This Privacy Policy explains how phkay collects, uses, stores, shares, and protects the personal information of players and visitors. Your privacy matters to us, and we are committed to handling your data with transparency and care in accordance with applicable Philippine data protection law.
Six principles that guide how phkay treats every piece of personal data we hold.
phkay only collects personal data that is strictly necessary for account operation, identity verification, payment processing, and regulatory compliance. We do not gather data beyond what is required to provide you with a safe and functional gaming experience.
All personal data transmitted to and from phkay is encrypted using 256-bit SSL/TLS technology. Stored data is protected by access controls, encrypted databases, and regular security audits. phkay does not store passwords in plain text under any circumstances.
phkay does not sell, rent, or trade your personal data to third-party marketers or data brokers. Your information is used only to operate and improve the phkay platform, fulfil regulatory obligations, and protect you as a player from fraud.
Registered phkay players have the right to access, correct, and in certain circumstances request the deletion of their personal data. Marketing communications can be opted out of at any time. phkay responds to all verified data access requests within thirty (30) days.
Identity documents submitted for KYC verification are handled with the highest level of confidentiality. They are used exclusively for identity confirmation and regulatory compliance purposes and are stored securely with restricted access limited to authorised compliance personnel.
phkay's data handling practices are aligned with the Republic Act No. 10173 — the Data Privacy Act of 2012 — and the regulations of the National Privacy Commission (NPC) of the Philippines. We treat your data rights as legally enforceable obligations, not optional courtesies.
Summary: phkay collects and uses your personal data to operate your account, process payments, verify your identity, and comply with Philippine gaming and data protection regulations. We do not sell your data. You have the right to access, correct, and in certain circumstances delete the personal data we hold about you. This policy explains all of that in full.
1.1 This Privacy Policy applies to all personal data collected, processed, stored, or transmitted by phkay in connection with your access to and use of the phkay platform available at phkay.app, including any associated mobile applications and related services (collectively, the "Platform").
1.2 This Policy applies to:
1.3 This Privacy Policy should be read together with the phkay Terms & Conditions and Responsible Gaming Policy. By accessing or using phkay, you acknowledge that you have read and understood this Privacy Policy.
2.1 For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173) and applicable regulations of the National Privacy Commission (NPC) of the Philippines, phkay is the data controller responsible for the personal data collected through the Platform.
2.2 phkay has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection law. You may contact the phkay DPO via the support email address listed in Section 17 of this Policy.
3.1 The categories of personal data phkay may collect about you are described in the table below, together with the context in which that data is collected.
| Category | Examples | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, government ID number | Account registration; KYC verification |
| Contact Data | Email address, Philippine mobile number, city of residence | Account registration; account settings updates |
| Authentication Data | Encrypted password hash, 2FA configuration, session tokens | Account login; security settings |
| Financial Data | GCash number, Maya account name, bank account name/number, transaction amounts and dates | Deposit and withdrawal processing; KYC |
| KYC Documents | Scanned government-issued ID, selfie photograph, proof of payment method | KYC verification process |
| Gameplay Data | Game session logs, bet amounts, win/loss records, bonus usage, RNG outcomes | During active play on phkay |
| Technical Data | IP address, device type, operating system, browser type, time zone | Platform access; login events |
| Usage Data | Pages visited, features used, session duration, click patterns | Platform browsing and interaction |
| Communication Data | Live chat transcripts, support email correspondence, survey responses | Customer support interactions |
| Marketing Preferences | Email/SMS opt-in or opt-out status, promotion claim history | Account settings; promotional activity |
3.2 phkay does not intentionally collect sensitive personal information such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or health data, except where this is strictly necessary for responsible gaming purposes (e.g., recording a self-exclusion request or a player-declared vulnerability).
4.1 phkay collects personal data through the following means:
Data you provide directly when you register a phkay account, complete KYC verification, make a deposit or withdrawal request, contact phkay support, respond to a survey, or update your account settings.
