Privacy Policy

1 Overview & Scope

This Privacy Policy ("Policy") applies to all personal data collected and processed by charmph ("we," "us," "our") in connection with the operation of the charmph online casino and sports betting platform, accessible at charmph.org and any associated mobile applications or services (collectively, "the Platform").

charmph is committed to protecting the privacy and security of every Filipino player who uses our platform. We operate under the regulatory supervision of the Philippine Amusement and Gaming Corporation (PAGCOR), and our data handling practices are designed to comply with:

• Republic Act No. 10173 — Data Privacy Act of 2012 (DPA);
• The Implementing Rules and Regulations of the DPA;
• National Privacy Commission (NPC) circulars and advisories;
• PAGCOR's Anti-Money Laundering and KYC requirements;
• Republic Act No. 9160 — Anti-Money Laundering Act of 2001 (as amended).

This Policy applies to all users of the Platform, regardless of whether you have registered an account, are browsing as a guest, or have contacted charmph's customer support. It covers personal data collected via the website, live chat, email, and any other channel through which you interact with charmph.

This Policy should be read together with our Terms & Conditions and Responsible Gaming Policy, both of which are incorporated herein by reference.

2 Data We Collect

charmph collects personal data through several channels: directly from you during registration and account use, automatically through your use of the Platform, and from third-party verification and payment providers. The categories of personal data we collect include:

Registration & Identity Data

• Full legal name as it appears on your government-issued ID;
• Date of birth (used to verify the 21+ age requirement);
• Residential address (barangay, city/municipality, province, ZIP code);
• Email address and mobile phone number;
• Username and encrypted password.

Identity Verification (KYC) Data

• Copies of government-issued photo identification (passport, PhilSys National ID, UMID, SSS ID, driver's license, or PRC ID);
• Proof of residential address (utility bill, bank statement dated within 90 days);
• Selfie photographs submitted for identity verification purposes;
• Proof of ownership of payment methods used for deposits.

Financial & Transaction Data

• GCash, Maya/PayMaya, Coins.ph, or bank account details linked to your account for deposit and withdrawal processing;
• Transaction history including deposit amounts, withdrawal amounts, dates, and reference numbers;
• Cryptocurrency wallet addresses for USDT TRC20 transactions.

Gaming & Behavioral Data

• Game history, betting records, wager amounts, and session durations;
• Bonus claims, promotional activity, and wagering progress;
• Responsible gaming settings such as deposit limits and self-exclusion status.

Technical & Device Data

• IP address and approximate geolocation derived from IP;
• Browser type, version, and operating system;
• Device identifiers and screen resolution;
• Session timestamps, pages visited, and click patterns;
• Referral source and marketing attribution data.

Communication Data

• Live chat transcripts with our customer support team;
• Email correspondence sent to or received from charmph;
• Responses to surveys, promotions, or feedback requests.

3 How We Use Your Data

charmph uses the personal data we collect exclusively for the following specified, explicit, and legitimate purposes:

charmph does not use your personal data for automated decision-making that produces legal effects or similarly significant consequences without human review, except as permitted by applicable Philippine law and PAGCOR regulations.

4 Legal Basis for Processing

Under the Data Privacy Act of 2012, charmph processes personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you accepted upon registration, including account management, payment processing, and service delivery;
• Legal Obligation: Processing required to comply with PAGCOR regulations, Anti-Money Laundering Act requirements, NPC directives, and other applicable Philippine laws;
• Legitimate Interest: Processing necessary for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where such interests are not overridden by your data protection rights;
• Consent: Processing for marketing communications and non-essential cookies, where your explicit consent has been obtained and may be withdrawn at any time.

Where charmph relies on consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.

5 Data Sharing & Disclosure

charmph does not sell, rent, or trade your personal data. We share personal data only in the following limited circumstances, and only to the extent strictly necessary for the stated purpose:

KYC & Identity Verification Providers

We engage accredited third-party identity verification providers to assist with KYC processing. These providers receive only the data necessary for verification and are bound by confidentiality agreements and data processing agreements consistent with RA 10173.

Payment Processors

Transaction data is shared with payment service providers including GCash, Maya/PayMaya, BPI, BDO, Metrobank, 7-Eleven CLiQQ, Coins.ph, and USDT TRC20 network facilitators solely for the purpose of processing your deposits and withdrawals. Each provider operates under its own privacy policy and applicable regulatory requirements.

Regulatory Authorities

charmph is legally obligated to share certain personal and transactional data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities when required by law, court order, or regulatory directive. Such disclosures are made strictly in compliance with applicable legal requirements.

Game Content Providers

Licensed game studios providing live casino, slot, and sports betting content on the charmph platform may receive pseudonymized session and gameplay data for technical integration, audit, and certification purposes. No directly identifying personal data is shared with game providers unless required for dispute resolution.

Legal and Professional Advisers

charmph may share personal data with legal counsel, auditors, and professional advisers where strictly necessary for the conduct of legal proceedings, regulatory investigations, or statutory audits, subject to professional confidentiality obligations.

6 Cookies & Tracking

charmph uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device that allow the Platform to recognize your browser and retain certain preferences and session information.

