36php Privacy Policy

1. Scope and Application

This Privacy Policy applies to all personal data collected and processed by 36php in connection with the operation of the 36php Casino platform accessible at 36php.vip ("the Platform"). It applies to all registered members, prospective members, visitors, and any individual whose personal data is processed by 36php in connection with the Platform, regardless of whether they are located in Metro Manila, Cebu, Davao, or any other part of the Philippines.

This Policy is to be read alongside and forms part of 36php's Terms & Conditions. Defined terms used herein and not otherwise defined carry the meaning given to them in the 36php Terms & Conditions.

By registering an account with 36php or using the Platform in any capacity, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein.

2. Personal Data We Collect

36php collects the following categories of personal data from its members and platform users:

2.1 Identity Data: Full legal name, date of birth, nationality, and government-issued identification document details (e.g., Philippine National ID, Passport, Driver's License, UMID, SSS, PhilHealth, or Voter's ID number) submitted during KYC verification.

2.2 Contact Data: Philippine mobile number, email address, and residential address.

2.3 Financial Data: GCash mobile number, Maya/PayMaya account reference, bank account details (where applicable for BPI, BDO, Metrobank, or other bank transfers), deposit and withdrawal history, and transaction records.

2.4 Account Data: 36php username, hashed account password, account registration date, login history, device identifiers, IP addresses used to access the Platform, and session activity logs.

2.5 Gaming Activity Data: Wagering history, game session records, bonus redemption history, and responsible gaming settings configured on your account.

2.6 Communications Data: Records of support chat sessions, email correspondence with 36php, and any other communications you submit to 36php through any channel.

2.7 Technical Data: Browser type, operating system, device type, screen resolution, and referral URL, collected automatically when you access the 36php Platform.

3. How We Collect Your Data

36php collects personal data through the following means:

• Directly from you — during account registration, KYC submission, deposit and withdrawal requests, support interactions, and any forms you complete on the Platform;
• Automatically — through cookies, session tokens, and server logs when you access or use the 36php Platform;
• From third-party service providers — including payment processors (GCash, Maya, BancNet), identity verification services, and fraud detection tools, who share data with 36php as necessary to complete transactions or verify your identity;
• From public sources — including government registries and sanctions lists, where required by Philippine AML regulations and PAGCOR compliance obligations.

4. Lawful Basis and Purpose of Processing

36php processes your personal data on the following lawful bases under RA 10173:

• Contractual necessity — to create and manage your 36php account, process your deposits and withdrawals, provide customer support, and deliver the gaming services you have registered for;
• Legal obligation — to comply with PAGCOR licensing requirements, Philippine Anti-Money Laundering Act (AMLA) obligations, Bureau of Internal Revenue reporting requirements, and National Privacy Commission regulations;
• Legitimate interests — to detect and prevent fraud, unauthorized account access, bonus abuse, and other prohibited activities; to improve platform performance; and to maintain the security and integrity of 36php's systems;
• Consent — for optional marketing communications, where you have explicitly opted in to receive promotional emails or SMS messages from 36php. You may withdraw this consent at any time by contacting 36php's support team.

5. Disclosure of Personal Data to Third Parties

36php does not sell, rent, or trade your personal information to third-party advertisers or data brokers under any circumstances. 36php may share your personal data with the following categories of third parties solely to the extent necessary for the purposes described in Section 4:

• Payment processors and e-wallet providers — GCash (GXI / Mynt), Maya Philippines, GrabPay, InstaPay network members, BancNet, and Philippine commercial banks, to process your deposits and withdrawals;
• Identity verification and KYC service providers — third-party providers used to verify the authenticity of government-issued identification documents submitted during KYC;
• Game content providers — licensed game developers and live dealer studios (such as Evolution) may receive anonymized session data for technical and RTP audit purposes;
• Regulatory authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), and law enforcement authorities, where disclosure is required by law, regulation, or valid legal process;
• Cloud infrastructure and IT service providers — data center and hosting providers who process data on 36php's behalf under strict data processing agreements.

All third-party service providers engaged by 36php are required by contract to implement appropriate technical and organizational security measures to protect your personal data and to process it only on 36php's documented instructions.

6. Data Retention

36php retains your personal data for as long as your account remains active and for such additional periods as are required to fulfill the purposes described in this Policy or to comply with legal and regulatory obligations. Specifically:

• Account and identity data is retained for a minimum of five (5) years following account closure, as required under Philippine AMLA and PAGCOR regulations;
• Financial transaction records are retained for a minimum of five (5) years for BIR and AMLA compliance;
• Support communications are retained for a period of two (2) years following the resolution of the relevant matter;
• Technical and analytics data is retained in anonymized or aggregated form for up to two (2) years.

