phlar Privacy Policy

phlar ("we", "us", "our") is committed to protecting and respecting the privacy of all users ("you", "your") who access and use the phlar online casino and sports betting platform at https://phlar.net (the "Platform"). We understand that your personal data is important to you, and we take our responsibility as a personal information controller under Philippine law very seriously.

This Privacy Policy explains in plain, accessible terms what personal data phlar collects about you, the purposes for which we process that data, how long we retain it, with whom we may share it, and the rights you have as a data subject under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, or "DPA") and the implementing rules and regulations (IRR) issued by the National Privacy Commission.

This Privacy Policy applies to all Filipino players and users accessing phlar from Manila, Cebu, Davao, Quezon City, Makati, and anywhere else across the Philippine archipelago, as well as any other users who access the Platform regardless of their location.

Please read this Privacy Policy carefully before registering an account or using any feature of the Platform. If you do not agree with the terms set out in this document, please do not create an account or use the Services offered by phlar.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information from which the identity of an individual is apparent or can be reasonably and directly ascertained, or when put together with other information would directly and certainly identify an individual — as defined under Section 3(g) of the Philippine DPA.
• "Sensitive Personal Information" refers to personal data about an individual's race, ethnic origin, marital status, age, colour, religious, philosophical or political affiliations, health, education, genetics, financial history, and government-issued identification numbers, as defined under Section 3(l) of the DPA.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, organisation, storage, updating, retrieval, consultation, use, disclosure, and deletion.
• "Data Subject" means you — the individual to whom the personal data relates.
• "Personal Information Controller" means phlar, being the entity that controls the collection, storage, and use of personal data on the Platform.
• "NPC" means the National Privacy Commission of the Republic of the Philippines.
• "DPA" means the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).
• "Cookies" means small text files stored on your device by the Platform that assist with session management, preferences, and analytics.

phlar collects the following categories of personal data from users of the Platform:

Identity & Registration Data

• Full legal name as it appears on your government-issued Philippine identification document
• Date of birth (used to verify that you meet the 21+ minimum age requirement)
• Gender
• Philippine residential address (barangay, city/municipality, province)
• Email address
• Mobile number (Philippine mobile prefix)
• Username and encrypted password

Identity Verification (KYC) Data

• Copy of a valid Philippine government-issued ID (e.g., PhilSys, SSS, UMID, Passport, Driver's Licence, PRC ID, Voter's ID)
• Proof of address documents (e.g., recent utility bill, bank statement)
• Selfie or liveness verification image for biometric matching where required

Financial & Transaction Data

• GCash mobile number or PayMaya account reference
• BPI, BDO, or Metrobank account name (not full account numbers) for bank transfer verification
• Deposit history, withdrawal history, transaction amounts in PHP (₱), and transaction timestamps
• Source of funds declarations where required by anti-money laundering regulations

Gaming & Behavioural Data

• Game session logs, including games played, wager amounts, outcomes, and session duration
• Bonus claims, wagering activity, and promotional participation history
• Responsible gaming tool selections (e.g., deposit limits, self-exclusion requests)

Technical & Device Data

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser version
• Cookie identifiers and session tokens
• Platform access timestamps and navigation logs

Communications Data

• Records of your interactions with phlar's customer support team via live chat or email
• Survey or feedback responses submitted voluntarily
• Email correspondence with phlar

phlar collects your personal data through the following channels and methods:

• Directly from you — when you register a phlar account, complete identity verification, make a deposit or withdrawal, contact support, or respond to a survey.
• Automatically — through cookies, web server logs, and analytics tools when you browse or interact with the Platform. This includes your IP address, session data, and device information.
• From payment providers — transaction confirmation data from GCash, PayMaya, BPI, BDO, and Metrobank when you make deposits or receive withdrawals.
• From identity verification partners — where phlar engages third-party KYC service providers to assist with age and identity verification, those partners may supply verification results to phlar.
• From publicly available sources — phlar may cross-reference your information against publicly available Philippine government databases, fraud prevention registries, or PEP (Politically Exposed Person) screening lists for AML compliance purposes.

phlar processes your personal data for the following specific, legitimate purposes:

phlar will not process your personal data for any purpose that is incompatible with those listed above without first obtaining your separate, explicit consent or as otherwise required by law.

