Privacy Policy

This Privacy Policy applies to all personal data collected, processed, and stored by filplay in connection with your use of the filplay Platform, accessible at filplay.vip. It covers all filplay Services, including online casino games, live dealer tables, sports betting, bingo, fishing games, sabong, esports wagering, the player account system, the Cashier, customer support interactions, and any promotional communications.

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, filplay acts as the Personal Information Controller (PIC) with respect to the personal data of its registered players and website visitors.

This Policy does not apply to the data practices of third-party payment providers (such as GCash, PayMaya, BPI, BDO, or Metrobank), third-party game studios, or any other external services that may be accessible through the filplay Platform. Each of those third parties operates under its own independent privacy policy, which filplay does not control and is not responsible for.

filplay collects personal data through several channels: directly from you when you register or use the Platform, automatically as you interact with the Platform, and in limited circumstances from third parties such as KYC verification services and payment processors. The categories of personal data we collect include:

filplay does not collect sensitive personal information as defined under the DPA (such as health information, sexual orientation, or political affiliation) except where strictly required by PAGCOR regulations (for example, problem gambling self-declaration in the context of responsible gaming tools).

filplay processes your personal data on the following legal bases under the Philippine Data Privacy Act of 2012:

• Contractual Necessity: Processing is necessary to perform the contract between you and filplay (i.e., the Terms & Conditions you agreed to at registration). This covers account management, transaction processing, game provision, and customer support.
• Legal Obligation: Processing is required to comply with applicable Philippine laws and regulatory requirements, including PAGCOR licensing conditions, the Anti-Money Laundering Act (Republic Act No. 9160, as amended), and the Data Privacy Act of 2012 itself. KYC verification and transaction monitoring fall under this basis.
• Legitimate Interests: Processing is necessary for filplay's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and product improvement — provided these interests do not override your fundamental rights and freedoms.
• Consent: For marketing communications (promotional emails, SMS, or push notifications about filplay offers and promotions), filplay relies on your explicit consent. You may withdraw this consent at any time through your account preferences or by contacting support.

filplay uses the personal data it collects for the following specific purposes:

• Account Creation and Management: To create, maintain, and operate your filplay account, including authentication, account security, and password management.
• KYC and Age Verification: To verify your identity, confirm that you meet the 21+ age requirement mandated by PAGCOR, and comply with the Philippines' Anti-Money Laundering obligations.
• Payment Processing: To process deposits, withdrawals, and refunds through GCash, PayMaya, bank transfers, and USDT. Financial data is shared with payment processors only to the extent necessary to complete transactions.
• Game Provision and Personalization: To provide access to all filplay games and Services, and to personalize your gaming experience based on your preferences and history (e.g., recently played games, recommended titles).
• Responsible Gaming Compliance: To monitor gaming behavior for indicators of problem gambling as required by PAGCOR's responsible gaming guidelines, and to implement any responsible gaming restrictions you have voluntarily set (deposit limits, self-exclusion, etc.).
• Fraud Prevention and Security: To detect, prevent, and investigate fraudulent activity, unauthorized account access, bonus abuse, money laundering, and other prohibited conduct under the Terms & Conditions.
• Customer Support: To respond to your queries, complaints, and support requests through live chat and email channels.
• Marketing Communications: To send you promotional offers, bonus notifications, and filplay news via SMS or email, subject to your consent and opt-in status.
• Platform Analytics and Improvement: To analyze Platform usage patterns, identify technical issues, and improve the user experience on filplay — using aggregated and anonymized data wherever possible.
• Legal and Regulatory Compliance: To comply with PAGCOR's reporting requirements, AMLC transaction monitoring obligations, NPC data governance requirements, and any court orders or lawful regulatory directions.

filplay does not sell, rent, or trade your personal data to third parties for commercial purposes. Your personal data is shared only in the following limited and controlled circumstances:

