At 23ph, we take your privacy seriously. This Privacy Policy explains what personal data we collect from Filipino players, how we use it, who we share it with, and what rights you have over your own information under applicable Philippine data protection law.
About this document: This Privacy Policy applies to all personal data processed by 23ph in connection with its online casino and sports betting platform at 23ph.club, including data collected through account registration, gameplay, deposits and withdrawals, customer support interactions, and browsing activity. By creating a 23ph account, you consent to the collection and processing of your personal data as described herein. For questions about this policy, contact [email protected].
23ph is a PAGCOR-regulated online gaming platform serving Filipino players across the Philippines, including members from Metro Manila, Cebu, Davao, Quezon City, Makati, and other regions nationwide. We understand that when you provide us with your personal information — your name, your Philippine mobile number, your GCash or BDO account details — you are trusting us to handle it responsibly.
This Privacy Policy sets out in clear terms: what data we collect and why, the legal grounds on which we process it, who we share it with and under what circumstances, how long we keep it, and what rights you have as a data subject under Philippine law. We have written this policy to be readable and specific — not a wall of generic legal text — because you deserve to understand what happens to your information.
This policy is supplementary to, and should be read alongside, our Terms & Conditions. In the event of any inconsistency between this policy and the Terms & Conditions on a matter of data privacy, this Privacy Policy will prevail.
The data controller responsible for the personal data of 23ph members is the operating entity behind the 23ph platform, registered and licensed under PAGCOR's online gaming framework in the Philippines.
For the purposes of Philippine data protection legislation, including Republic Act No. 10173 (the Data Privacy Act of 2012) and its Implementing Rules and Regulations, 23ph is the personal information controller for all data collected through the 23ph platform.
Data Protection Officer: 23ph has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act and this Privacy Policy. You may contact our DPO through the support channels listed in Section 15 of this policy.
The following table summarises the categories of personal data that 23ph collects from members and prospective members:
| Data Category | Specific Data Points | Required / Optional |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, government-issued ID type and number (SSS, UMID, passport, driver's licence, PhilSys ID) | Required — KYC obligation |
| Contact Data | Philippine mobile number (Globe, Smart, or DITO), email address, residential address | Required — account operation |
| Financial Data | GCash or PayMaya registered number, bank account details (BPI, BDO, Metrobank), transaction history, deposit and withdrawal records | Required — payment processing |
| Gaming Activity Data | Game session records, bet history, win/loss data, responsible gaming tool usage, bonus activity logs | Required — regulatory compliance |
| Technical Data | IP address, device type, browser type and version, operating system, session timestamps, platform access logs | Required — security and fraud prevention |
| Biometric Data | Facial image captured during identity verification (selfie with ID document), where provided for KYC purposes | Required — KYC verification |
| Communication Data | Live chat transcripts, email correspondence, support ticket content, survey responses | Collected when you contact us |
| Marketing Preferences | Opted-in promotional categories, SMS and email marketing consent status, communication preferences | Optional — subject to your consent |
We do not knowingly collect sensitive personal information beyond what is required for KYC identity verification and as described above. We do not collect information about your religious beliefs, political opinions, or health status unless you voluntarily disclose such information in a support communication.
23ph collects personal data through the following methods:
Under the Data Privacy Act of 2012 (Republic Act No. 10173), 23ph processes your personal data on the following legal bases:
Note on biometric data: Under the Data Privacy Act, biometric data — including facial images used for KYC — is classified as sensitive personal information and requires your explicit consent before processing. By submitting KYC documents that include a facial photograph, you provide this consent.
23ph uses your personal data strictly for the purposes for which it was collected. We do not use your data for purposes incompatible with the reason it was provided. The principal purposes for which we use personal data include:
23ph does not sell your personal data to third parties. We share your data only in the following limited circumstances and only to the extent necessary for the stated purpose:
All third parties with whom 23ph shares personal data are required to process that data in compliance with applicable Philippine data protection law and 23ph's data processing agreements. We do not permit third-party data processors to use your personal data for their own commercial purposes.
The 23ph platform uses cookies and similar tracking technologies to support essential platform functions, maintain session security, and collect analytics data for platform improvement purposes. The following categories of cookies are used:
23ph does not use third-party advertising or tracking cookies to serve targeted advertising to members or to track members across other websites. You may manage cookie preferences through your browser settings, though disabling strictly necessary cookies will affect your ability to use the 23ph platform.
23ph retains personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory retention obligations, and to resolve disputes or enforce agreements. The following indicative retention periods apply:
| Data Type | Retention Period | Basis |
|---|---|---|
| Account identity and KYC documents | Duration of account + 5 years after account closure | PAGCOR licence conditions; AMLA requirements |
| Financial transaction records | Duration of account + 5 years after closure | Anti-Money Laundering Act (AMLA); PAGCOR reporting obligations |
| Gaming activity logs | Duration of account + 5 years after closure | PAGCOR licensing conditions; responsible gaming obligations |
| Customer support communications | 3 years from date of interaction | Dispute resolution; quality assurance |
| Technical/access log data | 12 months from collection | Security monitoring; fraud prevention |
| Marketing consent records | Duration of consent + 2 years after withdrawal | Evidence of lawful processing basis |
| Self-exclusion records | Indefinite (subject to review after 10 years) | Responsible gaming obligations; PAGCOR requirements |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be linked to an identifiable individual. Anonymised data may be retained indefinitely for aggregate analytics purposes.
