p897 Privacy Policy — How We Protect Your Personal Data

2. Data Controller

For the purposes of the Philippine Data Privacy Act, p897 is the personal information controller in respect of your data collected through the Platform. This means p897 determines the purposes and means of processing your personal information.

p897's designated Data Privacy Officer ("DPO") is responsible for overseeing compliance with data privacy obligations and handling data-related requests and concerns. You can reach the DPO at support@p897.best with the subject line "Data Privacy Request."

3. Personal Data We Collect

p897 collects the following categories of personal data from players:

p897 does not collect sensitive personal information as defined under the DPA (such as health data, political or religious affiliations) unless specifically required for legal compliance purposes, in which case explicit consent will be sought.

4. How We Collect Your Data

p897 collects your personal data through the following channels:

• Direct submission: When you register for a p897 account, complete your profile, submit identity verification documents, make deposits or withdrawals, contact our support team, or participate in promotions.
• Automated collection: When you access and use the p897 Platform, our systems automatically collect technical and usage data including your IP address, device information, session duration, game activity, and navigation patterns.
• Payment processors: When you deposit or withdraw funds via GCash, Maya, InstaPay, or other supported payment methods, p897 receives transaction confirmation data from the payment processor. p897 does not receive or store your GCash PIN, bank password, or full card number.
• Identity verification services: When you complete the p897 KYC process, our identity verification partner processes your submitted documents and returns a verification result to p897. The documents themselves may be temporarily processed by our verification partner under data processing agreements consistent with the DPA.
• Cookies and tracking technologies: p897 uses cookies and similar technologies as described in the Cookies section of this policy.

5. Why We Process Your Personal Data

p897 processes your personal data only for the purposes listed below. For each purpose, the legal basis under the DPA is identified:

• Account creation and management — to create and maintain your p897 account, process logins, and deliver platform features. Basis: performance of a contract.
• Payment processing — to process your deposits and withdrawals through your chosen Philippine payment method. Basis: performance of a contract.
• Identity and age verification (KYC) — to verify that you are who you say you are, that you are at least 21 years of age, and that your account is being used by its rightful owner. Basis: legal obligation and legitimate interests.
• Fraud prevention and anti-money laundering (AML) — to detect and prevent fraudulent activity, money laundering, and other financial crimes in compliance with Philippine AML regulations. Basis: legal obligation and legitimate interests.
• Customer support — to respond to your inquiries, complaints, and requests efficiently and accurately. Basis: performance of a contract and legitimate interests.
• Responsible gaming — to support responsible gaming tools including deposit limits, self-exclusion, and session controls, and to identify players who may need additional support. Basis: legal obligation and legitimate interests.
• Platform improvement — to analyze usage patterns and improve the features, performance, and user experience of the p897 Platform. Basis: legitimate interests (data is aggregated and anonymized where possible).
• Marketing communications — to send promotional offers, bonus notifications, and platform updates to players who have consented to receive them. Basis: consent (you can opt out at any time).
• Legal compliance — to comply with applicable Philippine laws, regulations, court orders, and instructions from regulatory authorities. Basis: legal obligation.

6. Sharing Your Personal Data

p897 does not sell your personal data to any third party, ever. We share your data only in the following circumstances, and only to the extent necessary for the stated purpose:

• Payment processors: GCash, Maya, InstaPay, PESONet, BDO, BPI, UnionBank, and card networks receive transaction data necessary to process your deposits and withdrawals. These parties process data under their own privacy policies and are bound by PCI-DSS compliance requirements.
• Identity verification providers: p897's KYC partner receives copies of your verification documents solely to confirm your identity. This partner is bound by a data processing agreement aligned with the DPA and is prohibited from using your data for any other purpose.
• Game software providers: Game outcome data (but not your full personal profile) is shared with game software providers as needed for technical operation and audit purposes. These providers are contractually prohibited from using this data for independent profiling.
• Legal and regulatory authorities: p897 will disclose personal data to the National Privacy Commission, Anti-Money Laundering Council (AMLC), law enforcement agencies, or courts when required by Philippine law, a valid legal process, or a lawful regulatory directive. p897 will, where legally permitted, notify the affected player of such disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of p897 or its assets, your personal data may be transferred to the successor entity. In such an event, p897 will notify affected players and ensure the successor entity is bound by privacy obligations at least as protective as this policy.

In all cases where p897 shares data with third parties, those parties are required to maintain appropriate technical and organizational security measures consistent with applicable Philippine data protection law.

7. Payment Data and Financial Information

p897 takes special care with financial data because we understand the sensitivity of your payment information. Here is exactly what p897 does and does not store:

• What p897 stores: Transaction amounts in PHP, transaction dates and times, transaction reference numbers from your payment provider, payment method type (e.g., "GCash"), and transaction status (completed, pending, failed).
• What p897 does NOT store: Your GCash PIN, your GCash MPIN, your online banking password, your full card number, your card CVV/CVC, your one-time passwords (OTPs), or any authentication credentials for your payment accounts.

All payment processing at p897 is handled through secure, PCI-DSS compliant third-party payment gateways. When you tap "Deposit" or "Withdraw," you are redirected to or interact with the payment provider's secure interface — p897 does not intercept or see your credentials in real time.

