phrush Privacy Policy

1. Introduction

phrush ("we," "us," "our," or "phrush") operates the online gaming platform accessible at phrush.xyz (the "Platform"). We are committed to protecting the privacy and personal data of every individual who interacts with our Platform — whether as a registered player, a visitor, or a prospective user.

This Privacy Policy describes our practices regarding the collection, use, storage, disclosure, and protection of personal data. It applies to all personal data collected through the phrush Platform, including through our website, any associated mobile applications, customer support channels, and any other services we provide.

This policy should be read alongside the phrush Terms and Conditions, which govern your use of the Platform. Capitalized terms not defined in this policy have the meanings given to them in the Terms and Conditions.

If you have any questions about how phrush handles your personal data, please refer to Section 14 of this policy for contact details.

2. Data Controller

For the purposes of the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, phrush is the personal information controller responsible for the personal data collected through the Platform.

As a personal information controller, phrush determines the purposes and means of processing your personal data and is accountable for ensuring that such processing is carried out in accordance with applicable Philippine data privacy laws and regulations.

phrush has designated a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Privacy Policy and applicable data privacy laws. Contact details for the DPO are provided in Section 14 of this policy.

3. Personal Data We Collect

phrush collects personal data that is necessary for the provision of our services, compliance with legal obligations, and the improvement of the Platform. The categories of personal data we collect include:

3.1 Data You Provide Directly

• Identity Data: Full legal name, date of birth, gender, nationality, and government-issued identification details (e.g., Philippine National ID, passport, driver's license).
• Contact Data: Philippine mobile number, email address, and residential address.
• Account Data: Username, password (stored in encrypted form), security questions and answers, and account preferences.
• Financial Data: GCash account details, PayMaya account details, bank account information (BPI, BDO, Metrobank), and transaction history on the Platform.
• Verification Data: Copies of government-issued identification documents, selfies or photographs submitted for identity verification, and proof of address documents.
• Communications Data: Records of your communications with phrush customer support, including chat logs, emails, and call recordings where applicable.

3.2 Data Collected Automatically

• Technical Data: IP address, device type, operating system, browser type and version, device identifiers, and mobile network information.
• Usage Data: Pages visited, features used, games played, session duration, click patterns, and navigation paths within the Platform.
• Location Data: General geographic location derived from your IP address. We do not collect precise GPS location data unless you explicitly grant permission.
• Cookie and Tracking Data: Data collected through cookies, web beacons, and similar tracking technologies as described in Section 9.

3.3 Data from Third Parties

• Identity and fraud verification data from third-party KYC and AML service providers.
• Payment confirmation data from payment processors and e-wallet providers (GCash, PayMaya, and Philippine banks).
• Publicly available information used for fraud prevention and compliance purposes.

4. How We Use Your Personal Data

phrush processes your personal data only for specified, explicit, and legitimate purposes. The table below summarizes the primary purposes for which we use your data:

phrush will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your consent or establishing another lawful basis for processing.

5. Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, phrush processes your personal data on the following legal bases:

• Contract Performance: Processing is necessary for the performance of the contract between you and phrush — specifically, to provide you with access to the Platform and its services, process your transactions, and manage your account.
• Legal Obligation: Processing is required for phrush to comply with applicable Philippine laws and regulations, including anti-money laundering laws, PAGCOR regulations, and the Data Privacy Act itself.
• Legitimate Interest: Processing is necessary for phrush's legitimate interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided these interests are not overridden by your rights and interests.
• Consent: For certain processing activities — such as sending you marketing communications or using non-essential cookies — phrush relies on your freely given, specific, informed, and unambiguous consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Sharing Your Personal Data

phrush does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment Processors and E-Wallet Providers: GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers, solely for the purpose of processing your deposits and withdrawals.
• Identity Verification and KYC Providers: Third-party service providers that assist phrush in verifying your identity and conducting AML screening as required by Philippine law.
• Technology and Infrastructure Providers: Cloud hosting, data storage, and platform infrastructure providers who process data on our behalf under strict data processing agreements.
• Customer Support Tools: Third-party customer support platforms used to manage and respond to your support requests.
• Analytics Providers: Service providers that help phrush understand Platform usage and improve user experience, using aggregated or pseudonymized data where possible.
• Regulatory and Law Enforcement Authorities: PAGCOR, the National Privacy Commission (NPC), the Anti-Money Laundering Council (AMLC), and other Philippine government authorities, where disclosure is required by law, regulation, or lawful order.
• Professional Advisers: Lawyers, auditors, and other professional advisers where necessary for the conduct of phrush's business, subject to confidentiality obligations.

All third parties with whom phrush shares personal data are required to handle such data in accordance with applicable Philippine data privacy laws and phrush's data protection standards. Where phrush engages third-party processors, it does so under written data processing agreements that impose appropriate technical and organizational security measures.

7. Data Retention

phrush retains your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine laws and regulations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with AML and KYC regulatory requirements.
• Financial Transaction Data: Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act of 2001 (Republic Act No. 9160, as amended).
• Communications and Support Data: Retained for up to three (3) years from the date of the communication, unless a longer period is required for dispute resolution or legal proceedings.
• Technical and Usage Data: Generally retained for up to two (2) years, after which it is aggregated or anonymized for analytical purposes.
• Marketing Consent Records: Retained for the duration of your consent and for one (1) year following withdrawal of consent, as evidence of the consent given.

