Privacy Policy

This Privacy Policy applies to all personal data processed by pp222 in connection with the operation of the pp222 online gaming platform accessible at https://pp222.bio, including all sub-pages, account management functions, gaming interfaces, and support channels.

The data controller for all personal data collected through the pp222 platform is the operator of pp222, a PAGCOR-regulated online gaming entity serving the Philippines market. References to "pp222", "we", "us", or "our" in this Privacy Policy refer to that entity and its authorised data processors acting on its behalf.

This Privacy Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, and its Implementing Rules and Regulations (IRR), as well as relevant issuances of the National Privacy Commission (NPC) of the Philippines. It also reflects pp222's obligations under PAGCOR's data governance requirements for licensed online gaming operators.

pp222 collects personal data through several channels: directly from you during registration and account management, automatically through your use of the platform, and from third-party verification and payment service providers. The categories of data collected and their sources are set out below.

Under the Data Privacy Act of 2012, pp222 must identify a lawful basis for every category of personal data it processes. The primary legal bases applicable to pp222's data processing activities are as follows:

• Contractual Necessity (Section 12(b), RA 10173): Processing required to create and maintain your pp222 account, process deposits and withdrawals, deliver gaming services, and administer your account in accordance with the Terms and Conditions you accepted at registration.
• Legal Obligation (Section 12(c), RA 10173): Processing required to comply with PAGCOR licensing conditions, Anti-Money Laundering Act obligations, NPC regulatory requirements, and any applicable court orders or lawful directives from Philippine government authorities.
• Legitimate Interests (Section 12(f), RA 10173): Processing necessary for fraud detection and prevention, platform security, responsible gaming monitoring, and improving the quality and reliability of pp222's services, where such interests are not overridden by your data protection rights.
• Consent (Section 12(a), RA 10173): Processing for non-essential marketing communications and certain analytics activities, where you have provided explicit opt-in consent. You may withdraw this consent at any time via your account settings without affecting any other aspect of your account.

Where pp222 relies on legitimate interests as the legal basis for processing, we conduct a balancing test to ensure that our interests do not override your fundamental rights and freedoms. Documentation of these balancing tests is maintained by pp222's Data Privacy Officer and is available on request.

pp222 uses the personal data it collects exclusively for documented, legitimate purposes. The primary purposes and the data categories they draw on are as follows:

• Account Creation and Verification: Identity Data, Contact Data, and KYC Documents are used to register your account, verify your eligibility (including the 21+ age requirement), and comply with PAGCOR's player onboarding standards.
• Payment Processing and Fraud Prevention: Financial Data is used to process your deposits via GCash, PayMaya, BPI, BDO, and Metrobank, to verify withdrawal beneficiary identity, and to detect and investigate suspicious or fraudulent transactions.
• Service Delivery and Personalisation: Gaming Activity Data and Technical Data are used to deliver games, maintain session continuity, and surface game recommendations based on your activity history within the platform.
• Responsible Gaming Compliance: Gaming Activity Data and responsible gaming limit settings are monitored to identify indicators of problem gambling behaviour, to enforce limits you have set, and to fulfil pp222's obligations under PAGCOR's responsible gaming framework.
• Customer Support: Communications Data and Account Data are used to respond to your enquiries, process complaints, and improve support quality through periodic review of interaction records.
• Regulatory Reporting: Identity Data, Financial Data, and Gaming Activity Data may be reported to PAGCOR or the Anti-Money Laundering Council (AMLC) as required by applicable Philippine law.
• Marketing (Consent-Based Only): Where you have opted in, Contact Data and Marketing Preferences are used to send you information about pp222 promotions, new game releases, and platform updates. You may opt out at any time.
• Platform Security and Analytics: Technical Data is used to monitor for unauthorised access, investigate security incidents, and analyse aggregate platform usage patterns to improve performance and stability.

pp222 does not sell your personal data. We share personal data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• Payment Service Providers: GCash (Mynt), PayMaya (Maya Bank), BPI, BDO, and Metrobank receive transactional data necessary to process your deposits and withdrawals. These entities are regulated by the Bangko Sentral ng Pilipinas (BSP) and are bound by their own regulatory data protection obligations.
• KYC and Identity Verification Partners: Third-party identity verification service providers process your KYC documents on pp222's behalf under strict data processing agreements that prohibit any secondary use of your information.
• Game Content Providers: Third-party game studios whose games are hosted on pp222's platform may receive your player session identifier (a pseudonymous token, not your full identity) to manage game sessions and return real-time results.
• Regulatory Authorities: PAGCOR, the AMLC, the NPC, and other competent Philippine government authorities may receive your data pursuant to lawful orders, regulatory reporting obligations, or investigation mandates.
• IT Infrastructure and Cloud Providers: pp222 uses third-party cloud infrastructure providers to host its platform. These providers act as data processors under binding agreements and are not permitted to access or use your data independently.
• Legal and Compliance Advisors: In connection with legal proceedings, regulatory investigations, or compliance reviews, pp222 may share relevant personal data with its legal counsel and compliance consultants under professional confidentiality obligations.

pp222 uses cookies and similar tracking technologies on its platform. Cookies are small text files placed on your device that enable the platform to recognise your browser session and maintain certain settings and preferences.

The types of cookies used by pp222 are as follows:

• Strictly Necessary Cookies: These are required for the platform to function. They maintain your authenticated login session, preserve your responsible gaming settings, and ensure security token validation. These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: These remember your language preferences, last-played games, and display settings to provide a more personalised experience on subsequent visits.
• Analytical Cookies: pp222 uses privacy-respecting analytics tools to understand aggregate usage patterns — such as which games are most popular across its Filipino player base — and to identify technical issues. These do not link to personally identifiable information.
• Security Cookies: Used to detect anomalous login behaviour, support fraud detection, and implement bot-prevention measures that protect all pp222 players.

You can manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will impair your ability to log in and use core platform features. pp222 does not use third-party advertising cookies or cross-site tracking pixels.

pp222 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulation. The following retention periods apply:

• Account and Identity Data: Retained for the duration of your active account plus a minimum of five years following account closure, in compliance with PAGCOR record-keeping requirements and the Anti-Money Laundering Act.
• KYC Documents: Retained for a minimum of five years from the date of verification or account closure (whichever is later), in line with AMLC and PAGCOR obligations.
• Financial Transaction Records: Retained for a minimum of five years from the date of each transaction, as required by the Anti-Money Laundering Act and BSP regulations applicable to licensed gaming operators.
• Gaming Activity Logs: Retained for five years for regulatory compliance and responsible gaming monitoring purposes.
• Customer Support Communications: Retained for two years from the date of the last interaction, or longer where the communication relates to an ongoing dispute or regulatory matter.
• Marketing Consent Records: Retained for the duration of your account plus one year after account closure, to demonstrate compliance with consent requirements.
• Technical and Server Log Data: Retained for a maximum of 12 months from generation, after which it is automatically deleted unless relevant to an active security investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised using methods that prevent re-identification. Where anonymisation is used, the resulting data may be retained indefinitely for statistical and research purposes without restriction.

pp222 implements a layered security framework to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key technical and organisational measures in place include:

• Transport Layer Security (TLS): All data transmitted between your device and pp222's servers is encrypted using current-generation TLS protocols, ensuring that your login credentials, payment details, and personal information cannot be intercepted in transit.
• Encryption at Rest: Personal data stored in pp222's databases — including KYC documents and financial records — is encrypted at rest using AES-256 or equivalent industry-standard algorithms.
• Role-Based Access Control: Access to personal data within pp222's systems is restricted on a strict need-to-know basis. Staff members are granted access only to the data categories required for their specific roles. All access is logged and periodically audited.
• Multi-Factor Authentication: Administrative access to systems holding personal data requires multi-factor authentication. pp222 also makes MFA available to players for their own account security.
• Penetration Testing and Vulnerability Management: pp222's platform and infrastructure undergo regular security assessments, including periodic penetration testing by qualified security professionals.
• Data Processing Agreements: All third-party processors who handle personal data on pp222's behalf are bound by written data processing agreements that require them to implement equivalent security measures and prohibit secondary use of the data.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by pp222. These rights may be exercised by contacting pp222's Data Privacy Officer as described in Section 13 of this Policy.

