Your Privacy Matters
at 25phcom

Welcome to the 25phcom Privacy Policy. 25phcom is the Philippines' PAGCOR-regulated online casino and sports betting platform serving Filipino players with a safe, transparent, and entertaining gaming experience. We understand that when you sign up and play on 25phcom, you're trusting us with information that matters to you — your name, contact details, financial data, and identity documents. We do not take that trust lightly.

This Privacy Policy explains in plain, clear English exactly what personal data 25phcom collects from you, why we collect it, how we process and store it, who we share it with, and what rights you have over it. It has been drafted in accordance with the Philippine Data Privacy Act of 2012 (Republic Act 10173), its Implementing Rules and Regulations, and the guidelines of the National Privacy Commission (NPC).

By registering an account on 25phcom or by continuing to use our platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this policy, please discontinue your use of the platform and contact us to request account closure.

25phcom acts as the data controller for all personal data collected through the platform. As data controller, 25phcom determines the purposes and means by which your personal data is processed. We have appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Privacy Policy and Philippine data protection law.

Our Data Protection Officer can be reached at [email protected]. All data subject requests, privacy complaints, and inquiries regarding how 25phcom handles your personal information should be directed to this address, clearly marked "Attention: Data Protection Officer."

25phcom operates under the regulatory oversight of the Philippine Amusement and Gaming Corporation (PAGCOR), which requires us to maintain specific player records for anti-money laundering (AML) compliance and responsible gaming purposes. Our data practices are shaped in part by these regulatory obligations, which take precedence over individual deletion requests in certain circumstances as explained in Section 8.

25phcom collects the minimum personal data necessary to provide you with a safe, compliant, and high-quality gaming experience. The categories of personal data we collect include the following:

25phcom does not collect sensitive personal information as defined under the Philippine Data Privacy Act (such as health data, political opinions, or religious beliefs) unless specifically required for responsible gaming self-exclusion programs or as mandated by PAGCOR regulation.

25phcom collects personal data through the following means:

Direct Collection

When you register an account on 25phcom, complete KYC verification, make a deposit or withdrawal, interact with customer support, or respond to a promotion, you provide us with personal data directly. All direct data collection on 25phcom is voluntary — however, refusing to provide data required for regulatory compliance (such as KYC) may prevent you from accessing certain platform features.

Automated Collection

When you use the 25phcom platform, our systems automatically collect technical data such as your IP address, device identifier, browser characteristics, and session timestamps. This data is collected through server logs, cookies, and similar tracking technologies described in Section 10 of this Privacy Policy.

Third-Party Sources

25phcom may receive data about you from third-party sources including: payment processors (GCash, PayMaya, BPI, BDO, Metrobank) for transaction verification purposes; identity verification service providers used to cross-check KYC documents; and PAGCOR's player exclusion register, to confirm that you are not subject to a self-exclusion order before allowing account registration.

25phcom processes your personal data exclusively for the following declared purposes:

• Account Management: Creating, maintaining, and securing your 25phcom player account, including authentication and access control.
• KYC & Identity Verification: Verifying your identity and age (21+) as required by PAGCOR and Philippine AML regulations.
• Payment Processing: Facilitating deposits and withdrawals through GCash, PayMaya, BPI, BDO, and Metrobank in accordance with BSP regulations.
• Regulatory Compliance: Meeting our obligations under PAGCOR licensing conditions, the Philippine Anti-Money Laundering Act (AMLA), and the Data Privacy Act of 2012.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, unauthorized account access, and platform abuse.
• Responsible Gaming: Monitoring player behavior to identify problem gambling indicators, administering deposit limits, cool-off periods, and self-exclusion programs.
• Customer Support: Responding to your inquiries, resolving disputes, and maintaining records of support interactions.
• Platform Improvement: Analyzing aggregated, anonymized gameplay and usage data to improve our games, features, and user experience.
• Marketing Communications (opt-in only): Sending promotional offers, bonus notifications, and platform updates to players who have explicitly consented to receive them.

25phcom does not use your personal data for purposes incompatible with those listed above without first seeking your additional consent or establishing a separate legal basis for the new processing purpose.

