25superph Privacy Policy

This Privacy Policy ("Policy") applies to all personal information collected by or on behalf of 25superph ("we", "us", "our") through the 25superph platform accessible at 25superph.app and any associated services, mobile interfaces, or communications.

This Policy is designed to be consistent with the Republic Act No. 10173 (Data Privacy Act of 2012), its implementing rules and regulations, and the issuances of the National Privacy Commission of the Philippines. Where this Policy refers to "personal data" or "personal information", these terms have the meanings ascribed to them under RA 10173.

By using the 25superph platform, creating an account, depositing funds, or engaging with any 25superph service, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. If you do not agree with any part of this Policy, please discontinue your use of the 25superph platform.

For the purposes of the Data Privacy Act of 2012 and this Policy, 25superph is the personal information controller responsible for your personal data. We determine the purposes and means of processing your personal information in connection with the 25superph platform.

All inquiries, data access requests, correction requests, deletion requests, or privacy complaints should be directed to the 25superph data privacy team via the contact details set out in Section 15 of this Policy.

25superph collects the following categories of personal data:

We do not intentionally collect sensitive personal information beyond what is required for identity verification and regulatory compliance. If we need to process sensitive personal information for any other purpose, we will seek your explicit consent.

4.1 Directly from You. The majority of personal data held by 25superph is collected directly from you — through the account registration form, KYC document submission, payment method details you enter, and any communications you initiate with the support team.

4.2 Automatically. When you visit and interact with the 25superph platform, technical data is collected automatically by our servers and analytics systems. This includes your IP address, browser type, device identifiers, session start and end times, pages visited, and actions taken within the platform. This data is collected using standard web server logs and, where applicable, cookies and similar technologies as described in Section 8.

4.3 From Third Parties. In limited circumstances, 25superph may receive personal data from third parties. This includes identity verification data from KYC service providers, transaction confirmation data from payment processors such as GCash, Maya, BPI, and BDO, and fraud screening data from anti-money laundering compliance services. All third-party data sources are subject to appropriate data sharing agreements.

Under the Data Privacy Act of 2012, 25superph must have a lawful basis for processing personal data. The following bases apply to different processing activities:

• Contractual Necessity: Processing your identity data, contact data, financial data, and gaming activity data is necessary to perform our contract with you — specifically, to operate your 25superph account, process transactions, and deliver the gaming services you have requested.
• Legal Obligation: Processing identity data for KYC purposes and transaction data for AML monitoring is required by applicable Philippine law and regulations. We are legally obligated to conduct these activities regardless of your consent.
• Legitimate Interests: We process technical data and communication data on the basis of our legitimate interests in securing the platform, preventing fraud, improving user experience, and resolving disputes. These interests do not override your privacy rights.
• Consent: Where no other basis applies — such as for certain optional marketing communications — we will seek your explicit consent before processing your data for that purpose. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

25superph uses personal data for the following purposes:

• Account management: Creating, maintaining, and administering your 25superph account, including processing login requests and account updates.
• Identity verification: Conducting KYC checks to confirm your identity, age (21+), and eligibility to use the platform, as required by PAGCOR regulations.
• Payment processing: Processing your GCash, Maya, bank transfer, and other deposits and withdrawals, and maintaining accurate records of all financial transactions on your account.
• Regulatory compliance: Fulfilling our obligations under Philippine AML law, PAGCOR licensing requirements, and the Data Privacy Act. This includes maintaining transaction records and conducting suspicious activity monitoring.
• Responsible gaming: Monitoring gaming activity patterns to identify potential problem gambling indicators, maintaining self-exclusion and limit records, and enforcing responsible gaming restrictions you have set.
• Platform security: Detecting and preventing fraud, unauthorised access, bot activity, multi-accounting, and other prohibited conduct as defined in the 25superph Terms and Conditions.
• Customer support: Responding to your support enquiries, resolving account and transaction disputes, and maintaining records of communications for quality and compliance purposes.
• Platform improvement: Analysing aggregated and anonymised usage data to improve the performance, layout, and features of the 25superph platform.
• Legal proceedings: Where necessary, using relevant personal data in connection with legal claims, regulatory investigations, or judicial proceedings involving 25superph.

25superph does not sell, rent, or trade your personal data. We share personal data only in the following limited circumstances:

7.1 Service Providers. We engage trusted third-party service providers to assist in operating the 25superph platform. These include KYC and identity verification providers, payment processors (GCash, Maya, BPI, BDO, UnionBank, and other payment partners), game providers, cloud infrastructure providers, fraud and AML screening services, and customer support tools. All service providers are contractually required to process your data only for the specified purpose, to maintain appropriate security standards, and not to retain or use your data beyond what is necessary.

7.2 Regulatory and Law Enforcement Authorities. 25superph may disclose personal data to the National Privacy Commission, PAGCOR, AMLC (Anti-Money Laundering Council), the Philippine National Police, or other competent government authorities where required by law, court order, or regulatory requirement. We will comply with all lawful requests for data disclosure from Philippine authorities.

