26superph Privacy Policy

1. Introduction

26superph ("26superph," "we," "us," "our") is committed to protecting the privacy and security of the personal data of all individuals who access or use the 26superph website, mobile platform, and associated gaming services (collectively, the "Platform"). This Privacy Policy ("Policy") describes how 26superph collects, uses, stores, discloses, and protects personal data in connection with the operation of the Platform.

This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations, as administered by the National Privacy Commission of the Philippines ("NPC"). It should be read together with the 26superph Terms & Conditions and the Responsible Gaming Policy.

By registering an account or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not access or use the Platform.

2. Data Controller

For the purposes of the DPA, 26superph is the Personal Information Controller in respect of personal data collected through the Platform. 26superph determines the purposes and means of processing personal data submitted by Players and collected through Platform operations.

26superph has designated a Data Protection Officer ("DPO") responsible for overseeing compliance with the DPA and this Policy. Queries regarding this Policy or your personal data may be directed to the DPO via the contact details in Section 14.

3. Categories of Personal Data We Collect

26superph collects the following categories of personal data:

3.1 Identity & Registration Data

• Full legal name;
• Date of birth (required to verify 21+ age eligibility under PAGCOR regulations);
• Nationality and country of residence;
• Government-issued identification number and document type (e.g., SSS, PhilHealth, Passport, Driver's License, Voter's ID);
• Photograph (where submitted for KYC verification);
• Username and encrypted password.

3.2 Contact Data

• Philippine mobile number (primary identifier for account access and OTP delivery);
• Email address;
• Home or billing address (where required for enhanced KYC).

3.3 Financial & Transaction Data

• GCash account number or registered mobile number;
• Maya / PayMaya account details;
• Bank account name, number, and branch (BPI, BDO, Metrobank, or other Philippine banks);
• Transaction history: deposits, withdrawals, bonuses credited and redeemed;
• Source of funds declarations (where required under AMLC regulations).

3.4 Gaming & Behavioural Data

• Game play history, bet amounts, game results, session durations;
• Sports betting selections, odds accepted, and settlement results;
• Bonus uptake, wagering requirement progress, and promotion participation history;
• Self-imposed limits and responsible gaming tool usage.

3.5 Technical & Device Data

• IP address and approximate geolocation (province or city level);
• Device type, operating system, and browser or app version;
• Session timestamps and login history;
• Cookie identifiers and session tokens (see Section 10).

3.6 Communications Data

• Records of communications with 26superph customer support, including chat logs and email correspondence;
• Feedback, survey responses, and complaints submitted to 26superph.

4. How We Collect Personal Data

26superph collects personal data through the following means:

• Directly from you — when you register an account, complete KYC, contact customer support, participate in promotions, or voluntarily provide information through the Platform;
• Automatically — through cookies, server logs, and analytics tools as you use the Platform (see Section 10);
• From payment providers — GCash, Maya, and Philippine banks may provide transaction confirmation data to facilitate payment processing;
• From identity verification services — where 26superph uses a third-party KYC provider to verify government-issued identification documents, that provider may supply verification results to 26superph;
• From fraud and compliance providers — where 26superph uses third-party services to screen for sanctions, politically exposed persons (PEPs), or fraudulent activity as required under Philippine anti-money laundering law.

5. Legal Basis and Purposes of Processing

26superph processes personal data on the following legal bases under the DPA:

Purpose	Legal Basis
Account registration and management	Contract performance
Age verification (21+ requirement)	Legal obligation (PAGCOR regulations)
KYC / identity verification	Legal obligation (DPA, AMLC regulations)
Payment processing and fraud prevention	Contract performance; legal obligation
Game delivery and fair play integrity	Contract performance
Responsible gaming monitoring	Legal obligation (PAGCOR); legitimate interest
Customer support	Contract performance; legitimate interest
Platform security and abuse prevention	Legitimate interest
Regulatory reporting to PAGCOR and AMLC	Legal obligation
Service improvement and analytics	Legitimate interest (aggregate, anonymised data)

26superph does not use personal data for automated profiling that produces legal or similarly significant effects on Players without human review.

6. Sharing and Disclosure of Personal Data

26superph does not sell, rent, or trade personal data. Personal data may be shared with the following categories of recipients only to the extent necessary for the stated purpose:

6.1 Payment Service Providers

GCash, Maya, GrabPay, QR Ph network operators, and Philippine banks (BPI, BDO, Metrobank) receive transaction data necessary to process deposits and withdrawals. These providers are bound by their own privacy policies and the DPA.

6.2 KYC and Identity Verification Providers

26superph may use accredited third-party KYC verification services to validate government-issued identification documents. These providers process identity data solely for verification purposes under data processing agreements compliant with the DPA.

6.3 Regulatory and Law Enforcement Authorities

26superph is required by law to disclose certain personal and transaction data to PAGCOR, the Anti-Money Laundering Council (AMLC), and other Philippine government authorities upon lawful request or where mandatory reporting obligations apply. 26superph may be prohibited from notifying you of such disclosures in certain circumstances.

6.4 IT and Infrastructure Service Providers

26superph uses trusted technology vendors for hosting, security monitoring, and customer support infrastructure. These vendors access personal data only to the extent necessary to provide their services and are bound by data processing agreements.

