90ph Privacy Policy

This Policy applies to all personal data collected through your use of the 90ph platform, including account registration, account verification (KYC), deposits and withdrawals via GCash, Maya, BPI, BDO, Metrobank, and other payment channels, game play, customer support interactions, marketing communications, and any other activity conducted through https://90ph.one.

By registering an account with 90ph or by continuing to use the 90ph platform after the effective date of this Policy, you acknowledge that you have read and understood its contents and consent to the collection and processing of your personal data as described herein.

For the purposes of the Philippine Data Privacy Act of 2012, 90ph acts as the Personal Information Controller (PIC) in respect of the personal data of its registered players. This means 90ph determines the purposes for which and the manner in which your personal data is processed.

Third-party service providers engaged by 90ph to process personal data on its behalf (such as payment processors, game providers, and identity verification services) act as Personal Information Processors (PIPs) and are contractually bound to process your data only in accordance with 90ph's instructions and applicable Philippine data protection law.

90ph collects the following categories of personal data, depending on how you interact with the platform:

90ph collects personal data through the following channels and mechanisms:

• Directly from you — when you register an account, submit KYC documents, make a deposit or withdrawal, use live chat support, respond to surveys, or participate in promotions;
• Automatically during platform use — technical data including IP address, device identifiers, session duration, and game activity are recorded automatically via server logs and platform analytics systems each time you access 90ph;
• From payment service providers — when you make a GCash, Maya, BPI, or other payment method transaction, confirmation data including masked account references and transaction IDs are transmitted to 90ph by the payment processor;
• From identity verification services — third-party KYC providers may return verification results including identity match scores and document authenticity assessments based on documents you submit;
• From cookies and similar tracking technologies — as described in Section 7 of this Policy.

Under the Philippine Data Privacy Act, 90ph must have a lawful basis for each processing activity. The following table sets out the primary purposes for which we process your personal data and the corresponding legal basis:

90ph does not sell, rent, or trade your personal data to any third party for commercial marketing purposes. Personal data is shared only in the following circumstances and only to the extent strictly necessary for each purpose:

• Payment Processors: GCash (GXI), Maya (Voyager Innovations), BPI, BDO, Metrobank, and other payment service providers receive transaction-related data necessary to process deposits and withdrawals;
• Game Providers: Provider platforms such as PG Soft, Pragmatic Play, and JILI receive session data (player ID, currency, bet amounts) required to operate game sessions. They do not receive your identity documents or contact details;
• Identity Verification Services: KYC service providers receive identity documents you submit for verification purposes. These providers are bound by confidentiality and data processing agreements;
• Regulatory Authorities: PAGCOR and, where required by law, the Anti-Money Laundering Council (AMLC) or law enforcement agencies may receive data pursuant to lawful requests, court orders, or 90ph's regulatory reporting obligations;
• IT and Security Service Providers: Cloud hosting, cybersecurity, and fraud detection vendors process technical data as part of platform operations under data processing agreements that restrict their use of your data.

The 90ph platform uses cookies and similar technologies (such as local storage and session tokens) to support platform functionality, maintain your login session, and collect aggregate analytics data. The following types of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens and security cookies. They cannot be disabled without impairing your ability to use 90ph.
• Functional Cookies: Store your preferences such as language settings, display preferences, and last-used game categories. These improve your 90ph experience but are not essential.
• Analytics Cookies: Aggregate, anonymized data on how users navigate the platform. Used to identify usability issues and improve the 90ph experience. No personally identifiable information is transmitted to analytics providers.
• Security Cookies: Used for fraud detection, bot prevention, and identifying unusual login patterns. These work alongside 90ph's session security systems.

You can manage cookie preferences through your browser settings. Blocking strictly necessary cookies will affect platform functionality. Analytics and functional cookies can be disabled without preventing access to 90ph.

90ph retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or for as long as required by applicable law and regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized in accordance with 90ph's data destruction procedures. Anonymized data (which cannot be used to identify you) may be retained indefinitely for aggregate statistical analysis.

90ph implements a layered security architecture to protect personal data against unauthorized access, disclosure, alteration, and destruction. Security measures include:

• Encryption in Transit: All data exchanged between your device and 90ph servers is encrypted using 256-bit TLS 1.2 / 1.3;
• Encryption at Rest: Sensitive personal data including KYC documents and financial records are encrypted at rest in 90ph's secure data stores;
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Internal staff access is logged, audited, and subject to role-based permissions;
• Two-Factor Authentication: All player accounts support SMS OTP two-factor authentication. Internal system access by 90ph staff requires multi-factor authentication;
• Penetration Testing: 90ph conducts periodic security assessments and penetration tests of its platform infrastructure;
• Incident Response: 90ph maintains a data breach response protocol. In the event of a breach affecting your personal data, 90ph will notify affected players and the NPC within the timeframes required by the DPA.

Under the Philippine Data Privacy Act of 2012, you have the following rights in respect of your personal data held by 90ph:

To exercise any of the above rights, submit your request in writing to the 90ph Data Protection Officer via the email address listed in Section 2. 90ph will acknowledge your request within 5 business days and provide a substantive response within 15 business days, or notify you if an extension is required.

Identity verification will be required before 90ph acts on any data subject rights request, to ensure requests are fulfilled only for the legitimate account holder.

90ph implements mandatory age verification during the registration process and may require documentary proof of age at any stage of account use. Where 90ph discovers that personal data has been collected from an individual under the age of 21, that data will be immediately deleted and the associated account permanently closed.

If you are a parent or guardian and believe that a person under the age of 21 has registered a 90ph account, please contact our support team immediately via live chat or at [email protected]. 90ph will investigate and close the account within 24 hours of a verified report.

Some of the third-party service providers used by 90ph — including game providers, identity verification platforms, and cloud infrastructure services — may process data on servers located outside the Philippines. Where personal data is transferred outside the Philippines, 90ph ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under the Philippine DPA.

Safeguards for cross-border transfers include:

• Data processing agreements incorporating DPA-equivalent data protection clauses;
• Transfers only to jurisdictions with recognized adequate data protection frameworks;
• Contractual commitments by receiving processors to maintain technical and organizational security measures;
• NPC notification where required by Philippine law for cross-border transfers of sensitive personal information.

90ph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. The current version of this Policy is always available at https://90ph.one/privacy-policy. The "Last Updated" date at the top of this Policy will be revised each time material changes are made.

Where changes are material — meaning they significantly affect how your personal data is processed or your rights thereunder — 90ph will provide advance notice by posting a notice on the platform and, where practicable, by sending notification to your registered email address or mobile number at least 14 days before the changes take effect.

Your continued use of 90ph following the effective date of any amendment constitutes acceptance of the updated Privacy Policy. If you do not accept the amended Policy, you should cease use of the platform and request account closure before the effective date.

For any questions about this Privacy Policy, to exercise your data subject rights, or to report a privacy concern, contact the 90ph Data Protection Officer:

If you are unsatisfied with 90ph's response to a privacy complaint, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which is the independent government body responsible for enforcing the Data Privacy Act.