Privacy Policy

1. Introduction

phmystic ("phmystic," "we," "us," or "our") is committed to protecting the privacy and personal data of every individual who visits, registers with, or uses the phmystic online gaming platform at phmystic.one (the "Platform"). This Privacy Policy ("Policy") describes our practices regarding the collection, use, storage, disclosure, and protection of your personal information.

This Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC) of the Philippines. It applies to all personal data processed by phmystic in connection with your use of the Platform, regardless of whether you are a registered Member or a visitor.

By accessing the Platform or creating a phmystic account, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, please discontinue use of the Platform.

2. Data Controller

For the purposes of the Data Privacy Act of 2012, phmystic acts as the Personal Information Controller in respect of the personal data it collects and processes through the Platform. This means phmystic determines the purposes and means of processing your personal information.

Where phmystic engages third-party service providers to process personal data on its behalf (for example, payment processors or identity verification providers), those parties act as Personal Information Processors and are contractually bound to process data only in accordance with phmystic's instructions and applicable Philippine data protection law.

If you have any questions or concerns about how phmystic handles your personal data, you may contact our Data Protection Officer (DPO) using the contact details provided in Section 14 of this Policy.

3. Personal Data We Collect

phmystic collects personal data from you in the following categories, depending on how you interact with the Platform:

phmystic does not intentionally collect sensitive personal information (as defined under the Data Privacy Act) unless strictly required for regulatory compliance purposes, such as anti-money laundering verification. Where sensitive data is collected, we apply heightened security and access controls.

4. How We Use Your Personal Data

phmystic uses the personal data we collect for the following purposes:

1. Account Management: To create, maintain, and administer your phmystic account, verify your identity, and process your phmystic login credentials securely.
2. Service Delivery: To provide access to games, process deposits and withdrawals in Philippine Peso (PHP), and deliver the core features of the Platform.
3. Regulatory Compliance: To fulfill our obligations under Philippine law, including KYC verification under AMLA, age verification (21+ requirement), and reporting obligations to PAGCOR and other relevant authorities.
4. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, unauthorized account access, and other illegal conduct on the Platform.
5. Responsible Gaming: To monitor gaming behavior and identify patterns that may indicate problem gambling, and to administer self-exclusion, deposit limits, and other responsible gaming tools.
6. Customer Support: To respond to your inquiries, resolve disputes, and provide technical assistance.
7. Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have provided your consent to receive such communications.
8. Platform Improvement: To analyze usage patterns, conduct research, and improve the performance, security, and user experience of the Platform.
9. Legal Claims: To establish, exercise, or defend legal claims in connection with the Platform or your account.

phmystic will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your consent or establishing another lawful basis for processing.

5. Legal Basis for Processing

Under the Data Privacy Act of 2012, phmystic processes your personal data on the following legal bases:

• Contractual Necessity: Processing is necessary to perform our contract with you — specifically, to operate your phmystic account and deliver the services you have requested.
• Legal Obligation: Processing is required to comply with applicable Philippine laws and regulations, including AMLA, PAGCOR licensing requirements, and NPC directives.
• Legitimate Interests: Processing is necessary for phmystic's legitimate interests, including fraud prevention, platform security, and responsible gaming monitoring, provided these interests are not overridden by your rights and freedoms.
• Consent: For marketing communications and certain non-essential cookies, processing is based on your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

6. Data Sharing and Disclosure

phmystic does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis:

• Payment Processors: GCash, Maya, and Philippine banking partners require certain financial and identity data to process your transactions securely.
• Identity Verification Providers: Third-party KYC and AML screening services used to verify your identity and comply with Philippine regulatory requirements.
• Game Software Providers: Licensed game developers whose titles are hosted on the phmystic Platform may receive anonymized or pseudonymized usage data for game performance purposes.
• Regulatory Authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other Philippine government bodies where disclosure is required by law or court order.
• IT and Security Service Providers: Cloud hosting, cybersecurity, and platform infrastructure partners who process data solely on phmystic's instructions under strict data processing agreements.
• Professional Advisers: Lawyers, auditors, and accountants where necessary for legal compliance, dispute resolution, or financial reporting purposes.

All third-party processors engaged by phmystic are contractually required to implement appropriate technical and organizational security measures and to process personal data only in accordance with phmystic's documented instructions and applicable Philippine data protection law.