6.5 Professional Advisers

Lawyers, auditors, and insurers acting for 26superph may access personal data to the extent necessary for the relevant professional services, subject to professional confidentiality obligations.

7. International Data Transfers

Where personal data is transferred to a recipient located outside the Philippines (for example, to a technology vendor with servers outside the country), 26superph ensures that appropriate safeguards are in place in accordance with the DPA and NPC guidelines. Such safeguards may include standard contractual clauses approved by the NPC, or transfers to jurisdictions recognized by the NPC as providing adequate data protection. 26superph will not transfer personal data to a foreign country that does not offer at minimum a comparable level of data protection to that afforded under the DPA.

8. Data Retention

26superph retains personal data for the following periods, subject to applicable legal and regulatory retention obligations:

• Active account data: Retained for the duration of the account and for a minimum of five (5) years following account closure, as required by PAGCOR and AMLC regulations;
• Transaction and financial records: Retained for a minimum of five (5) years in compliance with Philippine anti-money laundering record-keeping requirements;
• KYC documents: Retained for a minimum of five (5) years following the end of the customer relationship;
• Customer support communications: Retained for three (3) years from the date of the communication, unless subject to a longer mandatory retention period;
• Technical and device data (logs): Retained for ninety (90) days for security monitoring purposes, after which they are deleted or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with an identifiable individual.

9. Security Measures

26superph implements appropriate technical and organizational security measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• TLS encryption for all data transmitted between the Platform and user devices;
• Encryption at rest for sensitive personal data stored in 26superph databases;
• Role-based access controls limiting staff access to personal data to that which is necessary for their role;
• Multi-factor authentication for administrative access to production systems;
• Regular penetration testing and security audits of Platform infrastructure;
• Incident response procedures aligned with NPC data breach notification requirements.

In the event of a personal data breach that is likely to result in a real risk of serious harm to data subjects, 26superph will notify the NPC within seventy-two (72) hours of becoming aware of the breach, and will notify affected Players where required under the DPA.

10. Cookies and Similar Technologies

26superph uses cookies and similar tracking technologies (collectively, "cookies") to operate and improve the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function. Include session authentication tokens, CSRF protection cookies, and load-balancing cookies. Cannot be disabled without preventing use of the Platform.
• Performance and Analytics Cookies: Used to collect aggregate, anonymised information about how Filipino players use the Platform — which game categories are most popular, typical session lengths, and technical error rates. This data is used solely to improve the Platform experience and is not linked to individual identifiable players for any external purpose.
• Preference Cookies: Store your language preferences, display settings, and responsible gaming tool configurations.

26superph does not deploy third-party behavioral advertising cookies or share browsing data with advertising networks. You can manage cookie settings through your browser's privacy controls; however, disabling strictly necessary cookies will prevent you from accessing the Platform.

11. Your Rights as a Data Subject

Under the DPA, you have the following rights with respect to your personal data held by 26superph:

• Right to be Informed: You have the right to be informed of the personal data that 26superph collects, the purposes of processing, and your rights under this Policy — which this document fulfils.
• Right to Access: You may request a copy of the personal data 26superph holds about you. Requests will be fulfilled within thirty (30) calendar days.
• Right to Rectification: If your personal data is inaccurate or incomplete, you may request correction. Where the correction relates to KYC data, documentary evidence will be required.
• Right to Erasure: You may request deletion of your personal data. This right is subject to 26superph's legal and regulatory retention obligations — data required by PAGCOR or AMLC regulations cannot be deleted before the mandatory retention period expires.
• Right to Object: You may object to processing based on legitimate interest. 26superph will honour such objections unless it has compelling legitimate grounds that override your interest or the processing is required for legal claims.
• Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format where technically feasible.
• Right to Lodge a Complaint: If you believe 26superph has processed your personal data in violation of the DPA, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

To exercise any of the above rights, contact the 26superph Data Protection Officer using the contact details in Section 14. 26superph will respond to all legitimate requests within the statutory timeframe under the DPA.

12. Children and Minors

The 26superph Platform is strictly intended for individuals who are 21 years of age or older, as mandated by PAGCOR for online gaming platforms in the Philippines. 26superph does not knowingly collect personal data from individuals below the age of 21. Age is verified during the registration and KYC process. If 26superph becomes aware that it has inadvertently collected personal data from a person below the minimum age, it will promptly delete such data and close the relevant account.

If you are a parent or guardian and believe that a person under 21 in your care has registered a 26superph account, please contact support immediately using the details in Section 14.

13. Amendments to This Privacy Policy

26superph reserves the right to update or amend this Privacy Policy at any time. Material amendments — those that substantively affect how personal data is processed or reduce data subject rights — will be communicated to registered Players via in-platform notification or registered email at least fourteen (14) days before taking effect. The "Last Updated" date at the top of this Policy will be revised to reflect the most recent version. Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Policy.

14. Contact & Complaints

For questions, requests to exercise data subject rights, or complaints regarding this Privacy Policy or 26superph's data processing practices, please contact the 26superph Data Protection Officer:

Email: [email protected]

Please mark your communication "Data Privacy — [Your Request Type]" for prompt routing to the DPO. 26superph will acknowledge receipt within five (5) business days and respond to substantive requests within thirty (30) calendar days, as required by the DPA.

If you are not satisfied with 26superph's response, you may escalate your complaint to the National Privacy Commission of the Philippines at privacy.gov.ph.