Privacy Policy – 291ph

291ph is committed to protecting the privacy and personal data of every player who uses our platform. We understand that trust is the foundation of any good relationship — and that trust starts with being transparent about how we handle your information.

This Policy applies to all personal data collected through the 291ph website, mobile application, customer support channels, and any other service we provide. By registering an account or using the 291ph platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

If you do not agree with any part of this Policy, please do not register or continue using the 291ph platform. You may contact our Data Protection Officer at any time with questions or concerns about how we handle your data.

291ph acts as the data controller for all personal information collected through the platform. As data controller, we determine the purposes and means of processing your personal data and are responsible for ensuring that such processing complies with applicable Philippine privacy laws.

Our designated Data Protection Officer (DPO) oversees all data privacy matters at 291ph. You may contact the DPO directly for any privacy-related queries, requests, or complaints. Contact details are provided in Section 15 of this Policy.

291ph collects the following categories of personal data from players:

We only collect personal data that is necessary, adequate, and relevant to the purposes for which it is processed. We do not collect sensitive personal information such as racial or ethnic origin, political opinions, or health data unless specifically required by law or regulation.

291ph collects personal data through the following means:

• Direct submission: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, or contacting our support team.
• Automated collection: Technical and usage data collected automatically when you access and interact with the 291ph platform, including through cookies, log files, and analytics tools.
• Third-party sources: Information received from payment processors such as GCash, PayMaya, BPI, BDO, and Metrobank in connection with your transactions, as well as identity verification service providers used for KYC compliance.
• Publicly available sources: In limited circumstances, we may verify information against publicly available records for fraud prevention or compliance purposes.

291ph processes your personal data for the following specific purposes:

• Account management: Creating, maintaining, and administering your 291ph player account.
• Identity and age verification: Confirming that you meet the minimum age requirement of 21 years and verifying your identity in compliance with KYC obligations.
• Payment processing: Facilitating deposits and withdrawals through your chosen Philippine payment method.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, money laundering, and other illegal conduct on the platform.
• Regulatory compliance: Meeting our obligations under Philippine gaming regulations, anti-money laundering laws, and the Data Privacy Act of 2012.
• Customer support: Responding to your queries, resolving disputes, and providing technical assistance.
• Responsible gaming: Monitoring gaming activity to identify potential problem gambling behaviour and administering responsible gaming tools such as deposit limits and self-exclusion.
• Platform improvement: Analysing usage patterns to improve the performance, features, and user experience of the 291ph platform.
• Marketing communications: Sending you promotional offers, bonuses, and updates about 291ph — only where you have provided your consent to receive such communications.

We will not process your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise permitted by law.

Under the Data Privacy Act of 2012 (RA 10173), 291ph processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you — including account management, payment processing, and game operation.
• Legal obligation: Processing necessary to comply with applicable Philippine laws, including anti-money laundering regulations, gaming regulations, and tax reporting requirements.
• Legitimate interests: Processing carried out for our legitimate business interests, such as fraud prevention, platform security, and service improvement, where such interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — particularly for marketing communications and optional data collection. You may withdraw your consent at any time without affecting the lawfulness of prior processing.

Your personal data may be shared with the following categories of recipients:

• Payment service providers: GCash, PayMaya, BPI, BDO, Metrobank, and other payment processors, solely for the purpose of processing your financial transactions.
• Identity verification providers: Third-party KYC and identity verification service providers engaged to assist with age and identity checks.
• Technology and hosting providers: Cloud hosting, data storage, and IT infrastructure providers who process data on our behalf under strict data processing agreements.
• Regulatory and law enforcement authorities: Philippine government agencies, including the National Privacy Commission (NPC), Anti-Money Laundering Council (AMLC), and law enforcement bodies, where we are legally required to disclose information.
• Professional advisers: Legal counsel, auditors, and compliance consultants, subject to professional confidentiality obligations.
• Business successors: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third parties with whom we share personal data are required to handle it in accordance with applicable privacy laws and our data sharing agreements. We do not permit third parties to use your data for their own marketing purposes.

