1. Overview
phmaca is committed to protecting the personal data of every Filipino player who registers, deposits, or interacts with the platform. This Privacy Policy has been prepared in compliance with Republic Act No. 10173, the Philippine Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations, as well as the data handling requirements imposed on PAGCOR-licensed operators.
This policy describes our practices as a data controller – meaning phmaca determines the purposes and means of processing your personal data. Where third-party service providers process data on our behalf, they do so as data processors operating under contractual data protection agreements that require them to handle your information only as phmaca instructs, and never for their own independent purposes.
We believe privacy is a right, not a feature. If you have questions about any part of this policy that are not answered here, please reach out to us at support@phmaca.best before using the platform.
2. Who We Are
phmaca is an online gaming and sports betting platform operating in the Philippines under a valid licence issued by the Philippine Amusement and Gaming Corporation (PAGCOR). The platform is accessible at https://phmaca.best and serves Filipino players aged 18 and above.
As the data controller for information collected through phmaca, we are responsible for ensuring that personal data is processed lawfully, fairly, and transparently. Our Data Protection Officer (DPO) can be reached at the contact details provided in Section 15 of this policy.
3. Data We Collect
phmaca collects the minimum personal data necessary to operate the platform, comply with legal and regulatory requirements, and protect the security of every player. The categories of data we may collect include:
Identity & Contact Data
- Full legal name and date of birth
- Philippine mobile number and email address
- Government-issued ID details (e.g., PhilSys ID, passport, driver's licence, SSS/GSIS card) collected during KYC verification
- Proof of address where required for enhanced verification
- Selfie or liveness image for identity confirmation
Financial & Transaction Data
- GCash or Maya mobile wallet number (partial, for transaction matching)
- Bank account identifiers used for InstaPay, PESONet, or bank transfer transactions
- Visa or Mastercard card details (processed exclusively through PCI-DSS-compliant payment processors; phmaca does not store full card numbers)
- Deposit history, withdrawal history, and transaction reference numbers
Gaming & Betting Activity Data
- Game session records including bets placed, outcomes, and winnings
- PBA betting selections, wager amounts, and settlement records
- Bonus uptake and wagering history
- Responsible gaming limit settings and self-exclusion records
Technical & Device Data
- IP address and approximate geolocation at the time of login or transaction
- Device type, operating system, browser version, and screen resolution
- Session timestamps, login/logout events, and page interaction data
- Cookie identifiers and analytics event data (see Section 8)
Communications Data
- Support chat transcripts and email correspondence with phmaca's customer service team
- Complaint and dispute records
4. How We Collect Your Data
phmaca collects personal data through the following channels:
- Registration: When you create a phmaca account, you directly provide identity and contact details.
- KYC Verification: When you submit identity documents for account verification, phmaca and our authorised verification partners receive and process those documents.
- Deposits and Withdrawals: Payment transactions generate financial data that is recorded in your phmaca account history.
- Platform Use: phmaca automatically collects technical and gaming data while you are logged in and active on the platform.
- Cookies and Tracking Technologies: Our website uses cookies and similar tools as described in Section 8.
- Customer Support: When you contact phmaca for help, any information you share during that interaction is recorded.
- Third-Party Sources: We may receive data from identity verification providers, fraud prevention databases, and payment processors as part of due diligence and compliance processes.
5. Why We Use Your Data
| Purpose | Data Used | Why It Is Necessary |
|---|---|---|
| Account creation and management | Identity, contact | To provide you with a phmaca account and maintain it |
| Identity verification (KYC) | Identity, document images | PAGCOR compliance and anti-money laundering obligations |
| Processing deposits and withdrawals | Financial, transaction | To move PHP funds between your phmaca wallet and payment method |
| Delivering games and betting services | Gaming activity | To operate game sessions and settle bets accurately |
| Fraud prevention and security | Technical, device, financial | To protect players and the platform from fraudulent activity |
| Regulatory reporting to PAGCOR | Identity, financial, gaming | Mandatory PAGCOR licence reporting obligations |
| Responsible gaming monitoring | Gaming activity, limits | To detect and respond to potentially harmful play patterns |
| Customer support | Communications, account | To resolve your queries and complaints |
| Marketing communications (opt-in only) | Contact, gaming activity | To send relevant promotions where you have given consent |
| Platform analytics and improvement | Technical, gaming activity | To improve phmaca's interface and performance |
phmaca does not use your personal data for any purpose beyond what is listed above without first obtaining your explicit consent or being required to do so by law.
