richph Privacy Policy

richph takes privacy seriously. We understand that when Filipino players register on our platform — sharing their name, contact details, financial information, and gaming activity — they are trusting us with sensitive personal data. That trust is not something we take lightly.

This Policy is written to be readable, not just legally defensible. We want every richph player — whether you're in Makati, Cebu City, Davao, or anywhere else in the Philippines — to clearly understand what happens to your information when you use our platform. Plain language matters, and where legal terminology is unavoidable, we explain it.

This Policy covers:

• What personal data richph collects from you;
• Why we collect it and what we use it for;
• Who we share it with and under what conditions;
• How we protect it from unauthorized access or misuse;
• How long we keep it;
• Your rights as a data subject under Philippine law; and
• How to contact richph's Data Protection Officer (DPO) if you have concerns.

For the purposes of the Data Privacy Act of 2012 and this Policy, the data controller responsible for personal data collected through the richph Platform is:

richph has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and Philippine data protection law. Contact details for the DPO are provided in Section 15.

richph collects only the personal data that is necessary for the purposes described in this Policy. The categories of personal data we collect are set out in the table below:

richph collects personal data through the following channels:

4.1 Directly From You

The majority of your personal data is provided directly by you when you: register an account on richph.win; complete KYC verification; make a deposit or withdrawal through our cashier; update your account profile; contact our customer support team; or respond to promotions, surveys, or competitions.

4.2 Automatically Through Technology

When you access the richph Platform, we automatically collect technical data about your device and session — including your IP address, browser type, operating system, pages visited, session start and end times, and referring URL. This data is collected through server logs, cookies, and similar tracking technologies as described in Section 10.

4.3 From Third Parties

richph may receive personal data from the following third-party sources:

• Payment Processors: GCash, Maya, BPI, BDO, and other payment providers share transaction confirmation data with richph to credit accounts and process withdrawals.
• Identity Verification Providers: Third-party KYC verification services may confirm identity document authenticity and perform biometric liveness checks.
• Fraud Prevention Partners: Anti-fraud and sanctions screening services may provide risk signals associated with IP addresses, devices, or financial instruments.
• Regulatory Authorities: PAGCOR and other competent authorities may share information relevant to compliance investigations.

richph processes your personal data only for the legitimate and specified purposes described in this section. We do not use your data for purposes incompatible with those originally stated without obtaining fresh consent or identifying a new lawful basis.

Under the Data Privacy Act of 2012, richph processes your personal data on one or more of the following lawful bases:

• Consent: Where you have given clear, specific, freely given, and informed consent — for example, when you register an account or opt in to marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Contract Performance: Processing necessary to fulfill our obligations to you under the richph Terms and Conditions — including operating your account, processing transactions, and delivering gaming services.
• Legal Obligation: Processing required to comply with applicable Philippine law, including AMLA obligations (Republic Act No. 9160, as amended), PAGCOR regulatory requirements, and NPC data governance rules.
• Legitimate Interests: Processing necessary for richph's legitimate business interests, including fraud prevention, platform security, and service improvement — where those interests are not overridden by your fundamental rights and freedoms.

richph does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. We may share your personal data only in the following circumstances and with the following categories of recipients:

7.1 Service Providers (Data Processors)

richph engages third-party service providers who process personal data on our behalf under strict contractual obligations. These include payment processors (GCash, Maya, BPI, BDO), identity verification providers, cloud hosting and infrastructure providers, email delivery services, and customer support platform vendors. All processors are required to maintain appropriate security measures and to process data only on richph's documented instructions.

7.2 Regulatory and Law Enforcement Authorities

richph may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, the Bureau of Internal Revenue (BIR), and other competent Philippine authorities where disclosure is required by law, court order, or regulatory obligation. richph will notify affected users of such disclosures where legally permissible to do so.

7.3 Business Transfers

In the event of a merger, acquisition, asset sale, or corporate restructuring affecting richph, personal data held by richph may be transferred to the successor entity as part of that transaction, subject to equivalent data protection obligations being maintained.

