By registering a 999 PHL account or using any part of the platform, you acknowledge that you have read this Privacy Policy and consent to the collection and processing of your personal data as described here. If you have questions before registering, contact our support team via live chat — we're online 24/7.
999 PHL operates the online gaming platform accessible at 999phl.my. As the entity that determines the purposes and means of processing your personal data, 999 PHL is the data controller under the Data Privacy Act of 2012 (Republic Act 10173) and its Implementing Rules and Regulations.
999 PHL holds a valid gaming license issued by the Philippine Amusement and Gaming Corporation (PAGCOR), which also imposes its own data handling and player protection requirements. This Privacy Policy is designed to satisfy both RA 10173 and PAGCOR's player data standards simultaneously.
Our appointed Data Protection Officer (DPO) can be reached at support@999phl.my with the subject line "DPO Inquiry." The DPO is responsible for overseeing 999 PHL's data protection practices and handling requests from players about their personal data rights.
999 PHL collects only the personal data we genuinely need to operate your account, comply with Philippine law, and provide a safe gaming environment. We don't collect data speculatively or build profiles beyond what's necessary for these purposes.
- Registration data: Full legal name, date of birth, mobile number, email address, and chosen username.
- Identity verification (KYC) documents: Government-issued photo ID (passport, SSS ID, Driver's License, PhilHealth ID, UMID, or Voter's ID), selfie photo for liveness verification, and proof of address.
- Payment information: GCash or Maya account number, bank account name and number (for bank transfers), or card details for Visa/Mastercard transactions. Full card numbers are never stored by 999 PHL — only tokenized references.
- Support communications: Content of live chat messages, emails, or any other communication you send to the 999 PHL support team.
- Device and technical data: IP address, device type, operating system, browser type and version, and screen resolution. This is used for security monitoring and platform optimization.
- Gameplay data: Game sessions played, bet amounts, winnings, game preferences, and session duration. Required for account management, regulatory reporting, and responsible gaming monitoring.
- Transaction logs: Deposit and withdrawal history, timestamps, amounts, and payment method references. Retained for AML compliance and dispute resolution.
- Location data: General location derived from IP address, used to verify eligibility and detect access from restricted jurisdictions.
- Cookie data: Session identifiers and preference settings stored via cookies. See Section 7 for full details on cookie use at 999 PHL.
999 PHL — Protecting Filipino Players' Data Across Every Region of the Philippines
Every piece of data 999 PHL collects has a specific, documented purpose. Below is a clear breakdown of the data we collect and why. If the purpose changes, we will update this Privacy Policy and notify you.
| Data Type | Primary Purpose | Legal Basis |
|---|---|---|
| Name, date of birth, contact details | Account creation, identity verification, age check | Contract performance; legal obligation (PAGCOR/AML) |
| KYC identity documents | Verify player identity before withdrawal; AML compliance | Legal obligation (RA 9160, PAGCOR regulations) |
| Payment method details | Process deposits and withdrawals; fraud prevention | Contract performance; legal obligation |
| Gameplay and session data | Game provision; responsible gaming monitoring; dispute resolution | Contract performance; legitimate interest |
| IP address and device data | Security monitoring; fraud detection; eligibility verification | Legitimate interest; legal obligation |
| Transaction history | AML monitoring; regulatory reporting; account statements | Legal obligation (RA 9160, PAGCOR regulations) |
| Support communications | Resolve player queries; service quality improvement | Contract performance; legitimate interest |
| Cookie and preference data | Platform functionality; user experience personalization | Consent (for non-essential cookies) |
Under the Data Privacy Act of 2012, 999 PHL must have a valid legal basis for every type of personal data processing we undertake. The bases we rely on are:
- Consent: For non-essential cookies, marketing communications, and any processing not covered by the bases below. You can withdraw consent at any time without affecting the legality of prior processing.
- Contract performance: Processing necessary to operate your 999 PHL account — including account creation, game provision, payment processing, and support services.
- Legal obligation: Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160), the Data Privacy Act (RA 10173), and other applicable Philippine laws.
- Legitimate interest: Processing for security monitoring, fraud detection, platform improvement, and responsible gaming monitoring — where our legitimate interest does not override your fundamental rights.
Your data at 999 PHL is used for these specific operational and compliance purposes. We do not use your data for any purpose not listed here without updating this Privacy Policy and, where required, obtaining your consent.
The most immediate use of your data at 999 PHL is to create and maintain your account, process your deposits and withdrawals, and deliver the gaming experience you've come to the platform for. This includes identifying you when you log in, recording your game sessions, maintaining your balance, processing GCash and Maya transactions, and providing customer support when you need it.
999 PHL is required under PAGCOR regulations and Philippine AML law to verify the identity of every player who withdraws funds above threshold amounts. Your KYC documents are used solely for this purpose. In addition, 999 PHL's security systems analyse account behaviour, device data, and transaction patterns to detect fraud, money laundering, and account takeover attempts. This analysis is automated but reviewed by a human security team when flagged.