8. Cookies and Tracking Technologies

p897 uses cookies and similar technologies (local storage, session tokens) to operate the Platform and improve your experience. Here's what each type does:

• Essential cookies: Required for the Platform to function. These maintain your login session, remember your preferences, and enable secure authentication. They cannot be disabled without breaking core functionality. No personal profiling is performed using essential cookies.
• Functional cookies: Remember choices you make on the Platform, such as your preferred language, game settings, and notification preferences. These improve your experience but are not strictly necessary.
• Analytics cookies: Collect anonymized and aggregated data about how players use the Platform — which pages are visited most, where players exit, how long sessions last. This data helps p897 improve the Platform. No individual player profile is built from analytics data.
• Session security tokens: Short-lived tokens used to verify the authenticity of your session and protect against cross-site request forgery (CSRF) attacks. These expire when you log out.

p897 does not use third-party advertising cookies or behavioral tracking cookies designed to build profiles for off-Platform advertising. You can manage cookie preferences through your browser settings. Note that disabling essential cookies will prevent you from accessing your p897 account.

9. Data Retention

p897 retains your personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable Philippine law. Key retention periods are:

• Active account data: Retained for the duration of your account's existence plus a minimum of 5 years after account closure, in accordance with AMLC record-keeping requirements.
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction, as required under Philippine anti-money laundering regulations.
• KYC and identity verification documents: Retained for the duration of account existence plus 5 years, or longer if required by a regulatory authority or ongoing investigation.
• Customer support records: Retained for 3 years from the date of the last support interaction, to allow for dispute resolution and quality monitoring.
• Marketing consent records: Retained for as long as you have an active p897 account, or until you withdraw your marketing consent, whichever is earlier.
• Technical and usage logs: Retained for 12 months in standard log storage, then archived for up to 3 years for security audit purposes before deletion.

When data is no longer required, p897 ensures it is securely deleted or anonymized in a manner that prevents reconstruction.

10. How p897 Secures Your Data

p897 implements technical and organizational measures designed to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and p897 servers.
• Encryption at rest for stored personal and financial data using industry-standard algorithms.
• Access controls that restrict internal access to personal data to authorized personnel only, on a need-to-know basis.
• Regular security audits, penetration testing, and vulnerability assessments by independent security specialists.
• Multi-factor authentication (MFA) requirements for internal staff accessing production systems containing personal data.
• Incident response procedures that ensure p897 can detect, respond to, and notify affected players and the NPC of any data breach in a timely manner consistent with DPA requirements.
• Staff training on data privacy obligations and secure data handling practices.

11. Your Data Rights Under the Philippine DPA

Under Republic Act 10173, every Filipino data subject has the following rights regarding their personal data. p897 is committed to honoring all of these rights in full:

• Right to be informed: You have the right to know that p897 is collecting your personal data, why it is being collected, and how it will be used. This Privacy Policy fulfills that obligation.
• Right to access: You can request a copy of the personal data p897 holds about you at any time. p897 will provide this within 15 business days of receiving a verified request.
• Right to correction: If any personal data p897 holds about you is inaccurate or incomplete, you can request correction. Corrections to identity data may require supporting documentation.
• Right to erasure (right to be forgotten): You can request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw your consent and there is no other legal basis for processing. Note that certain data must be retained for legal compliance reasons and cannot be deleted on request.
• Right to object: You can object to processing of your personal data for direct marketing purposes at any time. You can also object to other processing activities where the legal basis is legitimate interests, subject to p897's right to demonstrate compelling grounds for continued processing.
• Right to data portability: You can request that p897 provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another controller.
• Right to file a complaint: If you believe p897 has violated your data privacy rights, you may file a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any of these rights, email p897's Data Privacy Officer at support@p897.best with the subject line "Data Privacy Request." Include your account username and a description of your request. p897 will respond within 15 business days. We may request identity verification before processing sensitive requests such as data access or deletion.

12. Children and Minors

p897 does not knowingly collect personal data from individuals under 21 years of age. The Platform is intended exclusively for adults who meet the legal minimum age requirement for online gaming in the Philippines.

If p897 discovers that personal data has been collected from a person under 21 without verifiable parental or guardian consent, that data will be deleted immediately and the associated account closed. Parents or guardians who believe their child may have created a p897 account should contact support@p897.best immediately.

p897's age verification procedures during account registration and KYC are designed to identify and prevent underage access. However, if false age information is provided by a registrant, p897 cannot be held responsible for data collected prior to discovering the misrepresentation.

13. Marketing Communications

With your consent, p897 may send you promotional messages about bonuses, new games, events, and platform updates via SMS, email, or push notification. Consent for marketing communications is obtained separately from the standard account registration process.

• You can opt out of all marketing communications at any time by clicking "unsubscribe" in any p897 email, by updating your notification preferences in your account settings, or by contacting support at support@p897.best.
• Opting out of marketing communications does not affect transactional communications — p897 will continue to send you account-related messages such as deposit confirmations, withdrawal notifications, and security alerts as these are necessary for platform operation.
• p897 does not engage in aggressive re-marketing after you opt out. Your opt-out preference will be processed within 5 business days.

14. Changes to This Privacy Policy

p897 may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or platform features. When material changes are made — particularly changes that affect how we use your personal data or your rights — p897 will:

• Update the "Last updated" date at the top of this Privacy Policy.
• Send a notification to your registered email address at least 7 days before the changes take effect.
• Display a prominent notice on the p897 Platform for at least 14 days following any material update.

Continued use of the p897 Platform after the effective date of any changes to this Privacy Policy constitutes your acceptance of the revised policy. If you do not accept the revised policy, you should close your account and cease using the Platform.

15. Contact and Data Privacy Complaints

If you have any questions about this Privacy Policy, want to exercise your data rights, or have a concern about how p897 has handled your personal data, please contact our Data Privacy Officer:

• Email: support@p897.best (subject line: "Data Privacy Request")
• Response time: Within 15 business days for formal data subject requests; within 24 hours for urgent security concerns.
• Live chat: Available 24/7 for general privacy questions — ask to be connected to the Data Privacy Officer for formal requests.

If you are not satisfied with p897's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. Information about filing an NPC complaint is available at the NPC's official website.