Technical and usage data collected automatically when you access phkay.app, including through cookies, web beacons, and server-side logging. This includes your IP address, device identifiers, browser type, session duration, and navigation patterns within the Platform. See Section 8 for more on cookies.
phkay may receive limited data from third-party sources in the following contexts:
5.1 phkay uses personal data for the following purposes:
6.1 phkay processes personal data on the following legal bases as recognised under the Data Privacy Act of 2012 and applicable NPC regulations:
| Processing Purpose | Legal Basis |
|---|---|
| Account creation and operation; payment processing; game provision | Performance of a contract to which you are a party |
| KYC/AML verification; regulatory reporting; responsible gaming enforcement | Compliance with a legal obligation |
| Fraud detection; account security; platform integrity | Legitimate interest of phkay (protecting the platform and its players) |
| Marketing communications (email/SMS) | Your consent (opt-in), withdrawable at any time |
| Platform usage analytics (aggregated, anonymised) | Legitimate interest of phkay (platform improvement) |
7.1 phkay does not sell, rent, or trade your personal data to third-party marketers, data aggregators, or advertising networks. Personal data is shared with third parties only in the following limited and controlled circumstances:
Transaction data is shared with payment processors (GCash, Maya, BDO, BPI, Metrobank, UnionBank, and others) solely to facilitate deposit and withdrawal processing. These providers are contractually required to handle your data securely and in accordance with applicable law.
KYC document data may be processed by trusted third-party identity verification service providers on phkay's behalf. These providers act as data processors under contractual obligations that restrict their use of your data to the KYC verification purpose only.
Game studios whose products are hosted on phkay (e.g., Pragmatic Play, Evolution Gaming, Jili) may receive limited gameplay data necessary to deliver their game services. This data is used solely for game operation, RNG certification, and audit purposes.
phkay will disclose personal data to PAGCOR, the NPC, the Anti-Money Laundering Council (AMLC), or other competent Philippine authorities when required to do so by applicable law, court order, or regulatory instruction. phkay will notify affected players of such disclosure where legally permitted to do so.
In the event of a merger, acquisition, or sale of phkay's business or assets, personal data held by phkay may be transferred to the acquiring entity, subject to equivalent privacy protections. phkay will notify registered players of any such transfer via the email address on their account.
All third-party data processors engaged by phkay are bound by data processing agreements that require them to process your personal data only on phkay's instructions, for specified purposes, and with appropriate technical and organisational security measures in place.
8.1 phkay uses cookies and similar tracking technologies on the Platform for the following purposes:
8.2 phkay does not use third-party advertising or retargeting cookies that would track your activity across external websites.
8.3 You may manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will impair your ability to log in and use the phkay Platform. Changes to cookie preferences take effect on your next visit to phkay.app.
9.1 phkay retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or for as long as required by applicable law, whichever is longer.
9.2 The following retention periods apply as a general guide:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | Regulatory and AML compliance |
| KYC documents | Duration of account + 5 years post-closure | AMLC and regulatory compliance |
| Transaction records | Duration of account + 5 years post-closure | Financial record-keeping obligations |
| Gameplay logs | Duration of account + 3 years post-closure | Regulatory audit and dispute resolution |
| Support communications | 3 years from the date of the communication | Legitimate interest (dispute resolution) |
| Marketing preferences | Until opt-out or account closure | Consent-based processing |
| Technical/usage data (anonymised) | Up to 24 months on a rolling basis | Platform improvement |
9.3 When personal data is no longer required and no legal obligation requires its retention, phkay will securely delete or anonymise the data in a manner that prevents reconstruction of the individual's identity.
10.1 phkay implements comprehensive technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:
10.2 While phkay takes security seriously and invests heavily in protective measures, no digital platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own phkay account credentials and for ensuring your personal device is adequately secured.
11.1 Under the Data Privacy Act of 2012 and applicable NPC regulations, phkay players have the following rights in relation to their personal data. All rights requests must be submitted in writing via the contact details in Section 17.
You may request a copy of the personal data phkay holds about you, including information about how it is processed, who it has been shared with, and how long it is retained. phkay will respond within 30 days of a verified request.
You may request the correction of inaccurate or incomplete personal data phkay holds about you. Some corrections (e.g., name changes) may require documentary evidence before they are applied.
You may request the deletion of personal data phkay holds about you where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (where consent was the legal basis). This right is subject to overriding retention obligations under Philippine law.