• Payment Processors: Your financial information is shared with GCash, PayMaya, affiliated banks (BPI, BDO, Metrobank), and USDT processing services strictly to the extent necessary to process your transactions. Each of these providers is subject to their own data protection obligations.
• KYC Verification Partners: Identity document data may be shared with PAGCOR-approved KYC and identity verification service providers for the purpose of fulfilling our age verification and anti-money laundering obligations.
• Game Content Providers: Technical data (including game session data and pseudonymized player identifiers) may be shared with filplay's third-party game studios for the purpose of providing games, resolving technical disputes, and auditing game outcomes. These providers are contractually prohibited from using this data for any other purpose.
• PAGCOR and Regulatory Bodies: filplay is legally obligated to share transaction records, player activity data, and identity information with PAGCOR, the Anti-Money Laundering Council (AMLC), and other competent Philippine regulatory or law enforcement authorities when required by law or valid legal process.
• IT Service Providers: Technical infrastructure providers (hosting, cloud storage, cybersecurity services) may have access to personal data as part of providing their services to filplay. These providers are bound by data processing agreements and are prohibited from using the data for their own purposes.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of filplay's assets, player data may be transferred to the acquiring entity, subject to the acquiring entity assuming filplay's obligations under this Privacy Policy and Philippine law.

filplay uses cookies and similar tracking technologies on the Platform to support essential functionality and to improve your experience. The following types of cookies may be used:

• Strictly Necessary Cookies: These are essential for the Platform to function. They include session cookies that maintain your login state, security tokens, and load-balancing cookies. These cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies: These remember your preferences such as language settings, game filter preferences, and responsible gaming tool configurations. They improve your experience but are not essential to Platform operation.
• Analytics Cookies: These collect anonymized or aggregated data about how players interact with the Platform — which pages are visited most, where users exit, and how long sessions last. This data is used to improve Platform design and performance.
• Security Cookies: These are used to detect and prevent fraudulent activity, bot traffic, and unauthorized access attempts on the Platform.

You can manage cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the functionality of the filplay Platform. Most modern browsers allow you to view, delete, and block cookies from specific websites.

filplay implements a layered set of technical and organizational security controls to protect your personal data against unauthorized access, accidental loss, alteration, or unlawful destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and the filplay Platform is encrypted using Transport Layer Security (TLS 1.2 or higher), providing 256-bit encryption across all communications.
• Encryption at Rest: Sensitive personal data stored in filplay's systems (including identity documents and financial data) is encrypted using industry-standard encryption algorithms.
• Access Controls: Access to personal data within filplay's internal systems is granted on a strict need-to-know basis. Role-based access controls prevent unauthorized internal access to sensitive player data.
• Two-Factor Authentication: OTP-based two-factor authentication is used for account logins detected from new or unfamiliar devices, reducing the risk of unauthorized account access even if credentials are compromised.
• Regular Security Audits: filplay's infrastructure and application security are subject to regular penetration testing and vulnerability assessments by qualified third-party security professionals.
• Incident Response: filplay maintains a data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, filplay will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected players without undue delay as required by the DPA.

While filplay takes all reasonable measures to protect your data, no internet-based system can guarantee absolute security. You also play an important role in keeping your account secure — choose a strong, unique password, do not share your credentials, and report any suspected unauthorized access to filplay support immediately.

filplay retains your personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods required by Philippine law and PAGCOR regulations:

• Account and Identity Data: Retained for a minimum of five (5) years from the date of account closure, as required by PAGCOR's record-keeping requirements and the AMLC Act.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, consistent with AMLC reporting obligations.
• Gaming Activity Records: Retained for a minimum of three (3) years from the date of each gaming session or wagering transaction.
• Support Communications: Retained for three (3) years from the date of each interaction, to enable resolution of any delayed disputes or complaints.
• Marketing Consent Records: Retained for as long as your account is active and for three (3) years following account closure or consent withdrawal, to demonstrate compliance with consent requirements.

