p3333 Privacy Policy

This Privacy Policy ("Policy") describes how p3333 ("p3333", "we", "us", "the Company") collects, processes, stores, and protects personal data submitted by users ("Player", "you", "User") of the p3333 platform accessible at p3333.org. This Policy is issued in compliance with Republic Act 10173 — the Data Privacy Act of 2012 — and its Implementing Rules and Regulations as administered by the National Privacy Commission (NPC) of the Philippines.

This Policy applies to all personal data processed in connection with your registration, account use, financial transactions, customer support interactions, and participation in any promotional programme on p3333. It is incorporated by reference into the p3333 Terms & Conditions.

1 Scope & Data Controller Identity

This Policy applies to all personal data collected by p3333 through the p3333.org website, including mobile-optimised interfaces, in-platform messaging systems, customer support channels, and any affiliated promotional communications.

Data Controller: p3333 is the personal information controller (as defined under RA 10173) in respect of all personal data processed in connection with the p3333 platform. Where p3333 engages third-party technology providers to assist with platform operation, those providers act as personal information processors under written data processing agreements that require them to protect data in accordance with RA 10173 standards.

p3333 operates under a PAGCOR-issued license. Regulatory compliance obligations — including PAGCOR reporting requirements and Anti-Money Laundering Council (AMLC) obligations under Republic Act 9160 as amended — constitute separate legal bases for data processing that exist independently of Player consent.

2 Personal Data We Collect

p3333 collects the following categories of personal data in the ordinary course of operating the Platform:

3 How We Collect Your Data

p3333 collects personal data through the following channels:

• Direct submission — data you provide during registration, KYC verification, deposit/withdrawal requests, customer support contacts, and responsible gaming tool activation
• Automated technical collection — IP address, device identifiers, browser data, and session information collected automatically when you access p3333.org
• Payment processor feeds — transaction confirmation data returned by GCash, Maya, BPI, BDO, and other payment processors when you deposit or withdraw
• Game provider logs — game session data, including wager amounts and outcomes, recorded by third-party game providers (Pragmatic Play, PG Soft, Hacksaw Gaming, Ezugi, and others) and transmitted to p3333 for account management and regulatory reporting
• Cookies and similar technologies — see Section 6 for full details

4 Purpose of Processing & Legal Basis

p3333 processes personal data for the following purposes, each supported by a legal basis under RA 10173:

5 Data Sharing & Third-Party Disclosure

p3333 does not sell, rent, or otherwise transfer your personal data for third-party commercial purposes. Personal data is shared only in the following circumstances:

• Licensed gaming technology providers — game providers such as Pragmatic Play, PG Soft, Hacksaw Gaming, Ezugi Live, and Nolimit City receive gaming session data to deliver their games on the p3333 platform. These providers are bound by data processing agreements requiring RA 10173-standard protections.
• Payment processors — GCash (Mynt), Maya (Voyager Innovations), BPI, BDO, and other processors receive the minimum payment data required to process your transactions. p3333 does not store full payment credentials — only transaction reference IDs.
• PAGCOR — as a licensed operator, p3333 is required to submit regulatory reports to PAGCOR, which may include aggregated and individual player activity data as required by the PAGCOR charter and licensing conditions.
• Anti-Money Laundering Council (AMLC) — suspicious transactions above legal thresholds must be reported to AMLC under RA 9160 as amended by RA 10365. This obligation exists independently of Player consent.
• National Privacy Commission (NPC) — in the event of a data breach or regulatory investigation, data may be disclosed to the NPC as required by RA 10173.
• Law enforcement and courts — where compelled by a valid court order, subpoena, or other lawful process under Philippine law.
• Professional advisers — legal, audit, and compliance advisers under strict confidentiality obligations, solely to the extent necessary for their professional services to p3333.

6 Cookies & Similar Technologies

p3333 uses cookies and similar browser-based technologies to operate and improve the Platform. Cookies are small text files stored on your device by your browser when you visit p3333.org.

You may control cookie preferences through your browser settings. Disabling strictly necessary cookies may prevent you from logging into your p3333 Account. p3333 does not use third-party advertising cookies or allow advertising networks to place cookies on p3333.org.

7 Data Retention Periods

p3333 retains personal data only as long as necessary for the identified purpose or as required by applicable law. The following retention periods apply:

• Active account data: Retained throughout the period your account remains active and for five (5) years following account closure, in accordance with PAGCOR record-keeping requirements.
• KYC and identity documents: Retained for a minimum of five (5) years after account closure, as required under Philippine AML regulations (RA 9160 as amended).
• Financial transaction records: Retained for five (5) years per AMLC requirements. Certain transactions may be subject to longer retention if they are the subject of a Suspicious Transaction Report or regulatory investigation.
• Game session logs: Retained for three (3) years for dispute resolution purposes and PAGCOR reporting.
• Customer support records: Retained for two (2) years from the date of the interaction.
• Marketing consent records: Retained until consent is withdrawn, plus one (1) additional year for audit purposes.

Upon expiry of the applicable retention period, personal data is securely deleted using methods that render recovery impossible, or anonymised such that it can no longer be linked to an identifiable individual.

