cashph Privacy Policy

1.1 For the purposes of the Philippine Data Privacy Act of 2012 (R.A. 10173), cashph is the Personal Information Controller (PIC) in respect of the personal data of players and users of the cashph platform.

1.2 cashph operates as an online gaming platform licensed by the Philippine Amusement and Gaming Corporation (PAGCOR) and is subject to the data protection requirements of PAGCOR's licensing conditions in addition to those of the NPC.

1.3 cashph has designated a Data Protection Officer (DPO) responsible for overseeing compliance with R.A. 10173 and this Policy. Contact details for the DPO are provided in Section 16 of this Policy.

2.1 This Policy applies to all personal data collected by cashph from or about:

• Registered players and account holders on the cashph platform;
• Visitors to the cashph website who have not yet registered an account;
• Individuals who contact cashph's customer support team;
• Individuals who participate in cashph promotions, surveys, or communications.

2.2 This Policy does not apply to the data practices of third-party service providers, payment processors, or external websites that may be referenced in communications from cashph. Each such third party operates under its own privacy policy, which you should review independently.

2.3 Where cashph acts as a Personal Information Processor (PIP) — processing data on behalf of another controller — the privacy obligations applicable to that processing are governed by the contract between cashph and the relevant controller, in addition to R.A. 10173.

3.1 cashph collects the following categories of personal data from players and users:

3.2 cashph does not intentionally collect special categories of sensitive personal information (such as data concerning health, religion, or political affiliation) unless specifically required by regulation and with appropriate safeguards. Where a Player voluntarily discloses such information — for example, in the context of a responsible gaming self-exclusion request — cashph will process it solely for the purpose for which it was disclosed.

4.1 cashph collects personal data through the following channels:

• Direct provision: Information you provide when registering an account, completing KYC, making deposits or withdrawals, contacting customer support, or participating in promotions;
• Automated collection: Technical data collected automatically when you access the cashph website or platform, including through cookies, device fingerprinting, and server logs;
• Third-party sources: Identity verification data from KYC service providers; transaction confirmation data from GCash, PayMaya, and Philippine banking partners; fraud signals from anti-fraud and AML screening services;
• PAGCOR and regulatory sources: Data shared by PAGCOR or other competent Philippine authorities as part of licensing or regulatory oversight activities.

5.1 cashph processes personal data on the following legal bases under R.A. 10173:

• Contractual necessity: Processing required to perform the contract between cashph and the Player — including account registration, deposits, withdrawals, and gaming services;
• Legal obligation: Processing required to comply with applicable Philippine law, including PAGCOR licensing requirements, the Anti-Money Laundering Act (R.A. 9160 as amended), and tax obligations;
• Legitimate interests: Processing necessary for cashph's legitimate interests in fraud prevention, platform security, and business analytics, where these interests are not overridden by the Player's rights and freedoms;
• Consent: Processing for direct marketing communications, where cashph has obtained the Player's explicit prior consent. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

6.1 cashph processes personal data for the following specific purposes:

• Registering and maintaining Player accounts on the cashph platform;
• Verifying Player identity and age (minimum 21 years) in compliance with PAGCOR regulations;
• Processing deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and USDT;
• Providing live casino, slots, sports betting, crash game, and bingo services;
• Administering bonuses, promotions, and the cashph VIP loyalty programme;
• Providing 24/7 Filipino-speaking customer support via live chat and email;
• Detecting, investigating, and preventing fraud, money laundering, and other prohibited conduct;
• Complying with AMLA reporting obligations to the Anti-Money Laundering Council (AMLC);
• Monitoring Player activity for responsible gaming purposes, including identifying signs of problem gambling;
• Maintaining the technical operation, security, and improvement of the cashph platform;
• Sending transactional communications (account confirmations, withdrawal notifications, OTPs);
• Sending marketing and promotional communications, where the Player has provided consent;
• Complying with any other applicable Philippine law or regulatory obligation.

7.1 cashph does not sell, rent, or commercially disclose personal data to third parties. Personal data may be shared with the following categories of recipients only to the extent necessary for the stated purpose:

• PAGCOR: As required under cashph's operating licence, including player identity data, activity reports, and compliance information;
• Anti-Money Laundering Council (AMLC): Transaction data and suspicious transaction reports as required under the Anti-Money Laundering Act;
• National Privacy Commission (NPC): Data breach notifications and regulatory submissions as required;
• Philippine law enforcement authorities: Where cashph is required to disclose data pursuant to a court order, subpoena, or lawful request from a competent Philippine authority;
• KYC and identity verification providers: Identity and document data shared for the purpose of mandatory age and identity verification;
• Payment processors: Financial data shared with GCash, PayMaya, BPI, BDO, Metrobank, and USDT service providers for the purpose of processing transactions;
• IT infrastructure and cloud service providers: Technical data processed by hosting and infrastructure providers under binding data processing agreements;
• Game content providers: Aggregated, non-identifiable gaming activity data may be shared with game content licensors for RNG audit and regulatory compliance purposes.

7.2 All third parties engaged by cashph to process personal data are required to comply with R.A. 10173 and cashph's data protection standards under binding contractual agreements.

8.1 The cashph platform is operated primarily within the Philippines. Where personal data is transferred to, processed in, or stored in countries outside the Philippines — for example, in connection with international cloud infrastructure providers or game content licensors headquartered outside the Philippines — cashph ensures that appropriate safeguards are in place.

8.2 Appropriate safeguards for international transfers include:

• Binding contractual clauses approved by or consistent with NPC guidance;
• Transfers to jurisdictions recognised by the NPC as providing adequate data protection;
• Player consent, where required and obtained in compliance with R.A. 10173.

8.3 cashph will not transfer personal data to jurisdictions that do not provide adequate protection for personal data without implementing appropriate safeguards and, where required, obtaining NPC approval.

9.1 cashph retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply as a general guide:

9.2 At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data — which can no longer be linked to an identifiable individual — may be retained indefinitely for statistical and analytical purposes.

10.1 cashph uses cookies and similar tracking technologies (including local storage and device fingerprinting) on the cashph website and platform. These technologies serve the following purposes:

• Strictly necessary cookies: Required for the cashph platform to function — including session management, cashph login authentication, and security. These cookies cannot be disabled without affecting core platform functionality.
• Performance and analytics cookies: Used to measure platform performance, understand how Players use cashph features, and identify areas for improvement. Data collected is aggregated and does not identify individual Players.
• Preference cookies: Used to remember Player settings such as language preference and display options across sessions.
• Security cookies: Used to detect and prevent fraud, identify suspicious login patterns, and protect the security of Player accounts.

10.2 cashph does not use third-party advertising or retargeting cookies. cashph does not share cookie data with advertising networks.

10.3 Players may manage cookie preferences through their browser settings. Note that disabling strictly necessary cookies may impair the functionality of the cashph platform, including the ability to log in or complete transactions.

11.1 As a data subject under the Philippine Data Privacy Act of 2012 (R.A. 10173), you have the following rights in relation to your personal data held by cashph:

11.2 To exercise any of the above rights, contact cashph's Data Protection Officer using the details in Section 16. cashph will acknowledge your request within five (5) business days and respond substantively within fifteen (15) business days of receipt, or within such extended period as may be permitted by the NPC.

11.3 cashph may request proof of identity before processing a data rights request to ensure that personal data is not disclosed to or acted upon at the request of an unauthorised person.

12.1 The cashph platform is strictly prohibited for individuals under the age of 21 years, in accordance with PAGCOR guidelines and Philippine gaming law. cashph does not knowingly collect personal data from individuals under 21 years of age.

12.2 Where cashph becomes aware or reasonably suspects that personal data has been collected from a person under 21 years of age, cashph will take the following immediate steps:

• Suspend the associated account pending age verification;
• Delete or sequester the personal data collected from the individual;
• Report the incident to PAGCOR and, where applicable, to relevant Philippine law enforcement authorities.

12.3 If you believe that cashph has inadvertently collected personal data from a minor, please contact cashph's Data Protection Officer immediately using the contact details in Section 16.

13.1 cashph implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• Encryption: All personal data is transmitted using TLS (Transport Layer Security) encryption. Data stored on cashph's servers is encrypted at rest using AES-256 or equivalent standards.
• Access controls: Access to personal data within cashph is restricted to staff who require it for their role. All data access is logged and subject to regular review.
• Authentication: Two-factor authentication (2FA) is available to all Players and is required for privileged internal access to personal data systems.
• Penetration testing: cashph's systems are subject to regular independent security assessments and penetration testing.
• Staff training: All cashph staff with access to personal data receive mandatory data privacy and security training on joining and annually thereafter.
• Vendor due diligence: Third-party processors and technology vendors are assessed for data security compliance before engagement and on an ongoing basis.

13.2 While cashph implements robust security measures, no online platform can guarantee absolute security against all threats. Players are reminded to maintain the security of their own login credentials and to enable 2FA on their cashph accounts to reduce the risk of unauthorised access.

14.1 In the event of a personal data breach — defined as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data — cashph will:

• Notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, where the breach is likely to result in a risk to the rights and freedoms of affected Players, in accordance with NPC Circular 16-03;
• Notify affected data subjects as soon as reasonably practicable, providing information about the nature of the breach, the data involved, the potential consequences, and the measures taken or proposed to mitigate the effects;
• Document all personal data breaches, including those that are not required to be reported to the NPC, in cashph's internal breach register.

14.2 Where notification to affected individuals could compromise an ongoing law enforcement investigation or would involve disproportionate effort, cashph may delay or substitute individual notification with a public communication, subject to NPC guidance.

15.1 cashph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, NPC guidance, or PAGCOR regulatory requirements.

15.2 Material changes to this Policy will be communicated to registered Players via in-platform notification or email to their registered address at least seven (7) days prior to the effective date of the change, unless an earlier effective date is required by applicable law.

15.3 The date of the most recent update to this Policy is displayed at the top of this page. Continued use of the cashph platform after the effective date of any amended Policy constitutes acceptance of the amended terms. If you do not agree to the amended Policy, you must cease using the cashph platform and may request Account closure in accordance with the cashph Terms & Conditions.

15.4 Previous versions of this Policy are archived by cashph and are available on request from the Data Protection Officer.

16.1 For all data privacy queries, data rights requests, or concerns about cashph's handling of your personal data, please contact the cashph Data Protection Officer through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the cashph platform. Please identify your query as a data privacy matter for routing to the DPO team.
• Email: Copy the support email address from the footer of this page. Please include "Data Privacy Request" in the subject line and your full registered name and account username in the message body.

16.2 cashph will acknowledge all data privacy queries within two (2) Philippine business days and provide a substantive response within fifteen (15) business days, or within such extended period as may be required and communicated to you in advance.

16.3 If you are not satisfied with cashph's response to a data privacy concern, you have the right to escalate the matter to the National Privacy Commission (NPC) of the Philippines, which has jurisdiction over data privacy complaints involving Philippine-domiciled data subjects and personal information controllers.