Privacy Policy
— 366ph Platform

This Privacy Policy applies to 366ph ("we", "us", "our"), the operator of the online gaming and sports betting platform accessible at 366ph.app. It applies to all personal data collected from users ("you", "Player") who register an account, access the 366ph Platform, contact our support team, or interact with our services in any other capacity.

This Policy covers personal data collected through:

• The 366ph website at 366ph.app and all associated sub-pages;
• Account registration and verification processes;
• Deposit, withdrawal, and payment processing interactions;
• Customer support communications, whether via live chat or email;
• Cookies and analytics technologies deployed on the 366ph Platform;
• Responsible gaming tools and self-exclusion requests.

This Policy does not apply to third-party websites, payment processors, or services accessible through links from the 366ph Platform. Those third parties operate under their own privacy policies and 366ph is not responsible for their data handling practices.

366ph collects the following categories of personal data, depending on how you interact with the Platform:

• Full name as it appears on a valid government-issued identification document;
• Date of birth (used to verify the 21-year minimum age requirement);
• Email address and mobile number (used for account login, two-factor authentication, and communications);
• Username chosen at registration;
• Residential address in the Philippines.

• Copies of government-issued photo identification (Philippine passport, driver's licence, UMID, SSS/GSIS card, or PhilSys national ID);
• Proof of address documents;
• Proof of ownership of the payment method used for deposits and withdrawals;
• Selfie or live photo verification where required for enhanced due diligence.

• Deposit and withdrawal amounts, timestamps, and transaction reference numbers;
• Payment method identifiers (e.g., masked GCash or Maya account number, last four digits of a bank account);
• Account wallet balance history;
• Chargeback and dispute records where applicable.

• Games played, bet amounts, bet outcomes, and gaming session durations;
• Bonus offers claimed and wagering requirement progress;
• Responsible gaming tool usage (deposit limits, session timers, self-exclusion requests).

• IP address and approximate geographic location derived therefrom;
• Device type, operating system, and browser type;
• Session identifiers and login timestamps;
• Platform interaction logs (pages visited, features used, errors encountered).

• Content of support communications submitted via live chat or email;
• Records of responsible gaming interactions and self-exclusion requests;
• Survey responses and feedback submitted voluntarily.

366ph uses the personal data it collects for the following specific purposes:

• Account creation and management: To register your account, authenticate your identity at login, and manage your account settings and preferences;
• Age and identity verification: To confirm that you meet the minimum age requirement of 21 years old and to verify your identity as required by PAGCOR regulations and anti-money laundering laws;
• Payment processing: To process deposits and withdrawals, verify payment method ownership, and maintain accurate financial records;
• Gaming services delivery: To provide access to the game library, calculate and credit winnings, manage bonus offers, and maintain fair gaming records;
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeovers, bonus abuse, and other prohibited conduct;
• Regulatory compliance: To meet 366ph's obligations under PAGCOR regulations, anti-money laundering laws, and the Philippine Data Privacy Act, including record-keeping and reporting requirements;
• Customer support: To respond to your queries, resolve disputes, and process responsible gaming requests;
• Platform improvement: To analyse aggregated usage data to improve the performance, security, and content of the 366ph Platform;
• Responsible gaming: To monitor gameplay patterns that may indicate problem gambling behaviour and to administer self-exclusion and limit-setting tools;
• Communications: To send you transactional notifications (e.g., deposit confirmations, withdrawal updates, account security alerts) and, where you have consented, promotional communications about 366ph offers.

366ph will not use your personal data for any purpose that is incompatible with the purposes stated in this section without first obtaining your consent, except where required by law.

Under the Philippine Data Privacy Act, personal data must be processed on a legitimate legal basis. 366ph relies on the following legal bases:

• Contractual necessity: Processing required to enter into or perform the contract with you — including account registration, payment processing, and gaming services delivery — is necessary to fulfil 366ph's contractual obligations under the Terms and Conditions;
• Legal obligation: Processing required to comply with PAGCOR regulations, anti-money laundering laws (including the Philippine AMLA), tax obligations, and other applicable legal requirements;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and analytics, where such processing is proportionate and does not override your privacy rights;
• Consent: Processing for optional purposes — including marketing communications and non-essential cookies — is conducted on the basis of your prior consent. You may withdraw consent at any time by contacting 366ph or updating your account preferences, without affecting the lawfulness of processing conducted prior to withdrawal.

366ph uses cookies and similar technologies on the Platform. A cookie is a small text file placed on your device by a web server when you visit a website. 366ph uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function. These include session cookies that keep you logged in during your visit, security tokens that protect against cross-site request forgery, and cookies that store your language and currency preferences. These cookies cannot be disabled without breaking core Platform functionality.
• Functional cookies: Used to remember your preferences and customise your experience, such as remembering your preferred game category or table limit settings. These improve convenience but are not strictly required.
• Analytics cookies: First-party analytics cookies allow 366ph to understand aggregate Platform usage — which pages are visited most, where users drop off in the registration process, and which features generate errors. This data is used in anonymised or aggregated form to improve the Platform. 366ph does not use third-party advertising analytics networks.
• Security and fraud prevention cookies: Used to detect and block suspicious activity, including bot traffic, credential stuffing attempts, and suspicious login patterns.

366ph does not sell, rent, or trade your personal information to third-party marketers. Personal data is shared with third parties only in the following circumstances and under binding contractual obligations of confidentiality and data protection:

To process deposits and withdrawals, 366ph shares necessary transaction data with payment providers including GCash, Maya, BPI, BDO, Metrobank, and selected cryptocurrency processors. Data shared is limited to what is necessary to execute the requested transaction and is governed by each provider's own privacy policy.

