ptaya Privacy Policy

Introduction & Scope

This Privacy Policy applies to all personal data collected by ptaya through its website at https://ptaya.net, including all sub-pages and any mobile-optimised versions of the platform. It applies to all registered Players, prospective players who browse the platform without registering, and any individual who contacts ptaya through its support channels.

ptaya is a PAGCOR-regulated online gaming platform serving Filipino players across Manila, Cebu, Davao, Quezon City, Makati, and communities throughout the Philippines. As a licensed operator, ptaya is subject to both PAGCOR's player data protection requirements and the broader framework established by the Data Privacy Act of 2012 and enforced by the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy should be read alongside ptaya's Terms & Conditions, available at ptaya.net/terms-conditions, and the Responsible Gaming Policy at ptaya.net/responsible-gaming, both of which are incorporated by reference.

Data Controller

For the purposes of the Data Privacy Act of 2012 and its Implementing Rules and Regulations, ptaya is the personal information controller responsible for the personal data collected through the platform. ptaya has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Privacy Policy and applicable data protection legislation in the Philippines.

You may contact ptaya's Data Protection Officer directly at [email protected] with the subject line "Data Protection Officer — Privacy Enquiry." The DPO is responsible for handling all data subject rights requests, privacy complaints, and enquiries related to this Privacy Policy.

Personal Data We Collect

ptaya collects the following categories of personal data, strictly limited to what is necessary for the purposes described in this Privacy Policy:

ptaya does not collect sensitive personal information as defined under Section 3(l) of the Data Privacy Act — such as health data, political opinions, or religious beliefs — unless expressly required by PAGCOR's responsible gaming obligations (e.g., voluntary self-exclusion declarations).

How We Collect Your Data

ptaya collects personal data through the following means:

• Direct collection: Information you provide when registering a ptaya account, completing KYC verification, making a deposit or withdrawal via GCash, PayMaya, BPI, BDO, or Metrobank, or contacting customer support.
• Automated collection: Technical data collected automatically when you access the platform, including IP addresses, device identifiers, browser information, and session logs, collected via server logs and standard web analytics.
• Cookies and similar technologies: As described in Section 8 of this Privacy Policy, ptaya uses cookies and similar technologies to maintain session state, prevent fraud, and improve platform performance.
• Third-party sources: Identity and document verification data obtained from KYC service providers as part of the account verification process. Payment verification data obtained from payment processors during deposit and withdrawal transactions.
• PAGCOR-mandated sources: Where required by PAGCOR's player protection framework, ptaya may receive data from PAGCOR's self-exclusion register to ensure that self-excluded individuals cannot access the platform.

Legal Basis for Processing

ptaya processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform the contract between you and ptaya — operating your account, processing deposits and withdrawals, and delivering gaming services.
• Legal obligation: Processing required to comply with Philippine law, including KYC obligations under the Anti-Money Laundering Act (Republic Act No. 9160), PAGCOR licence conditions, and NPC data protection requirements.
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where such processing does not override your fundamental rights and freedoms.
• Consent: For marketing communications and optional personalisation features, ptaya relies on your freely given, specific, informed consent. You may withdraw consent at any time by contacting [email protected] or updating your account preferences after ptaya Login.

How We Use Your Personal Data

ptaya uses the personal data it collects for the following specific purposes:

• Creating and managing your ptaya account, including authentication of your ptaya Login credentials.
• Verifying your identity and age (21+ as required by PAGCOR) through the KYC process.
• Processing deposits and withdrawals via GCash, PayMaya, BPI, BDO, and Metrobank in Philippine Peso (₱).
• Delivering the gaming services you request, including sports betting, live casino, slots, bingo, and sabong products.
• Detecting, preventing, and investigating fraud, money laundering, and other prohibited activities under Philippine law.
• Monitoring gaming activity for responsible gaming purposes and applying player protection measures where required by PAGCOR's framework.
• Providing customer support and resolving disputes related to your account or gameplay.
• Fulfilling reporting obligations to PAGCOR and other Philippine regulatory and law enforcement authorities.
• Sending you service communications — account notifications, security alerts, and policy updates — which are not optional as they are necessary for platform operation.
• Sending you marketing communications about ptaya promotions, if and only if you have provided explicit consent to receive such communications.
• Improving platform performance, user experience, and game offerings through aggregated, anonymised analytics.

