p889 Privacy Policy

p889 ("the Platform," "we," "us," "our") takes the privacy and security of your personal data seriously. This Privacy Policy describes the personal information p889 collects from players and visitors of p889.app, how that information is used, who it may be shared with, and the rights you hold as a data subject under Philippine law.

By creating a p889 account, making a deposit, or using any feature of p889.app, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree, you must not create an account or use the Platform.

1.1   This Privacy Policy applies to all personal data processed by p889 in connection with the operation of p889.app, including data collected during registration, account use, payment transactions, customer support interactions, and marketing communications.

1.2   This Policy must be read in conjunction with p889's Terms & Conditions and Responsible Gaming Policy. In the event of any conflict regarding the treatment of personal data, this Privacy Policy governs.

1.3   p889 is committed to compliance with Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and applicable issuances of the National Privacy Commission (NPC) of the Philippines. p889 also processes personal data in accordance with its PAGCOR regulatory obligations, which include mandatory player identification and anti-money laundering (AML) record-keeping requirements.

2.1   The data controller responsible for your personal data processed through p889.app is p889 (the operating entity). For privacy-related inquiries, requests, or complaints, you may contact the p889 Data Protection Officer (DPO) at the contact details provided in Section 14 of this Policy.

2.2   p889 has registered its data processing activities with the National Privacy Commission as required under the DPA and its IRR. p889 maintains a Privacy Management Program (PMP) and conducts periodic Privacy Impact Assessments (PIAs) on high-risk processing activities.

p889 collects the following categories of personal data from registered Members and site visitors:

p889 does not collect sensitive personal information (as defined under Section 3(l) of the DPA) except where strictly required for KYC compliance — specifically, government-issued identification numbers. Such sensitive data is handled with heightened security controls and access restrictions.

p889 collects personal data through the following means:

• Direct submission: Information you provide when creating an account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in promotions.
• Automated collection: Technical data collected automatically via server logs, cookies, session tokens, and analytics tools when you access p889.app — including your IP address, device identifiers, and browsing behaviour on the Platform.
• Payment processors: Transaction confirmation data received from GCash, Maya, BPI, BDO, UnionBank, and other accepted payment providers when you fund or withdraw from your p889 wallet.
• Identity verification partners: Where p889 uses third-party KYC providers to perform document authentication and liveness checks, those providers return verification results and associated data to p889.
• Regulatory authorities: In limited circumstances, p889 may receive supplementary information from PAGCOR or the Anti-Money Laundering Council (AMLC) as part of regulatory compliance processes.

Under the Data Privacy Act of 2012 and its IRR, p889 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the p889 account agreement — including account creation, game participation, payment processing, and withdrawal settlement.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, Anti-Money Laundering Act (AMLA) obligations, AMLC reporting requirements, and NPC data governance requirements.
• Legitimate interests: Processing for fraud prevention, platform security, abuse detection, responsible gaming enforcement, and improvement of Platform services — where those interests are not overridden by your data protection rights.
• Consent: Processing for direct marketing communications (promotional SMS, email) and optional analytics cookies, where your prior consent has been obtained and may be withdrawn at any time.

p889 uses your personal data for the following purposes:

• Creating and managing your p889 account, including authentication and account security
• Processing deposits, bets, game settlements, and withdrawal requests to your GCash, Maya, or bank account
• Verifying your identity and age (minimum 21 years) in compliance with PAGCOR and KYC requirements
• Detecting, investigating, and preventing fraud, money laundering, bonus abuse, and prohibited conduct
• Complying with AMLC reporting obligations, including submission of covered and suspicious transaction reports where legally required
• Delivering customer support via live chat, SMS, and email
• Sending OTPs and security notifications related to your account
• Administering promotions, bonuses, and loyalty rewards programmes
• Sending marketing communications about p889 promotions and new games (with your consent; you may opt out at any time)
• Enforcing responsible gaming measures including deposit limits, self-exclusion, and cooling-off periods
• Analysing Platform usage to improve game offerings, user experience, and technical performance

p889 may share your personal data with the following categories of recipients:

• Payment service providers (GCash, Maya, BPI, BDO, UnionBank, Coins.ph): to process deposits, withdrawals, and transaction verification. These providers receive only the data necessary to execute the specific transaction.
• KYC and identity verification partners: third-party providers that assist p889 in document authentication, liveness verification, and sanctions screening as part of the KYC process.
• PAGCOR: as required under p889's operating licence conditions, including player registration data, gaming activity reports, and responsible gaming compliance records.
• Anti-Money Laundering Council (AMLC): transaction data disclosed as part of legally mandated covered transaction reports (CTRs) and suspicious transaction reports (STRs) under Republic Act No. 9160 (AMLA), as amended.
• Law enforcement and courts: in response to valid legal process (subpoena, court order, or lawful request from competent Philippine authorities).
• IT infrastructure and cloud service providers: technical partners who host p889's platform, provide security monitoring, or support data backup — all subject to data processing agreements that obligate them to process data only on p889's instructions.
• Game content providers: limited technical identifiers (not financial data or full identity) shared with licensed game software providers to authenticate your session in their game engines.

