startph Privacy Policy

This Privacy Policy is issued by the operator of the startph platform ("startph," "we," "us," or "our"), a PAGCOR-regulated online gaming entity operating the website accessible at startph.app and all associated subdomains and mobile-optimized interfaces.

startph is registered and operates under the jurisdiction of the Republic of the Philippines, subject to the oversight of the Philippine Amusement and Gaming Corporation (PAGCOR) and the regulatory framework established by the National Privacy Commission (NPC) under Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA) and its Implementing Rules and Regulations (IRR).

For all privacy-related inquiries, startph has designated a Data Protection Officer (DPO) as required by the DPA. Contact details for our DPO are provided in Section 14 of this policy.

startph collects personal data across several categories, depending on the nature of your interaction with the Platform. The following table summarizes the categories of data we collect and specific examples within each category:

We do not intentionally collect sensitive personal information beyond what is required for age and identity verification under PAGCOR's KYC mandates. Where sensitive information is collected (such as ID document images), it is treated with the heightened protections required by the DPA.

startph collects personal data through the following channels:

• Direct collection: Information you actively provide during account registration, KYC submission, deposit and withdrawal requests, customer support interactions, and when completing profile updates;
• Automated technical collection: Data collected automatically when you access the Platform, including IP addresses, device identifiers, browser information, session data, and cookies (see Section 7 for full cookie details);
• Payment processor data: Transaction confirmation data received from Philippine payment partners including GCash, Maya, GrabPay, InstaPay, PesoNet, BPI, BDO, and Metrobank when you initiate deposits or withdrawals;
• Identity verification partners: Confirmation results and risk scores from third-party KYC and liveness verification providers integrated into the startph registration and verification workflow;
• Regulatory sources: In limited circumstances, PAGCOR or Philippine law enforcement authorities may provide startph with information relevant to regulatory compliance or fraud investigation, which may be associated with your Account record.

startph does not purchase personal data from data brokers or any third-party marketing lists. All data collected is gathered in the context of your direct relationship with the Platform.

startph processes your personal data for the following specific purposes:

• Account management: Creating, maintaining, and securing your startph Account, including authentication and session management;
• KYC and age verification: Verifying that you meet the minimum age requirement of 21 years and confirming your identity in accordance with PAGCOR's player registration requirements;
• Payment processing: Facilitating deposits and withdrawals via Philippine payment channels including GCash, Maya, and major Philippine banks, and maintaining accurate Gaming Wallet records;
• Game delivery and platform operation: Providing access to and operating all gaming products available on the Platform, maintaining game history and wager records;
• Regulatory compliance: Fulfilling startph's legal obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), and any applicable directives from the Anti-Money Laundering Council (AMLC);
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, multi-accounting, collusion, and other Platform security threats;
• Responsible gaming: Operating self-exclusion programs, deposit limit tools, and reality check features, and identifying users who may show signs of problem gambling behavior for proactive intervention;
• Customer support: Responding to your inquiries, complaints, and dispute submissions in a timely and accurate manner;
• Marketing communications: Sending you promotional offers, bonus notifications, and platform updates, where you have provided consent to receive such communications and have not subsequently opted out;
• Platform improvement: Analyzing aggregated usage data to improve Platform performance, game selection, and user experience — this analysis is conducted on anonymized or pseudonymized data wherever possible.

Under the Data Privacy Act of 2012 and its IRR, startph processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions you accepted upon registration, including Account operation, payment processing, and game delivery;
• Legal obligation: Processing necessary to comply with PAGCOR licensing requirements, AMLA reporting obligations, NPC data handling standards, and any other applicable Philippine statutory requirement;
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring — where startph's legitimate interest in maintaining a safe and compliant Platform is balanced against and does not override your fundamental privacy rights;
• Consent: Processing for marketing communications and non-essential cookies, where your freely given, specific, and informed consent has been obtained and can be withdrawn at any time without penalty to your gaming access.

startph does not sell, rent, or trade your personal data to any third party for commercial purposes. Your data is only shared with third parties in the following strictly limited circumstances:

• Payment processors: GCash, Maya, GrabPay, BPI, BDO, Metrobank, and other Philippine payment partners receive the minimum data necessary to process your financial transactions. These partners operate under their own privacy policies and are subject to BSP (Bangko Sentral ng Pilipinas) data protection requirements;
• KYC and identity verification providers: Third-party providers engaged to perform automated identity document verification and liveness checks during the Account registration and KYC process. These providers are bound by data processing agreements consistent with the DPA;
• Regulatory and law enforcement authorities: PAGCOR, the AMLC, the NPC, and competent Philippine courts or law enforcement agencies, where startph is legally required or duly authorized to disclose data;
• IT infrastructure and hosting providers: Cloud infrastructure and managed hosting providers who process data on startph's behalf as data processors under formal data processing agreements, subject to equivalent data protection standards;
• Professional advisors: Legal counsel, auditors, and compliance consultants engaged in connection with startph's regulatory obligations, under binding confidentiality obligations.

