22ph Privacy Policy

1Introduction

22ph ("we," "us," "our," or "the Platform") operates the online gaming platform accessible at 22ph.one. We are committed to protecting the privacy and personal data of all individuals who interact with our platform, including registered players, prospective users, and visitors to our website.

This Privacy Policy ("Policy") describes the types of personal information we collect, the purposes for which we use it, the circumstances under which we may share it, and the rights you have in relation to your personal data. This Policy applies to all personal data processed by 22ph in connection with the operation of the platform and the provision of our services.

This Policy is issued in compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines. It should be read together with our Terms & Conditions.

2Data We Collect

22ph collects personal data that is necessary for the provision of our services, compliance with legal obligations, and the improvement of the platform experience. The categories of personal data we collect include:

Registration & Identity Data:

• Full legal name as it appears on your government-issued ID;
• Date of birth (used to verify the 21+ age requirement);
• Nationality and country of residence;
• Email address and mobile phone number;
• Username and encrypted password.

Identity Verification (KYC) Data:

• Copies of government-issued photo identification (e.g., Philippine passport, SSS ID, PhilSys National ID, driver's licence, UMID);
• Proof of address documents (e.g., utility bills, bank statements);
• Selfie or liveness check images used for biometric verification;
• Proof of payment method ownership where required.

Financial & Transaction Data:

• Deposit and withdrawal history, including amounts, dates, and payment methods used;
• GCash or PayMaya account references, bank account details, or debit card information (stored in tokenised form only — we do not store full card numbers);
• Bonus and promotional activity records.

Gaming Activity Data:

• Game session logs, including games played, wagers placed, outcomes, and session duration;
• Responsible gaming tool usage (deposit limits set, self-exclusion requests, session timer activations);
• Customer support interaction records.

Technical & Device Data:

• IP address and approximate geolocation (used to verify Philippine residency);
• Device type, operating system, and browser information;
• Cookie identifiers and session tokens (see Section 5).

3How We Use Your Data

22ph processes your personal data for the following purposes:

• Account Management: To create, maintain, and administer your 22ph account, including processing your registration, verifying your identity, and managing your account settings;
• Service Delivery: To provide access to games, process deposits and withdrawals, credit bonuses, and deliver the core features of the 22ph platform;
• Legal & Regulatory Compliance: To fulfil our obligations under the Data Privacy Act, PAGCOR regulations, Anti-Money Laundering Act (AMLA), and other applicable Philippine laws, including KYC verification and suspicious transaction reporting;
• Age Verification: To verify that all registered players are at least 21 years of age in compliance with Philippine gambling regulations;
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeovers, and other security threats;
• Responsible Gaming: To monitor gaming behaviour for signs of problem gambling and to administer responsible gaming tools such as deposit limits and self-exclusion;
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance;
• Platform Improvement: To analyse usage patterns, conduct A/B testing, and improve the performance, design, and features of the 22ph platform;
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have provided consent to receive such communications. You may withdraw this consent at any time.

22ph will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent.

4Legal Basis for Processing

Under the Data Privacy Act of 2012, 22ph processes your personal data on the following legal bases:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and 22ph (i.e., the Terms & Conditions), including account creation, game access, and payment processing;
• Legal Obligation: Processing is required to comply with applicable Philippine laws and regulations, including PAGCOR licensing requirements, AMLA obligations, and NPC directives;
• Legitimate Interests: Processing is necessary for the legitimate interests of 22ph, including fraud prevention, platform security, and responsible gaming monitoring, provided such interests are not overridden by your rights and freedoms;
• Consent: For processing activities not covered by the above bases — in particular, direct marketing communications — we rely on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5Cookies & Tracking Technologies

22ph uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small text files stored on your device that help us recognise you, maintain your session, and understand how you use the platform.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of the platform, including session management, login authentication, and security features. These cannot be disabled without affecting platform functionality;
• Performance & Analytics Cookies: Used to collect anonymised data about how users interact with the platform, helping us identify areas for improvement;
• Functional Cookies: Used to remember your preferences, such as language settings and responsible gaming tool configurations;
• Marketing Cookies: Used to deliver relevant promotional content. These are only activated with your consent.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the 22ph platform.

