38phcash Privacy Policy

38phcash ("we," "us," "our") is committed to protecting the privacy and personal data of every Filipino player who uses our platform. This Privacy Policy describes how 38phcash — accessible at 38phcash.app — collects, uses, stores, protects, and, in limited circumstances, shares the personal data of registered users, visitors, and prospective players.

This Privacy Policy applies to all personal data processed by 38phcash in connection with:

• Account registration and maintenance on the 38phcash platform
• Deposits, withdrawals, and all financial transactions conducted through 38phcash
• Participation in any game, promotion, bonus offer, or VIP programme available through 38phcash
• Communications with 38phcash support, including live chat, email, and any other contact channel
• Browsing and interaction with the 38phcash website without completing account registration

By using any part of the 38phcash platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. This policy should be read alongside the Terms & Conditions and Responsible Gaming Policy, which together govern your use of the 38phcash platform.

For the purposes of the Philippine Data Privacy Act of 2012, 38phcash is the personal information controller in respect of personal data collected through the 38phcash platform. As personal information controller, 38phcash determines the purposes and means of processing personal data collected from players and platform visitors.

38phcash has appointed a Data Protection Officer (DPO) responsible for ensuring compliance with the Data Privacy Act and for handling data subject rights requests. The contact details of the 38phcash DPO are provided in Section 16 of this Privacy Policy.

38phcash's Data Protection Officer registration has been completed with the National Privacy Commission as required under NPC Circular No. 17-01. Players may verify this registration or lodge complaints directly with the National Privacy Commission of the Philippines.

38phcash collects personal data in the categories described below. Collection is limited to data that is adequate, relevant, and not excessive in relation to the specific purposes for which it is processed.

3.1 Registration & Identity Data

3.2 Financial Data

3.3 Technical & Usage Data

When you access the 38phcash platform, our systems automatically collect certain technical information including: IP address, device type and operating system, browser type and version, session start and end timestamps, pages visited within the platform, game sessions accessed, and referring URL. This data is collected via server logs and cookies as described in Section 10.

3.4 Communications Data

Records of communications between you and 38phcash customer support — including live chat transcripts, email correspondence, and support ticket records — are retained as part of our service records. These records are used for quality assurance, dispute resolution, and regulatory compliance purposes.

3.5 Responsible Gaming Data

Where you use the responsible gaming tools available on the 38phcash platform — such as setting deposit limits, requesting cooling-off periods, or initiating self-exclusion — the details of those settings and requests are recorded. This data is processed to give effect to your responsible gaming preferences and to fulfil 38phcash's obligations under PAGCOR's responsible gaming framework.

38phcash collects personal data through the following channels and mechanisms:

• Directly from you — when you complete the account registration form, submit KYC identity documents, update your account profile, make a deposit or withdrawal request, contact customer support, or participate in a promotion.
• Automatically through the platform — when you browse or interact with 38phcash.app, our servers and cookies automatically record technical and usage data as described in Section 3.3 and Section 10.
• From payment processors — when you make a deposit via GCash, PayMaya, or bank transfer, 38phcash receives transaction confirmation data from the relevant payment processor, including transaction identifiers and payment status.
• From identity verification services — where third-party identity verification tools are used to assist with KYC processing, those services may return identity verification status and document authenticity assessments to 38phcash.
• From regulatory authorities — in limited circumstances, 38phcash may receive information about a player from PAGCOR, the Anti-Money Laundering Council (AMLC), or other competent Philippine government bodies, in connection with regulatory compliance obligations.

38phcash processes your personal data for the following specific purposes, each supported by a lawful basis under the Philippine Data Privacy Act:

38phcash does not sell, rent, or trade personal data to any third party for independent commercial use. Personal data is shared only in the following defined circumstances:

6.1 Payment Processors

Personal data necessary to process deposit and withdrawal transactions — including your name, registered mobile number, and payment reference — is shared with payment service providers such as GCash (Mynt), PayMaya Networks, BPI, BDO, and Metrobank solely for the purpose of executing your requested financial transaction. These providers process your data as independent personal information controllers under their own privacy policies and applicable Philippine financial regulations.

6.2 Game Providers

When you play a game on the 38phcash platform, a session token and anonymized player identifier is transmitted to the relevant game provider (such as Jili Games, PG Soft, or Pragmatic Play) to load and operate the game. Full identity data is not shared with game providers. Game session data is returned to 38phcash for account crediting and record-keeping purposes.

6.3 Identity Verification Services

To fulfill KYC verification requirements, 38phcash may engage accredited third-party identity verification service providers. Your submitted identity documents and associated biometric data (selfie images for liveness checks) are processed by these providers solely for identity verification purposes and are not retained by them beyond the period necessary for the verification assessment.

6.4 Regulatory Authorities

38phcash is required to disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), and other competent Philippine government authorities in the following circumstances: scheduled regulatory reporting, audit inspections, responses to lawful data requests or court orders, and mandatory suspicious transaction reporting under the Anti-Money Laundering Act. 38phcash will comply with all such lawful requests while endeavoring to notify affected players to the extent permitted by applicable law.

