megaph Privacy
Policy

megaph ("megaph," "we," "us," or "our") operates the online casino and sports betting platform accessible at megaph.vip (the "Platform"). megaph is a PAGCOR-regulated operator, serving Filipino players across the Philippines with online casino games, live dealer tables, sports betting, bingo, e-sabong, and related gaming services.

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations ("IRR"), megaph is the Personal Information Controller in respect of the personal data it processes about registered account holders and platform visitors.

This Privacy Policy applies to all personal data collected by megaph through the Platform, including during account registration, identity verification, gameplay, payment processing, customer support interactions, and marketing communications. It does not apply to third-party websites or services that may be linked to the Platform.

megaph collects the following categories of personal data in connection with your use of the Platform:

We do not collect or process sensitive personal information beyond what is strictly required for age verification and identity verification under PAGCOR licensing conditions and the Anti-Money Laundering Act.

megaph collects personal data through the following methods:

• Directly from you: Information you provide when registering your megaph account, completing KYC verification, submitting payment details, contacting support, or responding to surveys and promotions.
• Automatically: Technical and usage data collected through cookies, server logs, and similar tracking technologies when you access or interact with the Platform. See Section 7 for more information on cookies.
• From payment processors: Transaction confirmation data from GCash, PayMaya, BPI, BDO, Metrobank, and card payment networks, used solely to verify and reconcile deposits and withdrawals.
• From identity verification service providers: Document authentication results and facial recognition match scores generated during the KYC process, as required under PAGCOR and AMLC regulations.
• From fraud prevention and security services: Risk scoring and device fingerprint data from third-party security service providers used to detect and prevent fraudulent activity on the megaph platform.

megaph uses your personal data for the following purposes:

• Account management: Creating, maintaining, and securing your megaph account; processing logins; enabling access to Platform features and game content.
• Identity and age verification: Confirming that you meet megaph's eligibility requirements, including the 21+ age requirement mandated by PAGCOR, and verifying your identity in compliance with the Anti-Money Laundering Act (RA 9160).
• Payment processing: Processing deposits from and withdrawals to your GCash, PayMaya, or bank accounts; maintaining transaction records as required by law.
• Regulatory compliance: Meeting megaph's obligations under PAGCOR's licensing conditions, the DPA, the AMLA, and other applicable Philippine regulations, including reporting obligations to PAGCOR and the Anti-Money Laundering Council.
• Responsible gaming: Monitoring gaming activity to identify patterns that may indicate problem gambling behaviour; administering deposit limits, cool-off periods, and self-exclusion requests made by account holders.
• Platform security and fraud prevention: Detecting, investigating, and preventing fraudulent transactions, unauthorised account access, cheating, money laundering, and other prohibited conduct on the megaph platform.
• Customer support: Responding to account queries, complaints, and requests submitted via live chat, email, or other support channels.
• Platform improvement: Analysing aggregated, anonymised usage data to improve megaph's game library, platform performance, and user experience.
• Marketing communications: Sending promotional emails, SMS messages, and push notifications about megaph offers and promotions — but only to players who have opted in to such communications. You may withdraw consent at any time.

Under Republic Act No. 10173 (the Data Privacy Act of 2012), megaph processes your personal data on the following legal bases:

• Contract performance: Processing necessary to deliver the services set out in megaph's Terms & Conditions — including account management, payment processing, and gameplay — is required to perform the contract between you and megaph.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act, the Data Privacy Act, and other applicable Philippine law and regulatory directives.
• Legitimate interests: Processing for fraud prevention, platform security, and aggregated analytics that does not unduly prejudice your rights as a data subject, and where our interests do not override your fundamental rights.
• Consent: Processing for marketing communications, where we rely on your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out before withdrawal.

megaph does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients only to the extent strictly necessary:

• PAGCOR and regulatory authorities: As required by megaph's operating licence and applicable Philippine gaming and anti-money laundering regulations. This includes mandatory reporting to the Anti-Money Laundering Council (AMLC) where legally required.
• Payment service providers: GCash, PayMaya, BPI, BDO, Metrobank, Visa, and Mastercard processing networks — solely for the purpose of processing your deposits and withdrawals. These providers are bound by their own privacy and data security obligations.
• Identity verification service providers: Third-party KYC and document verification providers engaged to conduct identity and age verification on megaph's behalf, as required under PAGCOR regulations.
• Platform technology providers: Game software providers, cloud hosting services, and cybersecurity vendors who process data on megaph's behalf under data processing agreements that impose equivalent data protection standards.
• Fraud prevention services: Third-party fraud and risk management services used to protect the integrity of the megaph platform.
• Law enforcement and courts: Where megaph is required by a valid court order, law enforcement directive, or other lawful legal process under Philippine law to disclose personal data.