Data Sharing & Disclosure

ptaya does not sell, rent, or trade your personal data. We share personal data with third parties only in the following strictly controlled circumstances:

• KYC and identity verification providers: Third-party services engaged to verify the authenticity of identity documents submitted during the KYC process. These providers are contractually bound to process data only on ptaya's instructions and in accordance with Philippine data protection law.
• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, and any other payment service providers necessary to process your deposits and withdrawals. These providers receive only the minimum data required to execute the specific transaction.
• PAGCOR and regulatory authorities: ptaya is legally required to submit player data, transaction reports, and activity records to PAGCOR and, where applicable, to the Anti-Money Laundering Council (AMLC) of the Philippines. Such disclosures are mandatory and not optional.
• Law enforcement and courts: Where required by a valid court order, subpoena, or law enforcement request under Philippine law, ptaya will disclose personal data to the requesting authority.
• Fraud prevention and AML service providers: Specialised providers engaged to assist with fraud detection and anti-money laundering screening, who process data under strict contractual data protection terms.
• Business successors: In the event of a merger, acquisition, or transfer of ptaya's business or assets, personal data held about Players may be transferred to the acquiring entity, subject to the same privacy protections outlined in this Policy. Affected players will be notified in advance.

All third parties with whom ptaya shares personal data are required to maintain adequate data security standards and to use the data solely for the specified purpose. ptaya does not transfer personal data outside the Philippines except where expressly required by the circumstances above and subject to appropriate data transfer safeguards.

Cookies & Tracking Technologies

ptaya uses cookies and similar tracking technologies to operate the platform effectively, maintain your session after ptaya Login, prevent fraud, and understand how players interact with the site. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the platform to function. These include session management cookies that keep you logged in during your visit, security tokens that protect against cross-site request forgery, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences such as language settings and display options, to provide a more personalised experience on return visits.
• Analytics cookies: Collect anonymised, aggregated data about how pages are used — which sections are most visited, how long sessions last, and where players encounter difficulty — to help ptaya improve the platform. No individual player is identified through analytics data.
• Security and fraud prevention cookies: Help ptaya identify suspicious login patterns, detect automated bot activity, and protect the integrity of the platform and player accounts.

ptaya does not use third-party advertising cookies or allow any advertising network to set cookies on the platform. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the platform, including the ptaya Login function.

Data Security

ptaya implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and ptaya's servers.
• Encryption of sensitive data fields — including passwords and financial account details — at rest using industry-standard encryption algorithms.
• Access controls ensuring that ptaya staff can access personal data only on a strict need-to-know basis, with all access logged and audited.
• Regular security assessments, including vulnerability scanning and penetration testing of the platform infrastructure.
• Multi-factor authentication requirements for administrative access to systems holding personal data.
• Secure, geographically redundant data storage with disaster recovery capabilities.
• Staff training on data protection obligations under the Data Privacy Act of 2012 and ptaya's internal security policies.

While ptaya implements all reasonable security measures, no system connected to the internet can be guaranteed to be completely secure. You are responsible for maintaining the confidentiality of your ptaya Login password and for logging out of shared devices after each session. Contact [email protected] immediately if you suspect unauthorised access to your account.

Data Retention

ptaya retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, and in compliance with mandatory retention requirements under Philippine law. The following retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, as required by PAGCOR licence conditions and the Anti-Money Laundering Act.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with AMLC record-keeping requirements.
• Gaming activity records: Retained for the duration of your account and for two (2) years following account closure, or longer where required by PAGCOR regulatory obligations.
• Support communications: Retained for two (2) years from the date of the communication, or longer where the communication relates to an unresolved dispute or regulatory investigation.
• Technical and analytics data: Anonymised or deleted within twelve (12) months of collection where no longer required for platform security purposes.