6. Legal Basis for Processing
Under the Philippine Data Privacy Act, phmaca processes your personal data on one or more of the following legal bases depending on the specific purpose:
- Consent: For marketing communications and optional analytics cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
- Contractual necessity: For account management, payment processing, and game delivery – processing that is required to deliver the services you signed up for on phmaca.
- Legal obligation: For KYC verification, anti-money laundering records, and PAGCOR regulatory reporting.
- Legitimate interests: For fraud prevention, platform security, and internal analytics where those interests are not overridden by your rights and freedoms.
7. Sharing Your Data
phmaca does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share data only in the following circumstances and with appropriate safeguards in place:
Service Providers
We share data with carefully selected processors who help operate phmaca's services, including payment processors (for GCash, Maya, bank transfer, and card transactions), identity verification providers (for KYC document review and liveness checks), cloud hosting and infrastructure providers, and customer support tooling providers. All processors are required to process data solely on phmaca's instructions and maintain appropriate security standards.
Regulatory and Law Enforcement Authorities
phmaca discloses personal data to PAGCOR as required under our licence conditions. We also respond to lawful requests from Philippine law enforcement agencies, courts, and other government bodies when required by Philippine law. Where possible and legally permissible, phmaca will notify affected players before disclosing their data to authorities.
Anti-Fraud and Credit Reference Services
We may share data with fraud prevention databases and identity verification networks to detect and prevent fraudulent accounts, money laundering, and other illegal activity. A record may be held by these services and used to inform risk assessments by other regulated businesses.
Business Transfers
If phmaca undergoes a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify affected players before their data is transferred and will ensure the receiving entity commits to comparable data protection standards.
We never share your data with advertisers, data brokers, or marketing networks without your explicit opt-in consent. If you have opted in to marketing from phmaca, you can withdraw that consent at any time by contacting support@phmaca.best.
8. Cookies & Tracking Technologies
phmaca uses cookies and similar technologies to operate the platform, enhance your experience, and understand how the site is used. The types of cookies we use are:
- Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that keep you logged in while you navigate phmaca. These cannot be disabled without breaking the platform.
- Functional cookies: Remember your preferences such as language settings and responsible gaming limit configurations. Disabling these may reduce comfort but will not prevent you from using phmaca.
- Analytics cookies: Collect anonymised data about page views, session duration, and feature usage to help phmaca improve the platform. These are only placed with your consent.
- Security cookies: Help detect and prevent fraudulent login attempts, bot activity, and account takeover attempts.
You can manage cookie preferences through your browser settings. Blocking all cookies may prevent certain phmaca features from working correctly. phmaca does not use third-party advertising or retargeting cookies.
9. Data Retention
phmaca retains personal data only for as long as necessary to fulfil the purposes described in this policy, meet legal and regulatory obligations, and resolve any disputes that may arise.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account and identity data | Active account life + 5 years after closure | PAGCOR compliance, AML obligations |
| Transaction records | 7 years from transaction date | Philippine financial record-keeping requirements |
| KYC documents | 5 years after account closure | AML and regulatory audit requirements |
| Game session logs | 3 years from session date | Dispute resolution and regulatory reporting |
| Customer support records | 3 years from last interaction | Complaint resolution and quality assurance |
| Marketing consent records | Until consent is withdrawn + 1 year | Evidence of consent under DPA |
| Security and fraud logs | 5 years from event date | Ongoing fraud investigation capability |
When data is no longer required, phmaca securely deletes or anonymises it so it can no longer be linked to any individual player.
10. Security Measures
phmaca takes the security of your personal data seriously. We have implemented a range of technical and organisational measures appropriate to the risks presented by processing your data in an online gaming environment:
- 256-bit SSL/TLS encryption on all data in transit between your browser or device and phmaca's servers.