The megaph Platform uses cookies and similar tracking technologies to operate core platform functions, improve user experience, and support security and analytics. A cookie is a small text file placed on your device by the Platform when you visit.

megaph uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in to your megaph account during a session. These cookies cannot be disabled without impairing Platform functionality.
• Performance and analytics cookies: Used to collect anonymised information about how users interact with the megaph Platform — page visits, game selections, session durations — to help us improve the platform experience. No personally identifiable information is included in these analytics datasets.
• Security cookies: Used to detect fraudulent behaviour, unauthorised access attempts, and suspicious device activity on the megaph platform.
• Functional cookies: Used to remember your megaph account preferences, such as language settings, responsible gaming tool configurations, and display preferences.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may prevent you from logging in to or using the megaph Platform. Disabling performance or functional cookies will not prevent you from accessing the Platform but may affect certain preference and analytics functions.

megaph retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law. The following retention principles apply:

• Active accounts: Personal data associated with an active megaph account is retained for the duration of the account's existence and for a period of at least five (5) years after account closure, in compliance with PAGCOR record-keeping requirements and AMLA obligations.
• Transaction records: Financial transaction records are retained for a minimum of five (5) years in accordance with the Anti-Money Laundering Act and PAGCOR's audit requirements.
• Identity verification records: KYC documentation (government ID copies and verification results) is retained for a minimum of five (5) years after account closure as required by the AMLC.
• Customer support records: Support communications are retained for a period of two (2) years from the date of the interaction, or longer where required for ongoing dispute resolution.
• Marketing consent records: Records of your consent to or withdrawal from marketing communications are retained for a minimum of three (3) years to demonstrate compliance with DPA consent requirements.

Under Republic Act No. 10173 (the Data Privacy Act of 2012) and its Implementing Rules and Regulations, you have the following rights in respect of your personal data held by megaph:

To exercise any of the above rights, please contact megaph's Data Protection Officer using the contact details in Section 13. megaph will acknowledge your request within five (5) business days and respond substantively within thirty (30) calendar days. Where a request is particularly complex or where we receive a high volume of requests, we may extend this period by a further thirty (30) days, with prior notice to you.

megaph implements appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. These measures include:

• TLS/SSL encryption for all data transmitted between your device and megaph's servers.
• Encryption at rest for sensitive personal data and financial records stored on megaph's servers.
• Access controls and authentication limiting access to personal data to authorised megaph personnel on a need-to-know basis, with multi-factor authentication required for administrative access.
• Network security monitoring including intrusion detection systems, firewalls, and regular penetration testing conducted by qualified third-party security assessors.
• Regular security audits in accordance with PAGCOR's technical compliance requirements and ISO 27001-aligned security practices.
• Data breach response procedures including notification to affected account holders and the National Privacy Commission within seventy-two (72) hours of becoming aware of a breach that poses a risk to the rights of data subjects, as required by NPC Circular No. 16-03.

While megaph takes all reasonable steps to protect your data, no internet-based system can guarantee absolute security. You are responsible for maintaining the security of your megaph account credentials and for ensuring that any device you use to access the Platform is adequately protected.

The megaph Platform is intended solely for persons who are 21 years of age or older. megaph does not knowingly collect personal data from individuals under 21 years of age. Mandatory age verification is applied at registration and during the KYC process to enforce this requirement.

If megaph becomes aware that personal data has been collected from an individual under the age of 21, that account will be closed immediately, any balance will be handled in accordance with applicable law and PAGCOR regulations, and the personal data will be deleted or anonymised as soon as reasonably practicable and to the extent not required to be retained for regulatory purposes.

If you are a parent or guardian and believe that a person under 21 in your care has registered a megaph account, please contact our support team immediately at the details provided in Section 13.

megaph reserves the right to update or revise this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or regulatory requirements. Where changes are material — for example, changes to the categories of data collected, the purposes of processing, or your rights as a data subject — megaph will provide reasonable prior notice by publishing the updated Policy on the Platform and, where practicable, by notifying registered account holders via their registered email address or mobile number.

The "Last Updated" date at the top of this Policy will be revised each time a change is made. Your continued use of the megaph Platform after the publication of a revised Privacy Policy constitutes your acknowledgement of the changes. If you do not accept the revised Policy, you should discontinue use of the Platform and contact our Data Protection Officer to discuss the implications for your account.

For any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by megaph, you may contact us through the following channels:

• Data Protection Officer (DPO): megaph has designated a Data Protection Officer in accordance with the requirements of the Philippine Data Privacy Act. DPO enquiries may be directed to our support team, who will route your request to the DPO.
• Live Chat: Available 24/7 from the megaph Platform dashboard after logging in. This is the most efficient channel for urgent account or data-related queries.
• Email: [email protected] — please include your registered username, a description of your request, and the data subject right you wish to exercise. We acknowledge all DPA-related requests within five (5) business days.