20ph22 Privacy Policy

20ph22 ("we", "us", "the Company") operates the online gaming platform accessible at 20ph22.net and is committed to protecting the privacy and personal data of all registered players and platform visitors ("you", "the data subject") in full accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, and its Implementing Rules and Regulations.

This Privacy Policy sets out in detail the categories of personal data we collect, the legal grounds on which we process such data, the purposes for which it is used, how long it is retained, with whom it may be shared, and the rights available to you as a data subject under Philippine law.

This Privacy Policy applies to all personal data collected through:

• The 20ph22 website at 20ph22.net and all pages thereunder.
• The 20ph22 account registration, verification, and login processes.
• Financial transactions conducted through the 20ph22 platform, including deposits and withdrawals.
• Customer support interactions conducted via email, live chat, or any other communication channel operated by 20ph22.
• Any promotional or bonus programmes operated by 20ph22.

For the purposes of the Data Privacy Act of 2012 and its Implementing Rules and Regulations, the data controller responsible for the personal data processed in connection with the 20ph22 platform is:

All data privacy inquiries, data subject access requests, and complaints should be directed to the contact address above. Please note that this email address must be used for written correspondence only and is not a clickable link.

20ph22 collects personal data in several categories depending on how you interact with the platform. The following table summarises the categories of data collected and the context in which they are gathered:

20ph22 does not collect special categories of sensitive personal data as defined under RA 10173 (such as health data, religious beliefs, or political opinions) unless specifically required by law or with your explicit written consent.

20ph22 processes your personal data on one or more of the following legal grounds as recognised under the Data Privacy Act of 2012:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and 20ph22, including account registration, management, payment processing, and the provision of gaming services.
• Legal Obligation: Processing is required for 20ph22 to comply with its legal obligations under PAGCOR regulations, the Anti-Money Laundering Act (AMLA), and other applicable Philippine legislation.
• Legitimate Interests: Processing is necessary for purposes of fraud prevention, platform security, responsible gaming monitoring, and the improvement of our services, where such interests are not overridden by your rights and freedoms.
• Consent: For marketing communications and any processing not covered by the above grounds, we rely on your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

The personal data collected by 20ph22 is used for the following specific purposes:

• Creating, managing, and verifying your 20ph22 account, including KYC identity checks required by PAGCOR.
• Processing deposits, withdrawals, and all other financial transactions on the platform.
• Detecting and preventing fraud, money laundering, unauthorised account access, and bonus abuse.
• Monitoring gameplay activity to support responsible gaming obligations, including identifying players who may be exhibiting problem gambling behaviours.
• Providing customer support and responding to your inquiries, complaints, and data subject requests.
• Sending transactional communications related to your account, such as deposit confirmations, withdrawal notifications, and security alerts.
• Sending marketing and promotional communications where you have provided consent to receive them.
• Fulfilling regulatory reporting obligations to PAGCOR and other competent Philippine authorities.
• Improving platform functionality, user experience, and the range of games and services offered.

The 20ph22 platform uses cookies and similar tracking technologies to support platform functionality, session management, security, and analytics. The following categories of cookies are used:

Strictly necessary cookies cannot be disabled as they are essential to the operation of the platform. You may manage your preferences for functional and analytics cookies through your browser settings. Note that disabling certain cookies may affect platform functionality.

20ph22 does not use third-party advertising cookies or permit external advertising networks to place tracking technologies on the 20ph22 platform.

20ph22 does not sell, rent, or trade personal data. Data may be shared with the following categories of third parties strictly on a need-to-know basis and subject to contractual data protection obligations:

• Payment Processors: GCash (Mynt), Maya (Voyager Innovations), BPI, BDO, Metrobank, and other licensed payment service providers, solely for the purpose of processing financial transactions on the platform.
• Identity Verification Providers: Third-party KYC and AML screening services used to verify player identity and conduct sanctions checks in compliance with Philippine law.
• Fraud Prevention Partners: Specialist fraud detection and device intelligence providers used to protect the platform from abuse, multi-accounting, and financial crime.
• Regulatory Authorities: PAGCOR and other Philippine government bodies where disclosure is required by law, court order, or regulatory direction.
• Cloud Infrastructure Providers: Data hosting and cloud service providers whose servers are used to operate the 20ph22 platform, subject to contractual data processing agreements.
• Game Software Suppliers: Licensed game studios whose titles are available on 20ph22, where technical integration requires the passing of session tokens or anonymised player identifiers.

All third-party data processors engaged by 20ph22 are contractually required to process personal data solely on 20ph22's documented instructions and to implement appropriate technical and organisational security measures.