• Right to Be Informed: You have the right to be informed of how your personal data is collected, used, stored, and shared. This Privacy Policy fulfils that obligation, and pp222's support team is available to answer specific questions about data processing.
• Right to Access: You may request a copy of the personal data pp222 holds about you, including information on the purposes of processing, the categories of data held, and the recipients to whom it has been disclosed.
• Right to Correction / Rectification: You may request correction of any inaccurate, outdated, or incomplete personal data. For most account information, self-service correction is available via the account settings panel after pp222 login.
• Right to Erasure or Blocking: You may request the deletion or blocking of personal data where it is no longer necessary for the purpose for which it was collected, where consent has been withdrawn, or where the processing is unlawful. Note that pp222 may be required to retain certain data beyond your erasure request where PAGCOR or AMLC regulatory obligations apply.
• Right to Object: You may object to processing carried out on the basis of pp222's legitimate interests, including profiling for responsible gaming monitoring. Where you object, pp222 will cease that processing unless it can demonstrate compelling legitimate grounds.
• Right to Data Portability: You may request a copy of personal data you have provided to pp222 in a structured, commonly used, and machine-readable format where technically feasible.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC) at privacy.gov.ph if you believe pp222 has processed your data in breach of the Data Privacy Act.

pp222 will respond to all data subject requests within 15 business days of receipt. Where a request is complex or requires additional verification of the requestor's identity, pp222 may extend this period by a further 15 business days with written notice.

pp222 is strictly an adult gaming platform. Real-money gaming services are restricted to persons aged 21 years and above, in accordance with PAGCOR regulations governing online gaming in the Philippines. pp222 does not knowingly collect, store, or process personal data of individuals below the age of 21.

Age verification is conducted during the KYC process prior to enabling withdrawal functionality. Where pp222 has reasonable grounds to believe that an account holder is below the age of 21, the account will be suspended immediately pending verification. If a minor is confirmed to have registered, the account will be permanently closed and any deposited funds returned to the originating payment method after investigation.

Parents and guardians who have reason to believe that a minor has registered on pp222 are encouraged to contact pp222 support immediately for investigation and account closure.

pp222 operates a platform that may involve the use of infrastructure, game content providers, and technology partners whose systems are located in jurisdictions outside the Philippines. As a result, your personal data may be transferred to and processed in countries other than the Philippines.

Where personal data is transferred outside the Philippines, pp222 ensures that such transfers comply with the requirements of the Data Privacy Act and NPC regulations, including the implementation of one or more of the following safeguards:

• Binding contractual clauses in data processing agreements that impose Data Privacy Act-equivalent obligations on overseas recipients.
• Transfer to recipients in jurisdictions that have been assessed as providing an adequate level of data protection equivalent to Philippine standards.
• Transfer that is necessary for the performance of your player account contract, including the processing of payment transactions through international card networks.

Details of the safeguards applicable to any specific cross-border transfer are available from pp222's Data Privacy Officer upon written request.

pp222 may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, or platform operations. When material changes are made, pp222 will publish the revised Policy on this page with an updated Effective Date, and will notify registered players via the email address on record.

Your continued use of the pp222 platform following the publication of a revised Privacy Policy constitutes your acknowledgment of and agreement to the updated terms, subject to your right to object or request account closure under Section 9 of this Policy.

We encourage you to review this Privacy Policy periodically. The current version is always accessible at https://pp222.bio/privacy-policy.

pp222 has appointed a Data Privacy Officer (DPO) in compliance with Section 21 of the Data Privacy Act of 2012. The DPO is responsible for overseeing pp222's data protection compliance programme and is the designated point of contact for all data subject rights requests, privacy enquiries, and data breach notifications.

To exercise any of your rights under Section 9 of this Policy, or to raise a privacy-related concern, you may contact pp222 through the following channels:

• Live Chat (Fastest Response): Available 24 hours a day, 7 days a week, via the pp222 platform. For data subject requests, state "Data Privacy Request" at the start of your message to ensure routing to the DPO's queue.
• Email: [email protected] — mark the subject line as "Data Privacy Request — [Your Account Username]" for priority handling. Responses to data subject requests are provided within 15 business days.
• Escalation to NPC: If you are not satisfied with pp222's response to your data privacy concern, you have the right to file a complaint with the National Privacy Commission of the Philippines. Information on the NPC complaints process is available at privacy.gov.ph.