Upon expiry of the applicable retention period, personal data is securely deleted using methods appropriate to the data's sensitivity, or permanently anonymised so that it can no longer be linked to an individual.

Your Privacy Rights

Under the Data Privacy Act of 2012 (Republic Act No. 10173), Filipino players have the following rights in relation to their personal data held by ptaya:

To exercise any of the above rights, submit a written request to ptaya's Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request." Please include your registered account username and a clear description of the right you wish to exercise. ptaya will acknowledge your request within three (3) business days and aim to fulfil it within fifteen (15) business days, or within the timeframe required by applicable NPC regulations where different.

ptaya may request additional identity verification before processing a data subject rights request, to ensure that personal data is not disclosed to or altered by an unauthorised person.

Please note that certain rights are subject to limitations. For example, the right to erasure does not apply where ptaya is required to retain data to comply with a legal obligation (such as AML record-keeping) or to defend against a legal claim.

Children's Privacy

ptaya's platform is strictly intended for individuals aged 21 years and above, as mandated by PAGCOR for all casino-style gambling activities in the Philippines. ptaya does not knowingly collect personal data from any person under the age of 21.

If ptaya discovers or is notified that personal data belonging to a person under 21 years of age has been collected — whether through a misrepresentation during registration or any other means — ptaya will immediately suspend the associated account and take steps to securely delete the personal data of the underage individual, subject to any mandatory retention obligations under Philippine law.

Parents and guardians who believe that a minor may have registered on the ptaya platform should contact [email protected] immediately. ptaya takes underage gambling prevention seriously and cooperates fully with PAGCOR's minor protection requirements.

Cross-Border Data Transfers

ptaya's primary data processing infrastructure is located within the Philippines. In certain circumstances, personal data may be transferred to or accessed from servers or service providers located outside the Philippines — for example, where a KYC verification provider or fraud prevention service operates internationally.

Any cross-border transfer of personal data is conducted in compliance with Section 21 of the Data Privacy Act of 2012 and applicable NPC guidelines. ptaya ensures that adequate safeguards are in place before transferring personal data internationally, including:

• Contractual clauses that bind overseas recipients to data protection standards equivalent to those required under Philippine law.
• Due diligence assessments of the data protection framework of the recipient country.
• Minimum data transfer principles — only the data strictly necessary for the specific service is transferred.

ptaya will not transfer personal data to any jurisdiction that does not provide an adequate level of data protection without implementing the safeguards described above.

Amendments to This Privacy Policy

ptaya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable Philippine law, or updates to PAGCOR regulatory requirements. The "Last Updated" date at the top of this page will be revised to reflect any changes.

For material changes — those that significantly affect how we collect, use, or share your personal data — ptaya will provide notice to registered players via email or a prominent on-platform notification at least seven (7) days before the changes take effect. For minor clarifications or corrections that do not materially affect your rights, ptaya may update this Privacy Policy without prior notice.

Your continued use of the ptaya platform after the effective date of any amendment to this Privacy Policy constitutes your acknowledgement of the revised Policy. If you do not agree to the amended Privacy Policy, please cease using the platform and contact [email protected] to request account closure.

Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or ptaya's data processing activities, please contact our Data Protection Officer. The DPO is available to assist with all privacy-related enquiries and data subject rights requests.

Data Protection Officer — ptaya
Email: [email protected]
Subject line: Data Protection Officer — Privacy Enquiry

ptaya aims to acknowledge all privacy enquiries within 24 hours and to resolve substantive requests within fifteen (15) business days of receipt, in accordance with NPC guidelines.

If you are not satisfied with ptaya's response to a privacy concern, you have the right to escalate the matter to the National Privacy Commission of the Philippines, which has jurisdiction to investigate complaints against personal information controllers operating within the Philippines.