Privacy Policy – merryph22

This Privacy Policy (the "Policy") describes how merryph22 (the "Platform," "we," "us," or "our") collects, uses, stores, discloses, and protects personal information relating to registered players, website visitors, and other individuals who interact with the merryph22 online gaming platform accessible at merryph22.win (the "Service").

merryph22 is committed to processing personal data responsibly, lawfully, and in a manner that respects the privacy rights of all individuals. This Policy has been prepared in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, the relevant issuances of the National Privacy Commission (NPC) of the Philippines, and applicable PAGCOR data governance requirements.

By accessing or using merryph22, registering an account, or otherwise providing personal information to us, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, please discontinue use of the merryph22 Service.

For the purposes of the Data Privacy Act of 2012 and this Policy, the personal information controller is merryph22, the operator of the gaming platform at merryph22.win. merryph22 determines the purposes and means of processing personal data collected through the Service.

merryph22 has appointed a Data Protection Officer (DPO) responsible for overseeing the Platform's compliance with data privacy obligations, handling data subject rights requests, and serving as the primary point of contact for the National Privacy Commission. Contact details for the DPO are provided in Section 15 of this Policy.

In certain processing activities — particularly those involving game delivery, payment processing, or technical infrastructure — merryph22 engages personal information processors (third-party service providers) who process personal data on behalf of merryph22 pursuant to written data processing agreements. These processors are listed and described in Section 6.

merryph22 collects personal data from you in the following circumstances and categories:

3.1 Registration Data

When you create a merryph22 account, we collect the information you provide, which includes:

• Full legal name;
• Date of birth (to verify the 21-years-or-older eligibility requirement);
• Residential address in the Philippines;
• Email address;
• Mobile phone number;
• Chosen username and encrypted password.

3.2 Identity Verification (KYC) Data

Prior to processing withdrawals, merryph22 is required by PAGCOR to conduct Know Your Customer (KYC) identity verification. This may require collection of:

• Copy of a valid Philippine government-issued identification document (e.g., Philippine passport, PhilSys National ID, SSS ID, UMID, driver's license, or PRC ID);
• Proof of address (e.g., utility bill, bank statement);
• Proof of payment method ownership (e.g., screenshot of GCash or Maya wallet showing your registered name);
• Source of funds documentation where required by anti-money laundering regulations.

3.3 Transaction and Financial Data

When you make deposits or request withdrawals, merryph22 processes transaction records including payment method identifiers (e.g., masked GCash number, bank account name), transaction amounts, timestamps, and transaction reference numbers. merryph22 does not store full payment card numbers or complete financial account numbers.

3.4 Gaming Activity Data

merryph22 records your gaming activity on the Platform, including game sessions, wager amounts, game outcomes, bonus usage, and session durations. This data is used for account management, responsible gaming monitoring, regulatory reporting, and dispute resolution.

3.5 Technical and Device Data

When you access merryph22, we automatically collect certain technical information, including IP address, device type, operating system, browser type and version, referring URL, and pages visited. This data is collected through server logs and analytics tools.

3.6 Customer Support Communications

When you contact merryph22 customer support via live chat or email, we retain records of those communications, including any personal information you provide in the course of seeking assistance.

merryph22 processes personal data for the following specific purposes:

merryph22 does not engage in profiling that produces legal effects concerning data subjects, automated decision-making without human review, or any processing of personal data for purposes not listed above without obtaining fresh consent from the data subject.

Under the Data Privacy Act of 2012, merryph22 relies on the following legal bases for processing personal data:

• Contractual necessity: Processing required to perform the contract between merryph22 and the player — including account creation, payment processing, and game delivery;
• Legal obligation: Processing required to comply with obligations under Philippine law, including PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), and NPC regulations;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service analytics, where those interests are not overridden by the data subject's privacy rights;
• Consent: Processing for direct marketing communications, where merryph22 has obtained the data subject's explicit, informed, and freely given consent.

