ph.rush Privacy Policy

1 Introduction and Scope

1.1 Who We Are. ph.rush is an online gaming platform accessible at phrush.onl, operating under the regulatory framework of PAGCOR (the Philippine Amusement and Gaming Corporation). In this Privacy Policy, "ph.rush," "we," "us," and "our" refer to the operator of the ph.rush platform. "You" or "Player" refers to any individual who visits, registers on, or uses the ph.rush platform.

1.2 Scope of This Policy. This Privacy Policy applies to all personal data collected by ph.rush through the phrush.onl website, the platform's gaming services, customer support interactions, payment transactions, marketing communications, and any other interaction you have with ph.rush. It applies to players based in the Philippines and to any other individuals whose personal data is processed by ph.rush in connection with the platform's operations.

1.3 Legal Framework. ph.rush processes personal data in compliance with:

• The Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations;
• Regulations and guidelines issued by the National Privacy Commission (NPC) of the Philippines;
• PAGCOR licensing conditions and data protection requirements applicable to online gaming operators;
• The Anti-Money Laundering Act of 2001 (RA 9160) as amended, and related AMLC regulations, insofar as they impose data retention and reporting obligations;
• Any other applicable Philippine legislation governing data privacy and protection.

1.4 Acceptance. By registering an account on ph.rush or by continuing to use the platform after this Privacy Policy becomes effective, you acknowledge that you have read, understood, and consent to the collection and use of your personal data as described herein. If you do not agree with this Policy, you should not use the ph.rush platform.

2 Personal Data We Collect

ph.rush collects personal data through different channels and for different purposes. The categories of personal data we collect are described below.

2.1 Registration and Account Data. When you create a ph.rush account, we collect:

• Full legal name;
• Date of birth (for age verification — you must be 21 or older);
• Residential address;
• Mobile phone number (Philippine SIM, used for OTP and account recovery);
• Email address;
• Username and encrypted password hash.

2.2 Identity Verification (KYC) Data. To comply with PAGCOR requirements and Philippine AML regulations, ph.rush may request:

• Government-issued identification documents (PhilSys National ID, Philippine Passport, Driver's License, SSS/GSIS ID, or similar);
• Proof of address (utility bill, bank statement, or similar document);
• Source of funds documentation where required by AML thresholds;
• Photographs or selfies with ID documents for identity confirmation where required.

2.3 Financial Transaction Data. When you make deposits or withdrawals, we collect:

• Payment method identifiers (e.g., last four digits of a card, GCash registered number, Maya account reference);
• Transaction amounts, dates, and times;
• Transaction reference numbers issued by payment processors.

ph.rush does not store full payment card numbers on its own servers. Card transactions are processed by PCI DSS-compliant payment processors.

2.4 Gaming Activity Data. As part of normal platform operations and PAGCOR compliance, ph.rush records:

• Games played, bet amounts, game outcomes, and session durations;
• Bonus usage, wagering progress, and promotional participation history;
• Responsible gaming tool activations (deposit limits set, cooling-off periods taken, self-exclusion status).

2.5 Technical and Device Data. When you access ph.rush, our systems automatically collect:

• IP address and approximate geographic location (city/region level);
• Device type, operating system, and browser type and version;
• Session timestamps, page navigation data, and click-stream data;
• Cookie identifiers and similar tracking technologies (see Section 9).

2.6 Communications Data. When you contact ph.rush support, we collect:

• Live chat transcripts;
• Email correspondence content;
• Support ticket details and resolution records.

3 How We Use Your Personal Data

ph.rush processes your personal data for the following purposes and under the following legal bases:

4 Sharing of Personal Data with Third Parties

4.1 General Principle. ph.rush does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Sharing of your data is limited to the circumstances described in this section.

4.2 Service Providers. ph.rush shares personal data with trusted third-party service providers who assist in operating the platform, subject to data processing agreements that prohibit those providers from using your data for any purpose other than providing their designated service to ph.rush. These categories of service providers include:

• Payment processors — GCash (Mynt / GXI), Maya (Voyager Innovations), BPI, BDO, Metrobank, 7-Eleven (Cliqq), Coins.ph, and relevant USDT network infrastructure;
• Identity verification partners — KYC and AML compliance service providers operating under Philippine data protection requirements;
• Game content providers — licensed studios such as JILI, Pragmatic Play, Evolution Gaming, Asia Gaming, Spadegaming, and Habanero that supply games under license to ph.rush;
• Cloud infrastructure and hosting providers — data center and cloud service providers hosting ph.rush platform infrastructure;
• Customer support tools — live chat and support ticketing platform providers;
• Fraud prevention and security services — cybersecurity and fraud detection service providers.

