25superph Privacy Policy

This Privacy Policy ("Policy") is issued by 25superph ("we," "us," "our," or "Company") and governs the collection, use, disclosure, storage, and protection of personal data of users ("you," "Player," or "Data Subject") who access or interact with the 25superph online gaming platform at 25superph.org, including all services, games, features, support channels, and promotional communications made available through the Platform.

25superph is committed to protecting the privacy and personal data of all Filipino players who trust us with their information. We process personal data only for legitimate, specified purposes — primarily to provide our gaming services, comply with Philippine regulatory requirements, and maintain the security and integrity of the Platform for all users.

This Policy should be read in conjunction with the 25superph Terms and Conditions, which form part of our overall agreement with you regarding your use of the Platform. By registering an account, making a deposit, or otherwise using any feature of the 25superph Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

25superph processes the personal data of Filipino players in accordance with the following applicable Philippine laws and regulations:

• Republic Act No. 10173 — Data Privacy Act of 2012 (DPA): The primary Philippine legislation governing the processing of personal data. The DPA establishes the rights of data subjects, the obligations of personal information controllers and processors, and the enforcement role of the National Privacy Commission (NPC).
• Implementing Rules and Regulations of the DPA (IRR): The detailed implementing rules issued by the NPC that govern how the DPA is applied in practice by organisations processing Philippine personal data.
• Republic Act No. 9160 — Anti-Money Laundering Act (AMLA), as amended: Requires 25superph to collect, retain, and where directed, disclose certain transaction and identity records to the Anti-Money Laundering Council (AMLC) as part of the Philippines' financial crime prevention framework.
• PAGCOR Regulations: Requirements imposed on online gaming operators by the Philippine Amusement and Gaming Corporation relating to player identification, age verification, transaction records, and responsible gaming data.

25superph is registered as a Personal Information Controller with the National Privacy Commission of the Philippines. Our data processing activities are subject to NPC oversight, and players have the right to lodge complaints with the NPC regarding our handling of their personal data.

25superph collects the following categories of personal data from Players, depending on the stage of their interaction with the Platform:

Sensitive Personal Information: Government-issued ID numbers, photographs, and financial account details are classified as sensitive personal information under the Philippine Data Privacy Act. 25superph applies heightened security and access controls to all sensitive personal information collected from Players.

Voluntary Data: Certain data — such as marketing preferences and optional profile details — is provided voluntarily by the Player. Declining to provide this optional data will not prevent account registration or access to gaming services, though it may affect the personalisation of marketing communications.

25superph collects personal data from the following sources:

• Directly from You: When you complete the 25superph registration form, submit KYC verification documents, make a deposit or withdrawal request, contact our support team via live chat or email, respond to a promotion, or update your account profile settings.
• Automatically from Platform Use: When you access or browse the 25superph website or play games, our servers and analytics systems automatically collect technical data including your IP address, device identifiers, browser characteristics, and session activity logs. This data is collected through server logs, cookies, and similar tracking technologies.
• From Payment Processors: When you transact via GCash, Maya, BPI, BDO, or other supported Philippine payment channels, our payment processing partners transmit transaction confirmation data and, in some cases, partial payment method identifiers, to enable correct crediting and withdrawal processing.
• From Identity Verification Partners: 25superph may use third-party KYC verification services to assist in validating the authenticity of identity documents submitted by Players. These partners process document images on 25superph's behalf and return verification outcomes to our compliance team.
• From Fraud Prevention Systems: Automated risk and fraud detection systems generate data about the risk profile of account activities, login events, and transaction patterns, which is processed to protect both the Platform and individual Players from fraud.

25superph processes personal data only for specified, legitimate purposes. The table below sets out the primary purposes for which we use each category of data collected from Filipino players:

25superph does not sell, rent, or trade personal data to third-party commercial entities for their own marketing or commercial purposes. We do not use Player data for targeted advertising on third-party platforms without your explicit separate consent.

Under the Philippine Data Privacy Act, 25superph relies on one or more of the following lawful bases for each processing activity involving your personal data:

• Contractual Necessity: Processing that is necessary to perform our contract with you — specifically, the 25superph Terms and Conditions — including account creation, authentication, deposit processing, game delivery, withdrawal processing, and customer support.
• Legal Obligation: Processing required to comply with obligations imposed by Philippine law, including KYC and AML compliance obligations under the AMLA, PAGCOR regulatory requirements, and data retention obligations under applicable legislation.
• Legitimate Interests: Processing that is necessary for 25superph's legitimate business interests — including fraud detection and prevention, Platform security, responsible gaming monitoring, and analytics for service improvement — where those interests are not overridden by your fundamental privacy rights.
• Consent: Processing for purposes that go beyond contractual or legal necessity — primarily marketing communications and promotional profiling — where we have obtained your freely given, specific, informed, and unambiguous consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

25superph does not sell your personal data. We share personal data only in the following circumstances and only to the extent necessary for each purpose:

• Payment Processors: GCash (Mynt / Globe Fintech Innovations), Maya (PayMaya Philippines), BPI, BDO, and other Philippine payment service providers that process your deposits and withdrawals. These processors are bound by confidentiality obligations and applicable Philippine financial regulation.
• KYC and Identity Verification Partners: Third-party identity verification services that assist our compliance team in reviewing and validating KYC documents. These partners process data as personal information processors on our behalf, subject to data processing agreements consistent with the DPA.
• Game Studios and Platform Providers: Third-party game studios (including JILI, Pragmatic Play, PG Soft, and Evolution Gaming) whose game software is integrated into the 25superph Platform. Data shared with studios is limited to the minimum necessary for game delivery and RNG certification compliance.
• Fraud and Risk Management Systems: Automated fraud prevention and risk management platforms that assist 25superph in detecting and preventing fraudulent transactions, account takeovers, and money laundering activity.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies where disclosure is required by law, court order, or regulatory directive.
• Legal and Professional Advisers: Lawyers, auditors, and other professional service providers engaged by 25superph in connection with legal proceedings, compliance reviews, or corporate transactions, subject to professional confidentiality obligations.

All third-party recipients of personal data are required to maintain appropriate security safeguards and are prohibited from using the data for any purpose other than the specific purpose for which it was shared. International transfers of data (outside the Philippines) are subject to standard contractual clauses or other appropriate transfer mechanisms approved under the DPA's IRR.

25superph retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal obligations, and to resolve disputes or enforce our agreements. The following general retention periods apply:

After applicable retention periods expire, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original personal information. Anonymised and aggregated data (which cannot be used to identify any individual) may be retained indefinitely for statistical and analytics purposes.

25superph implements a multi-layered security framework to protect the personal data of Filipino players against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security measures include:

• Encryption in Transit: All data transmitted between your device and the 25superph Platform is encrypted using TLS 1.2 or TLS 1.3 (HTTPS). Plain HTTP connections are not accepted on any 25superph page that handles personal or financial data.
• Encryption at Rest: Sensitive personal data and financial records stored in 25superph's database infrastructure are encrypted at rest using AES-256 encryption.
• Access Controls: Personal data is accessible only to 25superph staff and contractors who require it to perform their specific job function. Role-based access control is enforced across all internal systems, and all access is logged and subject to periodic audit.
• Two-Factor Authentication: All 25superph internal staff accounts with access to personal data systems require two-factor authentication. Players are strongly encouraged to enable 2FA on their own accounts via Account Settings.
• Penetration Testing: 25superph conducts periodic external security assessments of its Platform and data infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Security Incident Response: 25superph maintains a formal security incident response plan. In the event of a personal data breach that is likely to adversely affect Players, 25superph will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected Players without undue delay.

While 25superph applies industry-standard security measures, no online system can guarantee absolute security. Players are also responsible for protecting their own account credentials, maintaining device security, and promptly reporting any suspected unauthorised access to their 25superph account.

The 25superph Platform uses cookies and similar technologies to deliver, optimise, and secure the service. A cookie is a small text file placed on your device by a website server. Cookies cannot execute programs or introduce viruses to your device.

25superph uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in to your 25superph account, and security cookies used to detect fraudulent account activity. These cookies cannot be disabled without disabling core Platform functionality.
• Functional Cookies: Remember your preferences — such as language settings, lobby filters, and last-played games — to provide a more personalised Platform experience between sessions.
• Analytics Cookies: Collect anonymised or pseudonymised data about how Players navigate and use the 25superph Platform. This data helps us identify performance issues, understand player behaviour, and improve the user experience. Analytics data is not used to identify individual players.
• Marketing Cookies: Used only where you have given explicit consent, to track interactions with promotional content and inform the relevance of bonus offers and marketing messages. You can withdraw consent for marketing cookies at any time via the cookie preference centre.

You can manage your cookie preferences via your browser settings. Note that disabling strictly necessary cookies may prevent access to your account or disrupt core Platform features. For more detail on specific cookies used on the 25superph Platform, access the cookie preference centre available in the footer of the Platform.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 25superph. These rights are not absolute and may be subject to limitations where legal obligations or third-party rights apply:

To exercise any of the rights above, contact 25superph's Data Protection Officer via the email address set out in Section 15 of this Policy. We will verify your identity before processing your request and will respond within the timeframes prescribed by the DPA.

The 25superph Platform is strictly restricted to persons aged twenty-one (21) years and above, in accordance with PAGCOR regulations governing real-money online gambling in the Philippines. 25superph does not knowingly collect, process, or store the personal data of anyone under the age of 21.

Age verification is conducted at registration through a declaration of date of birth and is confirmed through documentary identity verification during the KYC process. Any account found to belong to a person under the age of 21 will be immediately closed, any balance forfeited in accordance with the Terms and Conditions, and all collected data will be deleted to the extent permitted by applicable law.

If you are a parent or guardian and believe that a minor under your care has registered or attempted to register on the 25superph Platform, please contact our support team immediately via live chat or the email address in Section 15 so that we can take prompt action.

The 25superph Platform may contain references or functional integrations with third-party services, including payment gateways (GCash, Maya), identity verification platforms, and game studio delivery networks. These third-party services operate under their own privacy policies, which are independent of this Policy. 25superph is not responsible for the privacy practices of third-party services and encourages Players to review the privacy policies of any third-party service they interact with in connection with their 25superph account.

Where third parties act as personal information processors on behalf of 25superph — for example, KYC verification partners — they are contractually bound to process data only in accordance with 25superph's instructions and to maintain security standards consistent with this Policy and the DPA.

25superph reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable Philippine law, or updates to our Platform services. Material changes to this Policy will be notified to Players via the email address registered to their account and/or via a prominent notice on the 25superph Platform homepage, no less than seven (7) days prior to the effective date of the change.

The updated Privacy Policy will always be available at 25superph.org/privacy-policy with the effective date clearly indicated at the top of the document. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree to the updated Policy, you should cease using the Platform and may request account closure in accordance with the 25superph Terms and Conditions.

The version history of this Policy is maintained by 25superph's Data Protection Officer and is available on request.

25superph has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Philippine Data Privacy Act and for handling data subject rights requests, privacy inquiries, and data breach notifications. If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the 25superph DPO:

For regulatory complaints relating to our data processing practices, you may also contact the National Privacy Commission of the Philippines (NPC) through their official government channels and website.