phqueen Privacy Policy

This Privacy Policy ("Policy") is issued by phqueen ("phqueen," "we," "us," "our") and applies to all personal data collected through the phqueen website at phqueen.org, including all games, account management features, customer support interactions, payment processing flows, and promotional communications. This Policy is effective from January 2026 and supersedes all prior versions.

phqueen recognizes that Filipino players entrust us with sensitive personal and financial information. We take that responsibility seriously — not because data privacy compliance is a legal obligation under the Data Privacy Act of 2012 (Republic Act No. 10173, as amended) and the rules issued by the National Privacy Commission (NPC), but because the trust of our players is the foundation of everything phqueen does. This Policy is written in plain, accessible English so every phqueen player can understand exactly how their data is handled.

This Policy should be read alongside phqueen's Terms & Conditions and Responsible Gaming Policy, which are incorporated by reference and form part of your complete agreement with phqueen.

phqueen operates as a Personal Information Controller (PIC) as defined under the Data Privacy Act of 2012. As a PIC, phqueen determines the purposes and means of processing personal data collected through the platform. In certain contexts — for example, where phqueen processes data on behalf of PAGCOR for regulatory reporting — phqueen may also act as a Personal Information Processor (PIP).

This Policy applies to:

• All registered players holding a phqueen account, regardless of their current activity status (active, inactive, or suspended);
• Prospective players who have begun but not completed the phqueen registration process;
• Visitors to phqueen.org who have not registered but whose non-personal browsing data may be collected through cookies and analytics tools;
• Individuals who contact phqueen's customer support team, whether or not they hold an account.

This Policy does not apply to third-party websites or services that may be linked to from phqueen's platform. phqueen is not responsible for the privacy practices of any third-party game providers, payment processors, or external services — players should review the privacy policies of those parties separately.

Under RA 10173, personal data must be processed in accordance with the following principles, all of which phqueen observes:

• Transparency: Data subjects (players) must be informed of the nature, purpose, and extent of data processing — which is the purpose of this Policy.
• Legitimate Purpose: Personal data may only be processed for declared, specified, and legitimate purposes that are compatible with the circumstances under which consent was obtained.
• Proportionality: Processing is limited to what is necessary for the declared purpose. phqueen does not collect data beyond what is required for the operation of the platform and compliance with PAGCOR licensing.

In addition to RA 10173, phqueen's data processing is subject to requirements under the Anti-Money Laundering Act (RA 9160, as amended), PAGCOR's technical and operational licensing standards, and Bangko Sentral ng Pilipinas (BSP) regulations governing Philippine e-money service providers where applicable to payment processing.

phqueen collects personal data through three primary channels: information you provide directly during registration and platform use, information generated automatically by your use of the platform, and information we receive from third-party sources as required for KYC and payment processing. The following table summarizes the categories of data collected:

phqueen uses the personal data it collects for the following declared purposes. We do not use your data for any purpose not listed here without first obtaining your separate, specific consent:

• Account Creation and Management: Creating and maintaining your phqueen player account, authenticating your identity at login, and managing account settings and preferences.
• KYC Identity Verification: Verifying that you meet phqueen's eligibility requirements (21+ age restriction, Philippine residency) as mandated by PAGCOR licensing. KYC verification also satisfies requirements under AMLC regulations for online gaming operators.
• Payment Processing: Processing deposits from and withdrawals to your registered GCash, Maya, or bank account. Financial data is used exclusively for the execution of transactions and is never retained beyond what is necessary for audit and compliance purposes.
• Platform Security and Fraud Prevention: Monitoring account activity for signs of unauthorized access, fraudulent transactions, bonus abuse, money laundering, and other prohibited conduct. Technical data including IP addresses and device fingerprints is used to identify and block suspicious activity.
• Responsible Gaming Compliance: Monitoring gaming activity against responsible gaming limits you have set, enforcing self-exclusion orders (whether self-initiated or received from PAGCOR's national exclusion registry), and providing intervention support where gaming behavior patterns indicate potential harm.
• Legal and Regulatory Compliance: Satisfying reporting obligations to PAGCOR, the AMLC, the NPC, and other Philippine regulatory authorities. Certain data must be retained for legally mandated periods regardless of account closure.
• Customer Support: Using your account information and support history to resolve disputes, answer queries, and improve service quality. Support interactions are logged for quality assurance and compliance purposes.
• Service Communications: Sending you account alerts, security notifications, transaction confirmations, and (where you have opted in) promotional communications about phqueen offers and new games. You may opt out of marketing communications at any time without affecting your account.
• Platform Improvement: Using anonymized and aggregated gaming activity data to improve game selection, platform performance, and user experience. This analysis does not involve individual player profiling for marketing purposes.