4.3 Regulatory and Law Enforcement Disclosures. ph.rush may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), law enforcement agencies, or courts of competent jurisdiction where required or permitted by Philippine law, including in response to valid legal process, PAGCOR audit requirements, suspicious transaction reporting obligations, or court orders.

4.4 Business Transfers. In the event of a merger, acquisition, sale of assets, or restructuring involving ph.rush, personal data held by ph.rush may be transferred to a successor entity as part of that transaction. You will be notified of any such transfer and the privacy terms applicable to your data following the transfer.

4.5 Aggregated, Non-Identifiable Data. ph.rush may share aggregated, anonymized, or pseudonymized data that does not identify any individual player — for example, statistical reports on game popularity or player demographic trends — for business, research, or regulatory reporting purposes.

5 Data Retention

5.1 Retention Principles. ph.rush retains personal data for no longer than is necessary for the purposes for which it was collected, taking into account legal and regulatory retention obligations applicable under Philippine law.

5.2 Retention Periods. The following general retention guidelines apply:

• Active account data: Retained for the duration of your account's active status, plus a minimum of five (5) years following account closure, as required by PAGCOR licensing conditions and AMLC regulations;
• KYC and identity documents: Retained for a minimum of five (5) years following the end of the business relationship, as required by the Anti-Money Laundering Act;
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction;
• Support communications: Retained for up to two (2) years following the resolution of the relevant query or complaint;
• Marketing consent records: Retained for the duration of the consent period plus three (3) years thereafter for evidentiary purposes;
• Technical and device logs: Retained for up to twelve (12) months for security and fraud prevention purposes.

5.3 Post-Retention Disposal. Upon expiry of applicable retention periods, ph.rush will securely delete or irreversibly anonymize the relevant personal data in accordance with NPC guidelines for secure data disposal.

6 Data Security

6.1 Security Measures. ph.rush implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Current security measures include:

• SSL/TLS encryption for all data transmitted between your browser and ph.rush servers;
• Encryption of sensitive personal data fields at rest in ph.rush databases;
• Role-based access controls limiting data access to authorized ph.rush personnel on a need-to-know basis;
• Multi-factor authentication for administrative access to systems containing personal data;
• Regular security assessments and vulnerability scanning of platform infrastructure;
• Contractual data security obligations imposed on all third-party service providers with access to personal data.

6.2 No Absolute Security. Notwithstanding the security measures described above, no data transmission over the internet and no storage system can be guaranteed to be 100% secure. ph.rush cannot guarantee the absolute security of your personal data. You are encouraged to use strong, unique passwords for your ph.rush account and to enable Two-Factor Authentication.

6.3 Data Breach Notification. In the event of a personal data breach that is likely to give rise to a real risk of serious harm to affected individuals, ph.rush will notify the National Privacy Commission and affected players in accordance with the requirements of RA 10173 and NPC Circular 16-03.

7 Your Data Rights Under Philippine Law

Under the Data Privacy Act of 2012 (RA 10173), Filipino data subjects have the following rights with respect to their personal data held by ph.rush:

Exercising Your Rights. To exercise any of the rights above, contact ph.rush support via the live chat widget on the platform or by emailing [email protected] (plain text — not clickable). ph.rush will respond to data rights requests within 15 business days of receipt. Complex requests or requests involving mandatory legal retention periods may require additional time, and ph.rush will notify you of any extensions. Identity verification may be required before ph.rush processes a data rights request.

8 Marketing Communications and Opt-Out

8.1 Consent-Based Marketing. ph.rush sends direct marketing communications — including promotional offers, bonus notifications, game announcements, and platform news — only to players who have provided explicit consent to receive such communications during registration or through their account communication preferences.

8.2 Opt-Out. You may withdraw your marketing consent and opt out of receiving marketing communications from ph.rush at any time by:

• Updating your communication preferences in your ph.rush account settings;
• Clicking the unsubscribe link in any marketing email received from ph.rush;
• Contacting ph.rush support via live chat and requesting removal from marketing lists.

Withdrawal of marketing consent will take effect within a reasonable operational timeframe (typically within 5–10 business days). Withdrawing marketing consent does not affect your ability to use the ph.rush platform, access your account, or receive service communications necessary for the operation of your account (such as deposit confirmations, withdrawal notifications, or security alerts — these are not marketing communications and cannot be opted out of while your account is active).

8.3 No Third-Party Marketing. ph.rush does not share your personal data with third-party advertisers or marketing partners for the purpose of sending you marketing communications from those third parties. Your data is not monetized through third-party advertising networks.

9 Cookies and Tracking Technologies

9.1 Use of Cookies. ph.rush uses cookies and similar tracking technologies (local storage, session tokens, and pixel tags) to operate the platform, maintain your login session, remember your preferences, and analyze how the platform is used. The following categories of cookies are used:

9.2 Managing Cookies. You can manage or delete cookies through your browser settings. Most modern browsers allow you to view, block, or delete cookies on a per-site basis. Note that disabling essential cookies will impair or prevent your ability to use the ph.rush platform.

