Data Protection
This Privacy Policy explains what personal data phlag collects, how we use and protect it, who we may share it with, and what rights you have as a phlag user under Philippine law. We are committed to handling your information responsibly and transparently.
Your Privacy at a Glance
These highlights summarise phlag's key data protection commitments. The full policy below provides complete legal detail — please read it in full.
All data transmitted between your browser and phlag's servers is protected by 256-bit SSL/TLS encryption — the same standard used by Philippine commercial banks including BPI and BDO. Your credentials, payment details, and personal information are never transmitted in plain text.
phlag processes your personal data in compliance with Republic Act No. 10173, the Data Privacy Act of 2012, and its implementing rules and regulations. Your rights as a data subject under Philippine law are fully recognized and honoured by phlag.
phlag does not sell your personal data to third parties for marketing or commercial profiling purposes. Data sharing is limited strictly to service partners necessary for platform operation and regulatory obligations — never for third-party advertising networks unrelated to phlag.
As a phlag user, you have the right to access, correct, delete, and port your personal data, and to object to certain types of processing. You can exercise these rights at any time by contacting phlag's Data Protection Officer through the support channels listed in this policy.
phlag retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by Philippine law and regulatory obligations. Account data is retained for a minimum of five (5) years following account closure to meet AML and gaming regulatory requirements.
phlag clearly states what data it collects, for what purpose, and on what legal basis. We do not engage in covert data collection, hidden tracking beyond standard platform analytics, or profiling activities not disclosed in this policy. What you see here is what we do.
This Privacy Policy ("Policy") describes how phlag ("we", "us", or "our") collects, uses, discloses, stores, and protects the personal data of individuals who access or use the phlag online casino and sports betting platform available at phlag.club (the "Platform").
phlag is the data controller responsible for your personal data processed in connection with your use of the Platform. phlag operates under applicable Philippine online gaming regulations and processes personal data in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), and related issuances of the National Privacy Commission of the Philippines ("NPC").
This Policy applies to all phlag users, including registered account holders, visitors who browse the Platform without registering, and individuals who interact with phlag's customer support team. By accessing phlag or creating a phlag account, you acknowledge that you have read and understood this Policy.
Note on Language: This Policy is published in English, which is the governing language for all phlag legal documents. In the event of any inconsistency between this English version and any translation, the English version shall prevail.
phlag collects different categories of personal data depending on how you interact with the Platform. The following table sets out the main categories of personal data we process:
| Data Category | Specific Data Types | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, government-issued ID number, nationality, photograph (where KYC requires) | Registration, KYC verification |
| Contact Data | Philippine mobile number, email address, residential address | Registration, account updates |
| Financial Data | GCash wallet number, Maya account, bank account details (BPI, BDO, Metrobank), transaction history, deposit and withdrawal records | Payment processing, KYC |
| Gaming Data | Bet history, game session logs, win/loss records, bonus activity, responsible gaming tool usage | Ongoing platform use |
| Technical Data | IP address, device type, operating system, browser type and version, session timestamps, login history | Every platform session |
| Communications Data | Live chat transcripts, support ticket records, email correspondence content and metadata | Customer support interactions |
| Marketing Preferences | Communication channel preferences, promotional opt-in and opt-out records | Registration, account settings |
phlag does not intentionally collect sensitive personal information (as defined under the DPA, including racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation) except where specifically required for regulatory compliance and with appropriate legal basis.
phlag collects personal data through the following means:
Data you provide directly to phlag when creating an account, completing identity verification, making a deposit or withdrawal, contacting support, responding to surveys, or updating your account settings.
Data collected automatically when you access the Platform, including IP address, device and browser information, session duration, pages visited, and game activity. This is collected through server logs, cookies, and similar technologies described in Section 8.
In limited circumstances, phlag may receive personal data about you from third-party sources, including: (a) identity verification service providers used for KYC; (b) payment processors such as GCash, Maya, and Philippine banking networks to confirm transaction details; and (c) PAGCOR or other Philippine regulatory bodies where information sharing is required by law.
phlag may derive additional information about you from the data we collect — for example, assessing responsible gaming risk indicators from your betting patterns, or determining session frequency from login timestamps. Such inferences are used solely for the purposes described in Section 4 and are not shared commercially.
phlag processes your personal data only for defined, legitimate purposes and on a valid legal basis under the DPA. The following table maps our processing activities to their purpose and legal basis:
Processing necessary to create and manage your phlag account, process deposits and withdrawals, provide access to games, deliver winnings, and operate all platform services you use. Legal basis: performance of a contract to which you are a party (DPA Section 12(b)).