You may object to the processing of your personal data where phkay relies on legitimate interest as the legal basis. phkay will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
Where technically feasible, you may request that phkay provide your personal data in a structured, commonly used, machine-readable format to allow you to transfer it to another service provider.
If you believe phkay has handled your personal data in a manner that violates the Data Privacy Act of 2012, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph).
21+Age Restriction: phkay strictly prohibits the registration or use of the Platform by persons under the age of 21. This is a mandatory requirement under applicable Philippine gaming regulations. phkay does not knowingly collect or process personal data from individuals under 21 years of age.
12.1 Where phkay becomes aware or reasonably suspects that personal data has been collected from a person under 21, phkay will immediately suspend the associated account, delete the personal data collected, and return any real-money funds deposited in accordance with applicable regulations.
12.2 If you are a parent or guardian and believe a minor has registered on the phkay platform, please contact phkay support immediately using the contact details in Section 17 so that appropriate action can be taken without delay.
13.1 phkay may send promotional emails and SMS notifications to players who have explicitly opted in to receive marketing communications during account registration or at any subsequent time via their account settings. Marketing communications from phkay may include bonus offers, new game announcements, tournament invitations, and platform news.
13.2 You may opt out of phkay marketing communications at any time by:
13.3 Opting out of marketing communications will not affect the delivery of transactional communications — including deposit confirmations, withdrawal notifications, account security alerts, KYC status updates, and important platform announcements — which phkay may continue to send regardless of marketing preferences.
13.4 phkay does not share player contact information with third-party marketers for their own promotional purposes. If you receive unsolicited communications purporting to be from phkay that you did not opt in to receive, please report this to phkay support immediately.
14.1 The phkay Platform integrates services from third-party providers including game studios, payment processors, and identity verification services. Where these integrations involve the processing of your personal data, phkay ensures that appropriate data processing agreements are in place with the relevant provider.
14.2 phkay is not responsible for the privacy practices of third-party service providers who process data on your behalf for purposes unrelated to phkay — such as your mobile network provider, your bank, or GCash. phkay encourages you to review the privacy policies of any third-party service you use in connection with your phkay account.
15.1 In the event of a personal data breach that is likely to pose a risk to the rights and freedoms of affected players, phkay will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular No. 16-03.
15.2 Where the breach is likely to result in a high risk to affected players — such as exposure of financial data, KYC documents, or authentication credentials — phkay will also notify affected players directly without undue delay. Notification will be sent to the email address registered on the affected phkay account and will include:
15.3 phkay maintains a documented record of all personal data breaches, including those that do not require notification to the NPC, for internal audit and regulatory review purposes.
16.1 phkay reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, phkay's data processing activities, or industry best practices.
16.2 When material changes are made to this Policy — particularly changes that affect how phkay processes your personal data or your rights as a data subject — phkay will notify registered players via email and/or a prominent notice on the phkay Platform prior to the amended Policy taking effect.
16.3 Your continued use of the phkay Platform after the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms. The date at the top of this page reflects the effective date of the most recent version.
17.1 For any privacy-related enquiries, data rights requests, or complaints regarding phkay's handling of your personal data, please contact our Data Protection Officer through the following channels:
phkay Data Protection Officer
Email: [email protected]
Subject line: Privacy – [Your Request Type]
Live Chat: Available 24/7 via the chat icon on phkay.app
Response Time: Within 30 days for formal data rights requests; under 1 hour for general privacy queries via live chat.
17.2 If you are not satisfied with phkay's response to your privacy complaint, you have the right to escalate your complaint to the National Privacy Commission of the Philippines, which is the supervisory authority for data protection matters under the Data Privacy Act of 2012.
17.3 All formal data rights requests submitted to phkay must be accompanied by sufficient information to verify your identity before phkay can process the request. This is to ensure that personal data is disclosed only to the individual to whom it relates.
phkay takes your privacy seriously. Sign in to your account to review your data settings, update your marketing preferences, or explore hundreds of fair games — all on a platform built for Filipino players. 21+ only.
Questions about how we handle your data? Contact us at [email protected] or via live chat.