phonejoy Privacy Policy

This Privacy Policy (the "Policy") describes how phonejoy ("we," "us," "our," or "the Company") collects, processes, stores, shares, and protects the personal data of individuals ("you," "Data Subject," or "Player") who access or use the phonejoy online gaming platform at phonejoy.co and its associated subdomains (the "Platform").

This Policy applies to all personal data processed in connection with your use of the Platform, regardless of whether you are a registered player, a visitor browsing the site, or a person who contacts our customer support team. It covers personal data collected online through the Platform and through any communication channels operated by phonejoy, including live chat and email.

This Policy does not apply to the data practices of third-party game providers, payment processors, or other partners who operate under their own independent privacy policies. Where phonejoy shares data with such parties, this Policy explains the basis and scope of that sharing in Section 7.

phonejoy is the Data Controller responsible for your personal data under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations ("IRR") issued by the National Privacy Commission ("NPC").

As Data Controller, phonejoy determines the purposes for which, and the means by which, your personal data is processed. We have appointed a Data Protection Officer (DPO) who oversees our data governance framework and acts as the primary point of contact for all privacy-related inquiries. Contact details for our DPO are provided in Section 16.

phonejoy operates within the PAGCOR regulatory framework and complies with all applicable Philippine laws governing personal data, financial records, and anti-money laundering reporting.

phonejoy collects only the personal data that is necessary for the purposes described in this Policy. The categories of personal data we may hold about you are set out in the table below:

phonejoy does not collect sensitive personal information (as defined by the DPA, such as health, genetic, or biometric data) except where required by KYC regulations, such as a photograph for identity verification purposes.

phonejoy collects personal data through the following methods:

4.1 Directly From You

The majority of data phonejoy holds is provided directly by you. This includes information entered during account registration, KYC document uploads, deposit and withdrawal requests, and communications with our support team. You are always informed of what data is being collected at the point of collection.

4.2 Automatically During Platform Use

When you access the phonejoy Platform, our systems automatically record Technical Data (see Section 3) through cookies, server logs, and similar tracking technologies. This data helps us maintain Platform security, prevent fraud, and improve the user experience for Filipino players. See Section 8 for full details on our cookie practices.

4.3 From Third-Party Sources

phonejoy may receive data about you from trusted third parties including:

• Payment processors (e.g., GCash, Maya/PayMaya, BPI, BDO, Metrobank) for transaction confirmation and fraud screening;
• Identity verification service providers used during KYC processing;
• PAGCOR or other regulatory bodies for compliance purposes;
• Responsible gaming databases or self-exclusion registries maintained under Philippine gambling regulations.

Under the Philippine Data Privacy Act and its IRR, phonejoy processes your personal data on the following legal bases:

• Contractual necessity: Processing is necessary to provide you with the phonejoy service — including account creation, deposit processing, game access, and withdrawal fulfilment — under the agreement formed when you accept the Terms and Conditions;
• Legal obligation: Processing is required to comply with applicable Philippine law, including PAGCOR licensing conditions, Anti-Money Laundering Act (AMLA) obligations, and the mandatory KYC requirements of the Bangko Sentral ng Pilipinas (BSP) for e-wallet transactions;
• Legitimate interests: Processing is necessary for phonejoy's legitimate interests in operating a secure and fraud-free platform, improving our services, and communicating relevant offers to existing players — provided such interests are not overridden by your rights;
• Consent: Where none of the above bases applies, phonejoy will request your explicit consent before processing, such as for optional marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

phonejoy uses the personal data we collect for the following specific purposes:

• Account management: Creating, maintaining, and securing your phonejoy account, including processing login requests, managing session security, and communicating important account notifications;
• KYC and identity verification: Verifying your identity and age (21+ requirement) as required by PAGCOR and Philippine anti-money laundering regulations before processing withdrawals;
• Payment processing: Facilitating deposits via GCash, Maya, QR Ph, GrabPay, InstaPay, BPI, BDO, and Metrobank, and processing approved withdrawal requests to your registered payment method;
• Game services: Providing access to casino games, maintaining accurate wagering records, calculating bonus eligibility, and ensuring fair play integrity;
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, money laundering, unauthorized account access, and abuse of promotional offers;
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling indicators, enforcing deposit limits and self-exclusion settings, and communicating responsible gaming information;
• Customer support: Responding to your inquiries, resolving disputes, and maintaining records of support interactions for quality assurance;
• Legal and regulatory compliance: Fulfilling PAGCOR licensing obligations, AMLC reporting requirements, and NPC data privacy compliance;
• Service improvement: Analysing aggregated and anonymized usage data to improve Platform performance, game selection, and the Filipino player experience;
• Marketing (with consent): Sending promotional offers, bonus notifications, and platform updates to players who have opted in to marketing communications. You may opt out at any time by contacting support.

phonejoy does not sell your personal data. We share personal data with third parties only in the following limited circumstances, and only to the extent necessary for the stated purpose:

7.1 Service Providers and Processors

phonejoy engages trusted third-party service providers who process data on our behalf under written data processing agreements that impose obligations equivalent to those in this Policy. These include:

• Payment processors and e-wallet providers (GCash, Maya, BPI, BDO, Metrobank) for deposit and withdrawal facilitation;
• KYC and identity verification technology providers;
• Cloud infrastructure and hosting providers;
• Licensed third-party game software providers who power the games available on the phonejoy Platform;
• Customer support technology platforms (live chat software).