7. Cookies and Tracking Technologies

phmystic uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit the Platform. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in to your phmystic account. These cannot be disabled without affecting core functionality.
• Functional Cookies: Remember your preferences such as language settings, display options, and responsible gaming tool configurations.
• Analytics Cookies: Collect anonymized data about how Members use the Platform — which games are most popular, how long sessions last, and where users encounter issues. This data helps us improve phmystic.
• Marketing Cookies: Used only where you have consented, to deliver relevant promotional content about phmystic offers. These are never used to track your activity on third-party websites.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the Platform. For detailed instructions on managing cookies in your specific browser, refer to your browser's help documentation.

8. Data Retention

phmystic retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law. Our general retention periods are as follows:

• Account and Identity Data: Retained for the duration of your phmystic membership and for a minimum of five (5) years following account closure, in compliance with AMLA record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, as required under Philippine anti-money laundering regulations.
• KYC Documentation: Retained for the period required by PAGCOR licensing conditions and AMLA, typically five (5) years from the end of the business relationship.
• Support Communications: Retained for three (3) years from the date of the last interaction, to support dispute resolution and service improvement.
• Technical and Usage Logs: Retained for up to twelve (12) months for security monitoring and platform analytics purposes.
• Marketing Consent Records: Retained for the duration of your membership and for three (3) years following account closure, to demonstrate compliance with consent requirements.

When personal data is no longer required, phmystic will securely delete or anonymize it in accordance with our internal data disposal procedures.

9. Data Security

phmystic implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the phmystic Platform.
• Encryption of sensitive data at rest, including financial information and identity documents.
• Role-based access controls ensuring that only authorized phmystic personnel can access personal data, and only to the extent necessary for their specific job function.
• Regular security audits, vulnerability assessments, and penetration testing conducted by independent security specialists.
• Multi-factor authentication requirements for administrative access to systems containing personal data.
• Incident response procedures to detect, contain, and notify affected Members and the National Privacy Commission of any personal data breach within the timeframes required by the Data Privacy Act.

While phmystic takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your phmystic login credentials and for notifying us immediately if you suspect unauthorized access to your account.

10. Your Data Privacy Rights

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phmystic:

1. Right to be Informed: The right to know what personal data phmystic collects about you and how it is used — which this Policy fulfills.
2. Right of Access: The right to request a copy of the personal data phmystic holds about you, along with information about how it is processed.
3. Right to Rectification: The right to request correction of any inaccurate or incomplete personal data we hold about you.
4. Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
5. Right to Object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.
6. Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format where technically feasible.
7. Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated.

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 14. phmystic will respond to all verified data subject requests within fifteen (15) business days, as required under the Data Privacy Act.

11. Children's Privacy and Age Restriction

The phmystic Platform is strictly intended for individuals who are 21 years of age or older, in accordance with Philippine gaming regulations. phmystic does not knowingly collect personal data from individuals under the age of 21.

During registration, phmystic requires all applicants to confirm that they meet the minimum age requirement. Age verification is further enforced through our KYC process, which requires submission of a government-issued photo ID confirming date of birth.

If phmystic discovers that personal data has been collected from an individual under the age of 21, we will immediately suspend the associated account, delete the personal data in question, and refund any real-money balance to the payment source, subject to verification. If you believe a minor has registered on the Platform, please contact our support team immediately.

12. Third-Party Links and Services

The phmystic Platform may contain references to third-party services, such as payment gateways (GCash, Maya) that you are redirected to when completing financial transactions. Once you leave the phmystic Platform and access a third-party service, this Privacy Policy no longer applies. phmystic is not responsible for the privacy practices or content of third-party websites or services.

We encourage you to review the privacy policies of any third-party services you use in connection with your phmystic account, particularly your chosen payment provider, before submitting personal data to them.

13. Changes to This Privacy Policy

phmystic reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, or regulatory requirements. When material changes are made, we will notify registered Members via email or in-platform notification at least seven (7) days before the changes take effect.

The "Last updated" date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.

If you disagree with any changes to this Policy, you may request account closure by contacting our support team. We will process your request and handle your remaining personal data in accordance with the version of this Policy in effect at the time of your request.

14. Contact Our Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by phmystic, please contact our Data Protection Officer:

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines (NPC) if you believe your data privacy rights have not been adequately addressed by phmystic.