Processing required to comply with Philippine law, including PAGCOR licensing requirements, the Anti-Money Laundering Act (AMLA), age verification obligations, KYC/identity verification, and mandatory gaming regulatory reporting. Legal basis: compliance with a legal obligation (DPA Section 12(c)).
Processing to detect, investigate, and prevent fraudulent transactions, account takeovers, money laundering, bonus abuse, and other prohibited conduct. Legal basis: legitimate interest of phlag in protecting the integrity of the Platform and the interests of its users (DPA Section 12(f)).
Processing of gaming activity data to identify and respond to potential problem gambling indicators, deliver responsible gaming tools, apply account limits, and facilitate self-exclusion requests. Legal basis: legitimate interest in protecting player welfare, and compliance with PAGCOR responsible gaming requirements.
Processing of communications and account data to investigate and resolve support inquiries, disputes, and complaints. Legal basis: performance of contract; legitimate interest in maintaining service quality.
Sending promotional messages about phlag bonuses, new games, events, and offers — only where you have provided explicit consent during registration or have subsequently opted in through account settings. Legal basis: consent (DPA Section 12(a)). You may withdraw marketing consent at any time (see Section 12).
Aggregated and anonymised analysis of usage patterns to improve Platform performance, game selection, payment flow, and user experience. Where data is fully anonymised, DPA obligations do not apply; where pseudonymised data is used, the legal basis is legitimate interest (DPA Section 12(f)).
No Automated Decision-Making with Legal Effect: phlag does not make decisions that produce significant legal or material effects on you (such as permanent account closure or fund forfeiture) based solely on automated processing without human review, except where required by regulatory mandate.
phlag does not sell your personal data. Disclosure to third parties is limited to the following categories of recipients, each engaged under appropriate data processing agreements or legal obligations:
phlag primarily stores and processes personal data within the Philippines. Where operational requirements necessitate transfers of personal data to service providers or game platform infrastructure outside the Philippines, phlag ensures that such transfers are subject to adequate safeguards consistent with the requirements of the DPA and NPC regulations.
Safeguards for international transfers may include: contractual data protection clauses binding the recipient to DPA-equivalent standards; adequacy determinations by the NPC; or other mechanisms approved by the NPC for cross-border data transfers. phlag does not transfer personal data to jurisdictions with materially lower data protection standards without implementing appropriate safeguards.
If you have specific questions about the destinations to which your data may be transferred internationally, or the safeguards in place, please contact phlag's Data Protection Officer using the contact details in Section 15.
phlag retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, unless a longer retention period is required or permitted by applicable Philippine law or regulatory mandate.
Personal data associated with active phlag accounts is retained for the duration of the account relationship and for a minimum of five (5) years following permanent account closure. This retention period is required to comply with PAGCOR licensing conditions, AMLA record-keeping obligations, and applicable Philippine tax laws.
Deposit, withdrawal, and bet transaction records are retained for a minimum of five (5) years from the date of transaction, consistent with AMLA reporting obligations and gaming regulatory requirements.
Customer support correspondence and live chat transcripts are retained for two (2) years following the closure of the relevant support interaction, to enable resolution of any subsequent related disputes and quality assurance purposes.
Where you have consented to receive marketing communications from phlag, your marketing preferences are retained until you withdraw consent or request deletion. Following opt-out, phlag retains a suppression record (your contact detail and the fact of opt-out) indefinitely to prevent inadvertent future marketing contact.
Following the expiry of the applicable retention period, phlag will securely delete or irreversibly anonymise your personal data, subject to any ongoing legal hold requirements.
phlag uses cookies and similar tracking technologies on the Platform to support core functionality, improve your experience, and analyse Platform usage. The following categories of cookies are used:
Managing Cookies: You can control non-essential cookies through your browser settings. Note that disabling certain cookies may affect Platform functionality. phlag does not use third-party advertising network cookies or cross-site tracking cookies for commercial advertising purposes.
phlag implements appropriate technical and organisational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:
While phlag takes its security obligations seriously, no online platform can guarantee absolute security against all possible threats. If you believe your phlag account has been compromised, please contact phlag support immediately.
Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phlag. These rights may be exercised by contacting phlag's Data Protection Officer (see Section 15):
The right to be told what personal data phlag collects about you, how it is used, and who it may be shared with. This Policy fulfils phlag's obligation to inform you of these matters.
The right to request a copy of the personal data phlag holds about you. phlag will respond to access requests within 15 business days of receipt of a valid, verified request.
The right to request correction of inaccurate or incomplete personal data held by phlag. Corrections to your phlag account details can also be made through account settings or by contacting support.
The right to request deletion of your personal data where it is no longer necessary for the purpose collected, consent has been withdrawn, or processing is unlawful — subject to phlag's legal retention obligations under PAGCOR and AMLA requirements.