6.5 Service Providers & Processors

38phcash engages third-party service providers who process personal data on our behalf as personal information processors under data processing agreements that impose equivalent data protection obligations. These processors include cloud infrastructure providers, customer support software vendors, and analytics platforms. All processor relationships require contractual commitments to process data only on 38phcash's documented instructions and in compliance with the Data Privacy Act.

The 38phcash platform primarily stores and processes personal data within the Philippines. Where personal data is transferred to or processed in a jurisdiction outside the Philippines — for example, in connection with game provider server infrastructure or cloud hosting services — 38phcash ensures that appropriate safeguards are in place to protect the data at the destination.

Such safeguards include the use of standard contractual clauses approved or recognized under the Philippine Data Privacy Act framework, contractual obligations requiring the recipient to apply data protection standards at least equivalent to those required under Philippine law, and where available, transfers to jurisdictions recognized by the National Privacy Commission as providing adequate data protection.

Players may request information about the specific countries to which their personal data may be transferred by contacting the 38phcash Data Protection Officer at the address provided in Section 16.

38phcash implements and maintains a comprehensive set of technical, organizational, and physical security measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, and destruction:

• Encryption in transit: All communications between players' devices and the 38phcash platform are encrypted using TLS 1.3, preventing interception of data during transmission over public and mobile networks.
• Encryption at rest: Personal data and financial records stored in 38phcash databases are encrypted at rest using AES-256 encryption. Encryption keys are managed through a dedicated key management system with access restricted to authorized infrastructure personnel.
• Access controls: Access to personal data within 38phcash's internal systems is governed by a role-based access control framework. Personnel access is granted on a strict need-to-know basis, and all access to personal data is logged and regularly audited.
• Two-factor authentication: Two-factor authentication is enforced for all 38phcash internal system accounts that have access to player personal data. The same functionality is offered to players for their own account security.
• Intrusion detection and monitoring: 38phcash's infrastructure is protected by intrusion detection systems and continuously monitored for anomalous activity. Automated alerting systems are configured to flag potential security incidents for immediate investigation.
• Vulnerability management: 38phcash conducts regular security assessments of the platform and its dependencies. Critical vulnerabilities are addressed through an expedited patching process. Third-party penetration tests are conducted periodically.
• Staff training: All 38phcash personnel with access to personal data receive mandatory data privacy and security training at onboarding and on an annual basis thereafter.

While 38phcash employs industry-standard security measures, no technology platform can guarantee absolute security. In the event of a security incident affecting personal data, 38phcash will follow the breach notification procedures described in Section 13.

38phcash retains personal data for the periods specified below, after which data is securely deleted or anonymized such that it can no longer be associated with an individual player:

Where applicable law requires retention beyond the periods listed above, 38phcash will retain data for the legally required period. Where a player exercises their right to erasure, 38phcash will evaluate the request against applicable retention obligations and inform the player of any data that must be retained under legal or regulatory requirements.

10.1 What Are Cookies. Cookies are small text files placed on your device by a website to store information about your session and preferences. The 38phcash platform uses cookies and similar tracking technologies (including local storage and session tokens) to enable platform functionality, maintain your login session, and collect usage analytics.

10.2 Types of Cookies Used. 38phcash uses the following categories of cookies:

• Strictly necessary cookies: Required for the platform to function. These include session authentication tokens that keep you logged in during your session. These cookies cannot be disabled without preventing use of the platform.
• Functional cookies: Remember your preferences such as language settings, game lobby view preferences, and responsible gaming tool settings. Disabling these does not prevent platform access but may affect your user experience.
• Analytics cookies: Collect aggregated usage data to help 38phcash understand how players navigate the platform and identify areas for improvement. Where possible, analytics data is processed in anonymized or pseudonymized form.
• Security cookies: Used by 38phcash's fraud detection systems to identify and flag anomalous login patterns and suspicious session behavior.

10.3 Cookie Control. You may manage or disable non-essential cookies through your browser's cookie settings. Instructions for managing cookies vary by browser. Please note that disabling strictly necessary cookies will prevent you from using the 38phcash platform. 38phcash does not use third-party advertising cookies or cross-site tracking technologies that profile you for advertising purposes on external platforms.

11.1 Consent-Based Marketing. 38phcash will only send you promotional communications — including bonus offers, tournament announcements, new game launches, and VIP programme updates — where you have provided explicit consent to receive such communications at the time of account registration or through your account notification settings.

11.2 Withdrawal of Marketing Consent. You may withdraw your consent to receive marketing communications at any time by updating your notification preferences in your 38phcash account settings, or by submitting an opt-out request to [email protected]. Opt-out requests will be processed within five (5) business days. Withdrawal of marketing consent does not affect the lawfulness of processing that occurred before the withdrawal.

