Your Privacy Matters
to 991ph

This Privacy Policy ("Policy") applies to all personal data collected and processed by 991ph ("we", "us", "our") in connection with the operation of the 991ph online gaming platform, accessible at 991ph.net. It applies to all registered players, visitors, and any individual whose personal data we process in connection with the delivery of our services.

991ph is a PAGCOR-regulated online gaming operator serving Filipino players across the Philippines. As a licensed operator, we are subject to the requirements of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). This Policy is designed to meet and exceed those requirements.

By registering an account on 991ph or using any part of our platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with the terms of this Policy, you should not use the 991ph platform.

This Policy should be read together with our Terms & Conditions and our Responsible Gaming Policy, both of which form part of the overall agreement governing your use of 991ph.

991ph collects personal data that is necessary for the lawful operation of a licensed online gaming platform. The categories of personal data we collect include the following:

We do not collect any data that is not necessary for the legitimate operation of a PAGCOR-licensed gaming platform. We do not process special categories of personal data (such as biometric data or health information) unless expressly required by regulatory directive.

991ph collects your personal data through the following methods:

• Direct submission: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical data collected automatically when you access the 991ph platform, including IP address, device identifiers, browser data, and session activity logs, via server logs and cookies.
• Third-party sources: Identity and address verification data received from our contracted KYC verification service providers; payment confirmation data received from GCash, PayMaya, BPI, BDO, and Metrobank; fraud and sanctions screening data from compliance screening services.
• PAGCOR and regulatory sources: Data received from PAGCOR or other Philippine regulatory bodies in connection with licensing compliance, self-exclusion registers, or regulatory investigations.

991ph uses your personal data for the following purposes, each of which is supported by a lawful basis as described in Section 5:

• Account creation and management: To register your account, verify your identity, maintain your player profile, and provide access to all 991ph gaming services.
• KYC and age verification: To verify that you are at least 21 years of age and legally eligible to participate in online gaming under PAGCOR regulations, as required before any withdrawal is processed.
• Payment processing: To process deposits, wagers, withdrawals, and refunds using your registered payment methods (GCash, PayMaya, BPI, BDO, Metrobank).
• Regulatory compliance: To meet our obligations under PAGCOR licensing conditions, Philippine AML laws (RA 9160 as amended), the Data Privacy Act, and other applicable Philippine legislation.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, underage gambling, and other prohibited conduct on the platform.
• Responsible gaming: To monitor gaming activity for indicators of problem gambling behaviour, deliver responsible gaming tools, enforce deposit limits and self-exclusion orders, and comply with PAGCOR responsible gaming requirements.
• Customer support: To respond to your enquiries, resolve complaints, and provide technical assistance via live chat and email.
• Platform improvement: To analyse aggregated usage data, improve our games and services, fix technical issues, and develop new features for Filipino players.
• Promotions and marketing: To notify you of bonuses, promotional offers, and platform updates that you have opted in to receive. You may opt out of marketing communications at any time via your account settings.
• Legal proceedings: To establish, exercise, or defend legal claims in connection with disputes, regulatory investigations, or litigation.

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, 991ph processes your personal data on the following lawful bases:

• Contract performance: Processing is necessary to perform our obligations under the agreement with you (our Terms & Conditions), including operating your account, processing payments, and delivering gaming services.
• Legal obligation: Processing is required to comply with our obligations under PAGCOR regulations, Philippine AML laws, the Data Privacy Act, and other applicable Philippine legislation.
• Legitimate interests: Processing is necessary for our legitimate business interests — including fraud prevention, platform security, responsible gaming monitoring, and service improvement — where those interests are not overridden by your data protection rights.
• Consent: For marketing communications and non-essential cookies, we process your data on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

991ph does not sell your personal data. We may share your personal data with the following categories of recipients strictly where necessary and on a need-to-know basis:

• Payment service providers: GCash, PayMaya, BPI, BDO, and Metrobank, solely for the purpose of processing your financial transactions. Each provider operates under its own privacy policy and data security obligations.
• KYC and identity verification partners: Third-party identity verification providers contracted by 991ph to perform document verification, liveness checks, and sanctions screening as required by PAGCOR and AML regulations.
• Game software providers: Certified game studios whose software is hosted on or integrated into the 991ph platform. These providers may receive anonymised or pseudonymised session data for technical purposes.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities, where disclosure is required by law, court order, or regulatory direction.
• Legal and professional advisers: Law firms, auditors, and compliance consultants retained by 991ph, subject to professional confidentiality obligations.
• IT and infrastructure providers: Cloud hosting, content delivery, and cybersecurity service providers that process data on our behalf under strict data processing agreements.

All third-party service providers with whom we share personal data are contractually required to maintain the confidentiality and security of that data and to use it only for the specific purpose for which it was disclosed.

