Privacy Policy – merryph22

1. Introduction

merryph22 ("the Company," "we," "us," or "our") operates the online gaming platform accessible at merryph22.one (the "Platform"). We are committed to protecting the privacy and personal data of every player and visitor who interacts with our Platform.

This Privacy Policy ("Policy") has been prepared in accordance with Republic Act No. 10173, the Data Privacy Act of 2012 (DPA) of the Philippines and its Implementing Rules and Regulations, as well as the regulatory requirements of the Philippine Amusement and Gaming Corporation (PAGCOR). By creating a merryph22 account or otherwise using the Platform, you consent to the collection and processing of your personal data as described in this Policy.

2. Personal Data We Collect

merryph22 collects personal data in the following categories, depending on how you interact with the Platform:

2.1 Account Registration Data

• Full legal name
• Date of birth (for age verification — 21+ requirement)
• Email address
• Philippine mobile number
• Username and encrypted password
• Residential address

2.2 Identity Verification (KYC) Data

• Government-issued photo identification (e.g., PhilSys National ID, passport, UMID, driver's licence)
• Proof of address documentation (e.g., utility bill, bank statement)
• Selfie or liveness verification image where required

2.3 Financial Data

• GCash or PayMaya account reference (account number, not credentials)
• BPI, BDO, or Metrobank account reference for banking transfers
• Transaction history (deposits, withdrawals, wager amounts)

2.4 Technical & Usage Data

• IP address and approximate geolocation
• Device type, operating system, and browser
• Session duration and game activity logs
• Cookie identifiers and analytics data

2.5 Communications Data

• Support chat transcripts and email correspondence with merryph22
• Responsible gaming requests and self-exclusion records

3. How merryph22 Uses Your Data

merryph22 processes your personal data only for the following specified, legitimate purposes:

• Account management — creating, maintaining, and securing your merryph22 account
• Age and identity verification — confirming that you are 21 years of age or older and that your identity matches your registration details, as required by PAGCOR
• Payment processing — facilitating deposits and withdrawals via GCash, PayMaya, BPI, BDO, and Metrobank
• Regulatory compliance — meeting PAGCOR, Anti-Money Laundering Council (AMLC), and DPA obligations, including record-keeping and suspicious transaction reporting
• Fraud prevention and security — detecting and investigating suspected fraud, cheating, money laundering, or unauthorised account access
• Responsible gaming — applying deposit limits, session reminders, and self-exclusion controls at your request or under our duty-of-care obligations
• Customer support — responding to your queries and resolving disputes
• Platform improvement — analysing aggregated, anonymised usage data to improve game performance, interface design, and service reliability
• Marketing communications — sending promotional offers or updates, where you have provided explicit consent and subject to your right to opt out at any time

merryph22 does not use personal data for purposes incompatible with those listed above without first obtaining your explicit consent.

4. Legal Basis for Processing

Under the Data Privacy Act of 2012, merryph22 relies on the following legal bases for processing your personal data:

• Contractual necessity — processing required to perform the contract between you and merryph22 (i.e., the Terms & Conditions you accepted at registration)
• Legal obligation — processing required to comply with PAGCOR licensing conditions, AML regulations, and the DPA itself
• Legitimate interests — fraud prevention, platform security, and responsible gaming enforcement, where these interests are not overridden by your rights
• Consent — for marketing communications and non-essential cookies, where your explicit opt-in has been obtained

5. Data Sharing & Third Parties

merryph22 does not sell, rent, or trade your personal data to any third party for advertising or commercial profiling. We share personal data only in the following limited circumstances:

• Payment service providers — GCash, PayMaya, BPI, BDO, and Metrobank receive only the transaction data necessary to process your deposit or withdrawal. These providers are subject to their own privacy policies and are bound by Philippine financial regulations.
• Game software providers — providers such as PG Soft and Pragmatic Play may receive anonymised session and wager data to deliver game services. These providers operate under contractual data processing agreements with merryph22.
• KYC and identity verification partners — accredited verification services may process your identity documents on merryph22's behalf, under strict confidentiality and data security obligations.
• Regulatory and law enforcement authorities — PAGCOR, the Anti-Money Laundering Council, and other competent Philippine authorities may receive data as required by law or a valid legal order. merryph22 will not voluntarily disclose more than is legally required.
• Corporate successors — in the event of a merger, acquisition, or sale of the Company, your personal data may be transferred to the successor entity, subject to the same privacy protections described in this Policy.

