345ph Privacy Policy

1 Scope and Data Controller Identity

This Privacy Policy applies to all personal data processed by 345ph ("we", "us", "our") in connection with your use of the 345ph Platform accessible at https://345ph.org and all related sub-domains and services (collectively, the "345ph Platform").

345ph acts as the Personal Information Controller (PIC) as defined under Republic Act No. 10173 (the "Data Privacy Act of 2012" or "DPA") with respect to personal data collected from players, visitors, and account holders of the 345ph Platform. As a PIC, 345ph determines the purposes for which and the means by which personal data is processed.

By registering an account or using the 345ph Platform in any capacity, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein.

2 Categories of Personal Data We Collect

345ph collects personal data in two ways: (a) data you provide directly to us when registering, transacting, or communicating with us; and (b) data generated automatically when you use the Platform. The specific categories are set out in the table below.

We do not intentionally collect sensitive personal information as defined under the DPA (such as health data, political affiliation, religious beliefs, or biometric data) unless specifically required for identity verification purposes and with your explicit consent.

3 Purpose and Legal Basis for Processing

345ph processes your personal data only where a valid legal basis exists under the DPA. The primary purposes and corresponding legal bases are as follows:

• Account registration and management — Processing is necessary for the performance of the contract between you and 345ph (i.e., your use of the Platform under our Terms and Conditions).
• Identity verification and age compliance — Processing is required to comply with our legal obligations under PAGCOR regulations, which mandate verification that all players are at least 21 years of age.
• Payment processing and fraud prevention — Processing is necessary for the performance of the contract and for compliance with Philippine Anti-Money Laundering (AML) obligations under Republic Act No. 9160.
• Customer support — Processing is necessary for the performance of the contract and for our legitimate interest in resolving player queries efficiently.
• Marketing communications — Processing is based on your consent, which you may withdraw at any time by updating your communication preferences in your account settings or contacting our support team.
• Regulatory reporting — Processing is required to comply with legal obligations including PAGCOR reporting requirements and AML/CTF obligations.
• Platform security and fraud detection — Processing is based on our legitimate interest in maintaining a safe and secure gaming environment.
• Responsible gaming — Processing is based on our legal obligation to comply with PAGCOR's responsible gaming framework and our legitimate interest in protecting player welfare.

4 Data Retention Periods

345ph retains personal data only for as long as is necessary for the purposes described in this Privacy Policy, or as required or permitted by applicable law. The following general retention periods apply:

• Account data and transaction records: Retained for a minimum of five (5) years following account closure or last transaction, in compliance with PAGCOR record-keeping requirements and Philippine AML obligations.
• KYC and identity verification documents: Retained for a minimum of five (5) years from the date of submission, or longer if required by applicable law or an ongoing regulatory investigation.
• Gaming and session logs: Retained for three (3) years for dispute resolution, responsible gaming, and regulatory reporting purposes.
• Marketing data (where consent-based): Retained until you withdraw consent or until two (2) years of inactivity, whichever occurs first.
• Support communications: Retained for two (2) years from the date of the last interaction for training and dispute resolution purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identified individual.

5 Sharing and Disclosure of Personal Data

345ph does not sell your personal data. We may share your data with the following categories of recipients only to the extent strictly necessary for the stated purposes:

• Payment processors and e-wallet providers (GCash, Maya, BPI, BDO, Metrobank, GrabPay): to facilitate deposits and withdrawals from your 345ph wallet.
• Identity verification and KYC service providers: to fulfill age verification and AML screening obligations.
• Game software providers: to operate the games available on the 345ph Platform, where technically necessary.
• Cloud hosting and infrastructure providers: who store and process data on our behalf under contractual data processing agreements.
• Regulatory authorities: including PAGCOR, the National Privacy Commission (NPC), the Anti-Money Laundering Council (AMLC), and law enforcement agencies, where required by law or court order.
• Fraud prevention and security services: to detect and prevent fraudulent activity, account takeover, and bonus abuse on the Platform.

All third-party service providers acting as Personal Information Processors (PIPs) on behalf of 345ph are bound by contractual data processing agreements that require them to process your data only on our instructions and in compliance with the DPA.

6 International Data Transfers

In certain circumstances, the personal data of 345ph players may be transferred to, and processed by, service providers located outside of the Philippines — for example, where 345ph uses cloud infrastructure or game software operated from data centres in other countries.

Where such transfers occur, 345ph takes all reasonably practicable steps to ensure that your data receives an equivalent level of protection as it would in the Philippines, including through the use of standard contractual clauses, data processing agreements, and transfer impact assessments. 345ph will not transfer personal data to a country or jurisdiction that does not provide an adequate level of data protection without implementing appropriate safeguards as required under the DPA and its IRR.