When personal data is no longer required, phrush will securely delete or anonymize it in accordance with our data disposal procedures. Where deletion is not immediately possible due to technical constraints, the data will be securely isolated and protected from further processing until deletion can be carried out.

8. Security Measures

phrush takes the security of your personal data seriously. We implement a range of technical and organizational measures designed to protect your data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption: All data transmitted between your device and the phrush Platform is encrypted using industry-standard TLS (Transport Layer Security) protocols. Sensitive data at rest, including passwords and financial information, is encrypted using strong cryptographic algorithms.
• Access Controls: Access to personal data is restricted to authorized phrush personnel and service providers who require it to perform their functions. Role-based access controls and the principle of least privilege are applied throughout our systems.
• Two-Factor Authentication: phrush supports and encourages the use of two-factor authentication (2FA) for account access to provide an additional layer of security.
• Security Monitoring: phrush employs continuous security monitoring, intrusion detection systems, and regular vulnerability assessments to identify and address potential security threats.
• Staff Training: All phrush personnel who handle personal data receive regular training on data privacy and security obligations.
• Incident Response: phrush maintains a data breach response plan. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, phrush will notify the National Privacy Commission and affected individuals in accordance with the requirements of the Data Privacy Act.

While phrush takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying phrush immediately if you suspect any unauthorized access to your account.

9. Cookies and Tracking Technologies

phrush uses cookies and similar tracking technologies to enhance your experience on the Platform, analyze usage patterns, and support our security and fraud prevention measures. A cookie is a small text file placed on your device when you visit the Platform.

Types of Cookies We Use:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session management cookies, authentication tokens, and security cookies. These cannot be disabled without affecting Platform functionality.
• Performance and Analytics Cookies: Help us understand how users interact with the Platform by collecting aggregated, anonymized usage data. This allows us to identify areas for improvement and optimize the user experience.
• Functional Cookies: Remember your preferences and settings — such as your preferred language, display settings, and responsible gaming limits — to provide a more personalized experience.
• Marketing Cookies: Used to deliver relevant promotional content and measure the effectiveness of our marketing campaigns. These are only placed with your consent.

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling certain cookies may affect the functionality of the Platform. For marketing cookies, you may withdraw your consent at any time through your account settings.

10. Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phrush:

• Right to Be Informed: You have the right to be informed of how your personal data is being collected and processed, which this Privacy Policy fulfills.
• Right to Access: You may request a copy of the personal data phrush holds about you, along with information about how it is being processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure or Blocking: You may request the deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, or where processing is unlawful, subject to phrush's legal retention obligations.
• Right to Object: You may object to the processing of your personal data where phrush relies on legitimate interest as the legal basis, or where your data is used for direct marketing purposes.
• Right to Data Portability: You may request that phrush provide your personal data in a structured, commonly used, and machine-readable format, or transmit it directly to another controller where technically feasible.
• Right to Damages: You have the right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.

To exercise any of these rights, please contact phrush's Data Protection Officer using the details in Section 14. phrush will respond to your request within a reasonable timeframe and in any event within thirty (30) days, unless an extension is required and communicated to you. If you are not satisfied with phrush's response, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

11. Minors and Age Restriction

The phrush Platform is strictly intended for individuals who are at least twenty-one (21) years of age, in accordance with Philippine laws governing casino-style online gaming. phrush does not knowingly collect personal data from individuals under the age of 21.

During the registration process, phrush collects date of birth information and conducts age verification checks. Where phrush has reasonable grounds to believe that a registered user is under 21 years of age, the account will be suspended immediately pending verification, and any funds held in the account will be returned to the payment source after investigation.

If you are a parent or guardian and believe that a minor has registered on the phrush Platform or provided personal data to phrush without your consent, please contact us immediately using the details in Section 14. phrush will take prompt action to investigate and, where confirmed, delete the minor's personal data and close the account.

12. Cross-Border Data Transfers

In the course of providing its services, phrush may transfer your personal data to service providers or infrastructure located outside the Philippines. Where such transfers occur, phrush ensures that appropriate safeguards are in place to protect your personal data in accordance with the requirements of the Philippine Data Privacy Act.

Safeguards for cross-border transfers may include:

• Contractual clauses that impose data protection obligations on the recipient equivalent to those applicable in the Philippines;
• Transfers to countries or organizations that have been assessed as providing an adequate level of data protection;
• Binding corporate rules where transfers occur within a corporate group.

By using the phrush Platform, you acknowledge and consent to the transfer of your personal data outside the Philippines where necessary for the provision of our services, subject to the safeguards described above.

13. Changes to This Privacy Policy

phrush reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or Platform features. When material changes are made, phrush will notify registered users via the contact details on file (email or SMS) and will update the effective date at the top of this page.

We encourage you to review this Privacy Policy periodically to stay informed about how phrush protects your personal data. The most current version of this policy will always be available at phrush.xyz/privacy-policy.

Your continued use of the phrush Platform following the posting of any changes to this Privacy Policy constitutes your acceptance of those changes. If you do not agree to the revised policy, you must discontinue use of the Platform and may request account closure.

14. Contact and Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or phrush's handling of your personal data, please contact our Data Protection Officer:

If you are not satisfied with phrush's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). The NPC is the independent government body responsible for administering and implementing the Data Privacy Act of 2012.