Under the Philippine Data Privacy Act of 2012, phlar relies on the following legal bases to process your personal data:

• Contractual necessity: Processing is necessary to perform our contract with you — i.e., to operate your phlar account, process transactions, and deliver gaming services.
• Legal obligation: Processing is required to comply with Philippine legal obligations, including anti-money laundering laws (Republic Act No. 9160, as amended), the E-Commerce Act, and regulations issued by Philippine financial and gaming authorities.
• Legitimate interests: phlar has a legitimate interest in preventing fraud, ensuring Platform security, and improving the Services, provided that such interests are not overridden by your rights and freedoms.
• Consent: For optional processing activities such as marketing communications or the use of non-essential cookies, phlar relies on your freely given, specific, informed, and unambiguous consent, which you may withdraw at any time.
• Vital interests: In limited circumstances, phlar may process data to protect your vital interests, such as when responsible gaming concerns are identified that require intervention.

phlar does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share your personal data only in the following circumstances and only to the extent strictly necessary:

• Certified game providers: Game providers supplying content to the phlar Platform may receive anonymised session data required for game delivery and integrity verification. These providers are bound by data processing agreements consistent with RA 10173.
• Payment processors: GCash, PayMaya, BPI, BDO, and Metrobank receive the transaction data necessary to process your deposits and withdrawals. These institutions operate under their own privacy frameworks compliant with Philippine banking regulations.
• KYC and identity verification partners: Specialist third-party verification services may process your identity documents solely for the purpose of age and identity verification. Results are shared with phlar; underlying documents are handled subject to strict data minimisation principles.
• Fraud prevention and AML screening services: phlar may share limited personal data with accredited fraud prevention registries or AML screening databases to fulfil obligations under Philippine anti-money laundering law.
• Philippine authorities: phlar will disclose personal data to the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), law enforcement agencies, or courts when required to do so by valid legal process or regulatory order under Philippine law.
• Professional advisers: phlar's legal counsel, auditors, and accountants may access personal data on a strictly confidential and need-to-know basis to provide professional services to phlar.

Some of phlar's service providers and certified game suppliers may be located outside the Philippines. In cases where your personal data is transferred to a jurisdiction outside the Philippine archipelago, phlar ensures that adequate safeguards are in place as required by Section 21 of the Data Privacy Act of 2012 and NPC Circular No. 16-01.

Such safeguards may include:

• Standard contractual clauses approved by the National Privacy Commission
• Binding corporate rules where the recipient is part of the same corporate group as a phlar partner
• Adequacy determinations recognising the receiving jurisdiction as providing equivalent data protection standards

Where you require further information about the specific safeguards applied to a particular international transfer, you may submit a written request to phlar's Data Protection Officer at the contact details set out in Section 16 of this Privacy Policy.

phlar retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by Philippine law. The following general retention periods apply:

Upon expiry of the applicable retention period, phlar will securely delete or anonymise your personal data in a manner that prevents reconstruction of the original information. Anonymised or aggregated data that can no longer identify you may be retained indefinitely for statistical and analytical purposes.

phlar uses cookies and similar tracking technologies (collectively, "Cookies") on the Platform. Cookies are small text files stored on your device that help phlar deliver a functional, personalised, and secure gaming experience for Filipino players.

phlar uses the following types of Cookies:

• Strictly Necessary Cookies: These are essential to the operation of the Platform. They enable you to log in, maintain your session, and use core features. The Platform cannot function properly without them, and they cannot be disabled.
• Functional Cookies: These remember your preferences — such as your preferred language, currency display, and responsible gaming settings — so you do not have to re-enter them every time you visit phlar.
• Performance & Analytics Cookies: These collect anonymous information about how users interact with the Platform, helping phlar understand which pages are most popular, identify technical issues, and improve the user experience over time. These are only placed with your consent.
• Security Cookies: These help phlar detect and prevent fraudulent sessions, unauthorised access attempts, and bot activity on the Platform.