Under RA 10173, personal data may only be processed where at least one of the following legal bases applies. phqueen processes player data under the following bases:

• Consent: You provided consent to data processing at the time of account registration by accepting these Terms and Conditions and this Privacy Policy. You may withdraw consent at any time, subject to the limitations described in Section 10. Note that withdrawal of consent for processing necessary for account operation will require account closure.
• Contractual Necessity: Processing is necessary for the performance of the contract between you and phqueen (your account and the associated Terms & Conditions). This covers account management, payment processing, and game provision.
• Legal Obligation: Processing is necessary for phqueen's compliance with legal obligations under Philippine law, including PAGCOR licensing requirements, the Anti-Money Laundering Act, and the Data Privacy Act itself.
• Legitimate Interest: Processing is necessary for phqueen's legitimate interests in platform security, fraud prevention, and responsible gaming monitoring — provided those interests are not overridden by your privacy rights. phqueen conducts legitimate interest assessments for all processing under this basis.

phqueen may share personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• PAGCOR: phqueen is required by its PAGCOR license to provide player data, transaction records, and gaming activity reports to PAGCOR as part of ongoing regulatory oversight and compliance monitoring. This disclosure is mandatory and not subject to player opt-out.
• Anti-Money Laundering Council (AMLC): Under the Anti-Money Laundering Act, phqueen is required to file Suspicious Transaction Reports (STRs) and Covered Transaction Reports (CTRs) with the AMLC. These reports include personal data about the transactions and account holders involved.
• Payment Service Providers: GCash, Maya, BPI, BDO, Metrobank, GrabPay, and card network processors receive the minimum personal data necessary to authenticate and execute your deposit and withdrawal transactions. All payment processors are required to comply with applicable data protection standards.
• Game Software Licensors: Third-party game providers (such as JILI, Pragmatic Play, and PG Soft) may receive anonymized or pseudonymized session data necessary for game delivery and RNG auditing. These providers do not receive your name, government ID, or payment details.
• KYC/Identity Verification Providers: phqueen uses accredited KYC service providers to assist with document verification and biometric checks. These providers process identity documents and biometric data under strict confidentiality and data processing agreements.
• National Privacy Commission (NPC): In the event of a personal data breach, phqueen is required to notify the NPC within seventy-two (72) hours of discovery, as mandated by RA 10173 and NPC Circular 16-03.
• Law Enforcement: phqueen may disclose personal data to the Philippine National Police (PNP), National Bureau of Investigation (NBI), or other law enforcement agencies where required by a valid court order, warrant, or other lawful mandate.

phqueen does not transfer personal data to any party in a foreign jurisdiction except where necessary for payment processing (e.g., international card networks) or where game software infrastructure requires it. Any such transfers are governed by data processing agreements that require the receiving party to maintain data protection standards at least equivalent to those required under Philippine law.

phqueen uses cookies and similar tracking technologies on phqueen.org for the following purposes:

• Strictly Necessary Cookies: Required for the platform to function — including session authentication cookies that keep you logged in, security tokens that protect against CSRF attacks, and cookies that store your responsible gaming preferences. These cookies cannot be disabled without breaking platform functionality.
• Performance Cookies: Used to collect anonymized data about how players use the phqueen platform — which games are most played, where navigation difficulties occur, and how quickly pages load. This data is used exclusively to improve platform performance and user experience.
• Functional Cookies: Cookies that remember your preferences — such as your preferred game lobby layout, notification settings, and language preferences — to improve your experience on return visits.

phqueen does not use third-party advertising cookies or tracking pixels for behavioral advertising purposes. You will not see phqueen advertisements following you around the internet based on your phqueen gaming behavior.

You may manage cookie preferences through your browser settings. Blocking strictly necessary cookies may affect the functionality of the phqueen platform. Blocking performance and functional cookies will not affect your ability to access games or manage your account.

phqueen retains personal data for the minimum period necessary to fulfill the purpose for which it was collected, unless a longer retention period is required by law. The following retention periods apply:

• Active Account Data: Retained for the duration of your phqueen account and for five (5) years following account closure — as required by PAGCOR licensing standards and AMLC record-keeping obligations.
• KYC Documents and Identity Data: Retained for five (5) years from the date of account closure. This period is mandated by AMLC regulations for online gaming operators and cannot be shortened.
• Financial Transaction Records: Retained for ten (10) years from the date of each transaction, in compliance with the Anti-Money Laundering Act's record-keeping requirements.
• Customer Support Communications: Retained for three (3) years from the date of the interaction, for dispute resolution and quality assurance purposes.
• Marketing Communications Data: Where you have opted in to receive promotional communications, your contact details for this purpose are retained until you opt out. Opt-out records are retained indefinitely to ensure we do not accidentally re-subscribe you.
• Technical Logs and IP Data: Retained for twelve (12) months from collection, except where specific log entries are required for ongoing security investigations or legal proceedings.

