pgasia Privacy Policy

Welcome to the pgasia Privacy Policy. pgasia is a PAGCOR-regulated online gaming platform serving Filipino players across the Philippines — from Metro Manila, Cebu, Davao, Quezon City, and Makati, to every province and region nationwide. We take the privacy and security of your personal data seriously, and this document sets out exactly how we handle that data from the moment you visit our platform to the moment you close your account.

This Privacy Policy applies to all personal data collected through the pgasia website, mobile platform, customer support channels, and any other service offered under the pgasia brand. It applies to registered players, guest visitors, and any individual whose personal data pgasia processes in connection with the operation of the platform.

This policy is issued in compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR) as enforced by the National Privacy Commission of the Philippines. It also reflects applicable PAGCOR data governance requirements applicable to licensed online gaming operators.

For the purposes of the Data Privacy Act of 2012, pgasia acts as the Personal Information Controller (PIC) in respect of all personal data collected from players and visitors to the pgasia platform. As Personal Information Controller, pgasia determines the purposes and means of processing your personal data and is responsible for ensuring that processing is conducted in accordance with the DPA and its IRR.

pgasia operates under PAGCOR regulatory oversight. All data processing activities carried out by pgasia in connection with the operation of its licensed gaming services are subject to PAGCOR's data governance requirements, which are applied in addition to and consistent with the requirements of the DPA.

Where pgasia engages third-party service providers — including payment processors such as GCash, PayMaya, BPI, BDO, Metrobank, and InstaPay; game software providers; and fraud prevention services — those parties act as Personal Information Processors (PIPs) under written contracts that bind them to data protection obligations consistent with the DPA. pgasia remains accountable for ensuring that its PIPs handle your data appropriately.

The categories of personal data that pgasia collects and processes in connection with your use of the platform are set out in the table below. Not all categories apply to every user — the data collected depends on your level of registration, KYC verification status, and how you interact with the platform.

pgasia does not collect sensitive personal information beyond what is required for identity verification under PAGCOR KYC requirements. We do not collect biometric data beyond the liveness check photo used for KYC verification purposes, and we do not collect health or medical information.

pgasia collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide when registering an account, completing KYC verification, updating your profile, contacting customer support, or participating in promotions;
• Automated technical collection: Data collected automatically when you access the pgasia website or platform, including IP address, device identifiers, browser information, and session activity logs;
• Cookies and similar technologies: Session cookies, persistent cookies, and local storage data collected as described in Section 10 of this policy;
• Payment processors: Transaction confirmation and payment status data received from GCash, PayMaya, BPI, BDO, Metrobank, and InstaPay when you make deposits or withdrawals;
• Identity verification partners: KYC verification outcomes and identity confidence scores from our third-party identity verification service provider, which processes the government-issued ID images and selfie photos you submit;
• Fraud and AML screening services: Risk signals and watchlist screening results from anti-money laundering and fraud prevention service providers, as required under Republic Act No. 9160;
• Game platform providers: Game result data, bet histories, and session data from the third-party game software providers whose games are integrated into the pgasia platform.

Under the Data Privacy Act of 2012 and its IRR, pgasia processes your personal data on the following legal bases depending on the specific processing activity:

• Consent: Where you have given clear, informed, and freely given consent to processing — for example, when opting into marketing communications or accepting cookie preferences beyond strictly necessary cookies;
• Contractual necessity: Processing required to fulfil our contractual obligations to you as a registered pgasia player, including account creation, game access, deposit processing, and withdrawal payments;
• Legal obligation: Processing necessary to comply with our obligations under Philippine law, including PAGCOR licensing requirements, the Anti-Money Laundering Act (RA 9160), AMLC reporting obligations, and PAGCOR regulatory directives;
• Legitimate interests: Processing necessary for pgasia's legitimate interests where those interests are not overridden by your privacy rights — including fraud prevention, platform security, abuse detection, and statistical analysis of platform performance;
• Vital interests: In rare circumstances where processing is necessary to protect your vital interests or those of another person — for example, if responsible gaming concerns require us to act without waiting for consent.

pgasia processes your personal data for the following specific purposes:

• Registering and managing your pgasia player account;
• Conducting mandatory KYC identity and age verification as required by PAGCOR and the Anti-Money Laundering Act;
• Processing deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and InstaPay;
• Providing access to casino games, sabong live betting, slot games, bingo, fishing games, and mines games;
• Settling game outcomes, crediting winnings, and maintaining accurate account balance records;
• Delivering customer support via live chat and email, including resolving disputes and responding to complaints;
• Administering bonuses and promotions, and verifying eligibility for promotional offers;
• Operating responsible gaming tools including deposit limits, session limits, cooling-off periods, and self-exclusion;
• Detecting, investigating, and preventing fraud, cheating, money laundering, and other prohibited activities;
• Complying with PAGCOR regulatory reporting, AMLC suspicious transaction reporting, and other legal obligations;
• Improving platform performance, conducting internal analytics, and informing product development decisions;
• Sending account-related transactional notifications (deposit confirmations, withdrawal updates, security alerts);
• Sending promotional and marketing communications where you have opted in to receive them.

