At phsaya, we take your privacy seriously. This Privacy Policy explains exactly what personal data we collect, why we collect it, how we use and protect it, and what your rights are as a data subject under Philippine law. We operate in full compliance with Republic Act 10173 — the Data Privacy Act of 2012 — and under our PAGCOR online gaming license.
Six commitments that guide how phsaya handles every piece of your personal data.
phsaya collects your personal data only for clearly defined, legitimate purposes — account management, identity verification, payment processing, regulatory compliance, and responsible gaming. We do not use your data for unrelated purposes without your explicit consent.
We collect only the personal data that is actually necessary for the stated purpose. phsaya does not collect excessive information — if we don't need it to operate your account or meet our legal obligations, we don't ask for it.
phsaya implements technical and organizational security measures appropriate to the risk — including 256-bit SSL encryption, access controls, and regular security reviews — to protect your personal data from unauthorized access, loss, or disclosure.
This Privacy Policy is written in plain, accessible English — not buried in impenetrable legal jargon. phsaya is open about what data it holds, why, and for how long. You always know where you stand with phsaya.
As a data subject under Philippine law, you have rights — to access your data, correct it, object to its processing, and request its deletion in certain circumstances. phsaya has clear processes for honoring every one of these rights.
phsaya does not sell your personal data to third parties, advertisers, or data brokers. Ever. Your data is yours. We share it only where legally required, or with service partners directly supporting your phsaya account under strict contractual privacy obligations.
phsaya ("we", "us", "our") is committed to protecting the personal data of all individuals who interact with the phsaya online gaming platform at phsaya.lat ("Platform"). As a PAGCOR-licensed operator serving Filipino players across the Philippines — from Metro Manila to Cebu, Davao, and beyond — phsaya processes personal data in accordance with Republic Act 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC").
This Privacy Policy applies to all personal data collected and processed through the phsaya Platform, including data provided during registration, identity verification, account usage, payment transactions, customer support interactions, and marketing communications.
This Privacy Policy describes: (a) the categories of personal data phsaya collects; (b) the purposes for which phsaya processes that personal data; (c) the legal basis for each processing activity; (d) how and with whom phsaya may share your personal data; (e) how long phsaya retains your personal data; and (f) the rights you have as a data subject and how to exercise them.
This Policy should be read alongside phsaya's Terms & Conditions, which govern your use of the Platform and are available at phsaya.lat/terms-conditions. In the event of any conflict between this Privacy Policy and the Terms & Conditions regarding privacy matters, this Privacy Policy shall prevail.
For the purposes of the Data Privacy Act of 2012, phsaya is the personal information controller responsible for the personal data it collects and processes through the Platform. phsaya operates phsaya.lat as an online gaming operator licensed by the Philippine Amusement and Gaming Corporation (PAGCOR).
phsaya has appointed a Data Protection Officer ("DPO") responsible for overseeing compliance with this Privacy Policy and Philippine data privacy law. You may contact the phsaya DPO via the contact details provided in Section 16 of this Policy.
phsaya collects the following categories of personal data:
| Data Category | Specific Data Points | Primary Purpose |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, government ID type and number (PhilSys, Passport, Driver's License, SSS/GSIS/PRC ID) | Account registration, KYC verification, age verification (21+) |
| Contact Data | Philippine mobile number, email address, residential address (barangay, city/municipality, province) | Account communications, OTP delivery, KYC verification |
| Financial Data | GCash account reference, PayMaya account reference, bank account name and number (BPI, BDO, Metrobank, UnionBank), transaction history | Payment processing, withdrawal verification, anti-money laundering compliance |
| Gaming Activity Data | Game history, bet amounts, win/loss records, session duration, bonus usage, wagering progress | Account management, responsible gaming monitoring, dispute resolution |
| Technical Data | IP address, device type and operating system, browser type, session identifiers, login timestamps | Security monitoring, fraud prevention, service optimization |
| Communications Data | Live chat transcripts, support email correspondence, feedback submissions | Customer support, quality assurance, dispute records |
| Marketing Preferences | Communication opt-in/opt-out status, promotional preferences | Sending relevant offers and updates (only where consented) |
phsaya does not intentionally collect sensitive personal information beyond what is strictly necessary for identity verification and regulatory compliance. Where sensitive personal information (such as government ID details) must be collected for PAGCOR-mandated KYC purposes, it is handled with heightened security controls.
phsaya collects personal data through the following means:
phsaya processes your personal data on the following legal bases under the Data Privacy Act of 2012:
phsaya uses the personal data it collects for the following purposes:
phsaya does not sell, rent, or trade your personal data to third parties for their own commercial purposes. phsaya may share your personal data only in the following limited circumstances:
phsaya engages third-party service providers who process personal data on phsaya's behalf as personal information processors, including: payment processors (GCash/Maya, BPI, BDO, Metrobank, UnionBank); identity verification and KYC service providers; game software providers whose games are hosted on the Platform; cloud hosting and IT infrastructure providers; customer support platform providers; and fraud detection and security service providers.
All phsaya service providers are bound by contractual data processing agreements that require them to process personal data only for the specified purpose, maintain appropriate security standards, and comply with the DPA.
phsaya is required by law to share certain player data with PAGCOR as part of its licensing obligations. phsaya may also be required to disclose personal data to the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Philippine National Police (PNP), the National Bureau of Investigation (NBI), or other authorized Philippine government bodies pursuant to lawful orders, subpoenas, or legal requirements.
