Privacy Policy — magicph Online Casino

This Privacy Policy applies to all personal data processed by magicph in connection with your use of the magicph online gaming platform, accessible at magicph.app, including all associated games, features, support channels, and promotional activities. It applies to all registered Account holders, prospective users who browse the Platform without registering, and any individual whose personal data is submitted to magicph in connection with an Account application or support inquiry.

For purposes of the Data Privacy Act of 2012 (Republic Act No. 10173), magicph acts as the Personal Information Controller (PIC) in respect of the personal data described in this Policy. magicph determines the purposes and means of processing your personal data. Certain third-party service providers engaged by magicph — including payment processors, game providers, and identity verification services — act as Personal Information Processors (PIPs) and process personal data only on magicph's documented instructions.

magicph is registered with the National Privacy Commission (NPC) of the Philippines in accordance with NPC Circular No. 17-01. Our Data Protection Officer (DPO) can be reached at the contact details provided in Section 16 of this Policy.

magicph collects the following categories of personal data, depending on how you interact with the Platform:

Collected at the time of Account registration and during the KYC (Know Your Customer) verification process:

• Full legal name (as it appears on your government-issued ID);
• Date of birth (used to verify compliance with the 21+ age requirement);
• Philippine residential address;
• Active Philippine mobile number;
• Email address (where provided as an alternative login method);
• Government-issued identification document number and images (UMID, PhilSys ID, passport, driver's license, PRC ID);
• Selfie photograph taken alongside an identification document for liveness verification.

• GCash account reference number or Maya wallet reference number;
• Bank account or InstaPay details (BPI, BDO, UnionBank, Metrobank, or other Philippine bank) where used for deposits or withdrawals;
• Cryptocurrency wallet address (USDT or other supported currencies);
• Complete transaction history, including deposit amounts, withdrawal amounts, dates, and processing status;
• Betting history, game session records, wager amounts, and game outcomes.

• IP address and approximate geographic location at the time of login and transaction;
• Device type, operating system, and browser information;
• Session timestamps and login history;
• Cookie identifiers and similar tracking technologies as described in Section 7.

• The content of messages, inquiries, and complaints submitted to magicph's customer support team via live chat, email, or any other channel;
• Records of any self-exclusion requests, responsible gaming tool activations, or account restriction requests;
• Feedback and survey responses voluntarily submitted by you.

In accordance with PAGCOR's responsible gaming requirements, magicph records the following in connection with player protection obligations:

• Deposit limits set by the player;
• Self-exclusion periods and dates;
• Session duration and gaming frequency data used for responsible gaming assessments;
• Any information voluntarily disclosed in connection with a request for support related to problem gambling.

magicph collects personal data through the following channels and mechanisms:

• Directly from you — through the Account registration form, the KYC document submission process, support communications, and any voluntary information you provide while using the Platform;
• Automatically through the Platform — through server logs, session tracking, and cookies and similar technologies as described in Section 7, which collect technical and behavioral data as you navigate and use the Platform;
• From payment processors — GCash, Maya, InstaPay banks, and cryptocurrency networks provide transaction confirmation data and, in some cases, identity confirmation data in connection with payment processing;
• From identity verification service providers — third-party KYC service providers engaged by magicph process submitted identification documents and return a verification result and associated data to magicph;
• From government and regulatory sources — PAGCOR, the Anti-Money Laundering Council (AMLC), and other Philippine government bodies may share information with magicph in connection with compliance inquiries, regulatory directives, or investigation processes.

magicph processes your personal data for the following clearly defined purposes:

magicph does not use automated decision-making or profiling in a manner that produces legal or similarly significant effects on players, except in the context of AML risk-scoring required by Philippine law, which is subject to human review before any account action is taken.

Under the Data Privacy Act of 2012, magicph relies on the following legal bases for processing personal data:

• Performance of a contract — Processing necessary to create and maintain your Account, process transactions, and deliver the gaming services you have contracted for via the Terms & Conditions;
• Compliance with a legal obligation — Processing required by PAGCOR regulations, the Anti-Money Laundering Act (RA 9160 as amended), the Data Privacy Act itself, and other applicable Philippine legislation, including mandatory KYC, transaction monitoring, and regulatory reporting;
• Legitimate interests — Processing for fraud prevention, platform security, responsible gaming program management, and anonymized analytics, where such interests are not overridden by your privacy rights;
• Consent — Processing for direct marketing and promotional communications, which you may withdraw at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Where magicph relies on consent as a legal basis, you have the right to withdraw that consent at any time by contacting our Data Protection Officer or updating your communication preferences in your Account settings. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

magicph does not sell, rent, or trade your personal data to third parties. Data sharing is limited to the following categories of recipients, each of whom processes data only to the extent necessary for the specified purpose and is bound by appropriate data processing agreements or legal obligations:

• Payment processors — GCash, Maya, InstaPay network banks, cryptocurrency processors, and Coins.ph receive the minimum transaction data necessary to process deposits and withdrawals securely;
• Game providers — Licensed game software providers (such as PG Soft, Pragmatic Play, and Evolution Gaming) receive session and bet data necessary to operate their games within the magicph Platform;
• KYC and identity verification providers — Third-party identity verification services receive submitted KYC documents for automated verification processing;
• PAGCOR — magicph discloses account, transaction, and gaming activity data to PAGCOR as required by its licensing obligations and PAGCOR's inspection and audit rights;
• Anti-Money Laundering Council (AMLC) — magicph submits mandatory suspicious transaction reports (STRs) and covered transaction reports (CTRs) to AMLC as required under the Anti-Money Laundering Act;
• Law enforcement and courts — magicph discloses personal data to Philippine law enforcement agencies or courts when compelled by a valid court order, subpoena, or equivalent legal process;
• Cloud and infrastructure providers — magicph uses Philippine-based and internationally certified cloud infrastructure services to host Platform data, with all providers bound by appropriate data processing agreements.

The magicph Platform uses cookies and similar tracking technologies to deliver a functional and secure user experience. Cookies are small data files stored on your device by your browser. magicph uses the following categories of cookies:

• Strictly necessary cookies — Required for basic Platform functionality, including maintaining your login session, storing your wallet balance for display, and enabling security features such as CSRF protection. These cookies cannot be disabled without impairing Platform functionality;
• Functional cookies — Store your user preferences, such as language settings and responsible gaming tool configurations, to personalize your experience across sessions;
• Analytics cookies — Collect aggregated, anonymized information about how users navigate and interact with the Platform. magicph uses this data internally to improve Platform performance and user experience. No personally identifiable behavioral profiles are built or sold;
• Security cookies — Used to detect and prevent fraudulent access, bot activity, and suspicious login patterns. These are required for the protection of your Account.

magicph does not use third-party advertising cookies or allow advertising networks to place tracking cookies on the Platform. You may manage cookie preferences in your browser settings; however, disabling strictly necessary cookies will prevent you from logging in or using core Platform features.

magicph retains personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy or as required by Applicable Law. The following general retention periods apply:

• Account and identity data — Retained for the duration of the Account relationship and for a period of five (5) years following Account closure, in compliance with PAGCOR's record-keeping requirements and the Anti-Money Laundering Act's minimum five-year retention mandate for customer due diligence records;
• Transaction and financial data — Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act;
• Communications and support data — Retained for three (3) years from the date of the communication, unless a longer retention period is required by an ongoing dispute or legal proceeding;
• Gaming activity data — Retained for five (5) years for PAGCOR audit and regulatory reporting purposes;
• Technical and log data — Retained for twelve (12) months for security and fraud investigation purposes, after which it is anonymized or deleted.

Upon expiry of the applicable retention period, magicph will securely delete or anonymize personal data in a manner that prevents reconstruction or re-identification.

magicph implements technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Transport Layer Security (TLS) with 256-bit encryption for all data in transit between your device and magicph servers;
• Encryption at rest for all stored personal data, including identity documents and financial information;
• Role-based access controls ensuring that only magicph personnel with a demonstrable operational need can access personal data, subject to logging and review;
• Multi-factor authentication required for all internal administrative access to systems containing personal data;
• Regular penetration testing and vulnerability assessments conducted by qualified third-party security firms;
• An incident response plan and data breach notification procedure aligned with NPC requirements.

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to the personal data that magicph holds about you. To exercise any of these rights, contact the magicph Data Protection Officer at the details provided in Section 16.

The magicph Platform is strictly prohibited from persons under 21 years of age, in compliance with PAGCOR's age requirements for online gaming in the Philippines. magicph does not knowingly collect or process personal data from any person under the age of 21.

As part of the registration and KYC process, magicph verifies that all Account holders meet the 21-year minimum age requirement. If magicph discovers that personal data has been collected from a person under 21 without verified parental or guardian consent, that data will be deleted without delay and the associated Account will be immediately closed.

Certain personal information processing activities may involve the transfer of data to servers, service providers, or game providers located outside the Philippines. Such transfers may occur in connection with internationally certified cloud infrastructure providers, KYC verification service providers, and game software providers whose operations are based in other jurisdictions.

magicph ensures that any cross-border transfer of personal data is conducted only where the recipient jurisdiction provides a level of data protection substantially equivalent to the standards required under RA 10173, or where appropriate contractual safeguards — including standard contractual clauses — have been implemented with the recipient to ensure equivalent protection of transferred personal data.

Cross-border transfers are disclosed to the National Privacy Commission in accordance with NPC Circular No. 16-02 where required.

In the event of a personal data breach — meaning a security incident that results in the unauthorized access, disclosure, alteration, loss, or destruction of personal data — magicph will take the following steps:

1. Contain and investigate the breach as quickly as possible to minimize harm;
2. Notify the National Privacy Commission within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of affected data subjects, in accordance with NPC Circular No. 16-03;
3. Notify affected Account holders directly via their registered mobile number and/or email address without undue delay where the breach is likely to result in a high risk to their rights and freedoms — providing a description of the nature of the breach, the categories and approximate number of records affected, likely consequences, and measures taken or proposed;
4. Document all breaches in magicph's internal breach register, regardless of whether notification to the NPC is required.

magicph will not use a breach notification to request additional personal information or to direct you to a login page. If you receive what appears to be a breach notification from magicph, verify it by contacting support directly.

The magicph Platform may contain links to third-party game providers' game help pages or informational resources. These third-party pages operate under their own privacy policies and data handling practices, for which magicph is not responsible. magicph does not endorse or make any representations about the privacy practices of linked third-party sites.

We encourage you to review the privacy policies of any third-party site you access in connection with the magicph Platform.

magicph reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, changes in Applicable Law, or changes in our business operations. Material changes that affect your rights or how we process your personal data will be communicated to you via your registered mobile number or email address no less than 14 calendar days before the changes take effect.

Minor administrative amendments — such as corrections to typographical errors or clarifications that do not alter the substance of the Policy — may take effect immediately upon publication on the Platform. The "Last Updated" date at the top of this document will reflect the date of the most recent revision.

Continued use of the magicph Platform following the effective date of any amended Privacy Policy constitutes your acknowledgment of the amended terms. If you do not agree with any material change, you may request Account closure before the amendment takes effect.

For any questions, requests, or concerns relating to this Privacy Policy or your personal data, you may contact the magicph Data Protection Officer (DPO) through the following channels. All data subject rights requests should be submitted in writing with sufficient information to verify your identity.

• Data Protection Officer (Privacy Requests): [email protected]
• General Player Support: [email protected]
• Compliance & Legal: [email protected]

magicph will acknowledge receipt of a data subject rights request within 5 Philippine business days and will provide a substantive response within 30 calendar days of receipt. Where a request is particularly complex or numerous, the response period may be extended by a further 30 days with written notification to you of the extension and the reasons for it.

If you are not satisfied with magicph's response to your privacy inquiry, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. Contact information for the NPC is publicly available on the NPC's official website.