pgasia does not sell, rent, or trade your personal data to any third party for their own marketing purposes. We share your data only in the following circumstances and only to the extent necessary for the relevant purpose:

• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, and InstaPay receive the transaction details necessary to process your deposits and withdrawals. These parties have their own privacy policies and are bound by applicable Philippine financial regulations;
• KYC and identity verification providers: Your government-issued ID images and verification selfie are shared with our third-party KYC provider for identity confirmation. This provider is contractually bound to process the data solely for verification purposes;
• Game software providers: Your player identifier and game session data are shared with third-party game providers whose titles are integrated into the pgasia platform, solely for the purpose of game delivery and result logging;
• Fraud prevention and AML screening: Limited personal data including name, ID numbers, and transaction data may be shared with anti-money laundering screening services and fraud detection platforms as required under RA 9160 and PAGCOR guidelines;
• PAGCOR and regulatory authorities: pgasia is required to submit player data, transaction logs, and game records to PAGCOR as part of our licensed operator obligations. We may also be required to submit suspicious transaction reports to the Anti-Money Laundering Council (AMLC);
• Law enforcement and courts: We will disclose personal data to Philippine law enforcement agencies, courts, or government authorities where we are legally required to do so by a valid court order, subpoena, search warrant, or other lawful authority;
• Business transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity, subject to the same data protection obligations described in this policy. We will notify you of any such transfer where required by law.

pgasia retains your personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable Philippine law and PAGCOR regulatory requirements. The following retention periods apply:

After the applicable retention period expires, pgasia will securely delete or anonymise your personal data. Where data cannot be immediately deleted due to technical constraints, it will be securely isolated from active processing until deletion is completed.

Note that even if you close your pgasia account voluntarily, we are legally required to retain certain records — particularly KYC documents and financial transaction records — for the full retention periods mandated by the Anti-Money Laundering Act and PAGCOR. These retained records will not be used for any purpose other than regulatory compliance.

pgasia implements technical and organisational security measures appropriate to the nature and sensitivity of the personal data we process. These measures are designed to protect your data against unauthorised access, disclosure, alteration, loss, or destruction. Our security framework includes the following controls:

• All data transmitted between your device and the pgasia platform is encrypted using TLS 1.2 or higher (HTTPS). We do not operate any unencrypted HTTP access to account or transactional pages;
• Account passwords are stored using strong one-way cryptographic hashing algorithms. We do not store plaintext passwords and pgasia staff cannot retrieve your password — only reset it through a verified process;
• KYC identity document images and sensitive financial data are stored with encryption at rest using AES-256 or equivalent standards;
• Access to personal data within pgasia's systems is restricted on a strict need-to-know basis. Staff access to player data is role-based, logged, and subject to regular access reviews;
• The pgasia platform is subject to regular security testing, including vulnerability assessments, to identify and remediate security weaknesses;
• pgasia maintains a documented incident response plan. In the event of a personal data breach that is likely to affect your rights and freedoms, we will notify the National Privacy Commission and affected individuals in accordance with the timelines required by the DPA IRR.

The pgasia platform uses cookies and similar browser-based technologies to operate correctly, remember your preferences, and analyse platform usage. The following categories of cookies are used:

• Strictly necessary cookies: Required for the platform to function — including session authentication tokens, load balancing identifiers, and security cookies. These cannot be disabled without breaking platform functionality;
• Functional cookies: Remember your preferences such as language settings, display preferences, and responsible gaming tool configurations. Disabling these cookies may reduce your experience but will not prevent access;
• Analytics cookies: Used to collect anonymised data about how visitors interact with the pgasia platform, including pages visited, session duration, and navigation paths. This data is aggregated and used solely to improve platform performance. Analytics cookies are activated only with your consent;
• Session cookies: Temporary cookies that expire when you close your browser, used to maintain your login state and shopping basket equivalents during a single session.

You can control cookie settings through your browser's built-in privacy controls. Blocking strictly necessary cookies may prevent you from logging in or using core platform features. Your cookie preferences can also be updated at any time via the cookie consent banner displayed on your first visit to the platform.

Under the Data Privacy Act of 2012 and its IRR, you have the following rights in respect of your personal data held by pgasia. These rights can be exercised by contacting our Data Privacy Officer (DPO) as described in Section 15.