You can manage or withdraw your consent to non-essential Cookies at any time through your browser's settings. Note that disabling certain Cookies may limit the functionality of the phlar Platform — for example, you may need to log in again on each visit.

phlar takes the security of your personal data seriously. We implement a comprehensive set of technical and organisational security measures to protect your information against unauthorised access, disclosure, alteration, and destruction, including:

• TLS/SSL Encryption: All data transmitted between your device and the phlar Platform is encrypted in transit using Transport Layer Security (TLS 1.2 or higher).
• AES-256 Encryption: Sensitive personal data stored in phlar's databases — including identity documents and financial records — is encrypted at rest using AES-256 encryption.
• Multi-Factor Authentication (MFA): Staff access to systems that store or process personal data requires multi-factor authentication, limiting the risk of unauthorised internal access.
• Access Controls: phlar applies the principle of least privilege — employees and contractors only have access to the personal data they need to perform their specific job functions.
• Regular Security Audits: phlar engages independent third-party security experts to conduct periodic penetration testing and vulnerability assessments of the Platform and its infrastructure.
• Incident Response: phlar maintains a documented data breach response plan. In the event of a personal data breach that poses a real risk to your rights and freedoms, phlar will notify the National Privacy Commission (NPC) within 72 hours and affected data subjects as required under NPC Circular No. 16-03.
• Staff Training: All phlar personnel who handle personal data undergo regular data privacy training to ensure they understand their obligations under the DPA and phlar's internal data handling policies.

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phlar. You may exercise any of these rights by contacting phlar's Data Protection Officer as described in Section 16:

• Right to be Informed: You have the right to be informed of the existence of processing, the nature of the data collected, the purpose of processing, and the recipients of your data — which is the purpose of this Privacy Policy.
• Right of Access: You have the right to request a copy of the personal data phlar holds about you, together with information about how it is processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data phlar holds about you. For certain data fields, you can update your information directly within your phlar account settings.
• Right to Erasure or Blocking: You have the right to request deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, or where processing is unlawful. Note that phlar may be required to retain certain data to comply with Philippine legal obligations even after a deletion request.
• Right to Object: You have the right to object to the processing of your personal data on grounds relating to your particular situation, where phlar processes your data on the basis of legitimate interests. You may also withdraw consent for marketing communications at any time.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that phlar transmit it to another personal information controller where technically feasible.
• Right to Damages: You have the right to claim compensation for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised processing of your personal data by phlar.
• Right to File a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) at www.privacy.gov.ph if you believe that phlar has violated your rights under the DPA.

phlar will respond to data subject rights requests within thirty (30) calendar days of receipt. In cases of complex or high-volume requests, phlar may extend this period by a further thirty (30) days with written notice to you.

phlar is strictly an adult platform. Access to the Platform and its gaming services is limited to individuals who are 21 years of age or older, consistent with Philippine laws and regulations governing online gaming and casino-style gambling. This age requirement is higher than the general legal age of majority in the Philippines precisely because of the nature of the services offered.

phlar does not knowingly collect, process, or store personal data from individuals under the age of 21. During registration and as part of our Know Your Customer (KYC) process, phlar verifies the age of all users using government-issued Philippine identification documents.

If phlar discovers that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. If you believe that phlar may hold personal data belonging to a person under 21, please contact our Data Protection Officer immediately at the contact details in Section 16.

The phlar Platform may contain references to or information about services operated by phlar's certified game and payment partners. These references are provided solely in the context of describing phlar's services and are not outbound links to third-party websites.

phlar is not responsible for the privacy practices or content of any third-party websites or services. If you independently choose to visit any third-party website, we encourage you to review the privacy policy of that website carefully before providing any personal data.

phlar's Privacy Policy applies solely to the phlar Platform at https://phlar.net and does not extend to any third-party websites or external services.

phlar reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform features. When we make material changes to this Privacy Policy, we will:

• Update the "Effective Date" at the top of this Privacy Policy page
• Display a prominent notice on the phlar Platform informing users of the update
• Send an email notification to all registered users where the changes materially affect their rights or the way we process their personal data

Your continued use of the phlar Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Privacy Policy, you must stop using the Platform and may request closure of your account by contacting our support team.

We encourage you to review this Privacy Policy periodically to stay informed about how phlar protects your personal data. The most current version of this Privacy Policy will always be available at https://phlar.net/privacy-policy.

phlar has appointed a Data Protection Officer (DPO) in accordance with Section 21(c) of the Philippine Data Privacy Act of 2012 and NPC Circular No. 16-01. If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, you may contact phlar's DPO through the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 via the phlar Platform, Philippine Standard Time
• Response Time: phlar aims to acknowledge all privacy-related enquiries within 3 business days and provide a substantive response within 30 calendar days

If you are not satisfied with phlar's response to your privacy enquiry or data subject rights request, you have the right to escalate your complaint to the National Privacy Commission of the Philippines:

• National Privacy Commission (NPC)
• 5th Floor, Delegation Building, PICC Complex, Pasay City, Metro Manila, Philippines
• Website: www.privacy.gov.ph