291ph retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention periods are as follows:

• Account data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with anti-money laundering regulations.
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction, as required by Philippine financial regulations.
• KYC and identity documents: Retained for a minimum of five (5) years following account closure or the completion of the relevant transaction.
• Customer support records: Retained for three (3) years from the date of the interaction.
• Marketing consent records: Retained until you withdraw your consent, plus a reasonable period thereafter for compliance documentation purposes.
• Technical and usage logs: Retained for up to twelve (12) months, unless a longer period is required for security investigations.

Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymised in accordance with our data disposal procedures.

291ph implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include:

• SSL/TLS encryption for all data transmitted between your device and the 291ph platform.
• Encryption of sensitive data at rest, including financial information and identity documents.
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis.
• Regular security audits, vulnerability assessments, and penetration testing.
• Multi-factor authentication for administrative access to systems containing personal data.
• Incident response procedures for detecting, reporting, and managing personal data breaches.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, 291ph will notify the National Privacy Commission (NPC) and affected players in accordance with the requirements of the Data Privacy Act of 2012 and its Implementing Rules and Regulations.

While we take all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your 291ph account credentials and for notifying us immediately if you suspect any unauthorised access to your account.

291ph uses cookies and similar tracking technologies to enhance your experience on our platform, analyse usage patterns, and support security functions. The types of cookies we use include:

• Strictly necessary cookies: Essential for the operation of the platform, including session management, login authentication, and security functions. These cannot be disabled.
• Functional cookies: Used to remember your preferences, such as language settings and display options, to personalise your experience on 291ph.
• Analytics cookies: Used to collect anonymised data about how players use the platform, helping us identify areas for improvement. This data does not identify you personally.
• Security cookies: Used to detect and prevent fraudulent activity, bot access, and other security threats.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the 291ph platform. Strictly necessary cookies cannot be disabled as they are essential for the platform to operate.

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by 291ph:

To exercise any of these rights, please contact our Data Protection Officer using the details provided in Section 15. We will respond to all verified requests within thirty (30) days. We may need to verify your identity before processing your request. There is no fee for exercising your rights, though we reserve the right to charge a reasonable fee for manifestly unfounded or excessive requests.

If you believe that 291ph has not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

291ph takes the protection of minors very seriously. We implement age verification measures during the registration process and through our ongoing KYC procedures to prevent underage individuals from accessing the platform.

If we become aware that we have inadvertently collected personal data from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. Any winnings or balances associated with an underage account will be forfeited.

If you are a parent or guardian and believe that your child has registered on the 291ph platform, please contact our Data Protection Officer immediately using the contact details in Section 15 so that we can take appropriate action.

In certain circumstances, your personal data may be transferred to, stored in, or processed in countries outside the Philippines — for example, where our technology infrastructure providers or game content partners are located in other jurisdictions.

Where such transfers occur, 291ph ensures that appropriate safeguards are in place to protect your personal data in accordance with the Data Privacy Act of 2012 and the standards set by the National Privacy Commission. These safeguards may include contractual clauses, data processing agreements, or transfers to countries that have been assessed as providing an adequate level of data protection.

By using the 291ph platform, you acknowledge and consent to the transfer of your personal data to other countries as described in this section, subject to the protections outlined above.

291ph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When material changes are made, we will notify registered players by posting a prominent notice on the platform or by sending a notification to your registered contact details.

The updated Policy will take effect from the date it is published on the 291ph platform. The "Last Updated" date at the top of this Policy will be revised accordingly. We encourage you to review this Policy periodically to stay informed about how we protect your personal data.

Your continued use of the 291ph platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with the changes, you should stop using the platform and contact us to close your account.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 291ph handles your personal data, please contact our Data Protection Officer (DPO):

Please include your registered username, a clear description of your request or concern, and any relevant details to help us respond efficiently. For account-specific support queries, you may also reach our team via the live chat feature available inside your 291ph account dashboard, available 24 hours a day, 7 days a week.

If you are not satisfied with our response, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act of 2012.