991ph retains your personal data only for as long as necessary to fulfil the purposes set out in this Policy and to comply with applicable Philippine legal and regulatory requirements. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account plus a minimum of five (5) years following account closure, in accordance with PAGCOR record-keeping requirements and Philippine AML regulations.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, as required under RA 9160 (as amended).
• KYC documents: Retained for a minimum of five (5) years from the date of verification or account closure (whichever is later).
• Customer support records: Retained for three (3) years from the date of the relevant interaction, or longer if the matter is subject to ongoing dispute or legal proceedings.
• Marketing preferences and consent records: Retained for the duration of your account or until you withdraw consent, whichever is earlier.
• Technical and log data: Retained for up to twelve (12) months for security and fraud prevention purposes, then deleted or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with our data disposal procedures, unless continued retention is required by a specific legal obligation or pending regulatory or legal proceedings.

991ph implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption: All data transmitted between your device and 991ph servers is encrypted using TLS 1.2 or higher. Sensitive data at rest (including financial data and KYC documents) is encrypted using AES-256 encryption.
• Access controls: Access to personal data within 991ph is strictly limited to authorised personnel whose roles require access. Role-based access controls, multi-factor authentication, and audit logging are enforced on all internal systems.
• Penetration testing: 991ph conducts regular security assessments, including vulnerability scanning and penetration testing, to identify and remediate security weaknesses in our platform.
• Incident response: 991ph maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights, we will notify the National Privacy Commission (NPC) within 72 hours and affected players without undue delay, as required by RA 10173.
• Staff training: All 991ph staff who handle personal data undergo regular data protection and security awareness training.

991ph uses cookies and similar tracking technologies on our platform. Cookies are small text files stored on your device by your browser. We use the following categories of cookies:

• Strictly necessary cookies: Required for the platform to function. These include session management cookies, login authentication tokens, and security cookies. These cookies cannot be disabled without preventing access to core platform features.
• Functional cookies: Used to remember your preferences (such as language settings, deposit limit configurations, and game preferences) to provide a personalised experience on 991ph.
• Analytics cookies: Used to collect anonymised data about how players use the 991ph platform — such as which pages are visited most frequently and how long sessions last — to help us improve our services. These cookies do not identify you personally.
• Security cookies: Used to detect fraudulent access attempts, identify bot traffic, and protect the integrity of the platform.

991ph does not use third-party advertising cookies or permit third-party advertising networks to place cookies on our platform. You may control cookie preferences through your browser settings; however, disabling strictly necessary cookies may prevent you from accessing the 991ph platform.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 991ph. To exercise any of these rights, please contact our Data Protection Officer using the details provided in Section 14.

We will respond to all verified data rights requests within thirty (30) calendar days of receipt. Where a request is complex or numerous, we may extend this period by a further two months and will notify you accordingly. We will not charge a fee for handling data rights requests unless a request is manifestly unfounded or excessive.

If you believe that 991ph has not handled your personal data in accordance with the Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

During registration, 991ph collects date of birth information and conducts age verification as part of our mandatory KYC process. No account will be fully activated — and no withdrawals will be processed — until age verification has been successfully completed. This is a non-negotiable PAGCOR compliance requirement.

If we discover that personal data has been collected from a person under the age of 21, we will immediately suspend the relevant account, return any funds held in that account in accordance with applicable regulations, and securely delete all personal data associated with that account. Parents or guardians who believe their minor child has registered on 991ph should contact our support team immediately.

991ph also supports responsible gaming tools to help adults manage their gaming activity, including deposit limits, session time limits, cooling-off periods, and self-exclusion. For more information, please visit our Responsible Gaming page.

Some of the third-party service providers used by 991ph — including cloud infrastructure providers and game software developers — may process your personal data outside the Philippines. Where such cross-border transfers occur, 991ph ensures that adequate safeguards are in place to protect your personal data, including:

• Entering into data processing agreements that incorporate standard contractual clauses approved by the National Privacy Commission (NPC) or equivalent international data protection standards.
• Transferring data only to jurisdictions that provide an adequate level of data protection, as assessed by the NPC or under applicable Philippine regulations.
• Applying technical safeguards, including encryption of data in transit and at rest, to protect personal data transferred internationally.

You may request further information about the safeguards applied to specific international data transfers by contacting our Data Protection Officer at the address provided in Section 14.

991ph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or the evolution of our platform. We will always post the most current version of this Policy on this page, with the effective date clearly indicated.

For material changes — those that significantly affect how we process your personal data or your rights — we will provide prominent notice on the 991ph platform and, where required by the Data Privacy Act, seek renewed consent. Your continued use of the 991ph platform following the effective date of any update constitutes acceptance of the revised Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how 991ph protects your data. The date at the top of this page always reflects when the Policy was last revised.

991ph has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Philippine Data Privacy Act and this Privacy Policy. If you have any questions, concerns, or requests relating to the processing of your personal data, please contact our DPO using the following details:

If you are not satisfied with our response to a data rights request or complaint, you have the right to escalate your concern to the National Privacy Commission (NPC) of the Philippines. The NPC is the competent supervisory authority for data protection matters in the Philippines.

For general platform support, our customer service team is available 24/7 via live chat on the 991ph platform, with an average response time of under 2 minutes. Our support staff serve players across Manila, Cebu, Davao, Quezon City, Makati, Iloilo, Cagayan de Oro, and all regions of the Philippines.