Following the expiry of the applicable retention period, personal data is securely deleted or permanently anonymized in a manner that makes re-identification impossible. Where legal proceedings or regulatory investigations are ongoing, data may be retained for longer periods until those proceedings are concluded.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by filplay. These rights are not absolute — they are subject to legal limitations and may be balanced against filplay's legal obligations or legitimate interests:

To exercise any of the above rights, contact filplay's Data Protection Officer (DPO) at the email address provided in Section 13. filplay will respond to verified data subject requests within thirty (30) days of receipt, in accordance with the DPA and NPC regulations.

filplay's Services are strictly intended for adults aged 21 years and older in compliance with PAGCOR's licensing requirements. filplay does not knowingly collect, process, or store personal data from any person under the age of 21.

Age is verified at registration through mandatory government-issued Philippine ID submission and date-of-birth entry. filplay's KYC process is specifically designed to identify and reject applications from persons who do not meet the 21+ age requirement.

If filplay becomes aware that personal data has been collected from a person under 21 — whether through a registration error, fraudulent use of another person's identity, or any other means — filplay will:

• Immediately suspend the account;
• Secure and preserve all associated data pending review;
• Delete the personal data of the underage individual to the extent permitted by law;
• Report the matter to PAGCOR as required under our licensing conditions; and
• Withhold any funds pending regulatory determination of the appropriate disposition.

If you are a parent or guardian and believe that a minor in your care has accessed or registered on filplay, please contact our support team immediately at the contact details in Section 13.

The filplay Platform integrates third-party services including game providers, payment processors, and analytics tools. While filplay selects its third-party partners carefully and requires them to maintain appropriate data protection standards, this Privacy Policy does not cover the data practices of any third-party provider.

In particular:

• GCash and PayMaya are operated by independent third parties (GXI Inc. and PayMaya Philippines, Inc. respectively). Your use of these payment methods is governed by their own privacy policies.
• Third-party game studios operating games on the filplay Platform may collect pseudonymized technical data as part of game operation. These studios are contractually prohibited from linking this data to your identity.
• filplay does not permit third-party advertising networks or social media trackers on the Platform that would collect your personal data for the third party's own marketing purposes without your explicit consent.

filplay may update this Privacy Policy from time to time to reflect changes in our data practices, applicable Philippine law, NPC guidance, or PAGCOR requirements. Material changes — those that significantly affect your rights or the way we process your data — will be communicated to registered filplay players via SMS or email at least seven (7) days before they take effect.

The "Last updated" date at the top of this Policy will always reflect the date of the most recent revision. We encourage you to review this Policy periodically, especially when you receive a notification of changes.

Your continued use of the filplay Platform after an updated Privacy Policy takes effect constitutes your acknowledgment of the updated terms. If you do not agree with material changes to this Policy, you may close your filplay account by contacting our support team.

filplay has designated a Data Protection Officer (DPO) as required under the Philippine Data Privacy Act of 2012. The DPO is responsible for overseeing filplay's compliance with the DPA and serves as the primary point of contact for data subject rights requests, privacy complaints, and data breach notifications.

You may contact filplay's DPO or the general support team through the following channels:

• Live Chat: Available 24/7 through the live chat feature on the filplay Platform. For data privacy matters, please indicate "Data Privacy Request" at the start of your message.
• Email: support at filplay.vip (plain text — not a clickable link). Please use the subject line "Privacy – [Your Request Type]" (e.g., "Privacy – Access Request" or "Privacy – Erasure Request") so your message is routed to the DPO promptly.

filplay will acknowledge receipt of your privacy inquiry within two (2) business days and provide a substantive response within thirty (30) days, as required under the DPA. If your request is complex or involves a large volume of data, filplay may extend the response period by up to an additional thirty (30) days with notice to you.

If you are not satisfied with filplay's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, the regulatory body responsible for enforcing the Data Privacy Act.