6. Cookies & Tracking Technologies

merryph22 uses cookies and similar tracking technologies to operate the Platform and improve your experience. The following categories of cookies are used:

• Strictly necessary cookies — required for login sessions, security tokens, and core Platform functionality. These cannot be disabled without impacting your ability to use merryph22.
• Functional cookies — remember your preferences such as language settings and responsible gaming limit configurations.
• Analytics cookies — collect aggregated, anonymised data about how players navigate the Platform. This data is used solely to improve performance and usability. No individual player behaviour is shared externally for advertising purposes.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may prevent you from accessing certain features of the merryph22 Platform.

7. Data Security

merryph22 implements technical and organisational security measures appropriate to the sensitivity of the personal data we hold, including:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers
• Encrypted storage of passwords using one-way cryptographic hashing (bcrypt)
• Role-based access controls ensuring only authorised personnel can access personal data
• Regular security audits and penetration testing of the Platform infrastructure
• Two-factor authentication available for all player accounts
• Incident response procedures to detect, contain, and notify affected players of any data breach in accordance with the DPA's 72-hour notification requirement

While merryph22 takes every reasonable precaution to protect your data, no system is completely immune to security threats. You are encouraged to use a strong, unique password for your merryph22 account and to enable two-factor authentication.

8. Data Retention

merryph22 retains personal data for the following periods:

• Active account data — retained for as long as your merryph22 account remains active and for a period of five (5) years following account closure, as required by PAGCOR anti-money laundering record-keeping obligations.
• Transaction records — retained for ten (10) years from the date of transaction in accordance with AMLC requirements applicable to PAGCOR-licensed operators.
• Support communications — retained for three (3) years from the date of the communication.
• Marketing consent records — retained until you withdraw consent and for three (3) years thereafter as proof of consent.
• Analytics data — retained in anonymised, aggregated form with no fixed deletion date, as it cannot be linked to any individual.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised using industry-standard procedures.

9. Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by merryph22:

• Right to be informed — the right to know what data merryph22 holds about you, how it is used, and with whom it is shared
• Right of access — the right to request a copy of all personal data merryph22 holds about you
• Right to rectification — the right to have inaccurate personal data corrected
• Right to erasure — the right to request deletion of personal data where there is no longer a legal basis for retention (subject to our regulatory obligations)
• Right to object — the right to object to processing based on legitimate interests, including direct marketing
• Right to data portability — the right to receive your personal data in a structured, machine-readable format
• Right to lodge a complaint — the right to file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data rights have been violated

To exercise any of these rights, contact the merryph22 Data Protection Officer at [email protected]. We will acknowledge your request within five (5) business days and respond substantively within thirty (30) days.

10. Children's Privacy

The merryph22 Platform is strictly restricted to persons who are 21 years of age or older. merryph22 does not knowingly collect personal data from persons under the age of 21. If we become aware that personal data has been collected from a minor, such data will be deleted immediately and the relevant account suspended. Parents or guardians who believe that a minor may have accessed or registered on the merryph22 Platform are urged to contact our support team immediately.

11. International Data Transfers

Some of merryph22's third-party service providers — including game software providers and KYC verification partners — may be located outside the Philippines. Where personal data is transferred to jurisdictions outside the Philippines, merryph22 ensures that appropriate safeguards are in place, including:

• Contractual clauses requiring the recipient to apply data protection standards equivalent to those required under the Philippine DPA
• Transfers only to providers certified or accredited under applicable international data protection frameworks

merryph22 will not transfer personal data to any jurisdiction where an adequate level of protection cannot be guaranteed without first implementing appropriate safeguards or obtaining your explicit consent.

12. Updates to This Policy

merryph22 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. Where changes are material, we will notify registered players via email to their registered address and post a prominent notice on the Platform at least seven (7) days before the updated Policy takes effect.

Your continued use of the merryph22 Platform after the effective date of any update constitutes your acceptance of the revised Policy. If you do not accept the updated Policy, you must discontinue use of the Platform and may request account closure in accordance with our Terms & Conditions.

13. Contact & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by merryph22, please contact our Data Protection Officer:

You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated. Information on how to file a complaint is available on the NPC's official website.