999 PHL uses your gameplay and transaction data to identify indicators of potentially problematic gaming behaviour — patterns such as rapidly increasing bet sizes, frequent late-night sessions, or sharp changes in deposit volume. When such patterns appear, our responsible gaming team may reach out to offer support tools. This monitoring is a condition of our PAGCOR license and is done in your interest, not to restrict normal gameplay.
If you have opted in to receive marketing communications from 999 PHL, we may use your email address and/or mobile number to send you information about promotions, new games, and platform updates. You can opt out of marketing communications at any time by contacting support or using the unsubscribe link in any email we send. Opting out of marketing does not affect your account or any operational communications.
999 PHL — Your Data is Protected Whether You're Playing in Siargao or Manila
999 PHL does not sell your personal data. We share it only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.
- Payment processors: GCash, Maya, GrabPay, and banking partners receive the minimum data necessary to process your deposits and withdrawals — typically your name and account identifier. These partners have their own privacy policies and data security standards.
- KYC verification providers: Third-party identity verification services receive your submitted KYC documents under strict data processing agreements. They verify your identity and return a result — they do not retain your documents beyond what their own retention policies require.
- PAGCOR and regulatory bodies: We are required by law to provide player account data, transaction records, and gaming activity reports to PAGCOR on a regular basis and on request. We are also required to report suspicious transactions to the Anti-Money Laundering Council (AMLC) under RA 9160.
- Law enforcement: When legally required by valid Philippine court order, warrant, or subpoena, 999 PHL will disclose necessary player information to law enforcement authorities.
- Platform and hosting providers: Technical service providers who host and maintain the 999 PHL platform handle your data under contractual data processing agreements that require them to apply at least equivalent data protection standards.
- We do NOT share your data with: Advertisers, data brokers, social media platforms (for profiling or targeting purposes), or any third party for commercial gain. Your 999 PHL data stays within the purpose-limited ecosystem described here.
999 PHL uses cookies — small text files stored in your browser — to keep the platform working correctly, remember your preferences, and understand how players use the site so we can improve it. Here's exactly what we use and why.
999 PHL retains your personal data only for as long as necessary for the purpose it was collected, or as required by Philippine law. The following retention periods apply:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | 5 years after account closure | PAGCOR licensing requirement; AML obligations |
| KYC identity documents | 5 years after account closure | Anti-Money Laundering Act (RA 9160) |
| Transaction records | 5 years from date of transaction | AML compliance; PAGCOR reporting; tax obligations |
| Gameplay and session logs | 2 years from session date | Dispute resolution; responsible gaming analysis |
| Support communications | 2 years from last interaction | Service quality; dispute evidence |
| Marketing consent records | Until consent withdrawn + 1 year | Proof of lawful marketing basis |
| Cookie and analytics data | Up to 13 months | Platform improvement analysis |
999 PHL — Filipino Players' Privacy Rights Are Our Priority
Under the Data Privacy Act of 2012, you have the following rights regarding your personal data held by 999 PHL. These are real rights enforceable under Philippine law — not marketing statements. To exercise any of these rights, contact our Data Protection Officer at support@999phl.my with the subject line "Data Rights Request." We will respond within 10 business days.
Data security at 999 PHL is treated as a fundamental operational requirement, not an optional extra. The following technical and organisational measures are in place to protect your personal data.
- Encryption in transit and at rest: All data transmitted between your device and 999 PHL servers is encrypted using 256-bit TLS. Personal data stored in our databases is encrypted at rest using AES-256.
- Access controls: Staff access to personal data is granted on a strict need-to-know basis. All access to player data is logged and subject to regular audit.
- Two-factor authentication: 999 PHL supports and strongly encourages two-factor authentication (2FA) on all player accounts to prevent unauthorised access.
- Penetration testing: The 999 PHL platform undergoes regular security testing by independent security professionals to identify and remediate vulnerabilities before they can be exploited.
- Incident response: 999 PHL maintains a documented data breach response procedure. In the event of a breach affecting personal data, we will notify affected players and the National Privacy Commission within 72 hours.
- Staff training: All 999 PHL staff with access to personal data receive data privacy training upon onboarding and annually thereafter.
999 PHL is strictly an adult-only gaming platform. The minimum age to register and use the platform is 21 years old in compliance with PAGCOR regulations. We do not knowingly collect personal data from individuals under the age of 21.
If 999 PHL becomes aware that a player has provided false date-of-birth information and is under 21, the account will be immediately suspended, all balances will be forfeited, and all personal data collected will be deleted after the mandatory AML retention period. If you believe a minor has registered at 999 PHL using false information, please contact our support team immediately.
999 PHL reviews and updates this Privacy Policy periodically to reflect changes in our data practices, platform features, or Philippine privacy law. When material changes are made, we will update the "last updated" date at the top of this page and notify active players via platform notification or email at least 7 days before the changes take effect.
Continued use of the 999 PHL platform after any Privacy Policy update constitutes acceptance of the revised terms. If you disagree with any revision, you have the right to close your account and request deletion of your personal data as described in Section 9.
For any question, concern, or request relating to this Privacy Policy or your personal data at 999 PHL, please contact us through one of the channels below. We aim to respond to all data privacy inquiries within 10 business days.