7.2 Regulatory and Legal Disclosure

phonejoy may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, courts of law, or other government bodies where such disclosure is required by Philippine law, a valid legal order, or regulatory directive. phonejoy will notify affected players of such disclosure where legally permitted.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving phonejoy, personal data may be transferred to the acquiring entity as part of the transaction, subject to the acquirer accepting obligations equivalent to those in this Policy. Players will be notified of any such transfer in advance.

7.4 With Your Consent

phonejoy will share your data with any other third party only where you have provided prior explicit consent to such sharing.

The phonejoy Platform uses cookies and similar tracking technologies to ensure proper Platform functioning, maintain session security, analyze usage patterns, and improve the Filipino player experience. The main types of cookies we use are:

You may manage or disable non-essential cookies through your browser settings. Note that disabling strictly necessary cookies will impair Platform functionality. Most Android and iOS mobile browsers allow granular cookie control under Settings → Privacy.

phonejoy retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:

• Active account data: Retained for the duration of your phonejoy account and for five (5) years following permanent account closure, in compliance with PAGCOR record-keeping requirements and AMLA obligations;
• KYC documents: Retained for five (5) years following the last transaction or account closure, whichever is later, as required by the Anti-Money Laundering Act;
• Transaction records: Retained for five (5) years following each transaction date, as required by BSP and AMLC regulations applicable to online payment services;
• Communications and support records: Retained for three (3) years from the date of the last communication for dispute resolution and quality assurance purposes;
• Technical and log data: Retained for twelve (12) months for security monitoring and fraud investigation purposes, then deleted or anonymized;
• Marketing consent records: Retained for as long as the consent remains active, and for two (2) years after consent is withdrawn, for compliance documentation.

Upon expiry of the applicable retention period, phonejoy will securely delete or irreversibly anonymize your personal data in accordance with NPC-approved disposal procedures.

phonejoy implements a multi-layered security framework to protect your personal data from unauthorized access, disclosure, alteration, or destruction. Our security measures include:

• Encryption: All data transmitted between your device and the phonejoy Platform is encrypted using TLS 1.2 or higher. Stored personal data and financial records are encrypted at rest using AES-256;
• Access controls: Personal data is accessible only to phonejoy personnel and authorized processors with a legitimate operational need. Role-based access controls and audit logging are enforced;
• Two-factor authentication (2FA): Available to all players for account login protection. phonejoy strongly recommends enabling 2FA from your Account Security settings;
• Fraud monitoring: Real-time transaction monitoring systems flag unusual activity patterns, including login anomalies and suspicious payment behavior, for manual review;
• Penetration testing: The phonejoy Platform undergoes periodic security assessments by independent cybersecurity specialists to identify and remediate vulnerabilities;
• Incident response: phonejoy maintains a data breach response plan in accordance with NPC Circular No. 16-03. In the event of a breach affecting your personal data, you will be notified within 72 hours of phonejoy becoming aware of the incident, as required by NPC guidelines.

While phonejoy takes all reasonable precautions, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own login credentials and for reporting any suspected unauthorized account access promptly to [email protected].

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phonejoy. These rights are exercisable free of charge and phonejoy will respond to valid requests within fifteen (15) business days:

To exercise any of these rights, submit your request in writing to our DPO at [email protected] with subject line "Data Subject Rights Request." Please include your registered name, account email, and a clear description of the right you wish to exercise. Identity verification may be required before processing your request.

If you are unsatisfied with phonejoy's response, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

phonejoy's primary data processing infrastructure is located within the Philippines. Where it is operationally necessary to transfer personal data to servers or service providers located outside the Philippines — for example, cloud infrastructure operated in Singapore or Japan — phonejoy ensures that such transfers comply with the cross-border data transfer requirements of the Philippine Data Privacy Act.

Specifically, phonejoy applies the following safeguards to international transfers:

• Contracts with overseas processors include data protection clauses at least equivalent to Philippine DPA standards;
• Transfers are made only to countries or organizations that provide adequate levels of protection as recognized by the NPC or under binding corporate rules;
• Where required, phonejoy files the appropriate notifications with the NPC prior to cross-border data transfers.

The phonejoy Platform may display links to or integrate with third-party services such as game providers, payment gateways, and identity verification providers. Once you navigate to a third-party service or authorize a payment through GCash, Maya, or a bank platform, you are subject to that third party's own privacy policy — not this Policy.

phonejoy is not responsible for the privacy practices of any third-party service. We recommend reviewing the privacy policy of any third-party platform you interact with in connection with your phonejoy account, including GCash and Maya's respective data privacy terms.

phonejoy reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Material changes will be communicated to registered players via email to their registered address or via a prominent notice on the Platform, with not less than fourteen (14) days advance notice before the changes take effect.

The "Last Revised" date at the top of this Policy will always reflect the most recent update. Continued use of the phonejoy Platform after the effective date of a revised Policy constitutes acceptance of the updated terms. If you do not accept the changes, you should discontinue use and request account closure before the effective date.

phonejoy has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and the Philippine Data Privacy Act. You may contact our DPO for any privacy-related concerns, data subject rights requests, or questions about how phonejoy handles your personal data:

• Data Protection Officer — phonejoy
• Email: [email protected] (subject: "Privacy / DPO")
• Live Chat: Available 24/7 on phonejoy.co — Tagalog-speaking agents available
• Response Time: DPO acknowledges receipt within 3 business days; substantive response within 15 business days

You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you believe phonejoy has violated your rights under the Data Privacy Act.

This Privacy Policy was last revised on 1 January 2026. © 2026 phonejoy. All rights reserved.