spenph Privacy Policy

spenph ("we", "us", "our") is committed to protecting the personal data of every player who uses our platform. This Privacy Policy has been prepared in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines (the "DPA"), its Implementing Rules and Regulations, and the applicable data governance requirements of the Philippine Amusement and Gaming Corporation (PAGCOR) under which spenph operates.

As a regulated online gaming operator serving Filipino players from Manila to Cebu to Davao and everywhere in between, spenph processes personal data as a necessary part of providing secure, licensed, and responsible gaming services. This Policy explains in plain language — without unnecessary legal jargon — what data we handle, why we handle it, and the choices and rights available to you.

Where this Policy refers to "personal data," it means any information that, alone or in combination with other information, can identify you as a specific natural person. This includes your name, email address, mobile number, financial details, and gaming activity records.

spenph acts as the personal information controller (as defined under the Philippine Data Privacy Act) in respect of all personal data collected from players through the spenph platform. As the data controller, spenph is responsible for determining the purposes and means by which your personal data is processed.

spenph's designated Data Protection Officer (DPO) oversees compliance with the DPA and this Privacy Policy. Players may contact the DPO directly with any privacy-related queries, concerns, or complaints using the contact information provided in Section 15 of this Policy.

spenph collects personal data across several categories depending on the nature of your interaction with the platform. The table below sets out the categories of data collected, their purpose, and the legal basis for collection:

spenph does not collect or process sensitive personal information as defined by the DPA (such as health data, religious beliefs, or political affiliation) except where required by applicable law or regulatory obligation and with appropriate safeguards in place.

spenph collects personal data through the following means:

• Direct collection: When you register an account, complete the KYC process, make a deposit or withdrawal, contact our support team, or configure your account settings, you provide personal data directly to spenph.
• Automated collection: When you access and use the spenph platform, certain technical data is collected automatically through cookies, server logs, and similar tracking technologies. This includes your IP address, session data, and device information.
• Third-party collection: spenph receives data from payment service providers (including GCash, Maya, BPI, BDO, Metrobank, and other approved channels) in connection with the processing of your deposits and withdrawals. We may also receive fraud-risk signals from third-party fraud prevention services as part of our platform security controls.
• Regulatory sources: In certain circumstances, spenph may receive data from PAGCOR or other regulatory bodies in connection with licensing conditions, responsible gaming registers, or self-exclusion lists.

spenph processes personal data only where a lawful basis for processing exists under the Philippine Data Privacy Act. The following legal bases apply to spenph's processing activities:

1. Contractual necessity: Processing your identity, contact, financial, and gaming data is necessary to perform the contract between spenph and you as a registered player. Without this processing, spenph cannot provide account management, payment processing, or gaming services.
2. Legal obligation: spenph is required by Philippine law and PAGCOR licensing conditions to conduct KYC verification, maintain gaming records, file AML reports, and administer responsible gaming controls. Processing for these purposes is mandatory.
3. Legitimate interest: spenph processes technical and communications data for fraud prevention, platform security, and service improvement, where these interests do not override your rights and freedoms as a data subject.
4. Consent: Where spenph sends you promotional communications about bonuses, new games, or platform updates, we do so on the basis of your consent, which may be withdrawn at any time through your account notification settings or by contacting support.

spenph uses the personal data it collects for the following purposes:

• Creating, maintaining, and verifying your spenph account and player profile;
• Processing deposits and withdrawals through your chosen payment channels (GCash, Maya, bank transfer, etc.);
• Delivering gaming services and maintaining accurate records of your gaming activity;
• Performing age verification (21+) and identity verification as required by PAGCOR;
• Complying with anti-money laundering obligations under the Philippine AMLA and PAGCOR requirements;
• Administering responsible gaming tools including deposit limits, cooling-off periods, and self-exclusion requests;
• Providing customer support through live chat, email, and other communication channels;
• Sending you account-related notifications (transaction confirmations, security alerts, verification status updates);
• Sending promotional communications about spenph offers, bonuses, and new game releases, where you have consented to receive these;
• Detecting, investigating, and preventing fraud, cheating, collusion, and other prohibited conduct on the platform;
• Monitoring and improving platform performance, security, and user experience;
• Responding to regulatory inquiries or exercising legal rights in disputes or proceedings.

spenph does not sell your personal data to third parties. We share personal data only in the following defined circumstances and only to the extent necessary for the stated purpose:

• Payment processors: Financial data is shared with GCash, Maya, BPI, BDO, Metrobank, and other approved payment service providers to process your deposits and withdrawals. These providers process data under their own privacy policies and are bound by applicable financial data protection regulations.
• Game providers: Certain game-level data (session tokens, bet amounts) may be shared with our licensed third-party game content providers (including JILI, PG Soft, Pragmatic Play, and others) solely for the purpose of delivering the game session. These providers operate under data processing agreements with spenph.
• Regulatory authorities: spenph is required to share certain data with PAGCOR, the Anti-Money Laundering Council (AMLC), and other competent Philippine authorities in connection with licensing compliance, AML reporting, and lawful regulatory investigations.
• Fraud prevention services: Technical and identity data may be shared with fraud detection service providers to protect the spenph platform and its players from fraudulent activity.
• Legal proceedings: spenph may disclose personal data where required by a valid court order, legal process, or applicable law, or to defend spenph's legal rights in any dispute.

