56ph Privacy Policy — How We Handle Your Personal Data

This Privacy Policy ("Policy") describes how 56ph ("56ph," "we," "us," or "our") collects, uses, discloses, and safeguards the personal information of individuals ("you," "Player," or "User") who register for and use the 56ph online gaming platform accessible at 56ph.one.

56ph is committed to full compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and all applicable issuances of the National Privacy Commission (NPC) of the Philippines. Our operations as a PAGCOR-regulated online casino also require compliance with data processing obligations under PAGCOR's regulatory framework.

This Policy applies to all personal data collected through:

• The 56ph website at 56ph.one and all associated pages;
• Account registration, KYC verification, and ongoing account management;
• Deposits, withdrawals, and financial transactions via GCash, PayMaya, BPI, BDO, and Metrobank;
• Customer support interactions via live chat and email;
• Marketing communications and promotional campaigns where you have consented.

By registering and using a 56ph account, you confirm that you have read and understood this Policy and consent to the collection and use of your personal data as described herein.

For the purposes of the Philippine Data Privacy Act of 2012, 56ph is the Personal Information Controller (PIC) in respect of personal data collected through the 56ph platform. As the PIC, 56ph determines the purposes and means of processing your personal information and is responsible for ensuring that processing is carried out in accordance with applicable Philippine law.

Where 56ph engages third-party service providers to process personal data on its behalf — such as payment processors, KYC verification services, and cloud infrastructure providers — those parties act as Personal Information Processors (PIPs) under binding data processing agreements that restrict their use of your data to specified purposes only.

56ph collects the minimum personal data necessary to provide a secure, compliant, and personalised gaming experience. The categories of personal data we process are set out in the table below.

56ph does not collect sensitive personal information as defined under Section 3(l) of RA 10173 — including health, race, religious beliefs, or political affiliations — except where voluntarily disclosed by the player in a support context and strictly necessary to address the player's request.

56ph collects personal data through the following channels:

• Directly from you — when you register a 56ph account, complete KYC verification, submit a deposit or withdrawal request, contact our support team, or opt in to promotional communications;
• Automatically through platform use — via cookies, session tracking technology, and server logs that capture technical data such as your IP address, device type, and in-platform activity while you are logged in to 56ph;
• From payment processors — GCash, PayMaya, BPI, BDO, and Metrobank may provide 56ph with transaction confirmation data and, where required for AML compliance, account holder verification data;
• From identity verification services — where 56ph engages accredited third-party KYC providers to validate your government-issued identification documents against authoritative sources;
• From fraud prevention partners — technical risk signals shared by trusted fraud detection services to protect the integrity of the 56ph platform and its players.

56ph processes your personal data for the following defined purposes:

• Account creation and management — establishing, maintaining, and administering your 56ph player account;
• Age and identity verification — confirming that you are at least 21 years of age and that your identity is as stated, in compliance with PAGCOR requirements;
• Payment processing — facilitating deposits to your 56ph wallet and processing withdrawal requests to your registered GCash, PayMaya, or bank account;
• Regulatory compliance — fulfilling our obligations under PAGCOR's operating licence, the Anti-Money Laundering Act (RA 9160), the Tax Reform for Acceleration and Inclusion Act, and other applicable Philippine laws;
• Fraud prevention and security — detecting and preventing fraudulent transactions, account takeover attempts, bonus abuse, and other prohibited conduct outlined in the 56ph Terms and Conditions;
• Responsible gaming — monitoring gaming activity to identify patterns consistent with problem gambling and to enforce player-set deposit limits, loss limits, and self-exclusion requests;
• Customer support — resolving account queries, payment issues, gameplay disputes, and responsible gaming requests;
• Marketing communications — sending promotional offers, bonus notifications, and platform updates to players who have explicitly consented to receive such communications;
• Platform improvement — analysing aggregated, anonymised usage data to improve the 56ph platform, game selection, and overall player experience.

56ph processes your personal data on the following lawful bases under the Data Privacy Act of 2012:

• Contractual necessity — processing required to fulfil the agreement between 56ph and the player, including account operation, game access, and payment services;
• Legal obligation — processing required to comply with PAGCOR regulations, the Anti-Money Laundering Act, National Privacy Commission requirements, and other applicable Philippine laws;
• Legitimate interests — processing conducted for fraud detection, platform security, and responsible gaming monitoring, where those interests do not override your privacy rights;
• Consent — processing for direct marketing communications and optional analytics, where you have given a specific, informed, and freely given consent that you may withdraw at any time.

56ph does not sell, rent, or trade your personal data to third parties for commercial purposes. Your data may be shared only in the following circumstances:

• Payment processors — GCash (G-Xchange, Inc.), PayMaya Philippines, BPI, BDO, and Metrobank receive transaction-level data necessary to process your deposits and withdrawals. These institutions are independently regulated by the Bangko Sentral ng Pilipinas;
• PAGCOR and regulatory authorities — 56ph is required by its operating licence to report specified gaming activity data to PAGCOR. We may also be required to disclose player data to the Anti-Money Laundering Council (AMLC), National Privacy Commission, Bureau of Internal Revenue, or other Philippine government agencies pursuant to lawful orders or mandatory regulatory reporting obligations;
• KYC and identity verification providers — accredited third-party services that assist in verifying the authenticity of government-issued identification documents submitted during account registration;
• Fraud prevention and security services — trusted partners that provide risk assessment signals to assist 56ph in detecting prohibited conduct and protecting player accounts;
• Legal proceedings — in response to a valid court order, subpoena, or lawful request from a Philippine law enforcement authority;
• Business operations — internal service teams (technology, support, compliance) operating under strict data access controls and bound by confidentiality obligations.