All third-party data processors engaged by startph are required to implement appropriate technical and organizational security measures and to process data only on documented instructions from startph, consistent with the DPA's requirements for data sharing agreements.

startph uses cookies and similar tracking technologies on the Platform to support core functionality, security, and performance monitoring. The following categories of cookies are used:

You can manage your cookie preferences through the cookie settings panel available on the Platform. Disabling non-essential cookies will not prevent you from accessing core gaming features, though some preference-based features may not function optimally.

startph does not use third-party advertising network cookies or allow external ad networks to place tracking cookies on Platform pages.

startph implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and the startph Platform is protected using TLS 1.2 or higher encryption protocols;
• Encryption at rest: Sensitive personal data including KYC documents and financial records are stored using AES-256 encryption on secured servers;
• Access controls: Access to personal data within startph's systems is restricted on a strict need-to-know basis, with role-based access controls, multi-factor authentication requirements for administrative access, and comprehensive access logging;
• Network security: The Platform infrastructure is protected by web application firewalls (WAF), DDoS mitigation systems, and continuous intrusion detection monitoring;
• Security audits: startph undergoes periodic independent security assessments, including penetration testing and vulnerability scanning, as required under PAGCOR operational standards;
• Staff training: All startph personnel with access to personal data are required to complete data privacy and information security training, and are bound by confidentiality obligations.

startph retains personal data only for as long as is necessary for the purposes set out in this Privacy Policy, or as required by applicable Philippine law and PAGCOR regulatory standards. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymized so that it can no longer be associated with any identifiable individual. Anonymized, aggregated data may be retained indefinitely for statistical and analytical purposes.

Under the Data Privacy Act of 2012 and its IRR, you have the following rights with respect to your personal data held by startph. These rights can be exercised by contacting our Data Protection Officer using the details in Section 14:

• Right to be Informed: The right to know what personal data startph collects, processes, and retains about you — fulfilled primarily through this Privacy Policy;
• Right of Access: The right to request a copy of the personal data startph holds about you, along with information about how it is processed. startph will respond to access requests within 30 calendar days;
• Right to Rectification: The right to request correction of any inaccurate or incomplete personal data held in your Account. You can update most information directly through your Account profile settings;
• Right to Erasure ("Right to be Forgotten"): The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to startph's legal and regulatory retention obligations which may override this right in specific circumstances;
• Right to Data Portability: The right to receive a structured, commonly used, machine-readable copy of your personal data that you have provided to startph, where technically feasible and legally permissible;
• Right to Object: The right to object to the processing of your personal data for marketing purposes at any time. You can opt out of marketing communications through your Account settings or by contacting support;
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe startph has violated your data privacy rights. The NPC can be reached through its official published channels.

The startph Platform is strictly restricted to individuals who are 21 years of age or older in accordance with PAGCOR regulations and applicable Philippine law governing online gaming and gambling activities.

startph does not knowingly collect personal data from individuals under the age of 21. Our KYC and age verification process is specifically designed to detect and reject registrations from underage individuals at the point of account creation. Any Account subsequently found to have been registered by a person under 21 years of age will be immediately closed and all personal data associated with that Account will be deleted, except where retention is required by applicable law.

If you are a parent or guardian and you believe that an individual under 21 in your care has submitted personal data to startph, please contact our Data Protection Officer immediately using the details in Section 14. We will investigate and take prompt corrective action.

In certain circumstances, personal data processed by startph may be transferred to or accessed by service providers located outside the Republic of the Philippines — for example, cloud infrastructure providers operating data centers in other jurisdictions, or internationally-based KYC verification partners.

Any such cross-border transfer of personal data is conducted strictly in accordance with Section 21 of the Data Privacy Act of 2012 and NPC guidelines on cross-border data flows. startph ensures that adequate safeguards are in place before any transfer occurs, including:

• Binding data processing agreements incorporating NPC-compliant contractual clauses;
• Transfers only to countries or organizations that provide an equivalent level of data protection as recognized by the NPC;
• Where no adequacy determination exists, implementation of approved transfer mechanisms such as standard contractual clauses or equivalent contractual safeguards.

startph's primary data processing infrastructure is hosted within or specifically audited for compliance with Philippine jurisdiction requirements as a condition of PAGCOR licensing. Cross-border transfers are limited to ancillary services where a Philippine-located equivalent is not available.

startph reserves the right to update or revise this Privacy Policy from time to time to reflect changes in our data processing practices, changes in Philippine law or PAGCOR regulations, or improvements to Platform features that affect how personal data is collected or used.

When material changes are made to this Privacy Policy, startph will:

• Post the updated Privacy Policy at startph.app/privacy-policy with a revised effective date displayed at the top of the page;
• Display a notice on the Platform informing users that the Privacy Policy has been updated;
• Where the changes are significant, send a notification to the email address associated with your registered Account prior to the changes taking effect.

Your continued use of the Platform after the effective date of any Privacy Policy update constitutes acceptance of the revised policy. If you do not agree with the updated terms, you may request Account closure as provided in our Terms & Conditions.

We recommend reviewing this Privacy Policy periodically and particularly whenever you receive an update notification from startph. Archived versions of previous Privacy Policy documents are available upon request from our Data Protection Officer.

startph has appointed a Data Protection Officer (DPO) in accordance with Section 21 of the DPA IRR. The DPO is responsible for overseeing startph's data privacy compliance program, handling data subject requests, and serving as the primary point of contact with the National Privacy Commission.

For any privacy-related inquiry, data subject rights request, or to report a suspected data breach or privacy concern, you may contact startph's Data Protection Officer through the following channels:

• Email (plain text — not clickable): [email protected] — subject line: "Data Privacy / DPO Request"
• In-Platform Support: Use the 24/7 live chat function within the startph Platform and request escalation to the Data Protection team
• Postal: Correspondence addressed to the Data Protection Officer, startph Operations, Republic of the Philippines

We aim to acknowledge all DPO-directed inquiries within 5 business days and to provide a substantive response within 30 calendar days. For complex requests requiring additional investigation, we will notify you of the extended timeline and reason for the delay.

If you are not satisfied with startph's response to a data privacy concern, you have the right to escalate your complaint directly to the National Privacy Commission (NPC) through the NPC's officially published complaint mechanisms.

Support contact: [email protected] — displayed as plain text only, not a clickable link.