All third parties with whom spenph shares personal data are required to maintain appropriate technical and organisational security measures and to process data only for the specified purpose.

spenph retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to applicable legal and regulatory minimum retention requirements. The following general retention periods apply:

• Account and KYC data: Retained for the duration of your active account and for a minimum of five (5) years following permanent account closure, in accordance with PAGCOR licensing requirements and Philippine AML obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, in accordance with BSP and AMLC record-keeping obligations.
• Gaming session records: Retained for a minimum of three (3) years for dispute resolution and regulatory reporting purposes.
• Support communications: Retained for two (2) years from the date of the last communication, unless the subject matter relates to an ongoing dispute or regulatory inquiry.
• Technical logs: Retained for ninety (90) days in active storage; archived for up to twelve (12) months for security investigation purposes.

Where personal data is no longer required for the purpose for which it was collected and no legal retention obligation applies, spenph will securely delete or anonymise the data.

spenph implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS 1.3 encryption for all data transmitted between your device and the spenph platform;
• Encryption of sensitive data fields (including passwords, government ID numbers, and financial account references) in our database using industry-standard hashing and encryption algorithms;
• Role-based access controls ensuring that spenph staff can only access personal data required for their specific job function;
• Regular penetration testing and security audits conducted by independent third-party security firms;
• Multi-factor authentication for spenph internal systems that process personal data;
• Intrusion detection and real-time anomaly monitoring on all platform infrastructure;
• Documented incident response procedures, including mandatory notification to the National Privacy Commission (NPC) and affected data subjects in the event of a qualifying personal data breach.

While spenph applies rigorous security controls, no internet-connected system can guarantee absolute security. You are also responsible for maintaining the security of your own account credentials. If you suspect unauthorised access to your spenph account, contact support immediately via live chat or at [email protected].

spenph uses cookies and similar technologies (including local storage and session tokens) on the spenph platform. These technologies serve the following purposes:

• Strictly necessary cookies: Required for the platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences such as language settings, responsible gaming configurations, and notification preferences to personalise your spenph experience.
• Analytics cookies: Used by spenph's internal analytics tools to understand how players navigate the platform, which games are most accessed, and where technical issues occur. Data collected for analytics is aggregated and not used to identify individual players for marketing purposes.
• Security cookies: Used to detect fraudulent sessions, identify unusual login patterns, and enforce geographic access controls in compliance with PAGCOR licensing.

You may manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of specific spenph features. spenph does not use third-party advertising or retargeting cookies.

Under the Philippine Data Privacy Act, you have the following rights in respect of your personal data held by spenph. You may exercise these rights by contacting spenph's Data Protection Officer using the details in Section 15.

spenph will respond to valid data subject requests within thirty (30) calendar days of receipt. Where a request is complex or involves a large volume of data, the response period may be extended by a further thirty (30) days, with written notification to the requesting data subject.

spenph is strictly prohibited from collecting personal data from or providing services to persons under 21 years of age. In accordance with PAGCOR regulations and Philippine gaming law, all real-money gaming on spenph is exclusively available to individuals aged 21 and above who have completed the mandatory KYC age verification process.

If spenph discovers or has reason to believe that personal data has been collected from a person under 21 years of age, the relevant account will be immediately suspended and all associated data and funds will be handled in accordance with applicable regulatory guidance. Parents or guardians who believe a minor has registered on spenph should contact [email protected] immediately.

In certain operational circumstances, your personal data may be transferred to or processed by spenph's technology infrastructure providers, game content partners, or fraud prevention services that maintain systems outside the Philippines. Such transfers occur only where:

• The receiving country or organisation has been recognised by the National Privacy Commission as providing adequate data protection; or
• spenph has entered into appropriate contractual safeguards with the recipient, including data processing agreements that impose obligations equivalent to those required under the Philippine DPA; or
• The transfer is necessary for the performance of the contract between spenph and the player (for example, for the delivery of a game session hosted on a third-party provider's infrastructure).

spenph does not transfer personal data to recipients in countries that do not provide adequate privacy protections without first implementing appropriate contractual safeguards.

spenph may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or platform features. When material changes are made, spenph will provide reasonable notice to registered players through a notification on the platform or by email to the address associated with your account.

The updated Privacy Policy will be published on this page with a revised effective date. Continued use of the spenph platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the updated Policy, you must discontinue use of the platform and may request account closure.

The version of this Privacy Policy published at spenph.cam/privacy-policy at any given time is the operative version. Earlier versions may be made available on request.

For all privacy-related queries, data subject rights requests, complaints, or concerns, players may contact spenph through the following channels:

• Data Protection Officer — Email: [email protected] — please include "DPO / Privacy Request" in the subject line.
• Live Chat Support: Available 24/7 in English and Tagalog from the spenph platform after login. For urgent data security concerns such as suspected unauthorised account access, live chat is the fastest channel.
• Complaint escalation: If your concern is not resolved to your satisfaction by spenph's DPO within thirty (30) days, you may escalate your complaint to the National Privacy Commission of the Philippines at privacy.gov.ph.

This Privacy Policy was last reviewed and updated in January 2026. spenph operates under PAGCOR licensing and in compliance with Republic Act No. 10173, the Data Privacy Act of 2012. All rights reserved.