8 Security Measures

p3333 implements a layered security framework to protect personal data against unauthorised access, disclosure, alteration, or destruction:

• Encryption in transit: TLS 1.3 protocol on all communications between your browser and p3333.org
• Encryption at rest: AES-256 encryption for sensitive data fields in the p3333 database
• Password hashing: bcrypt hashing with work factor — passwords cannot be recovered even by p3333 administrators
• Two-factor authentication (2FA): Optional OTP-based 2FA available to all registered players; recommended for all accounts with positive balances
• Access controls: Role-based access control (RBAC) on all internal systems — data is accessible only to authorised staff with a documented business need
• Payment tokenisation: p3333 does not store raw GCash PINs, Maya passwords, or bank card numbers. All payment processing uses tokenised references from the respective processors.
• Infrastructure security: Web application firewall (WAF), DDoS protection, and intrusion detection systems on the p3333 hosting environment
• Regular security reviews: Periodic security assessments and penetration testing of the Platform and supporting infrastructure

9 Minors & Age Policy

p3333 is strictly an adult platform. The minimum age for registration and use of p3333 is twenty-one (21) years, as required by PAGCOR for online gaming platforms licensed in the Philippines.

p3333 does not knowingly collect personal data from persons under 21 years of age. Age verification is conducted as part of the KYC process for all registered accounts. If p3333 discovers that personal data has been collected from an underage individual, the Account will be immediately suspended, the data will be deleted, and any deposited funds will be returned to the verified payment source.

10 Cross-Border Data Transfers

p3333's platform infrastructure and third-party gaming providers may involve data storage or processing in jurisdictions outside the Philippines, including data centres in Singapore, Hong Kong, and Malta where game providers operate licensed studios.

Where personal data is transferred outside the Philippines, p3333 ensures that adequate safeguards are in place in accordance with NPC guidelines on cross-border data flows. These safeguards include contractual data protection clauses in agreements with all overseas processors, requiring them to maintain data protection standards consistent with RA 10173.

Game providers operating on p3333 — including Pragmatic Play (Malta), PG Soft (Singapore), Hacksaw Gaming (Malta), and Ezugi (Israel/Georgia) — hold licences from recognised gaming regulators in their respective jurisdictions and are subject to data protection frameworks in those jurisdictions in addition to the contractual obligations imposed by p3333.

11 Exercising Your Data Rights

To exercise any of your rights under RA 10173 — access, rectification, erasure, objection, data portability, or filing a complaint — submit a written request to the p3333 Data Privacy Officer at [email protected] with the subject line "Data Privacy Request – [Type of Right]".

Requests will be acknowledged within two (2) business days and responded to substantively within ten (10) business days of receipt. Complex requests involving large volumes of data or legal review may require up to thirty (30) calendar days, in which case you will be informed of the delay and the reason.

Identity verification will be required before any data access, rectification, or erasure request is processed. This is to protect your account against fraudulent data requests by third parties. If we are unable to verify your identity, we will notify you and the request cannot be fulfilled until verification is completed.

Certain data cannot be erased upon request, specifically data subject to mandatory retention under PAGCOR, AMLC, or NPC requirements — including transaction records, KYC documents, and AML-related suspicious activity reports. Where erasure is not possible due to a legal obligation, we will explain the specific legal basis for retention.

12 Data Breach Notification

In the event of a personal data security breach that is likely to result in harm to affected data subjects, p3333 will:

• Notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, as required under NPC Circular 16-03
• Notify affected Players directly via their registered email address within a reasonable period following NPC notification, with information about the nature of the breach, the data affected, and the steps Players should take to protect themselves
• Take immediate containment and remediation steps to limit the impact of the breach
• Maintain a breach incident log in accordance with NPC requirements

If you become aware of or suspect any unauthorised access to your p3333 Account or personal data, contact support immediately at [email protected] so that containment measures can be activated promptly.

13 Marketing Communications

With your consent, p3333 may send you marketing communications including promotional offers, bonus notifications, new game announcements, and tournament invitations via SMS, email, or in-platform notification.

Marketing communications are opt-in only. You may withdraw your consent to receive marketing at any time by:

• Updating your notification preferences in Account Settings under "Communication Preferences"
• Clicking the unsubscribe link in any marketing email sent by p3333
• Contacting the support team at [email protected] with the request "Unsubscribe from Marketing"

Withdrawal of marketing consent does not affect transactional communications — you will continue to receive account security alerts, deposit/withdrawal confirmations, KYC notifications, and responsible gaming tool updates regardless of marketing preferences.

14 Changes to This Privacy Policy

p3333 reserves the right to update this Privacy Policy at any time in response to changes in applicable law, PAGCOR requirements, NPC guidance, or p3333 data processing practices. All updates will be published on this page with an updated "Last Updated" date.

Where a material change affects how we process your personal data in a way that requires fresh consent, we will notify registered Players via their registered email address prior to the change taking effect and provide a mechanism to consent or withdraw consent accordingly.

Continued use of the p3333 Platform following publication of an updated Policy constitutes acceptance of the updated terms, where consent is not the applicable legal basis for the change in question.

15 Contact & Data Privacy Officer

p3333 has designated a Data Privacy Officer (DPO) in accordance with Section 21 of RA 10173 and NPC Circular 16-01. The DPO is responsible for overseeing p3333's data protection programme, handling data subject requests, and liaising with the NPC.

If you are unsatisfied with how p3333 has handled your data privacy concern, you have the right to file a complaint directly with the National Privacy Commission of the Philippines (NPC). The NPC is the independent government body responsible for enforcing RA 10173 and adjudicating data privacy complaints.