreement to the revised terms. If you do not accept any update, you may exercise your right to erasure and account closure by contacting 19ph support.

For all data privacy enquiries, rights requests, or complaints relating to this Policy or the processing of your personal data by 19ph, please contact our Data Protection Officer using the details below:

If you are not satisfied with 19ph's response to a data privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines. The NPC is the government authority responsible for the enforcement of the Data Privacy Act and can be contacted through its official government website. 19ph cooperates fully with NPC investigations and inquiries.