In the event of a merger, acquisition, sale of assets, or corporate restructuring involving phsaya, your personal data may be transferred as part of that transaction. phsaya will notify affected players prior to any such transfer and ensure that the receiving entity is bound to privacy obligations consistent with this Policy and the DPA.
The phsaya Platform uses cookies and similar technologies (local storage, session tokens) to provide and improve platform functionality. Cookies are small data files stored on your device when you access the Platform.
phsaya uses the following categories of cookies:
You can manage cookie preferences via your browser settings. Disabling strictly necessary cookies will impair your ability to use the phsaya Platform. Disabling functional or analytics cookies will not prevent you from using the Platform but may reduce the quality of your experience.
phsaya retains personal data for as long as is necessary for the purposes for which it was collected and to comply with its legal obligations. The principal retention periods applicable to phsaya player data are as follows:
Following the expiry of applicable retention periods, phsaya will securely delete or anonymize personal data in accordance with its data disposal procedures.
phsaya implements a multi-layered approach to personal data security, combining technical, organizational, and physical controls to protect player data against unauthorized access, disclosure, alteration, and destruction.
Technical security measures implemented by phsaya include:
Despite these measures, no system is entirely immune to security risks. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, phsaya will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected players as required by the DPA and NPC guidelines.
As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phsaya. These rights are subject to applicable exemptions and conditions under Philippine law.
These rights apply to the personal data phsaya holds about you. To exercise any right, contact phsaya's Data Protection Officer via the details in Section 16.
You have the right to request a copy of the personal data phsaya holds about you, information about how it is being used, and with whom it has been shared. phsaya will respond to access requests within 15 business days.
If any personal data phsaya holds about you is inaccurate or incomplete, you have the right to request correction. You can update most Account information directly via your phsaya Account settings; for KYC data, contact support.
You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where consent has been withdrawn, or where the data has been unlawfully processed. Erasure requests are subject to phsaya's legal retention obligations.
You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interest, subject to phsaya's right to demonstrate compelling legitimate grounds that override your interests.
Where processing is based on your consent or contract performance and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format to transmit to another service provider.
If you believe phsaya has breached its obligations under the Data Privacy Act of 2012, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. phsaya encourages you to contact us first to resolve any concerns directly.
The phsaya Platform is strictly intended for individuals aged 21 years and above, as required by PAGCOR's regulations governing online gaming in the Philippines. phsaya does not knowingly collect personal data from persons under the age of 21.
If phsaya becomes aware that it has inadvertently collected personal data from a person under the age of 21, it will immediately suspend the relevant Account, void any related transactions, and securely delete all personal data associated with the underage registration, subject to any applicable legal obligations to report the incident to PAGCOR or relevant authorities.
Parents and guardians who become aware that a minor under their care has accessed or registered on the phsaya Platform should contact phsaya support immediately via live chat.
phsaya primarily processes personal data of Philippine players within the Philippines. However, certain service providers engaged by phsaya — including game software providers, cloud infrastructure providers, and technical support vendors — may be located outside the Philippines.
Where personal data is transferred outside the Philippines, phsaya ensures that such transfers comply with the requirements of the Data Privacy Act of 2012 and NPC guidelines, including by implementing appropriate safeguards such as contractual data transfer agreements that impose equivalent data protection standards on the recipient.
phsaya will not transfer your personal data to a third country unless phsaya has determined that adequate protections are in place and the transfer is permitted under Philippine law.
phsaya may send you promotional communications about phsaya games, bonuses, promotions, and platform updates where you have provided your explicit consent during registration or subsequently through your Account settings.
Marketing communications from phsaya may be sent via: SMS to your registered Philippine mobile number; email to your registered email address; and in-Platform notifications when you are logged into your phsaya Account.
You may withdraw your consent to marketing communications at any time by: (a) updating your notification preferences in your phsaya Account settings; or (b) clicking the unsubscribe link included in any phsaya promotional email; or (c) contacting phsaya support directly via live chat.
phsaya reserves the right to update or amend this Privacy Policy at any time to reflect changes in its data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or the services provided on the Platform.
Where amendments are material — meaning they substantially affect your rights or the way phsaya uses your personal data — phsaya will notify registered players via email to their registered address and via in-Platform notification at least fourteen (14) days before the amendment takes effect, where practicable.
The current version of this Privacy Policy is always available at phsaya.lat/privacy-policy. The effective date at the top of this document will be updated to reflect the date of the most recent revision. Your continued use of the phsaya Platform after the effective date of any amendment constitutes your acknowledgment of the updated Privacy Policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or the personal data phsaya holds about you, please contact the phsaya Data Protection Officer through the following channels:
phsaya aims to respond to all privacy-related requests within fifteen (15) business days. Complex requests may require additional time; phsaya will inform you of any extension within the initial 15-day period.
If you are not satisfied with phsaya's response to your privacy concern, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Philippines. Information about the NPC's complaint process is available on the NPC's official website (privacy.gov.ph).
phsaya is PAGCOR-regulated and fully compliant with the Philippine Data Privacy Act. Your data is protected, your rights are respected, and your gaming is secure. Join 500,000+ Filipino players — 21+ only.