366ph Privacy Policy — Your Data, Protected

1 Introduction and Scope

This Privacy Policy ("Policy") describes how 366ph ("the Company," "we," "us," "our") collects, uses, discloses, and protects the personal data of individuals ("Player," "User," "you") who register for and use the 366ph online gaming platform, accessible at 366ph.vip and all associated interfaces.

This Policy is established in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 of the Republic of the Philippines, its implementing rules and regulations, and related issuances of the National Privacy Commission (NPC). Where applicable, this Policy also reflects the obligations of 366ph under the Anti-Money Laundering Act (AMLA) as amended, and applicable PAGCOR regulatory directives governing player data management.

By registering a 366ph account, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. This Policy should be read alongside the 366ph Terms and Conditions and Responsible Gaming Policy, which together govern your relationship with the 366ph platform.

2 Personal Data We Collect

2.1 Registration Data

When you create a 366ph account, we collect the following information necessary to establish and verify your account:

• Full legal name as it appears on your government-issued identification
• Date of birth (for mandatory 21+ age verification)
• Email address
• Philippine mobile phone number
• Chosen username
• Residential address in the Philippines

2.2 Identity Verification (KYC) Data

Before processing your first withdrawal, 366ph is required to verify your identity through a Know Your Customer (KYC) process. During KYC, we collect:

• Government-issued photo ID (PhilSys, DFA Passport, LTO Driver's License, SSS ID, UMID, or PRC ID)
• A selfie photograph holding the submitted ID document
• Proof of payment method ownership (e.g., screenshot of GCash account matching your registered name)
• Additional documentation where required by AMLA compliance obligations

2.3 Transaction and Game Data

366ph automatically records data related to your platform activity, including:

• Deposit amounts, payment methods used, and transaction timestamps
• Withdrawal requests, amounts, and processing records
• Complete game history: stakes, outcomes, game titles, and session durations
• Bonus offers claimed and wagering progress
• Account balance history

2.4 Technical and Device Data

When you access 366ph, our platform automatically collects certain technical information, including:

• IP address and approximate geolocation (country/region)
• Device type, operating system, and browser version
• Session login and logout timestamps
• Platform features accessed and pages visited within 366ph
• Cookie and local storage identifiers (see Section 6)

2.5 Communications Data

When you contact 366ph customer support, we retain records of those communications — including live chat transcripts, email correspondence, and support ticket history — to resolve your inquiry and improve our service quality.

3 How We Use Your Personal Data

366ph uses the personal data it collects for the following specific purposes:

366ph does not use player personal data for automated decision-making that produces legal or similarly significant effects without human review, except where such automated processes are required by law (e.g., AMLC transaction monitoring thresholds).

4 Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, 366ph processes personal data on the following legal bases:

• Contractual necessity: Processing required to fulfill our obligations to you under the 366ph Terms and Conditions — including account management, payment processing, and game provision.
• Legal obligation: Processing required to comply with Philippine laws, including AMLA, PAGCOR regulatory directives, and the Data Privacy Act itself — including KYC, transaction monitoring, and record-keeping obligations.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and platform improvement — where our interests do not override your rights and freedoms as a data subject.
• Consent: Marketing communications and non-essential cookie placement — where you have given explicit, freely-given, specific, and informed consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5 Data Sharing and Disclosure

5.1 Third-Party Service Providers

366ph engages carefully selected third-party service providers who process personal data on our behalf under data processing agreements that require them to protect your data with standards equivalent to those applied by 366ph. These providers include payment processors (GCash, PayMaya, and Philippine bank partners), game software providers, cloud hosting and infrastructure providers, identity verification and KYC service providers, and customer support platform operators.

All third-party processors are contractually bound to use your data solely for the purpose of delivering services to 366ph and are prohibited from using your personal data for their own independent purposes.

5.2 Legal and Regulatory Disclosure

366ph is required by Philippine law to disclose certain player data to regulatory and law enforcement authorities, including: the Anti-Money Laundering Council (AMLC) upon identification of covered or suspicious transactions; PAGCOR as the relevant gaming regulatory authority, upon lawful request; and other competent Philippine government agencies acting under lawful authority.

366ph will not voluntarily disclose player personal data to any authority beyond what is required by applicable Philippine law. Where legally permissible, 366ph will notify you of any such disclosure.

5.3 No Commercial Data Sales

366ph does not sell, rent, lease, or otherwise commercially transfer your personal data to any third party. Your personal data is not used for advertising network profiling or shared with data brokers. This commitment is unconditional and applies regardless of any future changes to 366ph's business structure, subject to Section 5.4.

5.4 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or part of 366ph's business, player personal data may be transferred to the acquiring or successor entity. In such circumstances, 366ph will provide advance notice and the successor entity will be required to honor the commitments in this Privacy Policy with respect to data collected prior to the transaction.

6 Cookies and Tracking Technologies

6.1 What Are Cookies

Cookies are small text files placed on your device when you visit the 366ph website. They enable the platform to recognize your device, remember your preferences, maintain your session after login, and collect analytical data about platform usage. 366ph uses cookies and similar technologies including web beacons and local browser storage.

