Privacy Policy

01 Introduction

This Privacy Policy ("Policy") describes how phyaya ("phyaya", "we", "us", or "our") collects, uses, stores, and discloses personal information obtained from users ("you" or "player") of the phyaya online gaming platform, accessible at phyaya.com and through any associated mobile applications or services (collectively, the "Platform").

phyaya operates in the Philippines and serves Filipino players. We are committed to handling your personal data in accordance with applicable Philippine data protection laws, including the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations. This Policy applies to all personal data collected through your use of the phyaya Platform, regardless of how you access it — whether via desktop browser, mobile browser, or any phyaya application.

This Policy should be read alongside phyaya's Terms & Conditions, which govern your use of the Platform. By registering an account or otherwise using the phyaya Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

02 Data Controller

phyaya acts as the data controller in respect of the personal data collected through the Platform. As data controller, phyaya determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable Philippine data protection legislation.

If you have any questions about how phyaya processes your personal data, or if you wish to exercise any of your data subject rights, you may contact our Data Protection Officer using the contact details set out in Section 14 of this Policy.

03 Data We Collect

phyaya collects the following categories of personal data from players:

3.1 Identity & Contact Data

• Full legal name as it appears on your government-issued ID;
• Date of birth (used to verify the 21+ age requirement);
• Nationality and country of residence;
• Email address and mobile phone number;
• Residential address, including barangay, city or municipality, province, and postal code.

3.2 Identity Verification Data

• Copies of government-issued identification documents (e.g., Philippine passport, SSS card, UMID, driver's license, PhilSys national ID);
• Proof of address documents (e.g., utility bills, bank statements);
• Selfie or facial image submitted for identity verification purposes.

3.3 Financial Data

• GCash or PayMaya mobile wallet number;
• Bank account details for BPI, BDO, or Metrobank transactions (account name and number only — phyaya does not store full card numbers or CVV codes);
• Transaction history, including deposit amounts, withdrawal amounts, dates, and payment method used;
• Account balance information.

3.4 Gaming & Activity Data

• Game history, including games played, wagers placed, outcomes, and winnings;
• Bonus and promotion usage history;
• Login timestamps, session durations, and platform activity logs;
• Responsible gaming settings and self-imposed limits.

3.5 Technical Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser type and version;
• Unique device identifiers;
• Cookie identifiers and similar tracking data (see Section 11).

3.6 Communications Data

• Records of your communications with phyaya's customer support team, including live chat transcripts and email correspondence;
• Feedback, complaints, and survey responses submitted to phyaya.

04 How We Collect Data

phyaya collects personal data through the following means:

• Direct collection: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions;
• Automated collection: Technical and activity data collected automatically as you use the Platform, including through cookies, log files, and analytics tools;
• Third-party sources: Identity verification data from KYC service providers; fraud prevention data from anti-fraud partners; payment data from GCash, PayMaya, and banking partners in connection with your transactions.

05 How We Use Your Data

phyaya uses your personal data for the following purposes:

• Account management: To register and maintain your phyaya account, verify your identity, and manage your account settings;
• Age verification: To confirm that you meet the 21+ age requirement mandated by Philippine gaming regulations;
• Transaction processing: To process deposits, withdrawals, and other financial transactions in PHP via GCash, PayMaya, BPI, BDO, and Metrobank;
• Gaming services: To provide access to phyaya's games, track your gaming activity, and calculate and pay out winnings;
• Regulatory compliance: To comply with anti-money laundering obligations, KYC requirements, and other applicable Philippine legal and regulatory requirements;
• Fraud prevention: To detect, investigate, and prevent fraudulent activity, unauthorized account access, and other prohibited conduct;
• Responsible gaming: To monitor gaming activity for signs of problem gambling and to administer responsible gaming tools such as deposit limits and self-exclusion;
• Customer support: To respond to your enquiries, complaints, and support requests;
• Marketing: To send you promotional offers, bonus notifications, and platform updates — where you have consented to receive such communications. You may opt out at any time;
• Platform improvement: To analyse usage patterns and improve the phyaya Platform's features, performance, and user experience.

