Privacy Policy — 19ph

This Privacy Policy ("Policy") applies to all personal data collected and processed by 19ph ("the Company," "we," "us," or "our") in connection with your use of the 19ph website located at https://19ph.app and all associated services, games, and features (collectively, the "Platform").

This Policy is issued in compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and the issuances of the National Privacy Commission (NPC) of the Philippines. By registering on or using the 19ph Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

19ph is committed to protecting the privacy and personal data of every player who uses our Platform. We understand that Filipino players entrust us with sensitive information — including financial data, identity documents, and gaming activity — and we take that responsibility seriously.

This Policy describes our practices with respect to the collection, use, storage, disclosure, and protection of personal data. It also outlines the rights available to you as a data subject under the Data Privacy Act of 2012 and how you can exercise those rights.

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. Your data is used solely to operate the 19ph Platform, comply with our legal and regulatory obligations, and improve your experience as a player.

For the purposes of the Data Privacy Act of 2012 and this Policy, 19ph is the personal information controller responsible for your personal data collected through the Platform.

19ph has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data privacy laws. You may contact our DPO at any time using the details provided in Section 14 of this Policy.

Our DPO is registered with the National Privacy Commission (NPC) as required under the DPA and its IRR. Any data privacy concerns, complaints, or requests to exercise your data subject rights should be directed to our DPO in the first instance.

19ph collects the following categories of personal data from players and platform users:

We collect only the minimum personal data necessary for the purposes described above. Where we need to collect personal data by law or under the terms of a contract with you, and you fail to provide that data when requested, we may not be able to perform the contract or provide the service — for example, we may be unable to process your withdrawal request without completing KYC verification.

19ph collects personal data through the following means:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting our support team, or participating in promotions.
• Automated technologies: Technical data collected automatically when you access the Platform, including through cookies, web beacons, log files, and similar tracking technologies. See Section 8 for more details on our cookie practices.
• Third-party sources: Identity verification data from KYC service providers; fraud and AML screening data from compliance partners; payment data from GCash, PayMaya, and banking partners in connection with your transactions.
• Publicly available sources: Information from public records or databases where relevant to our legal and regulatory compliance obligations.

All data collected through third-party sources is handled in accordance with this Policy and applicable data privacy laws. We require all third-party data processors to implement appropriate technical and organizational measures to protect your personal data.

19ph uses your personal data for the following purposes:

• Account management: Creating, maintaining, and securing your 19ph account; verifying your identity and age (21+ requirement); processing login and authentication.
• Service delivery: Enabling you to access and play games on the Platform; processing deposits and withdrawals via GCash, PayMaya, and bank transfer; crediting bonuses and promotions to your account.
• Legal and regulatory compliance: Fulfilling our obligations under PAGCOR regulations, the Anti-Money Laundering Act (AMLA), the Data Privacy Act of 2012, and other applicable Philippine laws; responding to lawful requests from government authorities.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, unauthorized account access, money laundering, and other illegal activities.
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behavior; administering self-exclusion, deposit limits, and other responsible gaming tools.
• Customer support: Responding to your inquiries, resolving disputes, and improving our support services.
• Platform improvement: Analyzing usage patterns and technical performance data to improve the Platform's functionality, reliability, and user experience.
• Marketing communications: Sending you promotional offers, bonus notifications, and platform updates — but only where you have provided your consent or where we have a legitimate interest to do so. You may opt out of marketing communications at any time.

We will not use your personal data for any purpose that is incompatible with the purposes described above without first obtaining your consent or establishing another lawful basis for processing.

Under the Data Privacy Act of 2012, 19ph processes your personal data on the following legal bases:

• Consent: Where you have given clear, informed, and freely given consent to the processing of your personal data for a specific purpose — for example, receiving marketing communications or participating in optional surveys.
• Contractual necessity: Where processing is necessary to perform our contract with you — for example, processing your deposit to fund your gaming account or verifying your identity to process a withdrawal.
• Legal obligation: Where processing is required to comply with a legal or regulatory obligation — for example, KYC verification under PAGCOR regulations, AML reporting under the Anti-Money Laundering Act, or responding to a court order.
• Legitimate interests: Where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests — for example, fraud prevention, platform security, and improving our services.

Where we rely on consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

19ph does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Payment service providers: GCash, PayMaya / Maya, and banking partners (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank) for the purpose of processing your deposits and withdrawals.
• KYC and identity verification providers: Third-party service providers engaged to verify your identity and age in compliance with PAGCOR and AML requirements.
• Fraud prevention and AML compliance partners: Service providers that assist us in detecting and preventing fraudulent activity and money laundering.
• IT and platform service providers: Cloud hosting, data storage, and technical infrastructure providers who process data on our behalf under strict data processing agreements.
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other government authorities where disclosure is required by law or regulation.
• Professional advisors: Lawyers, auditors, and other professional advisors where necessary for legal, compliance, or business purposes, subject to professional confidentiality obligations.