7.3 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of the 25superph business, your personal data may be transferred to the successor entity. You will be notified of any such transfer and the privacy implications before it occurs.

7.4 Protection of Rights. We may share personal data where we reasonably believe disclosure is necessary to protect the rights, property, or safety of 25superph, its users, or the public — including to prevent fraud, investigate security incidents, or enforce our Terms and Conditions.

8.1 What We Use. The 25superph platform uses cookies and similar tracking technologies — including session tokens, local storage, and analytics pixels — to operate the platform, maintain your login session, remember your preferences, and collect usage analytics.

8.2 Types of Cookies. The cookies used on 25superph fall into the following categories:

• Strictly Necessary: Essential for the platform to function — these maintain your login session, enforce security settings, and are required for the site to operate. These cannot be disabled without significantly impairing your use of 25superph.
• Functional: Remember your preferences such as language settings and display options to personalise your experience on return visits.
• Analytics: Collect anonymised data about how users interact with the 25superph platform — which pages are visited, how long sessions last, and where users navigate from. This data helps us improve the platform. No personally identifiable information is transmitted through analytics cookies.

8.3 Cookie Control. You may adjust your browser settings to refuse cookies or to be alerted when cookies are being set. Refusing strictly necessary cookies will prevent you from logging in to your 25superph account and may affect other essential functions. For other cookie types, your browser settings give you full control.

25superph implements appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the 25superph platform;
• Encryption at rest for sensitive personal data stored on 25superph servers, including financial data and identity documents;
• Access controls that limit access to personal data to authorised 25superph personnel with a documented operational need, with all access logged and subject to audit;
• Password hashing using industry-standard one-way algorithms — 25superph staff cannot see your password in plain text;
• Two-factor authentication available on all user accounts to add a second layer of login security;
• Regular security assessments of the 25superph platform infrastructure;
• Incident response procedures aligned with the breach notification requirements of RA 10173.

Notwithstanding these measures, no data transmission over the internet or storage system can be guaranteed to be 100% secure. You are responsible for maintaining the security of your own account credentials. If you believe your account has been compromised, please contact 25superph support immediately via live chat.

25superph retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by Philippine law and regulatory obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of the account relationship and for a minimum of five (5) years after account closure, as required by AMLC and PAGCOR recordkeeping obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, consistent with Philippine AML requirements.
• Gaming activity data: Retained for three (3) years from the date of the activity, unless a longer period is required for regulatory or dispute resolution purposes.
• Support communications: Retained for two (2) years from the date of the last communication.
• Technical and analytics data: Retained in anonymised form for up to twenty-four (24) months for platform analytics purposes.

When personal data reaches the end of its applicable retention period and there is no outstanding legal obligation to retain it, 25superph will securely delete or irreversibly anonymise the data.

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by 25superph. To exercise any of these rights, please contact us using the details in Section 15.

The 25superph platform may use service providers — including game providers, KYC verification services, cloud hosting providers, and analytics tools — that process personal data in countries outside the Philippines. Where such transfers occur, 25superph takes steps to ensure that your personal data is afforded a level of protection equivalent to that provided under RA 10173.

These steps include executing appropriate data processing agreements with overseas service providers, requiring recipients to implement adequate technical and organisational security measures, and restricting the purposes for which transferred data may be used to those necessary for the provision of the relevant service.

By using the 25superph platform, you acknowledge and consent to the transfer of your personal data to overseas service providers where necessary for the operation of the platform, subject to the safeguards described above.

The 25superph platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from an underage individual, we will immediately delete that data and close the associated account.

If you are a parent or guardian and believe that a minor has created a 25superph account or provided us with personal data, please contact our support team immediately via live chat so that we can take appropriate action without delay.

25superph may update this Privacy Policy from time to time to reflect changes in our data practices, the 25superph platform, or applicable Philippine law. When we make changes, we will update the "Last Updated" date at the top of this Policy and post the revised Policy on the platform.

Where a change is material — particularly one that significantly affects how we collect, use, or share your personal data — we will make reasonable efforts to notify registered users in advance via email or an in-platform notification. Your continued use of the 25superph platform following the effective date of any updated Policy constitutes your acceptance of the revised terms.

We recommend reviewing this Policy periodically. The version posted on the 25superph platform is always the current version.

If you have questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how 25superph has handled your personal information, please contact us through the following channels:

• Live Chat: Available 24/7 via the chat icon on the 25superph platform. This is the fastest way to reach our team for data-related queries.
• Email: [email protected] (plain text — not a clickable link). Please include "Privacy Request" in your subject line. We respond to all verified data requests within the timeframes required by RA 10173.

Complaints to the National Privacy Commission. If you believe that 25superph has failed to handle your personal data in accordance with RA 10173 and we have been unable to resolve your concern, you have the right to file a complaint with the National Privacy Commission of the Philippines (NPC). The NPC is the government body responsible for administering and enforcing the Data Privacy Act.