Privacy Policy

1. Introduction

megaph ("megaph," "we," "us," or "our") is committed to protecting the privacy and personal data of every individual who interacts with the megaph Platform, including registered players, visitors to megaph.net, and applicants for employment or partnership arrangements. This Privacy Policy describes the types of personal data we collect, the purposes for which we process that data, the parties with whom it may be shared, how long we retain it, the security measures we apply, and the rights available to you as a data subject under Philippine law.

This Privacy Policy applies to all personal data collected through the megaph website at megaph.net, the megaph account registration and management process, the megaph Cashier and payment processing systems, megaph's customer support channels (including live chat and email), megaph's marketing and promotional communications, and any other touchpoint through which megaph interacts with individuals.

This Policy is to be read in conjunction with megaph's Terms & Conditions and Responsible Gaming Policy, both of which are accessible from the megaph website.

2. Data Controller

For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations, megaph is the Personal Information Controller in respect of personal data collected and processed through the megaph Platform.

megaph operates as a PAGCOR-regulated online gaming platform serving Filipino players in the Philippines. Queries relating to this Privacy Policy or the exercise of data subject rights may be directed to megaph's designated Data Protection Officer (DPO) using the contact details set out in Section 13 below.

3. Personal Data We Collect

megaph collects personal data through several channels — directly from you during account registration and use, automatically through technical systems as you interact with the Platform, and occasionally from third-party sources for verification and compliance purposes.

megaph does not collect sensitive personal information (as defined under Section 3(l) of the DPA) unless strictly required for regulatory compliance — for example, health information in connection with a self-exclusion request based on a gambling disorder.

4. How We Use Your Personal Data

megaph processes your personal data for the following purposes:

• Account Registration & Management: To create, verify, and administer your megaph account, including Know Your Customer (KYC) identity verification as required by PAGCOR and applicable AML regulations.
• Service Delivery: To provide access to the megaph Platform's games, Cashier services, bonuses, loyalty program, and customer support.
• Payment Processing: To process deposits and withdrawals through GCash, Maya, BDO, BPI, and other supported payment methods, and to comply with anti-money laundering (AML) obligations.
• Regulatory Compliance: To fulfil megaph's legal and regulatory obligations as a PAGCOR-licensed operator, including transaction reporting, fraud prevention, and AML/CFT (Counter-Financing of Terrorism) compliance.
• Responsible Gaming: To monitor gaming behaviour, enforce self-exclusion orders, send reality-check notifications, and apply deposit limits in accordance with megaph's responsible gaming commitments.
• Marketing & Promotions: To send you information about megaph promotions, bonuses, and new games — where you have provided consent or where permitted under applicable law. You may opt out of marketing communications at any time through your Account Settings.
• Platform Security & Fraud Prevention: To detect and prevent unauthorized account access, bonus abuse, collusion, and other fraudulent or prohibited conduct.
• Analytics & Product Improvement: To analyse Platform usage patterns and improve the megaph product experience for Filipino players.

5. Legal Bases for Processing

megaph processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual Necessity: Processing is necessary to perform megaph's obligations under the Terms & Conditions you accepted at registration — including account management, game provision, and payment processing.
• Legal Obligation: Processing is required to comply with PAGCOR licensing conditions, AML regulations, tax obligations, and other requirements imposed on megaph by Philippine law.
• Legitimate Interests: Processing is necessary for megaph's legitimate interests, including Platform security, fraud prevention, and responsible gaming monitoring, provided such interests are not overridden by your rights and freedoms.
• Consent: For marketing communications and the use of non-essential cookies, megaph relies on your freely given, specific, and informed consent, which you may withdraw at any time.

6. Data Sharing & Third-Party Disclosure

megaph does not sell, rent, or trade your personal data to third parties. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• PAGCOR and Regulatory Authorities: Where required by law, regulation, or a valid regulatory directive, megaph will disclose player data to PAGCOR, the Anti-Money Laundering Council (AMLC), and other competent Philippine government authorities.
• Payment Processors: GCash, Maya, BDO, BPI, Metrobank, UnionBank, and other payment service providers receive the minimum personal and financial data necessary to process your transactions.
• Game Providers: megaph's licensed third-party game studios may receive session-level data necessary for game delivery and RNG certification. Game providers are bound by confidentiality and data protection obligations.
• KYC / Identity Verification Providers: megaph uses certified third-party KYC verification services to validate government-issued identification documents submitted by players.
• IT Infrastructure & Cloud Service Providers: megaph's Platform is hosted on secure cloud infrastructure. Our hosting providers process personal data solely on megaph's documented instructions.
• Law Enforcement: Where legally compelled by a court order or lawful request from Philippine law enforcement authorities.

