playtim Privacy
Policy

This Privacy Policy ("Policy") is issued by playtim ("playtim", "we", "us", "our") and governs the collection, processing, storage, disclosure, and protection of personal data provided by or collected from users ("you", "your", "Data Subject") of the playtim online gaming platform accessible at playtim.org ("Platform").

playtim operates under authorization from the Philippine Amusement and Gaming Corporation (PAGCOR) and is fully committed to complying with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 of the Philippines (DPA), its Implementing Rules and Regulations (IRR), and all applicable issuances of the National Privacy Commission (NPC).

This Policy applies to all personal data collected through your use of the Platform, including registration, account management, gaming activity, financial transactions, customer support interactions, and any other engagement with playtim's services — whether accessed via desktop, mobile browser, or any other device.

This Policy should be read together with playtim's Terms & Conditions, which govern your overall use of the Platform. In the event of any conflict between this Policy and the Terms & Conditions on matters of data privacy, this Policy shall prevail.

For the purposes of the Data Privacy Act of 2012, playtim acts as the Personal Information Controller (PIC) in respect of the personal data it collects from users of the Platform. As PIC, playtim is responsible for determining the purposes for which, and the manner in which, personal data is processed.

Where playtim engages third-party service providers to process personal data on its behalf — for example, payment processors, identity verification providers, and analytics platforms — those providers act as Personal Information Processors (PIPs) and are bound by written data processing agreements that require them to process personal data only on documented instructions from playtim and in accordance with the DPA.

playtim has appointed a Data Protection Officer (DPO) as required under Section 21 of the DPA IRR. The DPO is responsible for overseeing playtim's data protection compliance program, serving as the primary point of contact for the National Privacy Commission, and handling data subject requests and complaints. Contact details for the DPO are provided in Section 14 of this Policy.

playtim collects the following categories of personal data from users of the Platform. The specific data collected in each category may vary depending on the features and services you use:

playtim collects personal data through the following channels and mechanisms:

• Direct Registration: When you create a playtim account, you provide your name, date of birth, contact details, and other registration information directly through the registration form on the Platform.
• KYC Verification: When you submit identity documents (such as a government-issued ID and a selfie) to complete the Know Your Customer verification process required before withdrawals are processed.
• Deposits and Withdrawals: When you conduct financial transactions on the Platform, payment-related data is collected directly and, where applicable, through our authorized payment processing partners.
• Gaming Activity: Your gaming activity — including every wager placed, game launched, and session conducted — is automatically recorded by the Platform's server-side systems as part of normal Platform operation and for regulatory compliance purposes.
• Cookies and Tracking Technologies: playtim uses cookies, web beacons, and similar tracking technologies to collect Technical Data and Usage Data automatically when you access the Platform. See Section 9 for full details.
• Customer Support: When you contact playtim via live chat or email, your communications are recorded and retained as part of our customer support records.
• Responsible Gaming Tools: When you interact with playtim's responsible gaming features — such as setting a deposit limit or requesting a self-exclusion — the relevant data is collected and recorded to give effect to your request.

playtim processes your personal data for the following purposes. Each purpose is supported by a lawful basis under the Data Privacy Act of 2012:

• Account Registration and Management — To create and maintain your playtim account, authenticate your identity at login, and manage your account preferences. Legal basis: Performance of a contract (the Terms & Conditions).
• Identity Verification (KYC) — To verify your identity and age (21+) in compliance with PAGCOR regulatory requirements and Philippine anti-money laundering obligations. Legal basis: Compliance with a legal obligation.
• Processing Deposits and Withdrawals — To facilitate PHP deposits and withdrawals via GCash, PayMaya, BPI, BDO, and Metrobank. Legal basis: Performance of a contract.
• Provision of Gaming Services — To deliver the games, betting markets, bonuses, and other features available on the Platform. Legal basis: Performance of a contract.
• Fraud Prevention and Security — To detect, investigate, and prevent fraudulent transactions, unauthorized account access, money laundering, and other prohibited activities. Legal basis: Legitimate interests of playtim in protecting the Platform and its users; compliance with a legal obligation.
• Regulatory Reporting — To comply with playtim's obligations to PAGCOR and other Philippine regulatory authorities, including the submission of required reports and the production of records upon lawful demand. Legal basis: Compliance with a legal obligation.
• Responsible Gaming — To implement and maintain the responsible gaming tools available on the Platform, including deposit limits, self-exclusion records, and session alerts. Legal basis: Legitimate interests; compliance with regulatory requirements.
• Customer Support — To respond to your inquiries, resolve disputes, and improve our support services. Legal basis: Performance of a contract; legitimate interests.
• Marketing Communications — To send you information about playtim promotions, bonuses, and new features, where you have opted in to receive such communications. Legal basis: Consent (you may withdraw consent at any time).
• Platform Improvement and Analytics — To analyze usage patterns, improve Platform functionality, and develop new features. Legal basis: Legitimate interests, using aggregated or anonymized data where possible.