Where data is no longer required for any lawful purpose, 36php will securely delete or anonymize it.

7. Data Security

36php implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and 36php's servers;
• Encryption of sensitive data fields (including passwords, which are hashed using industry-standard cryptographic algorithms and never stored in plain text) in the 36php database;
• Multi-factor authentication requirements for 36php platform access from new or unrecognized devices;
• Role-based access controls limiting 36php staff access to personal data to those with a legitimate operational need;
• Regular security audits and penetration testing of 36php's platform infrastructure;
• Incident response procedures in place to detect, contain, and notify affected users and the National Privacy Commission of any qualifying personal data breach within the timeframes required under RA 10173.

Notwithstanding the above, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your 36php account has been compromised, please contact our support team immediately.

8. Cookies and Tracking Technologies

8.1 Session Cookies. 36php uses strictly necessary session cookies to maintain your logged-in state during an active Platform session. These cookies are deleted automatically when you close your browser or when your session expires. You cannot opt out of session cookies without disabling your ability to use the 36php platform.

8.2 Analytics Cookies. 36php uses first-party analytics tools to collect anonymized, aggregated data about how the Platform is used — including pages visited, time spent per session, and device/browser types. This data helps 36php identify performance issues and improve the user experience. No personally identifiable information is transmitted via analytics cookies.

8.3 No Third-Party Advertising Cookies. 36php does not deploy third-party advertising networks, behavioral retargeting pixels, or social media tracking cookies on the Platform.

8.4 Managing Cookies. You may disable non-essential cookies through your browser's settings at any time. Note that disabling certain cookies may affect the functionality of the 36php Platform.

9. Your Rights as a Data Subject

As a data subject under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by 36php:

• Right to be informed — to be notified of how your personal data is collected, used, and shared, which this Privacy Policy fulfills;
• Right of access — to request a copy of the personal data 36php holds about you;
• Right to rectification — to request correction of inaccurate or incomplete personal data in your 36php account;
• Right to erasure or blocking — to request deletion or blocking of personal data where it is no longer necessary for the purpose for which it was collected, subject to applicable legal retention obligations;
• Right to object — to object to certain types of processing, including processing for direct marketing purposes;
• Right to data portability — to request a structured, machine-readable copy of personal data you have provided to 36php;
• Right to lodge a complaint — to file a complaint with the National Privacy Commission (NPC) if you believe 36php has violated your data privacy rights.

To exercise any of the above rights, please contact 36php's Data Protection Officer as described in Section 13 of this Policy.

10. Children's Privacy

The 36php platform is strictly for individuals aged 21 years and above, as required by Philippine gaming law. 36php does not knowingly collect personal data from individuals under the age of 21. If 36php discovers that a registered account belongs to a person below the legal age, the account will be immediately suspended and all associated personal data will be processed in accordance with 36php's underage account procedures, including deletion of personal data not required to be retained for legal compliance purposes.

If you believe a person under the age of 21 has registered an account on 36php, please notify our support team immediately.

11. Cross-Border Data Transfers

36php's primary data processing infrastructure is located within the Asia-Pacific region. In some circumstances, personal data may be transferred to and processed in countries outside the Philippines — for example, where 36php uses cloud hosting services or game content providers with servers located in other jurisdictions.

Where such transfers occur, 36php ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that required under RA 10173, including contractual data processing agreements with all third-party recipients, and where applicable, the implementation of NPC-recognized transfer mechanisms.

12. Amendments to This Policy

36php reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable Philippine law, or PAGCOR regulatory requirements. Material amendments will be communicated to registered 36php members via email notification and/or a prominent notice on the Platform prior to the effective date of the change. The "Last updated" date at the top of this page will be revised accordingly. Your continued use of the 36php platform following the effective date of any amendment constitutes your acceptance of the updated Privacy Policy.

13. How to Contact Our Data Protection Officer

36php has designated a Data Protection Officer (DPO) responsible for overseeing compliance with RA 10173 and this Privacy Policy. If you have questions, concerns, or requests regarding your personal data, please contact the 36php DPO through the following channels:

• Email: [email protected] (subject line: "Data Privacy Request")
• Live Chat: Available 24/7 on the 36php platform — request to speak with the Data Protection team

36php will acknowledge your request within three (3) business days and will endeavor to respond fully within fifteen (15) business days, as required under RA 10173 and NPC regulations.