pegasusph Privacy Policy

1. Overview & Data Controller

pegasusph ("we," "us," "our," or the "Company") is the data controller responsible for the personal data of users ("you," "your," or "Player") who access and use the pegasusph online gaming platform (the "Platform").

We are committed to protecting your personal data and processing it in a transparent, lawful, and fair manner. This Privacy Policy has been prepared in accordance with the Republic Act No. 10173, also known as the Data Privacy Act of 2012 of the Philippines, its Implementing Rules and Regulations, and the guidelines issued by the National Privacy Commission (NPC).

By registering for an account or using the pegasusph Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform immediately.

2. Personal Data We Collect

pegasusph collects the following categories of personal data from players and visitors to the Platform:

2.1 Identity & Registration Data

• Full legal name
• Date of birth (for age verification — you must be 21 or older)
• Government-issued identification number (e.g., PhilSys ID, passport, driver's licence)
• Username and account credentials (password stored in encrypted form only)
• Profile photograph (where submitted for verification purposes)

2.2 Contact Data

• Email address
• Mobile phone number
• Residential address (city, province, postal code)

2.3 Financial & Transaction Data

• Deposit and withdrawal history
• Payment method details (GCash account reference, Maya account reference, bank account details, debit card details — stored in tokenised form)
• Account balance and transaction timestamps
• Bonus and promotional credit history

2.4 Gaming Activity Data

• Games played, bet amounts, win/loss records
• Session duration and frequency of play
• Responsible gaming tool usage (deposit limits, self-exclusion requests)

2.5 Technical & Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser information
• Cookie identifiers and session tokens
• Log data including access times and pages visited

2.6 Communications Data

• Records of live chat, email, and support ticket interactions
• Survey responses and feedback submissions
• Marketing preference settings

3. How We Collect Your Data

pegasusph collects personal data through the following means:

• Directly from you: When you register an account, complete identity verification, make a deposit or withdrawal, contact our support team, or participate in promotions.
• Automatically: Through cookies, web beacons, and similar tracking technologies when you browse or use the Platform. See Section 9 for our full Cookies Policy.
• From third parties: Identity verification providers, payment processors (GCash, Maya, banks), fraud prevention services, and PAGCOR where required for regulatory compliance.
• From publicly available sources: Where necessary for fraud prevention or regulatory compliance, we may cross-reference publicly available information.

4. Why We Use Your Personal Data

pegasusph processes your personal data for the following purposes:

5. Legal Basis for Processing

Under the Data Privacy Act of 2012, pegasusph processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions you agreed to upon registration (e.g., account management, payment processing, game provision).
• Legal obligation: Processing required to comply with applicable Philippine laws and PAGCOR regulations, including KYC, AML, and responsible gaming obligations.
• Legitimate interests: Processing necessary for fraud prevention, platform security, and improving our services, where such interests are not overridden by your rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have provided explicit, freely given consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Data Sharing & Third Parties

pegasusph does not sell your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection agreements:

• Payment processors: GCash, Maya, and Philippine banking partners (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank) for processing deposits and withdrawals.
• Identity verification providers: Third-party KYC service providers for age and identity verification.
• Fraud prevention and AML services: Specialist providers that help us detect and prevent fraudulent activity and money laundering.
• Game software providers: Licensed game developers whose titles are hosted on the pegasusph Platform, to the extent necessary for game operation and fairness auditing.
• Regulatory authorities: PAGCOR, the National Privacy Commission, and other Philippine government agencies where disclosure is required by law.
• IT and cloud service providers: Infrastructure and hosting providers who process data on our behalf under strict data processing agreements.
• Professional advisers: Legal, accounting, and auditing firms, subject to professional confidentiality obligations.

7. Data Retention

pegasusph retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years after account closure, as required by PAGCOR and AML regulations.
• Transaction and financial data: Retained for a minimum of five (5) years from the date of the transaction, in accordance with Philippine financial record-keeping requirements.
• Gaming activity data: Retained for three (3) years from the date of the activity, or longer where required for dispute resolution or regulatory purposes.
• Communications data: Retained for two (2) years from the date of the communication, unless required longer for dispute resolution.
• Technical and device data: Retained for twelve (12) months from collection, unless required longer for security investigations.
• Self-exclusion records: Retained indefinitely to prevent re-registration during an exclusion period and to comply with responsible gaming obligations.

Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymised in accordance with our data disposal procedures.

8. Security Measures

pegasusph implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and our servers.
• AES-256 encryption for sensitive data stored at rest, including payment method tokens and identity documents.
• Multi-factor authentication (MFA) for internal staff access to systems containing personal data.
• Regular penetration testing and vulnerability assessments conducted by independent security firms.
• Role-based access controls ensuring staff can only access data necessary for their specific job function.
• 24/7 security monitoring and intrusion detection systems.
• Regular staff training on data protection and information security best practices.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, pegasusph will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, and will notify affected individuals without undue delay, in accordance with the Data Privacy Act of 2012.

9. Cookies & Tracking Technologies

pegasusph uses cookies and similar tracking technologies to operate and improve the Platform. The types of cookies we use are:

• Strictly necessary cookies: Essential for the Platform to function. These cannot be disabled as they are required for account login, session management, and security. No consent is required for these cookies.
• Functional cookies: Remember your preferences (e.g., language, display settings) to provide a more personalised experience.
• Analytics cookies: Help us understand how players use the Platform so we can improve performance and user experience. These are only set with your consent.
• Marketing cookies: Used to deliver relevant promotional content. These are only set with your explicit consent and can be withdrawn at any time.

You can manage your cookie preferences through the cookie settings panel available on the Platform. Please note that disabling certain cookies may affect the functionality of the Platform.

10. Your Data Privacy Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by pegasusph:

To exercise any of these rights, please contact our Data Protection Officer (DPO) using the details in Section 14. We will respond to all verified requests within thirty (30) days. We may need to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

11. Minors & Age Policy

The pegasusph Platform is strictly intended for individuals who are 21 years of age or older, in accordance with Philippine gambling regulations. We do not knowingly collect personal data from individuals under the age of 21.

As part of our registration process, all players are required to verify their age by providing a valid government-issued identification document. Any account found to belong to a person under 21 years of age will be immediately suspended, all funds will be frozen pending investigation, and the matter will be reported to PAGCOR.

12. International Data Transfers

Where pegasusph transfers your personal data outside of the Philippines — for example, to cloud infrastructure providers or game software partners located in other countries — we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that required under the Data Privacy Act of 2012.

Such safeguards may include standard contractual clauses approved by the National Privacy Commission, binding corporate rules, or transfers to countries that have been assessed as providing an adequate level of data protection.

You may request information about the specific safeguards applicable to any international transfer of your personal data by contacting our DPO.

13. Changes to This Privacy Policy

pegasusph may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will notify registered players via email or a prominent notice on the Platform prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how pegasusph protects your personal data.

Your continued use of the pegasusph Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms.

14. Contact & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by pegasusph, please contact our Data Protection Officer:

• DPO Email: [email protected]
• General Support: [email protected]
• Live Chat: Available 24/7 via the pegasusph Platform

We aim to respond to all data privacy requests within thirty (30) days. For complex requests, we may extend this period by a further thirty (30) days, in which case we will notify you of the extension and the reasons for it.

If you are not satisfied with our response, you may escalate your complaint to the National Privacy Commission of the Philippines at [email protected] or visit their website for further guidance.