All third parties with whom we share personal data are required to implement appropriate technical and organizational security measures and to process your data only in accordance with our instructions and applicable data privacy laws.

The 19ph Platform uses cookies and similar tracking technologies to enhance your experience, maintain session security, and analyze Platform usage. A cookie is a small text file placed on your device when you visit a website.

19ph uses the following types of cookies:

• Strictly necessary cookies: Essential for the Platform to function correctly. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cookies cannot be disabled.
• Functional cookies: Remember your preferences and settings — for example, your preferred language or display settings — to provide a more personalized experience.
• Analytics cookies: Collect anonymized data about how players use the Platform, which pages are visited most frequently, and where errors occur. This data helps us improve Platform performance and user experience.
• Security cookies: Used to detect and prevent fraudulent activity, unauthorized access attempts, and other security threats.

You can control and manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the 19ph Platform — in particular, disabling strictly necessary cookies may prevent you from logging in or using core Platform features.

19ph does not use third-party advertising cookies or behavioral tracking cookies for the purpose of serving targeted advertisements on external websites.

19ph retains your personal data for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years after account closure, in compliance with PAGCOR regulations and AML record-keeping requirements under the Anti-Money Laundering Act.
• Financial transaction data: Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act and PAGCOR regulations.
• Gaming activity data: Retained for a minimum of three (3) years from the date of the gaming session, for dispute resolution and regulatory compliance purposes.
• Customer support communications: Retained for two (2) years from the date of the last communication, for quality assurance and dispute resolution purposes.
• Technical and log data: Retained for twelve (12) months from the date of collection, for security and fraud prevention purposes.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in accordance with our data disposal procedures. Where data is anonymized, it may be retained indefinitely for analytical purposes as it can no longer be used to identify you.

19ph implements industry-standard technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. Our security measures include:

• Encryption in transit: All data transmitted between your device and the 19ph Platform is encrypted using TLS (Transport Layer Security) with a minimum of 256-bit encryption.
• Encryption at rest: Sensitive personal data, including financial data and identity documents, is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data is restricted to 19ph personnel and authorized third parties who have a legitimate need to access it. All access is logged and audited.
• Multi-factor authentication: Administrative access to systems containing personal data requires multi-factor authentication.
• Regular security assessments: 19ph conducts regular vulnerability assessments and penetration testing to identify and remediate security weaknesses.
• Incident response: 19ph maintains a data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the National Privacy Commission and affected players within the timeframes required by the Data Privacy Act of 2012.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 19ph:

• Right to be informed: The right to be informed about how your personal data is collected, used, and processed — which is the primary purpose of this Policy.
• Right of access: The right to request a copy of the personal data we hold about you, along with information about how it is being processed.
• Right to rectification: The right to request correction of any inaccurate or incomplete personal data we hold about you.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal and regulatory retention obligations.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on our legitimate interests.
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

To exercise any of the above rights, please contact our Data Protection Officer using the details in Section 14. We will respond to all data subject requests within fifteen (15) business days of receipt. In complex cases, we may extend this period by a further fifteen (15) business days, in which case we will notify you of the extension and the reasons for it.

Please note that some rights are subject to limitations under applicable law — for example, we may be unable to delete data that we are legally required to retain for AML or PAGCOR compliance purposes.

The 19ph Platform is strictly intended for individuals aged 21 years and older, in compliance with Philippine law and PAGCOR regulations governing online gaming. 19ph does not knowingly collect personal data from individuals under the age of 21.

If we become aware that we have inadvertently collected personal data from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. Any winnings accumulated by an underage player will be forfeited in accordance with our Terms and Conditions.

If you are a parent or guardian and believe that your child under the age of 21 has registered on the 19ph Platform, please contact us immediately at the details provided in Section 14 so that we can take appropriate action.

19ph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or regulatory requirements. When material changes are made, we will notify registered players via the email address or mobile number on file at least seven (7) days before the changes take effect, where practicable.

The most current version of this Policy will always be available on this page, with the "Last Updated" date at the top reflecting the date of the most recent revision. We encourage you to review this Policy periodically to stay informed about how 19ph protects your personal data.

Your continued use of the 19ph Platform after the effective date of any amendment to this Policy constitutes your acknowledgment of the updated Policy. If you do not agree with any amendment, you should stop using the Platform and may request voluntary account closure in accordance with our Terms and Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by 19ph, please contact our Data Protection Officer:

• Data Protection Officer Email: [email protected]
• General Support Email: [email protected]
• Response Time: Within 15 business days of receipt of your request
• Office Hours: 8:00 AM – 12:00 MN, Manila Time (GMT+8), seven days a week
• Mailing Address: 19ph Data Protection Officer, Metro Manila, Philippines

If you are not satisfied with our response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act of 2012.