All third-party data processors engaged by p889 are required by contract to maintain appropriate data protection standards consistent with the DPA and are prohibited from using your data for their own independent purposes.

8.1   p889 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to minimum retention periods mandated by law. Key retention periods applicable to p889 Members are as follows:

• Account and identity data: retained for the duration of the account plus five (5) years after account closure, in compliance with PAGCOR and AMLC record-keeping requirements.
• Financial transaction records: retained for a minimum of five (5) years from the date of each transaction, as required under the AMLA and PAGCOR regulations.
• KYC documents: retained for five (5) years following account closure or the last transaction, whichever is later.
• Customer support communications: retained for three (3) years from the date of the interaction, or longer if the interaction relates to an unresolved dispute or regulatory inquiry.
• Marketing consent records: retained for the duration of the consent period plus three (3) years thereafter as evidence of lawful marketing activity.

8.2   Upon expiry of the applicable retention period, p889 will securely delete or anonymise personal data in accordance with the NPC's guidelines on data disposal.

9.1   p889 implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key security controls in place include:

• 256-bit TLS encryption for all data transmitted between your browser and p889 servers
• Bcrypt hashing for stored passwords — p889 never stores raw passwords
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis
• Multi-factor authentication for internal staff accessing player data systems
• Regular third-party penetration testing and vulnerability assessments of Platform infrastructure
• 24/7 security monitoring with automated alerting for anomalous access patterns
• Encrypted storage for KYC documents and financial records at rest

9.2   Data Breach Notification. In the event of a personal data breach that poses a real risk of harm to data subjects, p889 will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, and will notify affected data subjects without undue delay, in accordance with Section 20(f) of the DPA and NPC Circular No. 16-03.

10.1   p889.app uses cookies and similar tracking technologies to operate the Platform, maintain your session, remember your preferences, and analyse usage patterns. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function — including session authentication, security tokens, and load balancing. These cannot be disabled without breaking core functionality.
• Functional cookies: Store your preferences such as language settings, preferred game lobby view, and responsible gaming reminder intervals.
• Analytics cookies: Used by p889 to understand how players navigate the Platform, which features are used most, and where technical issues occur. Analytics data is aggregated and does not personally identify individual players. You may opt out of analytics cookies.
• Marketing cookies: Used to track the effectiveness of p889's own promotional campaigns and, with your prior consent, to tailor promotional communications. You may withdraw consent at any time via your account settings.

10.2   Most browsers allow you to manage or delete cookies through browser settings. Disabling strictly necessary cookies will impair your ability to use p889, including logging in. p889 does not use cross-site tracking cookies to monitor your activity on other websites.

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by p889:

• Right to be Informed: To be notified of how p889 processes your personal data — fulfilled by this Privacy Policy.
• Right of Access: To request a copy of the personal data p889 holds about you and information about how it is processed.
• Right to Rectification: To request correction of inaccurate or incomplete personal data. You may update most contact details directly in your account settings.
• Right to Erasure / Right to be Forgotten: To request deletion of your personal data where there is no longer a legitimate legal basis for p889 to retain it. Note that mandatory retention periods under PAGCOR and AMLC regulations may prevent immediate erasure of certain data.
• Right to Object: To object to processing of your personal data for direct marketing purposes. You may opt out of marketing SMS and email at any time via your account notification settings.
• Right to Data Portability: To receive a structured, machine-readable copy of personal data you have provided to p889, where technically feasible.
• Right to Lodge a Complaint: To file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe p889 has violated your data privacy rights.

To exercise any of the above rights, contact the p889 Data Protection Officer (see Section 14). p889 will respond to data subject requests within fifteen (15) business days of receipt of a verified request. Identity verification may be required before p889 processes a data subject request.

If you are a parent or guardian and believe your child under 21 has registered on p889, please contact the p889 DPO immediately at the details in Section 14. p889 will investigate and take appropriate action without delay.

13.1   p889 may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or Platform features. The "Last Updated" date at the top of this page indicates when the most recent revision was made.

13.2   For material changes that significantly affect how your personal data is processed — such as new categories of data collected, new third-party sharing arrangements, or changes to the legal basis for processing — p889 will notify registered Members via SMS or in-platform notification at least seven (7) days before the change takes effect.

13.3   Your continued use of p889 after the effective date of any updated Privacy Policy constitutes your acknowledgement of the revised version. If you do not agree with the updated Policy, you must close your account before the effective date.

For privacy-related inquiries, data subject rights requests, or to report a suspected privacy concern, please contact the p889 Data Protection Officer:

• DPO Contact (Live Chat): available 24/7 via the chat icon on p889.app — state "DPO Request" at the start of your message
• DPO Email: [email protected] — subject line: "Data Privacy Request"
• Response timeframe: 15 business days for data subject requests; 5 business days for general privacy inquiries

You also have the right to file a complaint with the National Privacy Commission of the Philippines (NPC) if you believe your data privacy rights have been violated. NPC contact information is publicly available on the official NPC website.