Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how 22phl ("we", "us", "our", "the Platform") collects, uses, stores, discloses, and otherwise processes personal data relating to individuals ("you", "your", "Data Subject") who access or use the 22phl online gaming platform, including its website, mobile application, and all associated services (collectively, "the 22phl Services").

This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), and the relevant issuances of the National Privacy Commission ("NPC") of the Philippines. By registering an account or otherwise using the 22phl Services, you acknowledge that you have read and understood this Policy and that you consent to the processing of your personal data as described herein.

2. Data Controller

For the purposes of the DPA and this Policy, 22phl acts as the Personal Information Controller ("PIC") with respect to the personal data it collects directly from Data Subjects. Where 22phl engages third-party service providers to process personal data on its behalf, those providers act as Personal Information Processors ("PIPs") and are bound by data processing agreements that require them to apply data protection standards no less rigorous than those maintained by 22phl.

22phl has appointed a Data Protection Officer ("DPO") who is responsible for overseeing the Platform's compliance with the DPA and this Policy. The DPO may be contacted via the details provided in Section 15 of this Policy.

3. Personal Data We Collect

22phl collects the following categories of personal data from registered players and platform visitors:

3.1 Identity & Contact Data

• Full legal name as it appears on your government-issued ID.
• Date of birth and age verification documentation.
• Philippine mobile number and email address.
• Residential address within the Philippines.
• Government-issued ID type and ID number (for KYC verification).

3.2 Financial Data

• GCash or Maya wallet number used for deposits and withdrawals.
• Bank account details (bank name, account name, account number) for bank transfer transactions.
• Transaction history, including deposit amounts, withdrawal amounts, dates, and payment method used.

3.3 Gaming Activity Data

• Wager history, game selections, bet amounts, and game outcomes.
• Session duration and frequency of play.
• Bonus and promotional activity, including bonuses claimed and wagering progress.
• VIP tier status and loyalty point history.

3.4 Technical & Usage Data

• IP address and approximate geolocation at the time of login or gameplay.
• Device type, operating system, browser type and version.
• Platform access logs, including login timestamps and session activity.
• Cookie data and similar tracking technology data as described in Section 10.

3.5 Communications Data

• Records of communications between you and 22phl customer support, including live chat transcripts, emails, and call logs.
• Responses to surveys, feedback forms, and promotions in which you voluntarily participate.

4. How We Collect Your Data

22phl collects personal data through the following means:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated collection: Technical and usage data collected automatically when you access or interact with the 22phl Platform, including via cookies and server logs.
• Third-party sources: Information received from payment processors (such as GCash, Maya, BPI, BDO, and Metrobank) in connection with your transactions; identity verification data from accredited KYC providers; and fraud screening data from authorised anti-fraud service providers.

5. How We Use Your Personal Data

6. Legal Basis for Processing

22phl processes your personal data on the following legal bases as recognised under the DPA:

• Contractual necessity: Processing required to fulfil the agreement between you and 22phl, including account management, transaction processing, and provision of gaming services.
• Legal obligation: Processing required to comply with applicable Philippine law, including the DPA, the Anti-Money Laundering Act (AMLA), and PAGCOR regulatory requirements.
• Legitimate interests: Processing necessary for 22phl's legitimate interests in fraud prevention, platform security, and responsible gaming monitoring, provided that these interests are not overridden by your data protection rights.
• Consent: For optional processing activities such as marketing communications, 22phl relies on your explicit consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

7. Sharing Your Personal Data

22phl does not sell, rent, or trade your personal data. We share personal data only in the following circumstances:

• Payment processors: GCash, Maya, BPI, BDO, Metrobank, InstaPay, PesoNet, GrabPay, and 7-Eleven CLiQQ receive transaction data necessary to process your deposits and withdrawals.
• KYC and identity verification providers: Accredited third-party KYC service providers receive identity documents and personal data to fulfil age verification and anti-money laundering obligations.
• Game software providers: Game studios and live dealer operators receive anonymised or pseudonymised session identifiers necessary to deliver game content and record outcomes.
• PAGCOR and Philippine regulatory authorities: 22phl discloses personal data and gaming records to PAGCOR and other competent Philippine regulatory bodies as required by law.
• Law enforcement: Where required by court order, subpoena, or other binding legal process, 22phl may disclose personal data to Philippine law enforcement authorities.
• Professional advisors: Legal counsel, auditors, and compliance consultants engaged by 22phl, subject to professional confidentiality obligations.