Under the Philippine Data Privacy Act, 25phcom relies on the following legal bases for processing your personal data:

• Contractual Necessity: Processing required to fulfill our obligations under the Terms & Conditions agreement with you — including account creation, payment processing, and gameplay services.
• Legal Obligation: Processing mandated by PAGCOR regulations, the Anti-Money Laundering Act, and other applicable Philippine law — including KYC verification, AML transaction monitoring, and PAGCOR reporting obligations.
• Legitimate Interest: Processing for fraud detection, platform security, responsible gaming monitoring, and anonymous analytics, where these interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications and the use of non-essential cookies, where you have freely given specific, informed, and unambiguous consent. You may withdraw this consent at any time without affecting the lawfulness of processing prior to withdrawal.

25phcom does not sell, rent, or trade your personal data. We share your information only in the following limited and necessary circumstances:

Regulatory Authorities

25phcom is required to share certain player data with PAGCOR and other Philippine government authorities (including the Anti-Money Laundering Council, Bureau of Internal Revenue, and law enforcement agencies) when legally mandated to do so. We have no discretion to withhold data in these circumstances.

Payment Processors

To process your deposits and withdrawals, 25phcom shares necessary transaction data with GCash, PayMaya, BPI, BDO, and Metrobank. These providers process your data only as required to execute the specific transaction and are bound by their own privacy policies and BSP data protection requirements.

KYC Service Providers

25phcom engages accredited third-party identity verification providers to assist with KYC document processing. These providers act as data processors under 25phcom's instructions and are contractually prohibited from using your data for any purpose other than identity verification on 25phcom's behalf.

IT & Infrastructure Providers

Our platform relies on cloud infrastructure, security monitoring, and analytics services provided by contracted third parties. These providers are bound by data processing agreements that restrict their use of 25phcom player data to the specific services they provide.

25phcom retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by Philippine law and PAGCOR regulatory obligations. The following retention periods apply:

After the applicable retention period expires, 25phcom will securely delete or anonymize your personal data in a manner that makes re-identification impossible. Anonymized, aggregated data may be retained indefinitely for statistical and platform improvement purposes.

25phcom implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Our security framework includes:

• Encryption in Transit: All data transmitted between your device and 25phcom's servers is encrypted using TLS 1.3 or higher. This applies to the platform interface, payment APIs, and all internal service communications.
• Encryption at Rest: Personal data stored in 25phcom databases is encrypted using AES-256. KYC documents and financial records are stored in isolated, access-controlled storage environments.
• Multi-Factor Authentication: All 25phcom staff with access to player data systems are required to use multi-factor authentication. Players are strongly encouraged to enable OTP-based two-factor authentication on their accounts.
• Access Controls: Role-based access controls ensure that 25phcom employees can only access the player data necessary for their specific job function. All access is logged and reviewed periodically.
• Penetration Testing: 25phcom conducts regular vulnerability assessments and third-party penetration tests on our platform and infrastructure to identify and remediate security weaknesses proactively.
• Incident Response: 25phcom maintains a documented data breach response plan. In the event of a breach affecting your personal data, we will notify you and the National Privacy Commission within 72 hours of discovery, as described in Section 13.

25phcom uses cookies and similar tracking technologies to operate the platform, maintain your session, detect fraud, and — where you have consented — to analyze usage patterns and deliver personalized content. The following types of cookies are used:

Essential Cookies

These cookies are strictly necessary for the 25phcom platform to function. They maintain your login session, remember your language and currency preferences, and enable security features like CSRF protection. Essential cookies cannot be disabled without breaking core platform functionality.

Analytics Cookies

With your consent, 25phcom uses anonymized analytics cookies to understand how players navigate the platform — which games are most popular, where players encounter difficulties, and how long sessions typically last. This data is used exclusively to improve the 25phcom experience and is never used to identify individual players.

Fraud Prevention Cookies

25phcom uses device fingerprinting cookies for fraud detection and AML compliance purposes. These cookies help us identify unusual patterns that may indicate account sharing, bot activity, or multiple account registration — all of which are prohibited under our Terms & Conditions.