11.3 Transactional Communications. Certain communications from 38phcash are transactional in nature and are sent regardless of marketing preferences. These include: account registration confirmation, deposit and withdrawal notifications, security alerts (such as new device login alerts), KYC verification status updates, and responsible gaming tool activation confirmations. These communications are sent on the basis of contract performance and cannot be opted out of while an active account is maintained.

11.4 Responsible Gaming and Marketing. In accordance with PAGCOR's responsible gaming requirements, 38phcash does not send promotional gambling-related marketing communications to players who have activated self-exclusion, requested a cooling-off period, or who have been identified as potentially at-risk players. Marketing suppression for at-risk players is implemented at the system level and is applied automatically.

The 38phcash platform is strictly intended for adults aged twenty-one (21) years and above, as required by PAGCOR regulations governing online gambling in the Philippines. 38phcash does not knowingly collect personal data from persons under 21 years of age.

Age verification is conducted as part of the KYC process required before withdrawals are permitted. Where 38phcash determines that personal data has been collected from a person under 21 years of age — whether through KYC review, parental notification, or other means — the associated account will be immediately suspended, any real money balance will be returned to the deposit source, and the personal data of the minor will be deleted from our systems as soon as practicable.

Parents and guardians of minors are encouraged to use parental control software to restrict access to gambling websites on devices used by children. If you have reason to believe that a minor has registered or is using a 38phcash account, please contact our Data Protection Officer immediately at [email protected].

13.1 Internal Breach Response. In the event that 38phcash becomes aware of a personal data breach — meaning a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data — 38phcash will immediately activate its Data Breach Response Plan. This plan includes: containment of the breach, assessment of the nature and scope of affected data, identification of affected individuals, and remediation of the security vulnerability.

13.2 Notification to the National Privacy Commission. Where a personal data breach is likely to give rise to a real risk of serious harm to affected data subjects, 38phcash will notify the National Privacy Commission of the Philippines within seventy-two (72) hours of becoming aware of the breach, as required under NPC Circular No. 16-03 and the Data Privacy Act.

13.3 Notification to Affected Players. Where a breach is likely to result in harm to the rights and freedoms of affected players, 38phcash will notify those players in a clear and plain language communication within the timeframe required by applicable law and NPC guidelines. The notification will describe the nature of the breach, the categories of personal data affected, the likely consequences, and the measures taken or proposed to address the breach.

To exercise any of the data subject rights described in the summary section of this Privacy Policy — including rights of access, rectification, erasure, objection, restriction, portability, or human review of automated decisions — please submit your request to the 38phcash Data Protection Officer using the contact details in Section 16.

Your request should include: your full name as registered on your 38phcash account, your registered email address or mobile number, a description of the specific right you wish to exercise and the personal data to which your request relates, and a copy of a valid Philippine government-issued identification document to verify your identity (required to prevent unauthorized disclosure of your personal data to third parties).

38phcash will respond to verified data subject requests within fifteen (15) business days of receipt. Where a request is complex or involves a high volume of data, this period may be extended by an additional thirty (30) business days, in which case 38phcash will inform you of the extension and the reasons for it within the initial fifteen-day period.

Exercising your data rights is free of charge. 38phcash will not charge a fee for data access requests unless requests are manifestly unfounded, excessive, or repetitive — in which case a reasonable administrative fee may be applied following prior written notice to you.

If you are not satisfied with 38phcash's response to your data rights request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

38phcash reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, regulatory guidance from the National Privacy Commission, or PAGCOR data governance requirements.

Where amendments are material — meaning they substantially affect how we process your personal data or reduce your privacy rights — 38phcash will provide advance notice via the platform notification system and/or email to your registered address no less than fourteen (14) days before the revised policy takes effect.

Non-material amendments, such as typographical corrections or clarifications that do not alter the substance of data processing practices, will be updated without advance notice and will take effect upon publication. The most current version of this Privacy Policy is always available at 38phcash.app/privacy-policy. The effective date at the top of this document reflects the date of the most recent review.

For all inquiries, requests, or concerns relating to this Privacy Policy or the processing of your personal data by 38phcash, please contact our Data Protection Officer through any of the following channels:

• Email (DPO): [email protected] — please include "Data Privacy Request" in the subject line for priority routing to the DPO team.
• Live Chat: Available 24/7 from every page of the 38phcash platform. For complex data rights requests, live chat agents will route your inquiry to the DPO team and confirm receipt within one business day.

For formal data privacy complaints that have not been resolved to your satisfaction through 38phcash's internal process, you may contact the National Privacy Commission of the Philippines through their official channels. 38phcash cooperates fully with NPC investigations and will provide all requested documentation in a timely manner.

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of the Philippines, including Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations, and applicable PAGCOR data governance directives. Any dispute arising from the interpretation or application of this Privacy Policy that is not resolved through the NPC complaints process shall be subject to the jurisdiction of the competent courts of the Philippines.