8. Data Retention Periods

22phl retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as mandated by applicable Philippine law. The following standard retention periods apply:

• Account and identity data: Retained for the duration of your active account, and for a period of five (5) years following account closure, as required by PAGCOR regulations and AMLA compliance obligations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLA record-keeping requirements.
• Gaming activity logs: Retained for three (3) years from the date of each gaming session for responsible gaming monitoring and dispute resolution purposes.
• Customer support communications: Retained for two (2) years from the date of each communication.
• Technical and usage data (logs): Retained for twelve (12) months from the date of collection, unless required for an ongoing investigation.
• Marketing consent records: Retained until you withdraw consent, plus one (1) year thereafter as evidence of prior consent status.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any identifiable individual.

9. Data Security Measures

22phl implements a multi-layered security architecture to protect personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• 128-bit SSL/TLS encryption for all data transmitted between your device and 22phl's servers.
• AES-256 encryption for personal data stored in 22phl's databases.
• Role-based access control (RBAC) restricting employee access to personal data on a strict need-to-know basis.
• Multi-factor authentication (MFA) required for all 22phl administrative system access.
• Automated real-time monitoring and alerting for suspicious access patterns or anomalous activity.
• Regular penetration testing and security audits by independent third-party security firms.
• Documented incident response procedures with mandatory notification obligations under the DPA.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, 22phl will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected Data Subjects without undue delay in accordance with the DPA and NPC Circular 16-03.

10. Cookies & Tracking Technologies

The 22phl Platform uses cookies and similar tracking technologies to operate certain platform functions, analyse usage patterns, and, where you have consented, to deliver relevant promotions. The following categories of cookies are used:

• Strictly necessary cookies: Required for the 22phl Platform to function. These include session authentication cookies and security tokens. You cannot opt out of these without ceasing to use the Platform.
• Functional cookies: Enable personalised features such as language preferences, game lobby display settings, and remembered login details. These are set only with your consent.
• Analytics cookies: Used to collect anonymised data about how players navigate the 22phl Platform, allowing us to identify areas for improvement. These are set only with your consent.
• Marketing cookies: Used to deliver promotions and offers relevant to your gaming preferences, where you have provided explicit consent.

You may manage your cookie preferences at any time via the Cookie Settings panel available in the 22phl Platform footer. Withdrawing consent for non-essential cookies will not affect your ability to play games or conduct transactions on the Platform.

11. Your Rights as a Data Subject

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 22phl:

To exercise any of these rights, contact 22phl's Data Protection Officer using the details in Section 15. 22phl will respond to all verified Data Subject requests within fifteen (15) business days of receipt. Where a request is complex or where 22phl receives a high volume of requests, the response period may be extended by a further thirty (30) days, with prior notification to you.

12. Minors & Age Restriction

The 22phl Platform is strictly restricted to individuals who are at least 21 years of age, in accordance with PAGCOR requirements governing online gaming in the Philippines. 22phl does not knowingly collect personal data from individuals under the age of 21. Age is verified as part of the mandatory KYC process at account registration.

If 22phl becomes aware that it has inadvertently collected personal data from an individual under the age of 21, it will promptly suspend the relevant account, delete the associated personal data, and return any deposited funds to the source payment method. Parents or guardians who believe a minor may have registered an account on the 22phl Platform are encouraged to contact 22phl's support team immediately.

13. Cross-Border Data Transfers

Certain service providers engaged by 22phl to deliver platform functions — including cloud infrastructure, game software providers, and fraud prevention services — may be located or operate data processing infrastructure outside of the Philippines. Where personal data is transferred outside the Philippines, 22phl ensures that such transfers are conducted in accordance with Section 21 of the DPA, which requires either: (a) the recipient country provides an adequate level of protection consistent with the DPA; or (b) 22phl implements appropriate safeguards, such as data processing agreements containing standard contractual clauses approved by the NPC, to protect the data during and after transfer.

14. Changes to This Policy

22phl reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, NPC guidance, PAGCOR requirements, or the 22phl Platform's data processing practices. Material changes to this Policy will be communicated to registered players via the email address on file, with a minimum of fourteen (14) calendar days' notice before the amended Policy takes effect. Non-material changes (such as typographical corrections or clarifications that do not affect the substance of the Policy) may be made without prior notice. The most current version of this Policy will always be accessible at this page, with the "Last Updated" date at the top reflecting the date of the most recent revision.

15. Contact Us & Data Protection Officer

For questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by 22phl, please contact our Data Protection Officer:

Data Protection Officer, 22phl
Email: [email protected]
Please include "Privacy / DPO" in the subject line of your email.

If you are not satisfied with 22phl's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. The NPC can be reached through its official government channels.