Types of Cookies We Use

• Strictly Necessary Cookies: Required for the Platform to function correctly, including session management, login authentication, and security features. These cookies cannot be disabled without severely impairing your ability to use charmph;
• Functional Cookies: Remember your preferences such as language settings, game lobby layout, and responsible gaming configurations;
• Analytics Cookies: Used to understand how players interact with the Platform — which pages are visited most frequently, session duration, and navigation patterns — using anonymized or pseudonymized data. This helps us improve user experience;
• Marketing Cookies (Consent Required): Used to deliver relevant promotional content and measure campaign effectiveness. These are activated only upon your explicit consent and can be withdrawn at any time via your cookie preferences.

You can manage or withdraw consent for non-essential cookies at any time through your browser settings or the cookie preference center available on the Platform. Please note that disabling certain cookies may affect the functionality and performance of charmph.

7 Data Retention

charmph retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by PAGCOR regulations and applicable Philippine law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents re-identification. Where data is retained beyond the standard period due to an ongoing legal dispute, regulatory investigation, or court order, charmph will notify you of the extended retention where legally permissible.

8 Data Security

charmph implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. These measures include:

• Transport Layer Security (TLS): All data transmitted between your browser and charmph's servers is encrypted using TLS 1.2 or higher;
• Data Encryption at Rest: Sensitive personal data and financial information stored on charmph servers is encrypted using AES-256 encryption;
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and undergo regular data protection training;
• Multi-Factor Authentication: Internal systems containing personal data require multi-factor authentication for access by charmph personnel;
• Regular Security Audits: charmph conducts periodic vulnerability assessments and penetration tests on its platform infrastructure;
• Incident Response Plan: charmph maintains a formal data breach response procedure. In the event of a breach likely to prejudice your rights, we will notify the National Privacy Commission and affected players within the timeframes required by the DPA.

While charmph takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying charmph immediately if you suspect unauthorized access to your account.

9 Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by charmph:

• Right to be Informed: The right to know what personal data charmph collects about you, how it is used, and with whom it is shared — as described in this Policy;
• Right to Access: The right to request a copy of the personal data charmph holds about you, including information about the sources from which it was obtained and the purposes for which it is processed;
• Right to Rectification: The right to request correction of inaccurate, incomplete, or outdated personal data held by charmph;
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations under PAGCOR regulations and the AMLA;
• Right to Data Portability: The right to receive a copy of your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller;
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interest;
• Right to Withdraw Consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of prior processing;
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe charmph has violated your data privacy rights.

To exercise any of the above rights, please contact charmph's Data Protection Officer via live chat or by writing to [email protected]. We will respond to your request within fifteen (15) business days in accordance with NPC guidelines. Requests may be subject to identity verification before processing.

10 Minors & Age Policy

charmph employs mandatory age verification as part of the KYC process to prevent access by underage individuals. If charmph discovers that personal data has been collected from a person under 21 years of age, the associated account will be immediately suspended, all data will be securely deleted, and the matter may be reported to relevant authorities in accordance with PAGCOR's child protection obligations.

If you are a parent or guardian and believe that your child may have registered an account on charmph, please contact our support team immediately via live chat or by writing to [email protected]. We will investigate and take appropriate action without delay.

11 International Data Transfers

charmph primarily processes and stores personal data within the Philippines. In certain circumstances, data may be transferred to or accessed from servers or service providers located outside the Philippines — for example, where game content providers or cloud infrastructure partners operate from other jurisdictions.

Any international transfer of personal data by charmph is carried out only where:

• The destination country has been recognized as providing an adequate level of data protection consistent with Philippine standards;
• Appropriate safeguards are in place, including standard contractual clauses approved by the NPC or binding corporate rules; or
• The transfer is necessary for the performance of a contract with you (such as processing a cryptocurrency withdrawal via the USDT TRC20 network).

charmph will not transfer personal data internationally in a manner that would undermine your rights under the Data Privacy Act of 2012.

12 Changes to This Policy

charmph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or PAGCOR regulatory requirements. The most current version of this Policy will always be available at charmph.org/privacy-policy.

Where changes are material — such as a new category of data being collected, a new purpose for processing, or a change in data retention periods — charmph will notify registered players via the email address on file or through a prominent notice displayed on the Platform, at least seven (7) days prior to the changes taking effect.

Your continued use of charmph following the effective date of any amended Privacy Policy constitutes your acknowledgment of the updated Policy. If you do not agree with any changes, you should close your account before the amended Policy takes effect.

13 Contact & Data Protection Officer

charmph has appointed a Data Protection Officer (DPO) in accordance with the requirements of the Data Privacy Act of 2012. If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us through any of the following channels:

• Live Chat: Available 24/7 directly from the charmph platform — the fastest way to reach our Filipino support team for urgent privacy concerns;
• Email: [email protected] — our DPO will respond to privacy-related inquiries within 15 business days;
• FAQ: Visit our FAQ page for answers to common questions about account data, KYC verification, and data deletion requests.

When submitting a privacy request, please include your registered email address or username so we can verify your identity before processing your request. charmph will not process data subject requests from unverified individuals to protect against unauthorized access to your personal data.