25ph9 Privacy Policy

Section 01

1. Scope & Data Controller

This Privacy Policy applies to all personal data collected, processed, and stored by 25ph9 in connection with the operation of the 25ph9 online gaming platform, accessible at 25ph9.org and any associated subdomains, mobile-optimised interfaces, or future applications released under the 25ph9 brand.

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, 25ph9 acts as the personal information controller in respect of data collected from Players registered on the platform. Where 25ph9 engages third-party service providers to process data on its behalf (for example, payment processors, identity verification providers, or analytics services), those parties act as personal information processors under 25ph9's instructions.

This Privacy Policy should be read in conjunction with the 25ph9 Terms & Conditions, which are incorporated by reference. By registering an Account on 25ph9 or continuing to use the platform after this Policy has been updated, you acknowledge that you have read and understood this Privacy Policy.

Section 02

2. Personal Data We Collect

25ph9 collects personal data through multiple channels — at registration, during account operation, via the KYC verification process, through platform usage, and via customer support interactions. The categories of data collected are described below.

2.1 Registration Data

• Identity information: full legal name, date of birth;
• Contact information: email address, Philippine mobile number (Globe or Smart format);
• Account credentials: username and hashed password (passwords are never stored in plain text at 25ph9);
• Residency: country of residence, city or province within the Philippines.

2.2 KYC and Identity Verification Data

• Copies of government-issued Philippine identification documents (passport, SSS UMID, driver's license, PhilHealth ID, Voter's ID, or equivalent);
• Proof of address documentation where required;
• Selfie or liveness verification images where required by our identity verification process;
• Source of funds declarations for transactions above applicable thresholds.

2.3 Financial and Transaction Data

• GCash account reference numbers, PayMaya account details, bank account details (BPI, BDO, Metrobank), card details (Visa/Mastercard — tokenised), or crypto wallet addresses (USDT) used for deposits and withdrawals;
• Full deposit and withdrawal transaction history, including timestamps, amounts, and payment methods;
• Balance history within your 25ph9 Wallet;
• Bonus credits issued, wagering activity against bonuses, and bonus forfeiture records.

2.4 Gaming Activity Data

• Full record of games played, stakes placed, outcomes, and net win/loss figures for every session;
• Sports betting selections, amounts wagered, and settlement outcomes;
• Time stamps and session duration data for all gaming activity;
• Self-imposed responsible gaming limits set within account settings (deposit limits, loss limits, session limits, self-exclusion status).

2.5 Technical and Device Data

• IP address at time of login and during sessions;
• Device type, operating system, browser type and version;
• Session identifiers and authentication tokens;
• Geolocation data (country and city level, derived from IP address) — 25ph9 does not request GPS-level location permission;
• Platform interaction logs including pages visited, features used, and error events.

2.6 Communications Data

• Content and metadata of customer support conversations (live chat transcripts, email correspondence);
• Records of promotional communications sent to you and your opt-in or opt-out status for marketing messages.

Section 03

3. Lawful Basis for Processing

25ph9 processes your personal data only where it has a lawful basis to do so under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations. The primary lawful bases on which 25ph9 relies are as follows:

Section 04

4. How We Use Your Data

25ph9 uses your personal data for the following specific purposes, each of which is supported by an appropriate lawful basis as identified in Section 3:

• Account management: creating, maintaining, and administering your 25ph9 Account, including authentication, password management, and session management;
• Service delivery: processing your deposits, crediting winnings, facilitating withdrawals to GCash, PayMaya, and Philippine bank accounts, and providing access to all game content on the platform;
• Identity verification: conducting KYC checks in compliance with anti-money laundering obligations and PAGCOR requirements applicable to online gaming platforms serving Filipino players;
• Age verification: confirming that you are 21 years of age or older before and during your use of the 25ph9 platform;
• Fraud prevention and security: monitoring transactions and account activity for signs of fraud, collusion, money laundering, or prohibited conduct as defined in the 25ph9 Terms & Conditions;
• Responsible gaming: maintaining records of your gaming activity, self-imposed limits, and any responsible gaming interventions to support your wellbeing as a player;
• Customer support: responding to your enquiries, complaints, and dispute resolutions submitted via live chat or email;
• Legal and regulatory compliance: fulfilling obligations to PAGCOR, Philippine tax authorities, anti-money laundering bodies, and any other applicable regulatory authority;
• Service improvement: analysing aggregate platform usage data to improve game performance, payment reliability, mobile optimisation, and overall user experience;
• Marketing communications: where you have opted in, sending you information about 25ph9 promotions, bonus offers, and new features — you may opt out at any time.

Section 05

5. Data Sharing with Third Parties

25ph9 does not sell your personal data. We share personal data with third parties only in the following limited circumstances, and only to the extent necessary for the specified purpose:

• Payment processors: GCash (Mynt), PayMaya (Maya), BPI, BDO, Metrobank, Visa/Mastercard network operators, and USDT infrastructure providers receive transaction data necessary to process your deposits and withdrawals. Each of these processors maintains its own privacy and security standards;
• KYC and identity verification providers: third-party identity verification services may receive copies of your government-issued ID and liveness check data to perform KYC processes on 25ph9's behalf under data processing agreements;
• Game providers: certified game studios and providers whose content appears on the 25ph9 platform may receive pseudonymised session and stake data necessary to operate their games and calculate RTPs. No identifiable player information beyond a session token is shared with game providers;
• Analytics and security providers: platform analytics and cybersecurity service providers may receive technical and interaction data in aggregated or pseudonymised form to support service quality and security monitoring;
• Regulatory and law enforcement bodies: 25ph9 will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), Philippine law enforcement agencies, or other competent authorities where required to do so by applicable law, court order, or binding regulatory directive;
• Professional advisers: legal, audit, and accounting advisers retained by 25ph9 may access data to the extent necessary and are bound by confidentiality obligations;
• Business transfers: in the event of a merger, acquisition, or sale of the 25ph9 platform, Player data may be transferred to the acquiring entity, which will be bound to treat it in accordance with this Privacy Policy or equivalent standards.

Section 06

6. Data Retention

25ph9 retains personal data for the periods set out below, after which data is securely deleted or irreversibly anonymised unless a longer retention period is required by applicable law or regulation:

Where an Account is the subject of an active investigation, dispute, regulatory inquiry, or legal proceedings, 25ph9 may retain relevant data beyond the standard retention periods specified above until the matter is fully resolved.

Section 07

7. Data Security

25ph9 implements a layered security architecture to protect the personal data of all Players against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• Encryption in transit: all connections to the 25ph9 platform use TLS 1.2 or higher. HTTPS is enforced on all pages and cannot be bypassed;
• Encryption at rest: personal data stored in 25ph9 databases is encrypted using AES-256 encryption. KYC documents are stored in isolated, access-controlled environments separate from operational databases;
• Password security: user passwords are hashed using industry-standard algorithms (bcrypt). Plain-text passwords are never stored or logged;
• Access controls: internal access to Player personal data is restricted on a strict need-to-know basis. Staff access is role-based, logged, and reviewed periodically;
• Two-factor authentication: all 25ph9 staff with access to systems holding personal data are required to use two-factor authentication. Players are encouraged to enable 2FA on their accounts;
• Network security: the 25ph9 platform is protected by web application firewalls (WAF), intrusion detection systems (IDS), and DDoS mitigation infrastructure;
• Penetration testing: 25ph9 conducts periodic third-party security assessments and penetration tests. Identified vulnerabilities are remediated according to risk priority.