7.4 With Your Consent

richph may share personal data with third parties not described above where you have given explicit consent for a specific sharing purpose. Any such consent will be sought separately and specifically.

richph retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The principal retention periods applied by richph are as follows:

After the applicable retention period expires, personal data is securely deleted or anonymized in accordance with richph's data disposal procedures. Anonymized, aggregated data may be retained indefinitely for statistical and analytical purposes.

richph implements appropriate technical and organizational security measures to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction. Our security infrastructure includes:

• Encryption in Transit: All data transmitted between your device and richph.win is encrypted using TLS 1.2 / 1.3 protocols with 256-bit SSL certificates. Look for the padlock in your browser's address bar.
• Encryption at Rest: Sensitive personal data — including KYC documents and financial account details — is encrypted at rest using AES-256 or equivalent encryption standards within richph's secure cloud infrastructure.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. richph staff who require access to player data undergo background checks and operate under confidentiality obligations.
• Two-Factor Authentication: richph offers 2FA to all registered users and requires it for high-value account actions. Internal system access by richph staff requires multi-factor authentication.
• Security Audits: richph's platform undergoes periodic security assessments, including penetration testing and vulnerability scanning, conducted by qualified third-party security professionals.
• Incident Response: richph maintains a documented personal data breach response procedure. In the event of a reportable breach, richph will notify the National Privacy Commission and affected data subjects within the timeframes prescribed by the DPA.

While richph employs robust security measures, no internet-based system is completely immune to risk. You are encouraged to maintain a strong password, enable 2FA, and log out from shared devices after each session to protect your own account security.

richph uses cookies and similar technologies on the richph.win Platform. Cookies are small text files placed on your device that help the Platform function correctly and allow richph to understand how players use the service.

10.1 Types of Cookies Used

10.2 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of some Platform features. richph does not use third-party advertising cookies or share cookie data with ad networks.

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights in relation to your personal data held by richph. richph will respond to all verified rights requests within twenty (20) business days of receipt.

richph's Platform is strictly for adults aged 21 years and above. richph does not knowingly collect personal data from individuals under 21 years of age. Age is verified through the KYC process as a mandatory condition of account activation.

Where richph becomes aware that personal data has been collected from a person under the age of 21 — whether through the KYC verification process, self-reporting, or third-party information — richph will:

• Immediately suspend the account;
• Refund any real money balance to the payment method used for deposit, subject to verification;
• Permanently delete all personal data associated with the underage account upon confirmation of age; and
• Report the matter to PAGCOR as required by regulatory obligations.

Parents and guardians who are concerned that a minor may have accessed richph should contact our support team immediately at [email protected].

richph's primary data processing activities take place in the Philippines. However, some of our service providers — including cloud infrastructure operators and certain KYC verification partners — may process data in other jurisdictions.

Where personal data is transferred outside the Philippines, richph ensures that appropriate safeguards are in place in accordance with NPC rules on cross-border data flow, including:

• Contractual clauses requiring the recipient to apply data protection standards at least equivalent to those under the Philippine DPA;
• Transfers to jurisdictions recognized by the NPC as providing adequate data protection; or
• Other mechanisms approved by the NPC from time to time.

richph will not transfer personal data to jurisdictions that do not offer adequate protections without your explicit prior consent, except where such transfer is required by Philippine law.

richph may update or revise this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or platform features. The date of the most recent revision will always be displayed at the top of this page.

Where changes to this Policy are material — particularly those that affect how your data is used or shared — richph will provide notice through the Platform and, where appropriate, by email to your registered address. Your continued use of the richph Platform after the effective date of any revised Policy constitutes acceptance of the changes.

We encourage you to review this Policy periodically. If you have concerns about any proposed changes, please contact our DPO using the details in Section 15 before the changes take effect.

If you wish to exercise any of your data subject rights, submit a privacy-related complaint, or simply ask a question about how richph handles your personal data, please contact us through the following channels:

richph will acknowledge all formal privacy requests within five (5) business days and aim to resolve them within twenty (20) business days. Complex requests may require additional time, in which case richph will inform you of the expected timeframe.