Where merryph22 relies on consent as the legal basis for a processing activity, you retain the right to withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal. Withdrawal of consent may be made through your account settings or by contacting the merryph22 DPO.

merryph22 does not sell, rent, or trade personal data. We share personal data only in the following circumstances and with the following categories of recipients:

• Game providers: Certified third-party game studios (such as Pragmatic Play, PG Soft, JILI Games, and Evolution) receive session data necessary to deliver game functionality. These providers process data under contractual obligations consistent with this Policy;
• Payment processors: Licensed payment service providers (including GCash, Maya, and partner banks) receive transaction data necessary to process deposits and withdrawals. These processors are regulated by the Bangko Sentral ng Pilipinas (BSP);
• Identity verification services: Third-party KYC and document verification providers may process identity documents on behalf of merryph22 under data processing agreements;
• PAGCOR: merryph22 is required to submit regulatory reports to PAGCOR, which may include transaction data, player account information, and gaming activity records as specified in our license conditions;
• Anti-Money Laundering Council (AMLC): merryph22 is required by the Anti-Money Laundering Act to report covered and suspicious transactions to the AMLC. Such disclosures may include personal data;
• National Privacy Commission: In the event of a personal data breach, merryph22 is required to notify the NPC and, where applicable, affected data subjects in accordance with NPC Circular 16-03;
• Legal and judicial authorities: merryph22 will disclose personal data in response to a valid court order, subpoena, or legal process under Philippine law;
• Analytics and security providers: Technical service providers that assist with platform analytics and cybersecurity receive access only to aggregated or pseudonymized data wherever possible.

All third-party processors engaged by merryph22 are subject to written data processing agreements that require them to process personal data only on merryph22's documented instructions and to maintain appropriate security measures.

merryph22 uses cookies and similar tracking technologies to operate and improve the Service. Cookies are small text files stored on your device by your browser when you visit merryph22.win. merryph22 uses the following categories of cookies:

• Strictly necessary cookies: Required for core platform functionality, including session management and security. These cannot be disabled without affecting your ability to use the Service;
• Functional cookies: Store your preferences such as language settings and remembering your login status (if "Keep me signed in" is selected);
• Analytics cookies: Collect aggregated, anonymized data about how visitors use merryph22 to help us understand and improve the platform. No personally identifying information is included in analytics data;
• Marketing cookies: Used only where you have given explicit consent to receive personalized promotional communications from merryph22. These cookies track interactions with merryph22 marketing content.

You may control and manage cookies through your browser settings. Most browsers allow you to refuse non-essential cookies or to clear cookies already stored on your device. Note that disabling strictly necessary cookies will impair or prevent your ability to use the merryph22 platform.

merryph22 retains personal data for as long as it is necessary for the purposes set out in this Policy and for compliance with applicable legal obligations. The following retention periods apply:

Following the expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with merryph22's data disposal procedures. Where legal obligations require extended retention, data is stored securely with access restricted to compliance personnel only.

merryph22 implements appropriate technical and organizational security measures to protect personal data against unauthorized access, accidental loss, destruction, alteration, or unauthorized disclosure. These measures include:

• Encryption in transit: All data transmitted between your device and the merryph22 platform is encrypted using TLS 1.2 or higher (256-bit SSL);
• Encryption at rest: Sensitive personal data stored in merryph22's databases is encrypted at rest using AES-256 encryption;
• Access controls: Access to personal data within merryph22's systems is restricted to authorized personnel with a documented business need, enforced through role-based access controls and multi-factor authentication;
• Pseudonymization: Where feasible, merryph22 uses pseudonymization to reduce the risk associated with data processing activities;
• Security monitoring: merryph22 maintains 24/7 security monitoring of its infrastructure, including intrusion detection systems, vulnerability scanning, and log analysis;
• Personnel training: All merryph22 personnel with access to personal data receive regular data privacy and security training;
• Incident response: merryph22 maintains a documented personal data breach response procedure in compliance with NPC Circular 16-03, including mandatory notification timelines.

While merryph22 takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. If you have reason to believe that your merryph22 account or personal data has been compromised, please contact our support team immediately via live chat to request account suspension.