6.2 Types of Cookies Used by 366ph

• Strictly Necessary Cookies: Required for the 366ph platform to function. These include session management cookies that keep you logged in, security cookies that protect against cross-site request forgery, and load balancing cookies. These cannot be disabled without breaking core functionality.
• Functional Cookies: Enable 366ph to remember your preferences such as language settings, display preferences, and last-visited game categories. Disabling these will not break the platform but may reduce convenience.
• Analytics Cookies: Used to understand how players navigate the 366ph platform in aggregate — which pages are most visited, where players encounter friction, and how game sections perform. Analytics data is processed in anonymized, aggregated form.

6.3 Cookie Management

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the 366ph platform, including logging in and playing games. Instructions for managing cookies are available in the help documentation of all major Philippine-used browsers including Chrome, Safari, Firefox, and the Samsung Internet browser.

7 Data Security Measures

366ph implements and maintains appropriate technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, and destruction. These measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and 366ph servers — visible via the padlock icon in your browser on any 366ph page.
• Encryption of data at rest — sensitive personal data, payment information, and KYC documents stored in 366ph's systems are encrypted using industry-standard algorithms.
• Role-based access controls — 366ph staff access to player data is strictly limited to personnel who require it to perform their job function. All access is logged and audited.
• Two-factor authentication for all 366ph staff who access player data systems, and optionally for players on their own accounts.
• Regular penetration testing and security audits conducted by independent security professionals to identify and remediate vulnerabilities in the 366ph platform.
• Incident response procedures — in the event of a data breach that poses a risk to your rights and freedoms, 366ph will notify the National Privacy Commission and affected players within the timeframe prescribed by the Data Privacy Act.

While 366ph takes data security extremely seriously and implements measures consistent with industry standards, no internet-transmitted data or digital storage system can be guaranteed to be 100% secure. You are encouraged to use a unique password for your 366ph account and to enable two-factor authentication to maximize your account security.

8 Data Retention

366ph retains personal data for as long as it is necessary to fulfill the purpose for which it was collected, subject to the following retention framework:

• Active account data: Retained for the duration of your active 366ph account relationship.
• Transaction records and KYC documents: Retained for a minimum of 5 years from the date of the transaction or account closure, as required by the Philippine Anti-Money Laundering Act and PAGCOR record-keeping obligations.
• Customer support communications: Retained for 3 years from the date of the last communication, to enable resolution of follow-up queries and disputes.
• Game session data: Retained for a minimum of 2 years for dispute resolution and responsible gaming monitoring purposes.
• Marketing consent records: Retained for 3 years from the date of consent or withdrawal of consent, to evidence compliance with consent requirements.

Upon expiry of the applicable retention period, personal data is securely deleted from 366ph's active systems or anonymized such that it can no longer be attributed to an identifiable individual. Anonymized aggregated data may be retained indefinitely for statistical and platform improvement purposes without restriction.

9 Your Data Subject Rights

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 366ph:

To exercise any of these rights, contact the 366ph Data Protection Officer as described in Section 12. 366ph will respond to verified data subject requests within the timeframe prescribed by the Data Privacy Act (generally 15 calendar days for access requests). Some requests may require identity verification before processing.

If you are not satisfied with 366ph's response to a data subject request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines at privacy.gov.ph.

10 Children and Minors

The 366ph platform is strictly intended for adults aged 21 years and above, in accordance with the minimum gambling age established under Philippine gaming regulations administered by PAGCOR. 366ph does not knowingly collect personal data from persons under 21 years of age.

If 366ph becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. Winnings associated with an underage account will be forfeited in accordance with the 366ph Terms and Conditions and applicable Philippine gaming law.

If you are a parent or guardian and believe that your child under 21 years of age has registered or provided personal data to 366ph, please contact us immediately via the contact details in Section 12 so we can take corrective action without delay.

11 Changes to This Privacy Policy

366ph reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, new services, amendments to Philippine data protection law, or PAGCOR regulatory requirements.

Material changes to this Policy — particularly changes that affect how we use your personal data or the rights available to you — will be communicated to you via email to your registered 366ph email address and/or via a prominent notice on the 366ph platform at least 14 days before the changes take effect.

The effective date at the top of this Policy indicates the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the 366ph platform after the effective date of an amended Policy constitutes your acceptance of the changes, to the extent permitted by applicable law.

12 Contact and Data Protection Officer

366ph has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Philippine Data Privacy Act and this Privacy Policy. If you have any questions, concerns, or requests regarding this Policy or the processing of your personal data, you may contact the 366ph DPO through the following channels:

• Email (plain text — not a link): [email protected] — addressed to "Data Protection Officer"
• Live Chat: Available 24/7 via the 366ph platform. Request to speak with the compliance team for DPA-related matters.
• Written correspondence: Address your letter to the Data Protection Officer at 366ph's registered business address.

366ph aims to respond to all data protection inquiries within 5 Philippine business days of receipt. Formal data subject rights requests (access, correction, erasure, portability) will be handled within the timelines prescribed by the National Privacy Commission.

If you are not satisfied with our response, you have the right to escalate your complaint to the National Privacy Commission of the Philippines. Information on filing a complaint is available on the NPC's official website at privacy.gov.ph.