All third-party processors engaged by megaph are subject to written data processing agreements that impose data security, confidentiality, and purpose-limitation obligations consistent with the DPA.

7. Cookies & Tracking Technologies

megaph uses cookies and similar tracking technologies on the megaph.net website to ensure the Platform functions correctly, maintain your logged-in session, detect fraud, and analyse usage patterns. The following cookie categories are used:

• Strictly Necessary Cookies: Essential for Platform functionality, including login session management and security. These cannot be disabled.
• Performance & Analytics Cookies: Collect anonymised data about how players navigate megaph to help us improve the Platform experience.
• Functional Cookies: Remember your preferences — such as language settings and display preferences — across sessions.
• Marketing Cookies: Used only where you have provided consent, to deliver relevant promotional content about megaph.

You may manage non-essential cookie preferences through your browser settings at any time. Disabling performance or functional cookies may affect your megaph Platform experience.

8. Data Retention

megaph retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention periods required by law. As a general guide:

• Account Data: Retained for the duration of your megaph account and for a minimum of five (5) years following account closure, as required by PAGCOR AML record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years in accordance with AML/CFT regulations applicable to PAGCOR-licensed operators.
• Gaming Activity Logs: Retained for a minimum of three (3) years following the date of each session for regulatory audit purposes.
• Customer Support Records: Retained for two (2) years following closure of the relevant support case.
• Marketing Consent Records: Retained for the duration of the consent and for one (1) year following withdrawal, as evidence of consent management.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with megaph's data disposal procedures.

9. Data Security

megaph implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include, without limitation:

• 256-bit SSL/TLS encryption for all data transmitted between your browser or device and the megaph Platform.
• Encryption of sensitive data at rest, including payment details and government ID information.
• Role-based access controls limiting internal access to personal data to authorized personnel with a legitimate business need.
• Two-factor authentication (2FA) available for all player accounts and enforced for internal megaph administrative systems.
• Regular penetration testing and vulnerability assessments by qualified third-party security professionals.
• Incident response procedures that comply with the DPA's 72-hour breach notification obligation to the National Privacy Commission (NPC) where applicable.

While megaph employs industry-standard security practices, no system is entirely immune to risk. You are responsible for keeping your megaph account credentials confidential and for enabling 2FA on your account.

10. Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by megaph:

• Right to be Informed: The right to be notified of what personal data megaph collects, how it is used, and with whom it is shared — as set out in this Privacy Policy.
• Right of Access: The right to request a copy of the personal data megaph holds about you.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data. You may update most personal details directly through your megaph Account Settings.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to megaph's legal retention obligations.
• Right to Data Portability: The right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: The right to object to processing of your personal data for marketing purposes at any time.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe megaph has processed your personal data in violation of the DPA.

To exercise any of the above rights, please contact megaph's Data Protection Officer using the details in Section 13. megaph will respond to all verified data subject requests within fifteen (15) business days.

11. Children's Privacy

The megaph Platform is strictly for individuals aged 21 years and above, in compliance with PAGCOR's age restriction requirements for online gaming in the Philippines. megaph does not knowingly collect personal data from individuals under the age of 21. If megaph becomes aware that personal data has been collected from an underage individual, the relevant account will be immediately suspended and the data will be securely deleted.

If you are a parent or guardian and believe your child has registered on the megaph Platform, please contact our support team immediately at [email protected] so that the matter can be investigated and resolved promptly.

12. Updates to This Privacy Policy

megaph reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or PAGCOR regulatory requirements. Material changes will be communicated to registered players via email notification and/or a prominent notice on the megaph Platform at least seven (7) days prior to the effective date of the revised Policy.

The effective date at the top of this Policy indicates when it was last revised. Your continued use of the megaph Platform following the effective date of any amendment constitutes your acknowledgement of the revised Privacy Policy.

13. Contact the Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or megaph's data processing practices, please contact megaph's Data Protection Officer:

• General & DPO Inquiries: [email protected]
• Partner & Business Inquiries: [email protected]
• Live Chat: Available 24/7 through the megaph Platform

megaph is committed to addressing all privacy-related inquiries promptly and transparently. If you are not satisfied with megaph's response, you have the right to escalate your complaint to the National Privacy Commission of the Philippines.