phqueen implements technical and organizational security measures designed to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and phqueen's servers is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to login credentials, payment information, KYC documents, and all other data exchanges.
• Encryption at Rest: Sensitive personal information including government ID data, financial account details, and biometric data is encrypted at rest using AES-256 encryption within phqueen's data storage systems.
• Access Controls: Access to personal data is restricted to phqueen employees and contractors who require it for their specific role. All access is logged, and access privileges are reviewed quarterly. No employee has unrestricted access to the full player dataset.
• Two-Factor Authentication for Staff: All phqueen staff members with access to player data systems are required to use two-factor authentication. Privileged access accounts are subject to additional authentication controls.
• Penetration Testing: phqueen's technical infrastructure undergoes regular third-party penetration testing and vulnerability assessments. Critical findings are remediated within defined SLA timelines.
• Data Breach Response: phqueen maintains a documented data breach response plan. In the event of a breach affecting your personal data, phqueen will notify the NPC within 72 hours and notify affected players as required by RA 10173.

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phqueen. These rights may be exercised by contacting phqueen's Data Protection Officer as described in Section 14:

• Right to Be Informed: The right to be notified of the nature and extent of data processing before your data is collected — fulfilled through this Privacy Policy, which is provided to you before or at the time of registration.
• Right of Access: The right to request a copy of all personal data phqueen holds about you, along with information about how it is being used and with whom it has been shared. phqueen will respond to access requests within fifteen (15) business days.
• Right to Rectification: The right to request correction of any inaccurate or incomplete personal data phqueen holds about you. Some data fields can be updated directly in your phqueen account settings; others require submission to our DPO.
• Right to Erasure ("Right to be Forgotten"): The right to request deletion of your personal data, subject to phqueen's legal obligations to retain certain data under PAGCOR licensing, AML laws, and other applicable regulations. Data subject to mandatory retention periods cannot be deleted before those periods expire.
• Right to Object: The right to object to the processing of your personal data, particularly for direct marketing purposes. Objections to marketing are processed immediately. Objections to processing for contractual or legal compliance purposes may result in account closure.
• Right to Data Portability: The right to receive a structured, machine-readable copy of the personal data you have provided to phqueen, for transfer to another service provider.
• Right to File a Complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe phqueen has violated your rights under RA 10173. Contact details for the NPC are publicly available on their official website.

If you are a parent or guardian and believe that a person under your care has registered an account on phqueen, please contact our Data Protection Officer immediately at [email protected] with "MINOR ACCOUNT" in the subject line. phqueen will investigate and take appropriate action within 24 hours of receiving the report.

phqueen does not use personal data collected from the registration process to identify or target potential players below the age of 21 for any marketing or re-engagement communications.

phqueen's primary data processing infrastructure is located in the Philippines. In certain limited circumstances, personal data may be transferred to or processed by systems located outside the Philippines — specifically in connection with:

• International payment card network processing (Visa, Mastercard) — which may involve processing nodes in other Asia-Pacific or global locations;
• Game software delivery through Content Delivery Networks (CDNs) that may have edge nodes outside the Philippines;
• Cloud infrastructure services where global data center redundancy is required for platform availability.

All international data transfers conducted by phqueen are governed by data processing agreements that require the receiving party to maintain data protection standards at least equivalent to those required under RA 10173 and NPC regulations. Where the destination country does not have an adequate data protection framework as recognized by the NPC, phqueen applies contractual safeguards to ensure equivalent protection is provided.

phqueen does not transfer your KYC identity documents, government ID numbers, or sensitive personal information to any foreign jurisdiction except as strictly necessary for the purposes described above and subject to the safeguards outlined herein.

phqueen may update this Privacy Policy from time to time to reflect changes in data processing practices, regulatory requirements, or platform features. When material changes are made, phqueen will:

• Publish the updated Policy on this page with a revised "Last Updated" date;
• Send a notification to all registered players via their registered mobile number or in-platform notification system at least fourteen (14) days before the changes take effect;
• Where required by NPC guidelines or where changes affect the basis on which consent was originally obtained, seek fresh consent from affected players.

Your continued use of the phqueen platform after the effective date of any amended Policy constitutes your acknowledgment of the changes. If you do not agree with the amended Policy, you should cease using phqueen and contact our DPO to close your account and arrange deletion of your data subject to applicable retention requirements.

phqueen has appointed a Data Protection Officer (DPO) as required under RA 10173 for personal information controllers handling sensitive personal information. The DPO is responsible for overseeing phqueen's compliance with the Data Privacy Act, handling data subject rights requests, managing data breach notifications, and liaising with the NPC.