playtim does not sell, rent, or trade your personal data to third parties for their own marketing purposes. Personal data is shared only in the following circumstances:

• Payment Processors: Your financial data is shared with authorized payment service providers (including GCash, PayMaya, BPI, BDO, and Metrobank) solely to facilitate deposit and withdrawal transactions. These providers are bound by their own privacy policies and applicable financial regulations.
• Identity Verification Providers: Your identity documents and biometric data may be shared with authorized KYC and identity verification service providers for the purpose of completing the verification process required by PAGCOR regulations.
• Regulatory Authorities: playtim is required by law to share certain data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies upon lawful request or as part of mandatory reporting obligations.
• Technology and Infrastructure Partners: playtim uses third-party cloud hosting, database, and Platform infrastructure providers to operate the Platform. These providers act as Personal Information Processors under written agreements that restrict their use of your data to the provision of services to playtim.
• Game Providers and Software Licensors: Where games on the Platform are provided by licensed third-party game studios, limited technical data (such as session tokens and game outcome verification data) may be shared with those providers as necessary to deliver the gaming experience. No personally identifiable information is shared with game providers beyond what is technically necessary.
• Legal Proceedings: playtim may disclose your personal data to law enforcement agencies, courts, or other governmental authorities in the Philippines where required by applicable law, court order, or legal process.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of playtim's assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and any material changes to the processing of your data in advance.

playtim retains personal data for as long as is necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods required by applicable Philippine law and PAGCOR regulations:

• Account and Identity Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and anti-money laundering regulations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with the Anti-Money Laundering Act and PAGCOR requirements.
• Gaming History: Retained for a minimum of three (3) years from the date of each gaming session or transaction for regulatory compliance, dispute resolution, and responsible gaming monitoring purposes.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Customer Support Records: Retained for a minimum of two (2) years from the date of the most recent interaction, unless a longer retention period is required for ongoing dispute resolution or regulatory purposes.
• Marketing Consent Records: Retained for the duration of your consent and for a reasonable period thereafter as evidence of consent, in accordance with NPC guidelines.
• Self-Exclusion Records: Retained indefinitely or for the duration of the self-exclusion period plus a minimum of five (5) years to prevent re-registration during the exclusion period.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in a manner that prevents re-identification, in accordance with playtim's data disposal procedures.

playtim implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the playtim Platform is encrypted using industry-standard 256-bit SSL/TLS technology, preventing interception during transmission.
• Encryption at Rest: Sensitive personal data — including government ID numbers, payment references, and authentication credentials — is encrypted at rest using AES-256 encryption within playtim's database systems.
• Access Controls: Access to personal data within playtim's systems is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and receive regular data privacy training.
• Two-Factor Authentication: playtim supports SMS OTP two-factor authentication for player accounts to provide an additional layer of protection against unauthorized login attempts.
• Penetration Testing and Vulnerability Management: playtim conducts regular security assessments, including penetration testing, to identify and remediate vulnerabilities in the Platform's technical infrastructure.
• Incident Response: playtim maintains a documented Personal Data Breach Response Policy. In the event of a personal data breach that is likely to prejudice your rights and freedoms, playtim will notify the National Privacy Commission and affected users within the timeframes required by the DPA.
• Third-Party Security Standards: All third-party service providers with access to personal data are required to maintain security standards at least equivalent to those maintained by playtim, as verified through contractual requirements and periodic due diligence.

playtim uses cookies and similar tracking technologies on the Platform to enhance your experience, ensure Platform functionality, prevent fraud, and analyze usage patterns. The following types of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function and cannot be switched off. They are set in response to actions you take, such as logging in, setting your language preferences, and managing your session. No consent is required for strictly necessary cookies.
• Functional Cookies: These cookies enable the Platform to remember your preferences and settings (such as your preferred game category or notification settings) to provide a more personalized experience.
• Security and Fraud Prevention Cookies: These cookies are used by playtim's fraud detection systems to identify and block suspicious activity, including bot traffic, account takeover attempts, and multi-account abuse.
• Analytics Cookies: These cookies allow playtim to measure and analyze how users interact with the Platform — for example, which pages are visited most frequently, where users drop off during registration, and how game features are used. Analytics data is used in aggregate form to improve the Platform.

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary or security cookies may impair the functionality of the Platform and may prevent you from accessing certain features. playtim's Platform does not respond to browser "Do Not Track" signals at this time.

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by playtim. These rights may be exercised by contacting our Data Protection Officer using the details in Section 14:

playtim will respond to all data subject requests within fifteen (15) working days of receipt, in accordance with NPC guidelines. Where a request cannot be fulfilled within this period, playtim will notify you of the extended timeline and the reason for the delay. playtim reserves the right to verify your identity before processing any data subject request to prevent unauthorized disclosure.