Section 08

8. Cookies & Tracking Technologies

25ph9 uses cookies and similar tracking technologies to operate the platform, improve performance, and understand how Players interact with the site. The categories of cookies used are:

• Strictly necessary cookies: required for the platform to function — these include session authentication tokens, load balancing identifiers, and CSRF protection tokens. These cannot be disabled without breaking platform functionality;
• Functional cookies: remember your preferences such as language settings, selected game categories, and responsible gaming limit configurations;
• Analytics cookies: collect anonymised data about how Players navigate the 25ph9 platform — which pages are visited most frequently, where users encounter errors, and how long game sessions last. This data is used exclusively for internal service improvement;
• Security cookies: used to detect and prevent fraudulent activity, identify unusual login patterns, and flag potentially compromised sessions.

25ph9 does not use third-party advertising cookies or permit advertising networks to place cookies on the platform. You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to or using the 25ph9 platform.

Section 09

9. International Data Transfers

While 25ph9 primarily serves Filipino players and operates with Philippine Standard Time-based support, certain technical infrastructure components and third-party service providers may involve the processing of personal data outside of the Philippines. Where such transfers occur, 25ph9 ensures that:

• Transfers are made only to recipients in jurisdictions that provide adequate levels of data protection, or where appropriate safeguards (such as contractual data protection clauses) have been implemented;
• Third-party processors receiving data outside the Philippines are contractually bound to protect that data to standards consistent with the Philippine Data Privacy Act;
• Game provider integrations that may involve offshore data processing are structured so that no more than pseudonymised session data leaves Philippine-proximate infrastructure.

Section 10

10. Minors and Age Restriction

If you are a parent or guardian and believe that a person under 21 has registered an Account on 25ph9, please contact support immediately at [email protected]. Include details that allow 25ph9 to identify the account in question. We will investigate and act promptly.

Section 11

11. Your Data Rights

Under the Philippine Data Privacy Act of 2012 (RA 10173), as a data subject you are entitled to the following rights in respect of your personal data held by 25ph9. To exercise any of these rights, contact 25ph9 support via live chat or at [email protected] with a description of your request. We will respond within thirty (30) days.

If you believe that 25ph9 has handled your personal data in a manner inconsistent with this Privacy Policy or the Philippine Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

Section 12

12. Data Breach Response

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected Players, 25ph9 will:

• Notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, where required under RA 10173;
• Notify affected Players without undue delay where the breach is likely to result in a high risk to their privacy rights — this notification will be made via the registered email address on their 25ph9 Account;
• Provide clear information in the breach notification about the nature of the breach, the categories of data affected, likely consequences, and the steps 25ph9 has taken or will take to mitigate its effects;
• Maintain a breach register documenting all personal data breaches, whether or not they require NPC notification, as part of 25ph9's accountability obligations.

Section 13

13. Changes to This Policy

25ph9 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory requirements. When changes are material — meaning they significantly affect how your personal data is collected, used, or shared — 25ph9 will provide advance notice to registered Players via email or in-platform notification before the changes take effect.

Minor clarifications, corrections to typographical errors, or changes that do not materially affect your privacy rights may be made without prior notification. The "Last Updated" date at the top of this Policy reflects when the most recent version was published. It is your responsibility to review this Policy periodically. Your continued use of the 25ph9 platform after an updated version is published constitutes your acceptance of the revised Policy.

Section 14

14. Contact & Data Protection Officer

For questions, concerns, or formal requests relating to this Privacy Policy or the handling of your personal data by 25ph9, please reach out through the following channels:

• Live Chat: Available 24/7 inside your 25ph9 Account dashboard — the fastest channel for privacy enquiries;
• Email: [email protected] — for formal written data subject requests, please include "Privacy Request" in the subject line;
• Response commitment: 25ph9 will acknowledge all privacy-related requests within 5 business days and provide a substantive response within 30 days on Philippine Standard Time;
• National Privacy Commission: if your concern is not resolved to your satisfaction by 25ph9's internal process, you may submit a complaint to the National Privacy Commission of the Philippines through official NPC channels.