7 Cookies and Tracking Technologies

The 345ph Platform uses cookies and similar tracking technologies to operate essential platform functions, remember your preferences, and analyse aggregate usage patterns. The categories of cookies used are:

• Strictly Necessary Cookies: Required for the Platform to function. These include session cookies that maintain your login state and security tokens that protect your account. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language settings, game display options, and notification preferences.
• Analytics Cookies: Collect anonymised data about how players interact with the Platform to help us improve performance, identify navigation issues, and optimise the player experience.
• Security Cookies: Support fraud detection, bot prevention, and unusual login activity monitoring to protect your account.

You may manage non-essential cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the 345ph Platform.

8 Minors and Age Restriction

The 345ph Platform is strictly intended for individuals aged 21 years and older, in compliance with PAGCOR's minimum age requirements for real-money online gaming in the Philippines. 345ph does not knowingly collect personal data from individuals below the age of 21.

If 345ph discovers or has reasonable grounds to believe that personal data has been collected from a person below the minimum age of 21, we will immediately close the relevant account, delete the personal data collected from the minor, and return any funds deposited to the original payment source to the extent practicable.

If you are a parent or guardian and believe that a minor in your care has registered on the 345ph Platform, please contact our support team immediately so that we can investigate and take appropriate action.

9 Your Rights as a Data Subject

Under the Data Privacy Act of 2012 and its IRR, you have the following rights in relation to your personal data held by 345ph:

To exercise any of these rights, please contact the 345ph Data Protection Officer (DPO) using the contact details in section 12 of this Policy. We will respond to all verifiable data subject requests within fifteen (15) business days as required under the DPA, and in any event no later than thirty (30) business days from receipt of the request.

345ph may need to verify your identity before processing a data subject request to ensure that personal data is not disclosed to an unauthorised third party.

10 Security Measures

345ph implements and maintains a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit AES encryption for all personal data stored at rest in 345ph databases.
• TLS 1.3 encryption for all data transmitted between your device and 345ph servers.
• Role-based access controls ensuring that only authorised 345ph personnel with a legitimate business need may access player data.
• Multi-factor authentication requirements for all 345ph administrative system access.
• Regular independent penetration testing and vulnerability assessments conducted by qualified third-party security firms.
• Dedicated security monitoring and incident response capabilities operating around the clock.
• Employee data privacy and security training conducted upon onboarding and updated annually.
• Physical security controls at all data centre locations used by 345ph and its processing partners.

11 Personal Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, 345ph will:

• Notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, as required under NPC Circular No. 16-03.
• Notify affected players as soon as reasonably practicable, providing a plain-language description of the nature of the breach, the categories of data affected, the likely consequences, and the steps 345ph has taken or proposes to take to address the breach.
• Document all breaches in a data breach register, including those that do not meet the threshold for mandatory notification to the NPC.

If you have reason to believe that your 345ph account has been compromised — such as unauthorised login activity, unrecognised transactions, or suspicious emails purportedly from 345ph — please contact our support team immediately so that we can take appropriate protective action.

12 Data Protection Officer

345ph has designated a Data Protection Officer (DPO) as required under the DPA. The DPO is responsible for overseeing 345ph's data protection strategy, ensuring compliance with the DPA and its IRR, and serving as the point of contact for data subjects and the National Privacy Commission.

You may contact the 345ph Data Protection Officer for all data privacy-related enquiries, data subject requests, or to raise a privacy concern:

• Email: [email protected] — please include "DPO Enquiry" in the subject line.
• Live Chat: Available 24/7 from the 345ph Platform after logging in — mention that your enquiry is a data privacy matter.

If you are not satisfied with 345ph's response to a privacy complaint, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for data privacy enforcement in the Philippines.

13 Changes to This Privacy Policy

345ph reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or regulatory requirements. When we make material changes, we will provide notice through one or more of the following channels: a notice on the 345ph website, an in-platform notification upon your next login, or an SMS message to your registered Philippine mobile number.

The "Effective Date" at the top of this page indicates when the current version came into force. Your continued use of the 345ph Platform after any update constitutes your acceptance of the revised Privacy Policy.

Previous versions of this Privacy Policy are available upon written request to the 345ph DPO.

14 Contact Us and Complaints

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or want to raise a concern about how 345ph handles your personal data, please reach out to us through the following channels:

• Live Chat: 24/7 live chat available directly on the 345ph Platform. Filipino-speaking agents are available around the clock — mention that your query is a privacy matter.
• Email: [email protected] — include "Privacy Policy Enquiry" or "Data Subject Request" in the subject line.

We aim to acknowledge all privacy enquiries within two (2) business days and to resolve them fully within fifteen (15) business days. For complex data subject requests involving large volumes of data, we may require up to thirty (30) business days.