6Data Sharing & Disclosure

22ph does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Payment Processors: GCash, PayMaya, and banking partners require certain personal and financial data to process your transactions securely;
• Identity Verification Providers: Third-party KYC service providers who assist with document verification and biometric checks;
• Game Providers: Licensed game studios and software providers may receive anonymised session data necessary to deliver their games on the 22ph platform;
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other competent Philippine authorities as required by law;
• Legal & Professional Advisers: Lawyers, auditors, and compliance consultants engaged by 22ph, subject to professional confidentiality obligations;
• IT & Security Service Providers: Cloud hosting, cybersecurity, and platform infrastructure providers who process data on our behalf under strict data processing agreements.

7Data Retention

22ph retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes or enforce our agreements.

Specific retention periods include:

• Account Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with PAGCOR and AMLA record-keeping requirements;
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later;
• Transaction Records: Retained for a minimum of five (5) years in compliance with AMLA obligations;
• Gaming Activity Logs: Retained for a minimum of two (2) years for responsible gaming monitoring and dispute resolution purposes;
• Marketing Consent Records: Retained until consent is withdrawn and for a reasonable period thereafter as evidence of consent.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with NPC guidelines.

8Data Security

22ph implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the 22ph platform is encrypted in transit;
• Encryption at Rest: Sensitive personal and financial data is encrypted when stored on our servers;
• Access Controls: Personal data is accessible only to authorised 22ph personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication;
• Tokenisation: Payment method details are tokenised — we store references to your payment methods, not the underlying account numbers or card details;
• Regular Security Audits: The 22ph platform undergoes regular penetration testing and security audits by independent cybersecurity firms;
• Incident Response: 22ph maintains a data breach response plan and will notify affected users and the NPC in the event of a personal data breach, in accordance with NPC Circular 16-03.

While 22ph takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately of any suspected unauthorised access to your account.

9Your Rights

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by 22ph:

• Right to Be Informed: You have the right to be informed of how your personal data is collected, used, and processed, as described in this Policy;
• Right to Access: You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed;
• Right to Rectification: You have the right to request the correction of any inaccurate or incomplete personal data we hold about you;
• Right to Erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations;
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes or where processing is based on our legitimate interests;
• Right to Data Portability: You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format;
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

To exercise any of the above rights, please contact our Data Protection Officer using the contact details provided in Section 13. We will respond to all verified requests within fifteen (15) business days in accordance with NPC guidelines. We may need to verify your identity before processing your request.

10Children & Minors

The 22ph platform is strictly intended for individuals who are at least 21 years of age, in accordance with Philippine gambling regulations. 22ph does not knowingly collect personal data from individuals under the age of 21.

If you are a parent or guardian and believe that a minor has registered on the 22ph platform or provided us with personal data without your consent, please contact us immediately using the details in Section 13. Upon verification, we will promptly close the account, delete the associated personal data, and return any deposits in accordance with our Terms & Conditions.

22ph employs age verification procedures during the registration process and reserves the right to request proof of age at any time. Accounts found to belong to individuals under 21 will be suspended immediately pending investigation.

11International Data Transfers

22ph primarily processes and stores personal data within the Republic of the Philippines. However, some of our third-party service providers — including cloud infrastructure providers, KYC verification platforms, and game studios — may be located in or operate from other countries.

Where personal data is transferred outside the Philippines, 22ph ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under the Data Privacy Act of 2012. These safeguards may include:

• Standard contractual clauses approved by the National Privacy Commission;
• Binding corporate rules where the recipient is part of a corporate group;
• Transfers to countries recognised by the NPC as providing an adequate level of data protection.

You may request further information about the safeguards in place for international data transfers by contacting our Data Protection Officer.

12Policy Updates

22ph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or regulatory requirements. When material changes are made, we will notify registered users via email or a prominent notice on the platform prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this page. We encourage you to review this Policy periodically to stay informed of how we are protecting your personal data. Your continued use of the 22ph platform following the publication of any updated Policy constitutes your acceptance of the changes.

If any amendment materially affects your rights or the way we process your personal data in a manner that requires fresh consent, we will seek that consent before the changes take effect.

13Contact & Data Protection Officer

22ph has appointed a Data Protection Officer (DPO) in accordance with the requirements of the Data Privacy Act of 2012 and NPC regulations. The DPO is responsible for overseeing 22ph's data protection strategy and ensuring compliance with applicable privacy laws.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact our DPO. All communications should be in writing and directed to the following address (plain text — not a clickable link):

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated. Information on how to file a complaint is available through the NPC's official channels.