KYC and identity verification services are provided by third-party specialist providers. These providers process identification documents and verification photographs under strict data processing agreements and are prohibited from using your data for any purpose other than verification on behalf of 366ph.

366ph may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, or other government authorities where required to do so by law, by court order, or in response to a lawful request from a competent authority. 366ph will notify affected Players of such disclosures where legally permitted to do so.

Certain technical services — including cloud hosting, platform maintenance, and security monitoring — are provided by third-party technology partners who process data on 366ph's behalf under data processing agreements that prohibit independent use of the data.

In the event of a merger, acquisition, or sale of assets involving 366ph, personal data held on the Platform may be transferred to the acquiring entity as part of that transaction. Affected Players will be notified of any change in data controller prior to any transfer taking effect.

The 366ph Platform is operated primarily from servers located in the Philippines. Certain service providers engaged by 366ph may process data in jurisdictions outside the Philippines. Where personal data is transferred outside the Philippines, 366ph ensures that such transfers are conducted under appropriate safeguards, including:

• Data processing agreements incorporating clauses equivalent in protection to those required under the Philippine Data Privacy Act;
• Transfers only to jurisdictions assessed by 366ph as providing an adequate level of data protection;
• Explicit contractual prohibitions on the receiving party using transferred data for any purpose beyond the specific service being rendered.

Players may request information about specific international data transfers involving their personal data by contacting the 366ph Data Privacy Officer.

366ph retains personal data for the following periods, subject to any longer retention period required by law:

• Active Account data: Retained for the lifetime of your account plus five (5) years following account closure, to comply with PAGCOR record-keeping requirements and Philippine anti-money laundering obligations;
• KYC and identity verification documents: Retained for five (5) years following the last transaction or account closure, whichever is later, as required by the Philippine AMLA and PAGCOR regulations;
• Financial transaction records: Retained for five (5) years from the date of each transaction, as required by law;
• Customer support communications: Retained for three (3) years from the date of the communication, unless the communication forms part of a dispute or legal claim in which case it is retained until the matter is resolved;
• Technical and device logs: Retained for ninety (90) days for routine security monitoring, extended to twelve (12) months where a security incident or fraud investigation is ongoing;
• Self-exclusion records: Retained for the duration of the self-exclusion period plus five (5) years to prevent re-registration during the exclusion period and to maintain responsible gaming records.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with 366ph's data disposal procedures.

366ph implements a layered set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction:

• Transport encryption: All data transmitted between your device and 366ph servers is encrypted using TLS 1.2 or higher with 256-bit encryption, the same standard applied by major Philippine banks including BPI and BDO;
• Data at rest encryption: Sensitive personal data and financial records stored on 366ph servers are encrypted at rest using AES-256;
• Access controls: Access to personal data is restricted to authorised 366ph personnel on a strict need-to-know basis. Role-based access controls and multi-factor authentication are applied to all administrative systems;
• Account security: Player accounts are protected by password hashing, optional two-factor authentication, session timeout controls, and login activity monitoring;
• Penetration testing and audits: The 366ph Platform undergoes periodic security assessments to identify and remediate vulnerabilities;
• Incident response: 366ph maintains a data breach incident response procedure. Where a breach is assessed as likely to cause harm to affected Players, 366ph will notify the NPC and affected individuals as required by the Data Privacy Act.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 366ph:

All rights requests are handled by the 366ph Data Privacy Officer. 366ph will respond to rights requests within fifteen (15) business days of receipt. Where a request cannot be fulfilled — for example, because the data is subject to a mandatory retention period — 366ph will provide a written explanation of the reason.

If you believe that a minor may have registered an account on the 366ph Platform using false information, please contact 366ph support immediately at [email protected] (plain text — not a clickable link). 366ph treats all reports of underage account use as high-priority matters and will investigate promptly.

366ph processes certain gameplay and financial data as part of its responsible gaming obligations. Specifically:

• Deposit limit and session data: Information about the deposit limits, session timers, and cooling-off periods you set is stored in your account and used to enforce the restrictions you have requested;
• Self-exclusion records: If you self-exclude from the 366ph Platform, your self-exclusion status is retained in our systems for the duration of the exclusion period and for five (5) years thereafter to prevent re-registration;
• Responsible gaming monitoring: 366ph may analyse your gameplay patterns — including session duration, deposit frequency, and loss patterns — to identify potential signs of problem gambling. Where such patterns are identified, 366ph may contact you to offer responsible gaming resources or to initiate a cooling-off period. This processing is conducted on the basis of 366ph's legitimate interest in promoting player welfare and its regulatory obligations.

Responsible gaming data is not used for marketing purposes and is not shared with third parties except where required for regulatory compliance. For more information on responsible gaming tools and resources, visit our Responsible Gaming page.

366ph reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Material changes to this Policy will be communicated to registered Players by email to the address associated with their account, or by a prominent notice on the 366ph Platform, no less than seven (7) days before the changes take effect.

The current version of this Privacy Policy, together with its effective date and last updated date, is always accessible at 366ph.app/privacy-policy. Your continued use of the 366ph Platform following the effective date of any amendment constitutes your acceptance of the updated Policy. If you do not accept the amended Policy, you should cease using the Platform and may request account closure in accordance with the Terms and Conditions.

For all privacy-related queries, data rights requests, or to lodge a complaint about 366ph's data processing practices, please contact the 366ph Data Privacy Officer using the following details:

If you are not satisfied with 366ph's response to a privacy complaint, you have the right to lodge a complaint directly with the National Privacy Commission of the Philippines (NPC). The NPC is the independent government body responsible for enforcing the Philippine Data Privacy Act and can be contacted through the NPC's official government channels.

This Privacy Policy was last reviewed by the 366ph Data Privacy Officer and approved for publication on 1 January 2026. Thank you for trusting 366ph with your personal information — we take that responsibility seriously.