56ph's primary data processing infrastructure is hosted within data centres serving the Philippine market. Where engagement with international third-party technology providers — such as cloud infrastructure services or game content providers — involves the transfer of data outside the Philippines, 56ph ensures that such transfers are subject to appropriate contractual protections consistent with Section 21 of the Data Privacy Act and applicable NPC guidance on cross-border data transfers.

Transfers to game content providers are limited to technical session data required for game functionality and do not include your identity or financial data. All cross-border data processing agreements include confidentiality, data minimisation, and security requirements binding on the recipient party.

56ph retains personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following retention periods apply:

• Account and KYC data — retained for a minimum of five (5) years following account closure, in compliance with PAGCOR anti-money laundering record-keeping requirements;
• Transaction records — deposit, withdrawal, and gaming transaction logs are retained for a minimum of five (5) years from the date of the transaction in accordance with AMLC and BIR requirements;
• Customer support records — live chat transcripts and email correspondence are retained for three (3) years from the date of the interaction;
• Marketing preference data — retained until you withdraw consent or close your account, and then deleted within thirty (30) days;
• Technical and security logs — server logs and fraud detection records are retained for up to twenty-four (24) months from the date of creation.

Upon the expiry of applicable retention periods, personal data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual.

56ph implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction.

• Encryption in transit — all data exchanged between your device and the 56ph platform is encrypted using TLS 1.2 / 1.3 (256-bit SSL). The padlock in your browser's address bar confirms an active secure connection;
• Encryption at rest — sensitive personal and financial data stored in 56ph databases is encrypted at rest using AES-256 encryption;
• Access controls — player data is accessible only to 56ph personnel with a defined business need. Role-based access controls and multi-factor authentication are enforced for all internal systems handling personal data;
• Two-factor authentication — optional 2FA using OTP to your registered Philippine mobile number is available for all 56ph player accounts and is strongly recommended;
• Fraud monitoring — automated systems monitor account activity for patterns consistent with account takeover, fraudulent deposits, or unusual session behaviour;
• Incident response — 56ph maintains a documented data breach response procedure. In the event of a personal data breach, 56ph will notify affected players and the National Privacy Commission within the timeframes required by RA 10173.

56ph uses cookies and similar tracking technologies on the 56ph platform to deliver a functional, secure, and personalised experience. The categories of cookies used are as follows:

• Strictly necessary cookies — required for the platform to function. These include session authentication tokens, security cookies, and login state management. These cannot be disabled without impairing platform functionality;
• Functional cookies — remember your preferences such as language settings, preferred lobby view, and responsible gaming settings across sessions;
• Analytics cookies — used to measure aggregate platform usage, identify pages with high error rates, and improve overall performance. Analytics data is processed in anonymised, aggregated form only;
• Security cookies — used by 56ph's fraud detection systems to assess session risk and identify suspicious login patterns.

56ph does not use third-party advertising or retargeting cookies. You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from logging in to your 56ph account.

The 56ph platform is strictly restricted to persons who are 21 years of age or older, in accordance with PAGCOR regulations governing online gaming in the Philippines. 56ph does not knowingly collect personal data from persons under 21 years of age.

Age verification is conducted as part of the mandatory KYC process for all 56ph account registrations. Any account discovered to belong to an individual under 21 years of age will be immediately suspended, all associated personal data will be deleted (subject to any mandatory regulatory retention requirements), and the registration will be reported to PAGCOR.

If you are a parent or guardian and believe that a minor in your care has registered a 56ph account, contact our support team immediately via live chat or at [email protected]. We will investigate and act promptly.

Under the Philippine Data Privacy Act of 2012, you are entitled to exercise the following rights in respect of personal data that 56ph holds about you:

• Right to be informed — the right to know what personal data 56ph collects about you and how it is used, as described in this Policy;
• Right to access — the right to obtain a copy of your personal data held by 56ph upon a verified written request;
• Right to rectification — the right to have inaccurate or incomplete personal data corrected without undue delay;
• Right to erasure or blocking — the right to request deletion or blocking of personal data that is no longer necessary, was collected without valid consent, or was processed unlawfully, subject to applicable legal retention requirements;
• Right to data portability — the right to receive your personal data in a structured, commonly used, and machine-readable format where technically feasible;
• Right to object — the right to object to processing based on legitimate interests or for direct marketing purposes;
• Right to damages — the right to seek compensation for damages suffered as a result of inaccurate, incomplete, outdated, or unlawfully obtained personal data.

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Privacy Request." Include your registered account username and a description of the right you wish to exercise. 56ph will acknowledge your request within three (3) business days and complete action within ten (10) business days of identity verification.

If you believe that 56ph has handled your personal data in a manner inconsistent with this Policy or in violation of your rights under the Data Privacy Act of 2012, you may:

• Submit a formal complaint to the 56ph Data Protection Officer at [email protected] — we will investigate and respond within fifteen (15) business days;
• If your complaint is not resolved to your satisfaction through the 56ph internal process, you may file a complaint with the National Privacy Commission of the Philippines at privacy.gov.ph, which has jurisdiction over data privacy disputes under RA 10173.

56ph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable Philippine law, or directions from the National Privacy Commission or PAGCOR.

Material changes to this Policy will be communicated to registered 56ph players via email notification to your registered address and/or through an in-platform notification at least seven (7) days before the revised Policy takes effect. The effective date at the top of this page will be updated accordingly.

Continued use of the 56ph platform after the effective date of an amended Privacy Policy constitutes your acknowledgment of and agreement to the revised terms. If you do not accept the revised Policy, you must cease use of the platform and may request account closure through 56ph support.

For all privacy-related inquiries, data subject rights requests, or complaints relating to 56ph's handling of your personal information, please contact the 56ph Data Protection Officer through the following channels: