Privacy Policy

1 Introduction

1.1 magicph ("magicph", "we", "us", "our") is committed to protecting the privacy and personal data of all individuals who interact with the magicph Platform, including registered members, prospective players, and visitors to the website at magicph.club.

1.2 This Privacy Policy ("Policy") is issued in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations ("IRR"), and the relevant issuances of the National Privacy Commission ("NPC") of the Philippines.

1.3 This Policy applies to all personal data collected through the magicph Platform, including via the website, mobile browser interface, customer support channels, and any other means through which you interact with magicph. It should be read together with the magicph Terms & Conditions and Responsible Gaming Policy.

2 Data Controller

2.1 The data controller responsible for your personal data processed in connection with the magicph Platform is the legal entity operating magicph, duly incorporated and registered under Philippine law, holding a valid gaming license issued by the Philippine Amusement and Gaming Corporation (PAGCOR).

2.2 As data controller, magicph determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data protection laws. Where magicph engages third-party service providers to process data on its behalf, such parties act as data processors under written agreements that impose equivalent data protection obligations.

3 Personal Data We Collect

3.1 magicph collects the following categories of personal data:

3.2 magicph does not intentionally collect sensitive personal data (as defined under RA 10173) beyond what is strictly required for PAGCOR-mandated identity verification. Where sensitive personal data such as government ID numbers are collected, they are processed solely for KYC compliance purposes and are stored with enhanced security controls.

4 How We Collect Your Data

4.1 magicph collects personal data through the following means:

• Direct provision: Data you submit during account registration, KYC verification, deposit/withdrawal forms, support inquiries, or promotional opt-ins;
• Automated collection: Technical data collected automatically when you access or use the Platform, including cookies, log files, and session analytics;
• Third-party sources: Identity verification agencies, payment processors (GCash, PayMaya, BPI, BDO, Metrobank), and fraud detection service providers where necessary for KYC and AML compliance;
• Regulatory sources: PAGCOR or other Philippine government agencies where legally required, for example in connection with self-exclusion registries.

5 Purposes of Processing

5.1 magicph processes your personal data for the following purposes:

• Creating, verifying, and managing your magicph account;
• Processing deposits, withdrawals, and related financial transactions in Philippine Pesos (PHP);
• Fulfilling PAGCOR-mandated KYC and AML compliance obligations, including identity and source-of-funds verification;
• Detecting, investigating, and preventing fraud, money laundering, underage access, and other illegal activity;
• Providing customer support and responding to your inquiries through live chat and email;
• Administering bonuses, promotions, loyalty programs, and VIP rewards;
• Personalizing your gaming experience, including game recommendations and interface preferences;
• Sending service communications — including account notifications, security alerts, and transaction confirmations — where required;
• Sending marketing communications where you have provided consent, including promotions relevant to PBA, UFC, slots, and other preferred content;
• Maintaining responsible gaming tools, including deposit limit enforcement and self-exclusion records;
• Conducting platform analytics to improve product performance, game selection, and user experience;
• Complying with applicable Philippine law, including data retention obligations under AML regulations.

6 Legal Basis for Processing

• Contractual necessity: Processing required to perform our contract with you — operating your account, processing transactions, and providing gaming services;
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, AML laws (AMLA RA 9160 as amended), and other applicable Philippine legal requirements;
• Legitimate interests: Processing necessary for fraud prevention, platform security, responsible gaming enforcement, and business analytics — where such interests are not overridden by your privacy rights;
• Consent: Processing for marketing communications and non-essential cookies, where your freely given, informed consent has been obtained and can be withdrawn at any time.

7 Data Sharing and Disclosure

7.1 magicph does not sell, rent, or trade your personal data to third parties for their own marketing purposes. Personal data is shared only in the following circumstances:

• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, Visa/Mastercard, and USDT network providers, solely to process your deposit and withdrawal transactions;
• Identity verification providers: Third-party KYC and AML screening services engaged to assist with PAGCOR-mandated verification obligations;
• Game software providers: Providers of casino game software integrated into the magicph Platform, who may receive session-level gaming data necessary to operate their games;
• IT and security service providers: Cloud hosting, cybersecurity, fraud detection, and platform analytics providers engaged under data processing agreements;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), Philippine law enforcement agencies, and courts of competent jurisdiction, where disclosure is required by law or court order;
• Corporate transactions: Successor entities in connection with a merger, acquisition, or sale of all or substantially all assets, where the acquiring entity assumes equivalent data protection obligations.

7.2 All third-party service providers engaged by magicph to process personal data on its behalf are subject to written data processing agreements requiring them to process personal data only on magicph's documented instructions and to implement appropriate technical and organizational security measures.

8 International Data Transfers

8.1 The magicph Platform is operated primarily from within the Philippines. Some of our third-party service providers — including cloud infrastructure and game software providers — may process data in jurisdictions outside the Philippines.

8.2 Where personal data is transferred outside the Philippines, magicph ensures that appropriate safeguards are in place as required by the DPA and NPC regulations, including contractual data protection clauses, adequacy determinations, or equivalent protective mechanisms.

8.3 By using the magicph Platform, you acknowledge that your personal data may be transferred to, stored in, or processed in jurisdictions outside the Philippines, subject to the safeguards described above.

9 Data Retention

9.1 magicph retains personal data for the following periods:

9.2 Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized such that it can no longer be attributed to an identifiable individual.

10 Security Measures

• Encryption: All data in transit is encrypted using TLS 1.2 or higher (256-bit SSL). Sensitive data at rest, including ID documents and financial records, is encrypted using AES-256;
• Access controls: Access to personal data is restricted on a need-to-know basis, with role-based access controls and multi-factor authentication required for all staff accessing production systems;
• Two-factor authentication: SMS-based OTP two-factor authentication is available — and triggered for new device logins — for all player accounts;
• Security audits: Regular vulnerability assessments and penetration tests are conducted by independent security specialists;
• Incident response: magicph maintains a documented data breach response plan. In the event of a personal data breach that creates a real risk of harm, affected individuals and the NPC will be notified within the timeframes required by RA 10173.

10.1 While magicph employs robust security measures, no online platform can guarantee absolute security. You are responsible for maintaining the security of your magicph login credentials. If you suspect unauthorized access to your account, contact magicph's 24/7 customer support immediately.

11 Cookies & Tracking Technologies

11.1 magicph uses cookies and similar tracking technologies on the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for core Platform functionality including session management, authentication, and security. These cannot be disabled without impeding Platform use;
• Functional cookies: Used to remember your preferences such as language settings, game display options, and notification configurations;
• Analytical cookies: Used to collect aggregated, anonymized data about how visitors use the Platform, including pages visited, session duration, and error reports, to improve Platform performance;
• Session replay and heatmap tools: Used on an aggregated and anonymized basis to identify UX issues. No personal gameplay data is captured by these tools.

11.2 magicph does not use third-party advertising or tracking cookies for serving targeted advertisements to users on external platforms. No personal data collected via cookies is sold to advertisers.

11.3 You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use core Platform features including login and payment processing.

12 Minors and Age Restriction

12.1 Age verification is a mandatory component of the KYC process for all magicph accounts. Registration requires submission of a valid Philippine government-issued ID confirming the applicant is at least 21 years of age. Withdrawal functionality is disabled until age has been verified.

12.2 If magicph becomes aware that personal data has been collected from an individual under the age of 21, such data will be promptly deleted, the associated account will be closed, and any funds held will be returned in accordance with applicable law and PAGCOR guidelines.

12.3 If you believe that magicph has inadvertently collected data from a minor, please contact our Data Protection Officer at the contact details in Section 14 immediately.

13 Your Data Subject Rights

13.1 Under the Philippine Data Privacy Act (RA 10173), you have the following rights in relation to your personal data held by magicph. To exercise any of these rights, contact our Data Protection Officer as described in Section 14.

• Right to Access You have the right to obtain confirmation of whether magicph holds personal data about you, and to receive a copy of that data in a commonly used electronic format.
• Right to Rectification You have the right to request correction of inaccurate or incomplete personal data held about you. For some data categories (e.g., identity data), corrections require supporting documentation.
• Right to Erasure You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. Note that this right may be limited where retention is required by PAGCOR or AML law.
• Right to Object You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests where your specific situation warrants it.
• Right to Data Portability You have the right to receive your personal data in a structured, commonly used, machine-readable format where processing is based on your consent or contractual necessity.
• Right to Withdraw Consent Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Be Indemnified Under RA 10173, you have the right to be indemnified for damages sustained as a result of inaccurate, incomplete, outdated, false, or unlawfully obtained personal data.

13.2 magicph will respond to data subject rights requests within fifteen (15) calendar days of receipt, or within such extended period as permitted by the DPA where the complexity or volume of requests justifies additional time. In such cases, magicph will inform you of the extension and the reasons for it.

14 Data Protection Officer

14.1 magicph has designated a Data Protection Officer ("DPO") as required under RA 10173. The DPO is responsible for overseeing magicph's data protection compliance, handling data subject rights requests, and serving as the primary point of contact for the National Privacy Commission.

14.2 To contact the magicph Data Protection Officer:

• Email: [email protected] — please include "DPO Request" in the subject line. Note: this address is displayed as plain text and is not a clickable link;
• Live Chat: Available 24/7 for verified members via the magicph Platform;
• Written correspondence: magicph Data Protection Officer, magicph Philippines (registered address on file with PAGCOR and the NPC).

14.3 Please include your full name, registered mobile number or email address, and a clear description of your request or concern when contacting the DPO. This enables efficient handling of your request within the statutory response period.

15 Complaints to the National Privacy Commission

15.1 If you believe that magicph has processed your personal data in violation of the Philippine Data Privacy Act and you are not satisfied with magicph's response to your complaint, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

15.2 The National Privacy Commission can be reached through official Philippine government channels. Contact information and complaint procedures are available through the NPC's official government website. magicph encourages players to first contact the magicph DPO to attempt resolution before escalating to the NPC.

16 Changes to This Policy

16.1 magicph may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. The date of the most recent revision is always shown at the top of this Policy.

16.2 Where changes are material, magicph will notify active members via email or in-platform notification at least seven (7) days before the changes take effect, and will obtain fresh consent where required for any new processing activities.

16.3 Your continued use of the magicph Platform after the effective date of any revised Policy constitutes your acknowledgment of those changes.