06 Legal Basis for Processing

phyaya processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform our contract with you — i.e., to provide the phyaya gaming services you have registered for;
• Legal obligation: Processing required to comply with applicable Philippine laws and regulations, including anti-money laundering and KYC obligations;
• Legitimate interests: Processing necessary for phyaya's legitimate interests in fraud prevention, platform security, and service improvement, where such interests are not overridden by your data protection rights;
• Consent: Processing based on your freely given, specific, and informed consent — primarily for direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

07 Sharing Your Data

phyaya does not sell your personal data to third parties. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

7.1 Service Providers

Third-party vendors engaged by phyaya to provide services on our behalf, including KYC and identity verification providers, payment processors (GCash, PayMaya, BPI, BDO, Metrobank), fraud detection services, cloud hosting providers, and customer support platform operators. These providers are contractually bound to process your data only on phyaya's instructions and in accordance with applicable data protection law.

7.2 Regulatory & Law Enforcement Authorities

Philippine government agencies, regulatory bodies, and law enforcement authorities where disclosure is required by law, court order, or regulatory direction — including disclosures required under anti-money laundering regulations.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of phyaya's assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and any material changes to this Privacy Policy that result from it.

08 Data Retention

phyaya retains your personal data for as long as your account remains active and for a period thereafter as required by applicable Philippine law and regulation. Specifically:

• Account and identity data is retained for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements;
• Transaction records are retained for a minimum of five (5) years from the date of the transaction;
• Gaming activity logs are retained for a minimum of three (3) years;
• Customer support communications are retained for two (2) years from the date of the last interaction;
• Marketing consent records are retained for the duration of your account and for one (1) year following account closure or withdrawal of consent.

Where retention beyond these minimum periods is required by a specific legal obligation or ongoing regulatory investigation, phyaya will retain the relevant data for the duration of that obligation or investigation. Upon expiry of the applicable retention period, personal data is securely deleted or anonymised.

09 Data Security

phyaya implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption of data in transit using TLS (Transport Layer Security) protocols;
• Encryption of sensitive data at rest, including identity documents and financial information;
• Role-based access controls limiting employee access to personal data on a need-to-know basis;
• Regular security assessments and penetration testing of the phyaya Platform;
• Multi-factor authentication requirements for administrative access to phyaya systems;
• Incident response procedures for detecting, reporting, and managing personal data breaches.

10 Your Rights

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by phyaya:

• Right to be informed: The right to be told how your personal data is being collected and processed — which this Privacy Policy fulfils;
• Right of access: The right to request a copy of the personal data phyaya holds about you;
• Right to rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to erasure: The right to request deletion of your personal data, subject to phyaya's legal retention obligations;
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or on grounds relating to your particular situation;
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format;
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe phyaya has processed your personal data in violation of the Data Privacy Act.

To exercise any of these rights, please contact phyaya's Data Protection Officer using the contact details in Section 14. phyaya will respond to all verified data subject requests within thirty (30) days. We may need to verify your identity before processing your request.

11 Cookies & Tracking

phyaya uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you visit the phyaya website. We use the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function — including session management, login authentication, and security features. These cannot be disabled;
• Functional cookies: Remember your preferences and settings, such as language and display options, to personalise your phyaya experience;
• Analytics cookies: Collect anonymised data about how players use the Platform — such as pages visited and session duration — to help us improve phyaya's features and performance;
• Marketing cookies: Used to deliver relevant promotional content and measure the effectiveness of phyaya's marketing campaigns. These are only set with your consent.

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the phyaya Platform. For strictly necessary cookies, no consent is required as they are essential to the service you have requested.

12 Minors

13 Changes to This Policy

phyaya may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the phyaya Platform's features. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify registered players via email or an in-platform notification.

Your continued use of the phyaya Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically to stay informed about how phyaya protects your personal data.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or phyaya's handling of your personal data, please contact our Data Protection Officer through any of the following channels:

phyaya aims to respond to all privacy-related enquiries within five (5) business days. If you are not satisfied with phyaya's response, you have the right to escalate your complaint to the National Privacy Commission of the Philippines.