You can manage non-essential cookie preferences through the cookie consent panel available at the bottom of the 25phcom platform. Note that disabling certain categories of cookies may affect your experience on the platform.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 25phcom. These rights may be exercised by contacting our Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request":

25phcom will respond to all verified data subject rights requests within fifteen (15) business days of receipt. We may request proof of identity before processing your request to prevent unauthorized disclosure of personal data. In certain cases — particularly where retention is required by PAGCOR or AMLA — we may be unable to fulfill a deletion request in full; we will explain the specific legal basis for any refusal clearly in our response.

If you are not satisfied with 25phcom's response to your data rights request, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines at privacy.gov.ph.

25phcom is strictly prohibited for individuals under 21 years of age. In accordance with Philippine law and PAGCOR regulations, all players must be at least 21 years old to register and play on 25phcom. This age restriction applies to all Filipino players regardless of their location within the Philippines.

25phcom takes age verification seriously as a matter of both legal compliance and responsible gaming. During the KYC verification process, all players are required to submit a valid government-issued ID that confirms their date of birth. Accounts where age cannot be verified will be suspended pending document submission. Accounts found to belong to individuals under 21 years of age will be permanently closed and any funds returned in accordance with applicable law.

25phcom does not knowingly collect, store, or process personal data from individuals under 21 years of age. If you are a parent or guardian and believe that a minor has registered on 25phcom, please contact us immediately at [email protected]. We will investigate and take appropriate action, including immediate account termination and data deletion, within 48 hours of a verified report.

Despite our robust security measures, no platform can guarantee absolute immunity from data breaches. In the event that 25phcom becomes aware of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, we will take the following steps:

• Immediate Containment: Upon discovery of a potential breach, 25phcom's security team will immediately work to contain the incident, preserve evidence, and prevent further unauthorized access.
• Assessment: We will assess the nature, scope, and likely impact of the breach on affected players within the first 24 hours, prioritizing the security of payment data and identity documents.
• NPC Notification: 25phcom will notify the National Privacy Commission (NPC) within 72 hours of confirming a breach that poses risk to affected data subjects, as required by NPC Circular 16-03.
• Player Notification: Affected players will be notified directly via their registered email address as soon as practically possible. Our notification will include: the nature of the data involved, likely consequences of the breach, and the steps 25phcom is taking to address it.
• Remediation: Following containment, 25phcom will conduct a thorough root cause analysis and implement remediation measures to prevent recurrence. A post-incident report will be submitted to PAGCOR and the NPC as required.

To report a suspected security vulnerability or data breach on the 25phcom platform, please contact our security team at [email protected] immediately. We treat all security reports with the highest priority.

25phcom reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or PAGCOR regulatory requirements. Any material changes — meaning changes that significantly affect how we collect, use, or share your personal data — will be communicated to you at least seven (7) days in advance via email to your registered address and via a prominent notice on the 25phcom platform.

Non-material changes (such as clarifications of existing practices, formatting updates, or corrections of typographical errors) may be made without advance notice, with the updated date reflected at the top of this policy. It is your responsibility to review this Privacy Policy periodically to stay informed of any updates.

Your continued use of the 25phcom platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with material changes, you have the right to close your account and request deletion of your personal data (subject to regulatory retention requirements) before the revised policy takes effect.

All previous versions of this Privacy Policy are archived and available upon written request to our Data Protection Officer at [email protected].

For any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data by 25phcom, please contact our Data Protection Officer directly. We are committed to responding to all privacy inquiries promptly and transparently.

You can reach our Data Protection Officer by:

• Email: [email protected] — please use the subject line "Privacy Inquiry" or "Data Subject Rights Request" to ensure your message is routed to the correct team.
• Live Chat: Available 24/7 inside the 25phcom platform. Identify yourself as a registered player and request to speak with the Data Protection team.
• Written Request: You may submit a formal written data subject rights request by emailing [email protected] with your full name, registered email address, and a clear description of your request. A copy of a valid government-issued ID will be required to verify your identity before we process the request.

If you feel that 25phcom has not adequately addressed your privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines. The NPC's mandate is to protect the privacy rights of all Filipinos and to enforce the Data Privacy Act of 2012.