Privacy Policy

1. Introduction

This Privacy Policy ("Policy") is issued by playfun ("playfun", "we", "us", "our"), the operator of the online gaming platform accessible at https://playfun.bio and all associated subdomains, mobile applications, and related digital services (collectively, the "Platform"). This Policy describes how playfun collects, processes, stores, discloses, and protects personal information relating to individuals who access or use the Platform ("you", "Player", "User").

playfun is committed to processing personal data in a manner consistent with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC). We treat your privacy as a fundamental obligation, not a compliance formality.

By registering an account on playfun, accessing the Platform, or providing personal information to us in any form, you acknowledge that you have read this Policy and consent to the collection, use, and processing of your personal data as described herein. If you do not agree to this Policy, please do not access or use the Platform.

2. Data Controller

For the purposes of the Data Privacy Act of 2012 and applicable privacy legislation, playfun acts as the Personal Information Controller (PIC) in respect of the personal data it collects and processes about players and visitors to the Platform. This means playfun determines the purposes and means of processing your personal information.

In certain circumstances, playfun may engage third-party service providers who process personal data on our behalf as Personal Information Processors (PIP). Such processors are bound by data processing agreements that restrict their use of your personal information to the specific purposes for which it was shared, and require them to apply security standards no less protective than those applied by playfun itself.

If you have any questions about how playfun handles your personal data, or wish to exercise any of your rights under this Policy, please contact our Data Protection Officer (DPO) using the details provided in Section 13 of this Policy.

3. Personal Data We Collect

playfun collects only the personal data that is necessary for the purposes described in this Policy. The categories of personal data we collect include the following:

3.1 Identity & Registration Data

• Full legal name as it appears on your government-issued identification document
• Date of birth (for age verification — you must be at least 21 years of age)
• Gender (optional, collected at registration)
• Nationality and country of residence
• Username chosen at registration

3.2 Contact Data

• Philippine mobile number (used for account verification, OTP delivery, and communications)
• Email address
• Residential address (collected during KYC verification)

3.3 Identity Verification (KYC) Data

• Copies of government-issued photo identification documents (e.g., Philippine passport, SSS ID, UMID, PhilSys National ID, driver's licence, Voter's ID, PRC ID)
• Proof of address documents (e.g., utility bills, bank statements, barangay certification)
• Selfie photographs submitted alongside identity documents where requested
• Proof of payment method ownership (e.g., GCash or PayMaya account screenshots showing registered name)

3.4 Financial Data

• Payment method identifiers (e.g., registered GCash mobile number, PayMaya account reference, bank account name for BPI, BDO, Metrobank, or UnionBank)
• Transaction history including deposit amounts, withdrawal requests, and dates
• Account balance information

playfun does not store full payment card numbers, CVV codes, or full online banking credentials. Payment processing is handled by regulated third-party payment processors who maintain their own security certifications.

3.5 Gaming Activity Data

• Game participation records including games played, wager amounts, and outcomes
• Bonus and promotion usage history
• Session duration and frequency data
• Responsible gaming tool settings (deposit limits, self-exclusion status, session reminders)

3.6 Technical & Device Data

• IP address and approximate geolocation derived therefrom
• Device type, operating system, and browser version
• Device fingerprint identifiers used to detect multiple accounts
• Log data including access timestamps, pages visited, and error logs

3.7 Communications Data

• Records of live chat conversations with the playfun support team
• Email correspondence submitted to playfun
• Feedback, complaint records, and dispute documentation

4. How We Collect Your Data

playfun collects personal data through the following channels:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or respond to a survey or promotion.
• Automatically — when you access and use the Platform, through cookies, server logs, and device fingerprinting technology. See Section 9 for details on cookies.
• From third-party payment providers — when you make a deposit or withdrawal, your payment provider may share transaction confirmation data with playfun to facilitate processing.
• From identity verification partners — playfun may engage accredited third-party KYC service providers to assist with document verification. These providers supply verification results to playfun under strict data processing agreements.
• From fraud prevention and anti-money laundering services — playfun may receive risk signals or alerts from licensed third-party compliance service providers as part of its AML and fraud detection obligations.

5. Purpose & Legal Basis for Processing

playfun processes your personal data only where there is a lawful basis for doing so under the Data Privacy Act of 2012 and its Implementing Rules. The table below summarizes the primary purposes for which we process your data and the corresponding legal basis:

Purpose	Legal Basis
Account registration and platform access	Performance of contract (your agreement with playfun)
Age verification (21+ requirement) and KYC compliance	Legal obligation; legitimate interest in regulatory compliance
Processing deposits and withdrawals	Performance of contract
Anti-money laundering (AML) and fraud prevention	Legal obligation under Philippine AML regulations
Responsible gaming monitoring and intervention	Legal obligation; legitimate interest in player welfare
Customer support and dispute resolution	Performance of contract; legitimate interest
Platform security and fraud detection	Legitimate interest in protecting the Platform and players
Sending promotional and marketing communications	Consent (you may withdraw at any time)
Analytics and Platform improvement	Legitimate interest (aggregated, anonymized data where possible)
Compliance with regulatory reporting obligations	Legal obligation

Where playfun relies on your consent as the legal basis for processing (such as for marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal, and it does not affect processing conducted on any other legal basis.

6. Data Sharing & Third-Party Disclosure

playfun does not sell, rent, or trade your personal information to any third party for commercial purposes. We may share your data only in the following specific circumstances:

6.1 Service Providers (Personal Information Processors)

playfun engages carefully selected third-party service providers to assist in operating the Platform. These include payment processing partners (GCash, PayMaya, and banking institutions), KYC and identity verification providers, fraud and AML screening services, cloud hosting and infrastructure providers, and customer support tooling providers. All such processors are contractually bound to process your data only as instructed by playfun and to implement appropriate technical and organizational security measures.

6.2 Regulatory and Law Enforcement Authorities

playfun may disclose personal data to government agencies, regulatory bodies, law enforcement authorities, or financial intelligence units where required to do so by law, court order, or binding regulatory directive. This includes disclosures required under Philippine anti-money laundering legislation, PAGCOR licensing requirements, and NPC directives.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of playfun's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will provide notice of any such transfer and the privacy commitments applicable to your data in the context of the transaction.

6.4 Protection of Rights

playfun may disclose personal data where it reasonably believes disclosure is necessary to protect the rights, property, or safety of playfun, its players, or the public — including for the purpose of detecting, preventing, or addressing fraud, security breaches, or other prohibited conduct.

7. Data Retention

playfun retains personal data for no longer than is necessary to fulfill the purposes for which it was collected, subject to any longer retention periods required by applicable law or regulation. The following general retention guidelines apply:

• Account and identity data: Retained for the duration of your active account relationship with playfun, and for a minimum of five (5) years following permanent account closure, in accordance with applicable AML recordkeeping obligations.
• KYC verification documents: Retained for a minimum of five (5) years from the date of verification, as required under Philippine AML regulations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Support communications: Retained for three (3) years from the date of the last interaction, unless a longer period is required for dispute resolution or regulatory purposes.
• Technical and device logs: Retained for up to twelve (12) months, after which they are anonymized or deleted.
• Marketing consent records: Retained for the duration of your consent plus three (3) years, to demonstrate compliance with consent requirements.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized using industry-standard data destruction methods.

8. Security Measures

playfun implements a comprehensive set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption in transit: All data transmitted between your device and the playfun Platform is encrypted using Transport Layer Security (TLS) protocol version 1.3 or higher.
• Encryption at rest: Sensitive personal data stored in playfun's systems, including KYC documents and financial records, is encrypted at rest using AES-256 or equivalent standards.
• Access controls: Access to personal data within playfun's internal systems is restricted on a need-to-know basis. Staff with access to sensitive data are subject to confidentiality obligations and undergo regular security awareness training.
• Multi-factor authentication: Administrative access to systems containing personal data requires multi-factor authentication.
• Penetration testing and vulnerability management: playfun conducts periodic security assessments and maintains a vulnerability management program to identify and remediate potential security weaknesses.
• Incident response: playfun maintains a data breach response plan. In the event of a personal data breach that is likely to adversely affect your rights or freedoms, we will notify the NPC and affected individuals in accordance with the Data Privacy Act's breach notification requirements.

While playfun applies robust security controls, no digital platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials and for ensuring that the devices you use to access the Platform are adequately secured.

9. Cookies & Tracking Technologies

playfun uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file stored on your device when you visit a website. The following categories of cookies are used on the Platform:

Cookie Type	Purpose	Can Be Disabled?
Strictly Necessary	Required for the Platform to function. Includes session authentication tokens, security tokens, and load-balancing cookies.	No — disabling these will prevent login and core functionality.
Functional	Remember your language preferences, account settings, and responsible gaming tool configurations across sessions.	Yes, but doing so may reduce platform personalization.
Analytical / Performance	Collect anonymized data about how players use the Platform (pages visited, session duration, error frequency) to help playfun improve service quality.	Yes — opt out via cookie settings.
Security & Fraud Prevention	Device fingerprinting and behavioral signals used to detect multiple accounts, bot activity, and unauthorized access attempts.	No — these are necessary for platform integrity.

playfun does not use third-party advertising cookies or retargeting pixels. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the Platform. Your continued use of the Platform after being presented with a cookie consent notice constitutes your consent to the use of non-essential cookies as described above.

10. Your Rights as a Data Subject

Under the Data Privacy Act of 2012 (Republic Act No. 10173), you have the following rights with respect to your personal data held by playfun:

• Right to be Informed: You have the right to be informed that your personal data is being collected and processed, including the purpose and legal basis for such processing. This Policy fulfills that obligation.
• Right of Access: You have the right to request a copy of the personal data playfun holds about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. Certain data (such as your legal name and date of birth) may require supporting documentation before correction is applied.
• Right to Erasure / Right to be Forgotten: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where consent has been withdrawn (and there is no other legal basis for processing), or where processing is unlawful. This right is subject to playfun's legal retention obligations.
• Right to Object: You have the right to object to processing of your personal data carried out on the basis of legitimate interest, including processing for direct marketing purposes. Objection to marketing will be honored immediately.
• Right to Data Portability: Where technically feasible, you may request a copy of personal data you have provided to playfun in a structured, commonly used, machine-readable format.
• Right to Lodge a Complaint: If you believe playfun has mishandled your personal data, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any of the above rights, please contact playfun's Data Protection Officer via the live chat channel on the Platform or by email at the address provided in Section 13. We will respond to all valid requests within fifteen (15) business days. We may require you to verify your identity before fulfilling certain requests.

11. Minors & Age Restriction

The playfun Platform is strictly intended for individuals who are at least 21 years of age. We do not knowingly collect, process, or retain personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process.

If playfun becomes aware that personal data has been collected from an individual under the age of 21, we will immediately suspend the associated account, void any associated balances in accordance with our Terms & Conditions, and securely delete the minor's personal data from our systems, except where retention is required for the purpose of reporting the incident to the relevant authorities.

If you are a parent or guardian and believe that a minor in your care has accessed or registered on the playfun Platform, please contact us immediately via live chat or at the contact details provided in Section 13 so that we may take prompt remedial action.

12. Changes to This Privacy Policy

playfun reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made to this Policy, we will provide notice to registered players through one or more of the following channels: a prominent notice on the Platform upon login, an in-platform notification, or an email to your registered address.

The "Last Updated" date at the top of this Policy will always reflect the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the changes. If you do not agree to a revised Policy, you must discontinue use of the Platform and may request account closure via live chat.

Prior versions of this Privacy Policy are available upon request by contacting our Data Protection Officer.

13. Contact Us & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or playfun's handling of your personal data, you may contact us through the following channels:

• Live Chat: Available 24/7 directly on the playfun Platform. Average response time: 3–5 minutes. This is the fastest channel for urgent data subject requests.
• Email (Data Protection Officer): [email protected] — please include "Privacy / DPO Request" in your subject line for faster routing. Response time: within 5 business days for DPO matters.

When submitting a data subject request, please provide your registered username and mobile number so that we can verify your identity and locate your records efficiently. Do not include passwords or full financial account numbers in any written communications to us.

For concerns that remain unresolved after engaging with the playfun Data Protection Officer, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, the regulatory body responsible for enforcing the Data Privacy Act of 2012.

For platform-related questions including account management, game rules, payment processing, and responsible gaming tools, please visit our FAQ page or our Responsible Gaming page.