Some of the third-party service providers engaged by 20ph22 may be located in, or operate infrastructure in, jurisdictions outside of the Philippines. Where personal data is transferred internationally, 20ph22 ensures that such transfers are carried out only:

• To countries or organisations that provide an adequate level of data protection as recognised under Philippine law or by the National Privacy Commission (NPC).
• Subject to appropriate contractual safeguards, including Standard Contractual Clauses or equivalent binding data processing agreements that require the recipient to protect your data to the same standard as required under RA 10173.

In all cases, 20ph22 retains responsibility for ensuring that any international transfer of your personal data is conducted securely and in compliance with applicable Philippine data protection law.

20ph22 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to overriding legal and regulatory retention obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with 20ph22's data disposal procedures. Anonymised data may be retained indefinitely for statistical and analytical purposes, as it no longer constitutes personal data under RA 10173.

20ph22 implements a layered approach to data security, combining technical, organisational, and procedural controls to protect your personal data against unauthorised access, loss, disclosure, alteration, or destruction. Key security measures include:

• Encryption: AES-256 encryption for all data at rest; TLS 1.3 for all data in transit between your device and 20ph22 servers.
• Access Controls: Role-based access control (RBAC) ensures that personal data is accessible only to authorised 20ph22 personnel who require it for legitimate operational purposes.
• Two-Factor Authentication: All 20ph22 internal systems that process personal data require multi-factor authentication for staff access.
• Penetration Testing: Regular security assessments and penetration tests are conducted by independent security professionals to identify and remediate vulnerabilities.
• Incident Response: 20ph22 maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in harm to data subjects, 20ph22 will notify the National Privacy Commission and affected data subjects within the timeframes prescribed by RA 10173.
• Staff Training: All 20ph22 personnel with access to personal data receive mandatory data privacy and security training on an annual basis.

The 20ph22 platform is strictly intended for adults aged 21 years and above, in accordance with PAGCOR's age restriction requirements for online gaming in the Philippines. 20ph22 does not knowingly collect, process, or retain the personal data of any individual under the age of 21.

If 20ph22 discovers or has reason to believe that a registered account belongs to an individual under the age of 21, the account will be immediately suspended pending investigation, all balances will be frozen, and the matter will be reported to PAGCOR in accordance with regulatory requirements. Any deposits made by underage users will be returned via the original payment method following identity verification of the account holder.

Parents and guardians who believe that a minor may have registered an account on 20ph22 are encouraged to contact our support team immediately at [email protected].

To exercise any of the data subject rights described in this Privacy Policy or summarised in the rights section above, please follow the process below:

1. Send a written request to [email protected] with the subject line: "Data Privacy Request — [Request Type]".
2. Include in your request: your full name as registered on 20ph22, your registered email address, the specific right you wish to exercise, and sufficient detail to allow us to identify and locate your data.
3. 20ph22 will verify your identity before processing any request. You may be asked to provide a copy of a government-issued ID for this purpose.
4. We will acknowledge receipt of your request within 3 business days and provide a substantive response within 15 business days of identity verification being completed.
5. Where a request is complex or involves a large volume of data, we may extend the response period by a further 15 business days, and will notify you of this extension within the initial 15-business-day period.

20ph22 will not charge a fee for processing data subject requests unless the request is manifestly unfounded or excessive, in which case a reasonable administrative fee may be applied. We will inform you of any such fee before proceeding.

If you are not satisfied with how 20ph22 has handled your personal data or responded to a data subject request, you have the right to lodge a complaint with the Philippine National Privacy Commission (NPC), the supervisory authority responsible for enforcing the Data Privacy Act of 2012.

Before lodging a complaint with the NPC, we encourage you to first contact our data privacy team at [email protected] to give us the opportunity to resolve the matter directly. Most privacy concerns can be addressed efficiently through our internal complaints process.

The National Privacy Commission can be contacted through its official government channels. 20ph22 will cooperate fully with any NPC investigation and will not penalise any data subject for exercising their right to complain to the regulatory authority.

20ph22 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, PAGCOR regulatory requirements, our data processing practices, or the services we offer. All changes will be effective upon posting of the updated policy to this page.

Where changes to this Privacy Policy are material — meaning they significantly affect your rights or the way we process your personal data — 20ph22 will notify registered players via email to the address on file and/or via a prominent notice on the platform prior to the changes taking effect.

The "Effective Date" at the top of this page will always reflect the date on which the current version of the Privacy Policy came into force. We encourage you to review this page periodically to stay informed of how 20ph22 protects your personal data.

Your continued use of the 20ph22 platform following the posting of any updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with the updated policy, you should cease using the platform and contact our support team to request account closure.