Under the Data Privacy Act of 2012 and applicable NPC issuances, you have the following rights with respect to your personal data processed by merryph22. These rights may be exercised by contacting merryph22's Data Protection Officer as described in Section 15.

Requests to exercise data subject rights will be acknowledged within three (3) business days and substantively responded to within fifteen (15) business days, except where the complexity of the request requires a longer period, in which case merryph22 will notify you of the extended timeline.

merryph22 may decline to fulfil a data subject rights request where it conflicts with a mandatory legal retention obligation (such as the AMLA's 10-year transaction record requirement) or where compliance would adversely affect the rights and freedoms of other persons. Any refusal will be communicated in writing with reasons.

merryph22 strictly prohibits access to and use of its platform by individuals under the age of twenty-one (21) years, as required by PAGCOR for casino-style online gambling in the Philippines. merryph22 does not knowingly collect personal data from persons under 21 years of age.

If merryph22 discovers or is informed that personal data has been collected from a person under 21 years of age, the relevant account will be immediately suspended, all balances will be frozen pending review, and the personal data associated with the account will be deleted as soon as practicable, subject to any mandatory legal hold obligations.

Age verification is conducted at registration (through date of birth declaration) and confirmed through the KYC identity verification process prior to any withdrawal. merryph22 reserves the right to require documentary age verification at any time.

merryph22 may send promotional communications — including emails, SMS messages, and in-platform notifications — about bonuses, new games, promotions, and platform updates to players who have provided explicit consent to receive such communications.

Consent to receive marketing communications is not a condition of registering a merryph22 account or accessing the Service. You may opt in or out of marketing communications at any time through the following channels:

• Your merryph22 account settings (Communications Preferences section);
• The unsubscribe link included in every marketing email sent by merryph22;
• By contacting the merryph22 DPO or customer support team.

Transactional communications — including deposit confirmations, withdrawal notifications, account security alerts, and responsible gaming notifications — are not marketing communications and will continue to be sent regardless of your marketing preferences, as they are necessary for the operation of your account.

merryph22 does not purchase marketing lists or send unsolicited marketing communications to persons who have not consented. All marketing communications from merryph22 originate from the merryph22.win email domain.

The merryph22 platform may contain references or links to third-party websites or services — including game provider pages, payment service provider portals, and regulatory authority websites. This Privacy Policy does not apply to those third-party services.

merryph22 has no control over the privacy practices, content, or data handling of third-party websites. Before providing any personal information to a third-party website, you should review that party's privacy policy. merryph22 makes no representations or warranties regarding the privacy practices of any third party.

merryph22 reserves the right to update or modify this Privacy Policy at any time. When material changes are made — particularly changes that affect the nature of the data we collect, the purposes for which we use it, or the rights of data subjects — we will notify registered players by email and/or through a prominent notice on the merryph22 platform at least fourteen (14) days before the changes take effect.

The effective date at the top of this Policy reflects the date of the most recent update. Continued use of the merryph22 Service following the effective date of any revision constitutes your acceptance of the updated Policy.

For changes that require fresh consent under the Data Privacy Act — such as new processing activities based on consent — merryph22 will separately request your explicit consent before commencing the new processing activity.

The most current version of this Privacy Policy is always accessible at merryph22.win/privacy-policy. We recommend reviewing this Policy periodically.

For all privacy-related inquiries, data subject rights requests, or concerns about merryph22's data processing practices, please contact the merryph22 Data Protection Officer (DPO):

• Email: [email protected] — Please include "Privacy / DPO Request" in the subject line.
• Live Chat: Available 24/7 through the merryph22 platform. Request to speak with the DPO team for privacy matters.

merryph22 will acknowledge all privacy inquiries within three (3) business days and will make every effort to resolve them within fifteen (15) business days. Complex requests may require additional time, and you will be informed promptly if this is the case.

If you are dissatisfied with merryph22's response to a privacy inquiry or believe your rights under the Data Privacy Act have been violated, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Philippines. Information on the NPC's complaint process is available through government channels in the Philippines.