23ph implements technical and organisational security measures appropriate to the nature and sensitivity of the personal data we process. These measures include, but are not limited to:
Your responsibility: No security system is impenetrable. You play an important role in keeping your 23ph account secure by using a strong, unique password, enabling 2FA, not sharing login credentials, and reporting any suspicious account activity to support promptly. See Section 4 of our Terms & Conditions for your security responsibilities.
As a data subject under Republic Act No. 10173 (Data Privacy Act of 2012), you have the following rights in relation to your personal data held by 23ph. To exercise any of these rights, contact us at [email protected] with your full name, account username, and a description of your request. We will respond within 15 business days.
You have the right to request a copy of the personal data that 23ph holds about you, including the purposes for which it is processed, the categories of data held, and the third parties with whom it has been shared. Requests will be responded to within 15 business days.
You have the right to request correction of inaccurate or incomplete personal data held about you. If you believe any data in your 23ph account is incorrect, you may update it directly from your account settings or contact support for assistance with data fields you cannot edit yourself.
You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. Note that this right is subject to 23ph's legal obligations under PAGCOR and AMLA to retain certain data for defined periods — erasure requests cannot override these mandatory retention requirements.
You have the right to object to the processing of your personal data where processing is based on legitimate interests, including profiling for marketing purposes. You may opt out of all marketing communications at any time by contacting support or using the unsubscribe link in any email communication.
You have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller. This right applies to data you have provided to 23ph and which is processed on the basis of consent or contract.
If you believe 23ph has processed your personal data in violation of the Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. Before filing with the NPC, we encourage you to first raise the matter with 23ph's Data Protection Officer so we have the opportunity to address your concern directly.
The 23ph platform is strictly for persons aged 21 years and above. PAGCOR requires all licensed online gambling operators in the Philippines to enforce a minimum age of 21. 23ph does not knowingly collect personal data from persons under 21 years of age.
If 23ph discovers or is notified that a person under 21 has created an account or provided personal data, all data associated with that account will be permanently deleted, the account will be closed immediately, and any deposited funds will be returned to the payment method of origin after identity verification.
If you are a parent or guardian and believe that a minor in your household may have accessed or registered on the 23ph platform, please contact us immediately at [email protected]. We will investigate and take appropriate action without delay.
Some of the third-party service providers that 23ph uses to deliver its services — including game studio partners, identity verification providers, and cloud infrastructure providers — may operate servers or process data outside of the Philippines.
Where personal data is transferred outside the Philippines, 23ph ensures that appropriate safeguards are in place to protect your data in accordance with the Data Privacy Act. These safeguards include:
You may request information about the specific safeguards in place for any particular cross-border transfer by contacting 23ph's Data Protection Officer.
23ph reserves the right to update this Privacy Policy from time to time to reflect changes in applicable law, PAGCOR regulatory requirements, our data processing practices, or the structure of the 23ph platform. All changes will be published on this page with an updated "Last Updated" date.
Where changes are material — for example, where we introduce a new category of data collection, add a new purpose for processing, or materially change how we share data with third parties — we will provide you with advance notice via the email address or mobile number registered on your 23ph account, allowing you a reasonable opportunity to review the changes before they take effect.
Your continued use of the 23ph platform following the publication of an updated Privacy Policy constitutes your acknowledgment of the updated terms. If you do not accept the changes, you may close your account and request deletion of your data subject to the mandatory retention periods described in Section 9.
For any questions, concerns, or requests relating to this Privacy Policy or your personal data held by 23ph, please contact us using the following channels:
We will acknowledge your request within 2 business days and respond in full within 15 business days. For complex data subject right requests (such as data portability or comprehensive access requests), we may require additional time, in which case we will notify you of the extended timeline and reason.
National Privacy Commission: If you are not satisfied with 23ph's response to your privacy concern, you have the right to file a complaint with the National Privacy Commission of the Philippines. Information about filing a complaint with the NPC is available through the NPC's official government channels.
Six concrete commitments that back up the 23ph Privacy Policy with real technical and operational measures.
Every connection between your device and the 23ph platform uses TLS encryption — the same standard as Philippine internet banking. Your personal data, financial details, and login credentials are never transmitted in plaintext.
23ph does not sell, rent, or trade your personal data to marketers, data brokers, or any third party for commercial purposes. Your GCash number, your transaction history, your gaming activity — all of it stays within 23ph's controlled systems except as required by law.
23ph operates in full compliance with Republic Act No. 10173 — the Philippines' Data Privacy Act of 2012. A designated Data Protection Officer oversees all data processing activities, and members have enforceable rights including access, rectification, and erasure.
23ph collects only the data that is genuinely necessary to operate your account, process payments, fulfil PAGCOR's KYC requirements, and prevent fraud. We do not collect data speculatively or "just in case." Every data field we capture has a documented, specific purpose.
Personal data is not kept indefinitely. 23ph maintains a documented data retention schedule. Data is deleted or anonymised once it is no longer required for its original purpose or legally required to be retained — whichever is the later date.
In the unlikely event of a personal data breach, 23ph's incident response process requires notification to the National Privacy Commission within 72 hours and to affected members without undue delay — going beyond the minimum requirements of the Data Privacy Act.
Privacy-first design, PAGCOR regulation, Data Privacy Act compliance, and 256-bit encryption — 23ph was built to be a platform Filipino players can trust. Over 3,200 games, GCash cashouts in minutes, and your data protected every step of the way.
Must be 21+ and a Philippine resident to play. Gambling involves financial risk. Play responsibly with the tools available in your account dashboard.
Your Privacy Rights at a Glance
Contact [email protected] to exercise any of these rights.