The right to object to phlag's processing of your personal data on grounds of legitimate interest, including profiling for responsible gaming purposes, where the processing is not strictly necessary for contract performance or legal compliance.
The right to receive a copy of personal data you have provided to phlag in a structured, commonly used, machine-readable format, and to request that it be transmitted to another data controller where technically feasible.
To exercise any of these rights, submit a written request to phlag's Data Protection Officer using the contact details in Section 15. phlag will acknowledge your request within three (3) business days and provide a substantive response within fifteen (15) business days, or notify you of any applicable extension and the reason for it. If you believe phlag has not complied with your data subject rights, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.
phlag does not knowingly collect personal data from or provide services to individuals under the age of 21. phlag's platform is an online gambling service and under Philippine law and PAGCOR regulations, access is strictly restricted to persons who are 21 years of age or older.
🔞 Strict 21+ Requirement: Age verification is conducted during phlag account registration. Any account found to be held by a person under the age of 21 will be closed immediately, and any funds held in the account handled in accordance with phlag's Terms and Conditions and applicable Philippine law. If you have reason to believe a minor has registered a phlag account, please contact phlag's support team immediately at the contact details in Section 15.
If phlag discovers or is informed that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated account, and will comply with all applicable Philippine legal requirements relating to the incident.
phlag sends promotional communications — including bonus offers, new game announcements, event notifications, and other phlag marketing content — only to users who have given explicit consent to receive such communications during registration or through account settings.
Marketing communications from phlag may be sent via SMS to your registered Philippine mobile number, to your registered email address, or as in-platform notifications. You can specify your preferred channels, or opt out of all channels, through your phlag account settings at any time.
You may withdraw consent to receive phlag marketing communications at any time — at no cost and without affecting your ability to use the Platform — by: (a) adjusting your communication preferences in your phlag account settings; or (b) contacting phlag support with an opt-out request. phlag will process opt-out requests within five (5) business days. Note that transactional communications (account activity notifications, security alerts, support responses) are not marketing and will continue regardless of marketing opt-out status.
phlag does not share your contact details with third parties for their own marketing purposes. You will not receive unsolicited marketing from third parties as a result of your phlag account.
In the event of a personal data breach affecting phlag users, phlag will comply with its notification obligations under the DPA and applicable NPC regulations.
Where a personal data breach is reasonably likely to result in serious harm to the rights and freedoms of affected data subjects, phlag will notify the National Privacy Commission of the Philippines within seventy-two (72) hours of becoming aware of the breach, providing the information required by NPC regulations.
Where a personal data breach is likely to result in a high risk to the rights and freedoms of individual phlag users, phlag will notify affected users without undue delay, providing clear information about the nature of the breach, the likely consequences, and the steps phlag has taken or is taking to address it. Notification will be provided through the most appropriate and secure channel available, which may include in-platform notifications, email, or SMS to registered contact details.
phlag maintains a documented data breach response procedure and conducts regular drills to ensure the response team is prepared to act quickly and effectively in the event of a security incident.
phlag reserves the right to update or revise this Privacy Policy at any time to reflect changes in phlag's data processing practices, changes in applicable Philippine law or NPC guidance, or changes in phlag's business operations.
When material changes are made to this Policy, phlag will notify registered users through a prominent notice on the Platform, by notification to your registered mobile number or email address, or by a combination of these methods. The "Effective Date" displayed at the top of this Policy will be updated to reflect the date the revised version takes effect.
Your continued use of the phlag Platform following the effective date of any amendment to this Policy constitutes your acceptance of the revised terms. If you do not agree with the revised Policy, you should discontinue use of the Platform and contact phlag to close your account.
All previous versions of this Policy are archived and available upon written request to phlag's Data Protection Officer.
phlag has appointed a Data Protection Officer ("DPO") responsible for overseeing compliance with the DPA and this Policy. You may contact phlag's DPO or data protection team through the following channels:
Data Protection Officer
Email:
[email protected]
(Subject: Data Privacy Request)
Live Chat:
Available 24/7 directly on the phlag Platform — for urgent data security matters, live chat is the fastest route to our team.
Response Time:
Data subject rights requests acknowledged within 3 business days; substantive response within 15 business days.
If you are not satisfied with phlag's response to a data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). Information on how to file a complaint with the NPC is available through the NPC's official government portal.
This Privacy Policy was last revised on 1 January 2026. It supersedes all prior versions of phlag's privacy notice. The English language version is the governing document.
You've read how phlag protects your personal data. Create your free phlag account — registration takes under two minutes, deposits via GCash are instant, and your information is handled exactly as this Policy describes.
Must be 21 years or older. By registering, you agree to phlag's Terms & Conditions and this Privacy Policy.