Privacy Policy

1. Introduction

This Privacy Policy ("Policy") governs the collection and processing of personal data by richph ("richph," "we," "us," "our") in connection with the operation of the online gaming platform at richph.asia and all associated services, applications, and promotional activities (the "Platform").

richph is committed to processing personal data responsibly, transparently, and in compliance with the Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission of the Philippines (NPC). By creating a richph account and using the Platform, you consent to the practices described in this Policy.

This Policy should be read together with the richph Terms & Conditions, which also form part of the agreement between you and richph.

2. Data We Collect

richph collects personal data that is necessary to provide you with safe, compliant, and personalized gaming services. The categories of personal data we collect include:

richph does not collect sensitive personal data (as defined under RA 10173) unless explicitly required for compliance purposes, in which case the data is collected only with your express consent or as required by law.

3. How We Collect Your Data

richph collects personal data through the following channels:

• Direct collection: Data you provide when registering a richph account, completing KYC verification, depositing or withdrawing funds, contacting support, or participating in promotions;
• Automated collection: Technical and usage data collected automatically as you navigate and interact with the richph Platform, through server logs, cookies, and analytics tools;
• Third-party sources: Identity verification data from KYC service providers; payment confirmation data from GCash, PayMaya, BPI, BDO, and Metrobank; fraud prevention data from security partners. richph only receives data from third parties that are themselves compliant with applicable data privacy law.

4. How We Use Your Data

richph processes personal data for the following purposes:

• Account management: Creating, maintaining, and administering your richph account, including login authentication and session management;
• KYC and compliance: Verifying your identity and age (21+), complying with anti-money laundering (AML) obligations, and meeting PAGCOR-aligned regulatory requirements;
• Payment processing: Facilitating deposits and withdrawals via GCash, PayMaya, and bank transfer in Philippine Peso;
• Game provision: Delivering the games, sports betting markets, and live sabong streams that make up the richph Platform;
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behaviour and enabling self-exclusion, deposit limit, and session timer tools;
• Marketing and promotions: Sending promotional offers, bonus notifications, and richph news to members who have opted in to marketing communications — you may opt out at any time via your account settings;
• Security and fraud prevention: Detecting, investigating, and preventing fraudulent transactions, account takeovers, bonus abuse, and other prohibited conduct;
• Customer support: Responding to queries, resolving disputes, and improving the richph support experience;
• Analytics and improvement: Understanding how members use the richph Platform and making data-informed improvements to products and services.

5. Legal Basis for Processing

richph processes your personal data under the following legal bases as provided under the Data Privacy Act of 2012:

• Consent: Where you have freely given, specific, informed, and unambiguous consent — for example, when you register a richph account or opt in to marketing communications;
• Contractual necessity: Where processing is necessary to perform the agreement between you and richph — including account management, game provision, and payment processing;
• Legal obligation: Where processing is required to comply with a legal obligation — including KYC verification, AML reporting, and PAGCOR compliance obligations;
• Legitimate interests: Where processing is necessary for the legitimate interests of richph, such as fraud prevention and platform security, provided those interests are not overridden by your rights and freedoms.

6. Sharing Your Personal Data

richph does not sell, rent, or trade your personal data to third parties for their own marketing purposes. richph shares personal data only where necessary and under strict data protection obligations, with the following categories of recipients:

• Payment processors: GCash, PayMaya, BPI, BDO, and Metrobank — to process deposits and withdrawals;
• KYC providers: Identity verification service providers used to perform age and identity checks;
• Game providers: Third-party game studios (such as JILI and Pragmatic Play) may receive limited technical data necessary to deliver their games via the richph Platform;
• Security partners: Fraud detection and cybersecurity service providers assisting richph in protecting the Platform and its members;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, or other government authorities where richph is legally required to disclose information;
• Professional advisers: Legal, accounting, and auditing firms under strict confidentiality obligations.

Any third party that receives personal data from richph is required to process that data only for the specified purpose and in accordance with data protection obligations equivalent to those imposed under Philippine law.

7. Cookies & Tracking Technologies

richph uses cookies and similar tracking technologies on the Platform to deliver essential functionality, improve user experience, and analyse usage patterns. The categories of cookies richph uses are:

• Strictly necessary cookies: Required for the Platform to function — including session authentication, login state, and security tokens. These cannot be disabled without breaking core Platform functionality;
• Analytics cookies: Used to understand how members interact with richph — pages visited, session duration, and navigation paths. Data is aggregated and anonymised where possible;
• Preference cookies: Store your display preferences, language settings, and responsible gaming tool configurations;
• Security cookies: Used by richph's fraud detection systems to identify suspicious login patterns and device anomalies.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect your ability to log in and use the richph Platform. richph does not use third-party advertising cookies or cross-site tracking technologies for behavioural advertising.

8. Data Retention

richph retains personal data for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required by law. The general retention periods applied by richph are:

• Active account data: Retained for the duration of your richph account's existence plus a post-closure period required by AML regulations (minimum 5 years under Philippine AML law);
• KYC and identity documents: Retained for a minimum of 5 years from account closure in compliance with AMLC requirements;
• Transaction records: Retained for a minimum of 5 years from the date of each transaction;
• Support communications: Retained for 2 years from the date of resolution;
• Marketing data: Retained until you withdraw consent, with opt-out actioned within 30 days of your request.

After the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to you.

9. Data Security

richph implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the richph Platform;
• Encryption of sensitive data fields at rest in richph's databases;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Two-factor authentication for richph staff accessing internal systems containing personal data;
• Regular security audits, penetration testing, and vulnerability assessments of the richph infrastructure;
• Automated anomaly detection systems that flag unusual access patterns for immediate investigation.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, richph will notify the National Privacy Commission within 72 hours of becoming aware of the breach and will inform affected members without undue delay in accordance with RA 10173.

10. Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by richph:

• Right to be informed: The right to know what personal data richph collects and how it is processed — addressed by this Policy;
• Right of access: The right to request a copy of the personal data richph holds about you;
• Right to rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to erasure: The right to request deletion of your personal data where richph has no legal obligation to retain it;
• Right to object: The right to object to richph's processing of your personal data for marketing purposes or on grounds relating to your particular situation;
• Right to data portability: The right to receive your personal data in a structured, commonly used format where technically feasible;
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe richph has violated your data privacy rights.

To exercise any of the above rights, contact the richph Data Protection Officer at the contact details in Section 13. richph will respond to all valid requests within 15 business days.

11. Children & Minors

If you are a parent or guardian and believe that a person under 21 in your care has created a richph account, please contact richph support immediately. richph will investigate and take immediate action including account closure and data deletion.

12. Changes to This Privacy Policy

richph reserves the right to update or amend this Privacy Policy at any time. Material changes — changes that significantly affect how richph processes your personal data or your rights — will be communicated to registered richph members via email to the address on file at least 14 days before the amendment takes effect.

The "Last Updated" date at the top of this Policy reflects the most recent revision. Your continued use of the richph Platform following any amendment constitutes acceptance of the revised Policy. If you do not accept a material change, you should close your richph account before the amendment's effective date.

13. Contact & Data Protection Officer

richph has appointed a Data Protection Officer (DPO) as required under the Data Privacy Act of 2012. If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or need to report a privacy concern, please contact: