66ph Casino — Privacy Policy

This Privacy Policy ("Policy") describes how 66ph Casino ("66ph", "we", "our", or "us") collects, processes, stores, shares, and protects the personal information of individuals who use the 66ph platform at https://66ph.club ("Platform"), including registered Members, prospective registrants, and visitors.

This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 of the Philippines ("DPA"), and its Implementing Rules and Regulations ("IRR"), as administered by the National Privacy Commission ("NPC"). 66ph is a registered personal information controller under the NPC's registration system.

This Policy applies to all personal data processed in connection with the 66ph Platform, regardless of whether processing occurs electronically or otherwise. It covers data collected via the website, account registration, financial transactions, customer support interactions, and technical platform logs.

The personal information controller responsible for your data under this Policy is the operator of the 66ph Casino platform, licensed by the Philippine Amusement and Gaming Corporation (PAGCOR) and operating the website at https://66ph.club.

66ph has appointed a Data Protection Officer ("DPO") as required under the DPA. The DPO is responsible for overseeing 66ph's data protection strategy, handling data subject rights requests, responding to NPC enquiries, and monitoring ongoing compliance with the DPA and its IRR.

Contact details for the DPO are set out in Section 15 of this Policy.

66ph collects the following categories of personal information in connection with your use of the Platform:

3.1 Registration and Identity Data. When you create a 66ph account, we collect your full legal name, date of birth, Philippine mobile number, email address, and the password you create. This information is required to establish your account and to verify that you meet the 21+ age eligibility requirement.

3.2 Know Your Customer (KYC) and Verification Data. Prior to processing your first withdrawal, and at any point where identity verification is required under PAGCOR regulations or our internal compliance policies, we collect government-issued identification documents such as a passport, Philippine driver's licence, SSS ID, UMID, or PhilSys national ID. We may also collect a photograph or selfie for liveness verification purposes.

3.3 Financial and Transaction Data. We collect records of all deposits, withdrawals, bonus credits, wagers, and winnings associated with your 66ph account. We also collect payment method details, including your registered GCash or PayMaya mobile number and the last four digits of any linked bank account or card. We do not store full bank card numbers.

3.4 Gaming and Activity Data. We maintain logs of your gameplay activity, including game titles accessed, bet amounts, outcomes, session durations, and in-play event records. This data is required for PAGCOR reporting, dispute resolution, and fraud detection.

3.5 Communication Data. If you contact 66ph customer support via live chat or email, we retain records of that correspondence, including the content of messages, the time and date of contact, and the resolution reached. This data is used for quality assurance and dispute resolution.

3.6 Technical and Device Data. We automatically collect technical information when you access the Platform, including your IP address, device type and operating system, browser type and version, screen resolution, and session identifiers. This data is used to ensure platform stability, detect fraud, and enforce geographic access controls required by our PAGCOR license.

Under the Philippine DPA, 66ph processes personal information only where a valid legal basis exists. The legal bases applicable to our processing activities are as follows:

66ph uses the personal information we collect for the following purposes:

• To create, verify, maintain, and secure your 66ph account;
• To process deposits, withdrawals, and all financial transactions in Philippine Peso (PHP) via GCash, PayMaya, BPI, BDO, Metrobank, and other supported methods;
• To comply with PAGCOR licensing requirements, including player activity reporting and responsible gaming obligations;
• To verify your age (21+) and identity as required by Philippine gambling law and our internal KYC procedures;
• To detect, investigate, and prevent fraud, money laundering, collusion, and other prohibited conduct;
• To provide customer support and resolve disputes or complaints arising from your use of the Platform;
• To send you transactional communications related to your account, including deposit confirmations, withdrawal notifications, and security alerts — these communications are not optional and are sent regardless of your marketing preferences;
• To send you promotional offers, bonus notifications, and marketing materials about 66ph products, where you have provided consent;
• To analyse Platform usage patterns and improve the 66ph user experience, game library, and payment infrastructure;
• To comply with any legal obligation imposed on 66ph by Philippine law, including orders from courts, PAGCOR, the NPC, the AMLC, or other government bodies.

66ph does not use personal data for automated individual decision-making that produces significant legal effects for Members without human review.

The 66ph Platform uses cookies and similar tracking technologies to deliver a functional, secure, and personalised experience. The categories of cookies used are:

• Strictly Necessary Cookies: Required for core Platform functions including session management, login persistence, security token handling, and geographic access enforcement. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, display options, and previously used payment methods to personalise your 66ph experience across sessions.
• Analytical Cookies: Collect aggregated, anonymised data about how visitors use the Platform — pages visited, session duration, error occurrences — to help 66ph improve the platform. No individual is identifiable from this data in its processed form.

66ph does not use third-party advertising or retargeting cookies. You can manage functional and analytical cookie preferences through your browser's cookie settings. Note that disabling strictly necessary cookies will prevent the 66ph Platform from operating correctly.

7.1 No Sale of Personal Data. 66ph does not sell, rent, or trade your personal information to any third party for commercial purposes. This applies at all times and is not subject to exception.

7.2 Service Providers and Processors. 66ph engages carefully selected third-party service providers who process personal data on our behalf as personal information processors, under binding data processing agreements that restrict their use of data to the specific service being provided. These include:

• Payment processors: GCash (Mynt), PayMaya (Voyager), BPI, BDO, and Metrobank — for deposit and withdrawal processing;
• Identity verification providers — for KYC document review and age verification;
• Cloud infrastructure providers — for Platform hosting and data storage, bound by data processing agreements with appropriate technical safeguards;
• Customer support technology providers — for live chat infrastructure, subject to confidentiality obligations;
• Fraud detection and security analytics providers — for real-time threat identification.

7.3 Regulatory Disclosure. 66ph is required by law and by the terms of our PAGCOR license to disclose certain player and financial data to PAGCOR, the Anti-Money Laundering Council (AMLC), and other Philippine government bodies upon lawful request. We will notify you of any such disclosure where we are legally permitted to do so.

7.4 Legal Process. We may disclose personal data in response to a valid court order, subpoena, search warrant, or other legally binding government directive. We review all such requests for legal sufficiency before complying.

7.5 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or a substantial portion of 66ph's business assets, personal data held by 66ph may be transferred to the successor entity. Members will be notified of any such transfer and the successor entity will be bound by this Policy or an equivalent data protection policy.

Certain third-party service providers engaged by 66ph may process personal data in jurisdictions outside the Philippines. Where such international transfers occur, 66ph ensures that adequate safeguards are in place in accordance with the DPA's requirements for cross-border data transfers, including:

• Binding contractual clauses in data processing agreements that require overseas processors to provide protection equivalent to the Philippine DPA;
• Transfer only to jurisdictions that the NPC has recognised as providing adequate data protection;
• Where neither of the above applies, obtaining your explicit consent to the transfer after informing you of the associated risks.

The primary data storage infrastructure for 66ph Member data is located within or proximate to the Philippines, with redundancy arrangements in compliant data centre facilities in the Asia-Pacific region.

66ph retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by law or regulation. Our general retention schedule is as follows:

• Active Account Data: Retained for the duration of your 66ph account and for a minimum of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and Philippine anti-money laundering obligations.
• KYC and Identity Documents: Retained for a minimum of five (5) years following the last transaction on your account, as required by the AMLC Act and PAGCOR regulations.
• Transaction Records: Retained for a minimum of five (5) years following each transaction date for regulatory reporting and AMLC compliance purposes.
• Customer Support Records: Retained for three (3) years following the date of the last interaction, for dispute resolution purposes.
• Technical and Log Data: Retained for twelve (12) months, after which aggregated or anonymised forms may be retained for analytics purposes without individual identifiers.
• Marketing Data: Retained until you withdraw your consent to receive marketing communications, after which we retain a suppression record to honour your opt-out preference.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised using industry-standard methods.

66ph implements technical and organisational security measures appropriate to the sensitivity of the personal data we process. These measures include:

• Encryption: All personal data transmitted between your device and the 66ph Platform is encrypted using 256-bit SSL/TLS protocols. Data stored in 66ph systems is encrypted at rest using AES-256 encryption.
• Access Controls: Internal access to personal data is restricted on a need-to-know basis using role-based access control (RBAC) systems. Access is granted only to personnel whose job function requires it and is logged for audit purposes.
• Authentication: Staff access to systems containing personal data requires multi-factor authentication. Member accounts offer optional two-factor authentication, which 66ph strongly recommends enabling, particularly for accounts with higher wallet balances.
• Vulnerability Management: 66ph conducts regular vulnerability assessments and penetration testing of Platform infrastructure. Critical vulnerabilities are remediated on an expedited basis.
• Incident Response: 66ph maintains a data breach response plan aligned with the NPC's breach notification requirements. In the event of a personal data breach that creates a real risk to data subjects, we will notify the NPC within 72 hours and affected Members as soon as reasonably practicable.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 66ph:

• Right to be Informed: To be notified of how your personal data is collected and used, as fulfilled by this Policy;
• Right to Access: To obtain a copy of your personal data and information about how it is being processed;
• Right to Correction/Rectification: To have inaccurate or outdated personal data corrected or completed;
• Right to Erasure / Right to be Forgotten: To request deletion of personal data where processing is no longer necessary, unlawful, or where consent has been withdrawn and no other legal basis applies — subject to our legal retention obligations;
• Right to Object: To object to the processing of your personal data on the basis of legitimate interest, including direct marketing;
• Right to Data Portability: To receive your personal data in a structured, commonly used, machine-readable format;
• Right to Damages: To be compensated for damages sustained as a result of inaccurate, incomplete, outdated, false, or unlawfully processed personal information;
• Right to File a Complaint with the NPC: To lodge a complaint with the National Privacy Commission if you believe your rights under the DPA have been violated.

To exercise any of the rights listed above, submit a written request to our Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request", or contact us via the 24/7 live chat with the same subject. We will respond to all requests within thirty (30) calendar days of receipt, as required by the DPA.

12.1 Consent-Based Marketing. 66ph sends promotional SMS, email, and in-platform notifications about bonuses, new games, events, and VIP programme updates only to Members who have opted in to receive such communications. Your consent is collected at registration and can be withdrawn at any time.

12.2 Opting Out. To withdraw your consent to receive marketing communications, update your notification preferences in your 66ph account settings, or contact our support team via live chat. Opt-out requests for SMS and email will be processed within 5 business days. Note that opting out of marketing does not affect transactional communications, which are sent regardless of marketing preferences.

12.3 No Third-Party Marketing. 66ph does not share your contact details with third parties for their marketing purposes. We do not participate in co-marketing arrangements that involve sharing individual Member data.

The 66ph Platform is strictly for adults aged 21 years and older, in compliance with Philippine gambling law and PAGCOR regulations. 66ph does not knowingly collect, process, or retain personal data from any individual under the age of 21.

Where 66ph discovers or is notified that an account has been registered by a person under the age of 21, the following steps will be taken immediately:

• The account will be suspended and access blocked;
• All deposits made by the underage individual will be returned to the source payment method, without deduction for any wagers placed;
• Any winnings accrued on the account will be voided;
• The personal data of the underage individual will be securely deleted from 66ph systems, except where retention is required for regulatory reporting purposes related to the incident;
• The incident will be reported to PAGCOR as required under our license conditions.

If you are a parent or guardian and believe your child has registered a 66ph account, contact our Data Protection Officer immediately via [email protected] or via live chat. We will act on all such reports within 24 hours.

66ph reserves the right to update, amend, or replace this Privacy Policy from time to time to reflect changes in our data processing practices, changes in Philippine law, regulatory guidance from the NPC, or improvements to our Platform. The effective date at the top of this Policy will be updated whenever material changes are made.

Where changes are material — meaning they meaningfully affect how we use your data or the rights available to you — we will notify registered Members via the email address or mobile number on their account, with a notice period of at least fourteen (14) calendar days before the updated Policy takes effect, except where immediate changes are required to comply with a legal or regulatory obligation.

Continued use of the 66ph Platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of and agreement to the revised terms. We encourage you to review this Policy periodically.

For any privacy-related enquiries, data subject rights requests, data breach notifications, or complaints about 66ph's data handling practices, please contact our Data Protection Officer through the following channels:

• Email: [email protected] — subject line: "Data Privacy Request" or "DPO Enquiry"
• Live Chat: Available 24/7 at 66ph.club — request to speak with the data privacy team
• Response Time: Within 30 calendar days of receipt for data subject rights requests; within 5 business days for general privacy enquiries

If you are not satisfied with 66ph's response to your privacy concern, you have the right to file a complaint with the National Privacy Commission of the Philippines:

This Privacy Policy was last reviewed and updated on January 1, 2026, and supersedes all previous versions.