- Encrypted storage for sensitive data at rest, including identity documents and financial account references.
- Access controls limiting access to personal data to authorised phmaca personnel on a strict need-to-know basis.
- Two-factor authentication available for player accounts and required for internal administrative systems.
- Continuous security monitoring including intrusion detection, anomaly alerts, and regular penetration testing by independent security firms.
- PCI-DSS-compliant payment processing – phmaca does not store full card numbers and delegates all card transaction processing to certified payment processors.
Despite these measures, no online platform can guarantee absolute security. If you suspect that your phmaca account has been compromised, contact us immediately at support@phmaca.best so we can act promptly to protect your account and data.
Protect yourself too: Never share your phmaca password, OTP codes, or payment PINs with anyone – including anyone who claims to be from phmaca support. Genuine phmaca staff will never ask for your full password or payment credentials.
11. Your Rights Under the DPA
As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phmaca. You may exercise any of these rights by contacting us at support@phmaca.best.
Request a copy of the personal data phmaca holds about you and information about how it is processed.
Request correction of inaccurate or incomplete personal data in your phmaca account.
Request deletion of your personal data where it is no longer necessary for the purposes it was collected, subject to legal retention obligations.
Object to processing based on legitimate interests, including direct marketing. We will stop processing unless compelling grounds override your objection.
Receive your personal data in a commonly used, machine-readable format for transfer to another service where technically feasible.
Withdraw consent for marketing communications or optional analytics at any time without affecting prior processing.
phmaca will respond to rights requests within 15 business days. If we are unable to fulfil a request – for example because retention is required by PAGCOR or AML law – we will explain the reason in writing. If you are not satisfied with our response, you may escalate to the National Privacy Commission (NPC) of the Philippines.
12. Minors
phmaca is strictly intended for adults aged 18 and above. We do not knowingly collect personal data from anyone under 18 years of age. Age is verified during the KYC process using government-issued identity documents.
If phmaca discovers that personal data has been collected from a minor – whether through a false declaration of age or any other means – we will immediately close the associated account, refund any remaining verified balance to the depositing payment method where possible, delete the personal data collected, and report the incident as required under applicable regulations.
If you are a parent or guardian and believe a minor has accessed phmaca using falsified information or your credentials, please contact support@phmaca.best immediately. phmaca will act promptly on all such reports.
13. International Data Transfers
Some of phmaca's service providers operate servers or processing facilities outside the Philippines. Where personal data is transferred internationally, phmaca ensures that appropriate safeguards are in place, including:
- Contractual data processing agreements incorporating standard data protection clauses aligned with Philippine DPA requirements.
- Transfers only to jurisdictions or processors that maintain data protection standards comparable to those required under Philippine law.
- Data minimisation – only the personal data strictly necessary for the relevant service is transferred internationally.
You may request details of the specific safeguards in place for international transfers by contacting our Data Protection Officer at support@phmaca.best.
14. Changes to This Privacy Policy
phmaca may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or platform functionality. When we make material changes, we will publish the updated policy on this page and notify registered players via in-platform notification or email where appropriate.
The effective date at the top of this policy will always reflect when the most recent version was published. We encourage you to review this policy periodically. Continued use of phmaca after a published update constitutes acceptance of the revised Privacy Policy. If you disagree with any changes, you may close your account and request deletion of your data subject to the retention obligations described in Section 9.
15. Contact Us & Data Protection Officer
If you have questions, concerns, or requests related to this Privacy Policy or phmaca's data practices, please contact our Data Protection Officer:
Email: support@phmaca.best
Subject line for data requests: "Data Privacy Request – [Your Name]"
Response time: Within 15 business days for formal data rights requests; typically within 24 hours for general privacy inquiries via live chat
Available: 24/7 via phmaca live chat, Monday–Friday 9:00 AM–6:00 PM PHT for formal written responses
If you are not satisfied with phmaca's response to a privacy concern, you have the right to file a complaint with the National Privacy Commission of the Philippines (NPC) through their official complaint channels.