10 Cross-Border Data Transfers

10.1 Data Location. ph.rush's primary platform data is hosted on servers located within or serving the Philippines. Certain service providers used by ph.rush — in particular, game content providers and cloud infrastructure suppliers — may process data in other jurisdictions.

10.2 Transfer Safeguards. Where personal data is transferred outside the Philippines, ph.rush ensures that adequate safeguards are in place in accordance with NPC requirements, including: standard contractual clauses requiring the recipient to apply data protection standards consistent with Philippine law; data processing agreements with all relevant service providers; and transmission only to jurisdictions where data protection adequacy has been established.

10.3 No Unauthorized International Transfers. ph.rush does not transfer personal data to foreign entities without a lawful basis and appropriate contractual protections. Transfers to foreign game providers are limited to data necessary for game operation (typically session tokens and bet data) and are governed by data processing agreements.

11 Children's Data and Age Verification

11.1 No Services to Minors. ph.rush is strictly limited to persons aged 21 years and older. ph.rush does not knowingly collect personal data from individuals under 21. Age verification is conducted as part of the registration process and is reinforced by KYC document checks in compliance with PAGCOR requirements.

11.2 Discovery of Underage Data. If ph.rush discovers that an individual under the age of 21 has provided personal data during registration, ph.rush will immediately close the account, remove the personal data from operational systems (subject to any mandatory regulatory retention obligations), and if applicable, report the incident as required under PAGCOR's reporting framework.

11.3 Parental Responsibility. Adults who hold ph.rush accounts are responsible for ensuring that their account credentials are not accessible to minors in their household. If you believe your account has been accessed by a minor, contact ph.rush support via live chat immediately.

12 Responsible Gaming and Data Processing

12.1 Behavioral Monitoring. As part of its responsible gaming obligations under PAGCOR's licensing conditions, ph.rush monitors player gaming behavior — including frequency of play, session duration, deposit patterns, and loss levels — to identify potential indicators of problem gambling. This monitoring is conducted in the legitimate interests of player welfare and PAGCOR compliance.

12.2 Responsible Gaming Tool Records. ph.rush retains records of responsible gaming tool activations — including deposit limits set, cooling-off periods taken, and self-exclusion history — for the duration of the account relationship and for the mandatory post-closure retention period. These records may be required by PAGCOR for audit and compliance purposes.

12.3 Self-Exclusion Registry. Where a player activates self-exclusion on ph.rush, their exclusion status and associated personal data necessary to enforce the exclusion are retained for the full duration of the exclusion period and for a minimum period thereafter as required by PAGCOR regulations. This data is not deleted upon self-exclusion request — the retention is legally necessary to enforce the exclusion.

13 Changes to This Privacy Policy

13.1 Right to Amend. ph.rush reserves the right to update or amend this Privacy Policy at any time. Changes may be necessary to reflect updates to Philippine data protection regulations, NPC guidelines, PAGCOR requirements, changes in platform operations, or improvements in privacy practices.

13.2 Notification of Material Changes. Material changes to this Privacy Policy — particularly those affecting how your personal data is used, shared, or retained — will be communicated to registered players via email to their registered address, via an in-platform notification, or by a prominent notice on the phrush.onl website, at least 7 days before the change takes effect where operationally practicable.

13.3 Continued Use as Acceptance. Your continued use of the ph.rush platform following the effective date of a Privacy Policy amendment constitutes acceptance of the updated Policy. If you do not agree with material changes, you may close your account in accordance with the Terms & Conditions before the effective date of the changes.

13.4 Policy Versioning. The effective date shown at the top of this page indicates the date from which the current version of the Privacy Policy applies to all active ph.rush accounts.

14 Contact and Data Protection Inquiries

14.1 How to Contact Us. If you have any questions, concerns, or requests regarding this Privacy Policy or ph.rush's handling of your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 via the chat widget on phrush.onl — the fastest method for most inquiries;
• Email: [email protected] (plain text — not a clickable link). Please include "Data Privacy Request" in the subject line for data rights requests.

14.2 Response Timeframes. ph.rush acknowledges data privacy inquiries within 5 business days and provides substantive responses within 15 business days. Complex requests involving extensive data retrieval or legal review may require additional time, and ph.rush will notify you of any extension and the expected completion date.

14.3 National Privacy Commission. If you believe ph.rush has violated your data privacy rights under RA 10173 and you have not received a satisfactory response from ph.rush, you have the right to file a complaint with the National Privacy Commission of the Philippines (NPC). The NPC's contact information and complaint procedures are publicly available on the NPC's official website.