romaph Privacy Policy

1. Introduction

romaph ("romaph," "we," "us," "the Platform") operates romaph.club, an online casino and sports betting platform serving Filipino players across the Philippines. In the course of providing our services, romaph necessarily collects and processes certain personal data about the individuals who register and use the Platform.

This Privacy Policy ("Policy") sets out the basis on which we collect, use, store, share, and protect personal data, and the rights available to you as a data subject under the Data Privacy Act of the Philippines (Republic Act No. 10173) and its Implementing Rules and Regulations ("IRR").

This Policy should be read alongside our Terms & Conditions, which govern the overall use of the romaph platform. Any term not defined in this Policy has the meaning given to it in the Terms & Conditions.

2. Data Controller

For the purposes of the Data Privacy Act of the Philippines, romaph is the personal information controller in respect of personal data collected through romaph.club. Our designated Data Protection Officer ("DPO") is responsible for overseeing data protection practices within the organisation and is the appropriate contact for any data subject rights requests or privacy concerns.

Contact our DPO via the live chat channel on romaph.club or by email at the address provided in Section 14 of this Policy.

3. Personal Data We Collect

romaph collects the following categories of personal data, depending on how you interact with the Platform:

Registration & Identity Data

• Full legal name as it appears on a Philippine government-issued ID.
• Date of birth (used to verify the 21+ age requirement).
• Philippine mobile number (09xx format).
• Email address.
• Username and account credentials (password stored as a cryptographic hash — never in plain text).

Know Your Customer (KYC) Verification Data

• Copy or image of a valid Philippine government-issued ID (e.g., passport, SSS ID, UMID, PhilHealth card, driver's license).
• Selfie or identity confirmation image where required for enhanced KYC.
• Address information as reflected on identity documents.

Financial & Transaction Data

• GCash number, Maya account, bank account details, or card information used for deposits and withdrawals.
• Transaction history: deposits, withdrawals, bonus credits, and game wagering records.
• Payment method type and transaction timestamps.

Technical & Usage Data

• IP address and approximate geographic location (region/city level).
• Device type, operating system, and browser type.
• Pages visited, games played, session duration, and navigation patterns.
• Login timestamps and device identifiers used for OTP-based security.

Communications Data

• Content of messages sent to romaph support via live chat.
• Email correspondence with romaph.
• Responses to voluntary surveys or feedback requests.

4. How We Collect Your Data

romaph collects personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit, request a withdrawal, contact support, or participate in promotions.
• Automatically: Through cookies, session tracking, and server logs when you access romaph.club. Technical data about your device and browsing behaviour is collected automatically during each visit.
• From third parties: Payment processors (GCash, Maya, BPI, BDO, etc.) may transmit transaction confirmation data to romaph to reconcile deposits and withdrawals. Identity verification service providers may return KYC status flags to our system.

5. Legal Basis for Processing

romaph processes your personal data on one or more of the following legal bases as recognised under the Data Privacy Act of the Philippines:

• Contract performance: Processing is necessary to fulfil the Terms & Conditions you accepted upon registration — including account management, game access, and payment processing.
• Legal obligation: Processing is required to comply with applicable laws, including PAGCOR regulations, the Anti-Money Laundering Act (AMLA), and the Data Privacy Act itself (e.g., KYC retention obligations).
• Legitimate interests: Processing for fraud detection, security monitoring, platform analytics, and responsible gaming enforcement — provided such interests do not override your fundamental rights.
• Consent: For optional marketing communications and non-essential cookies, where we rely on your explicit opt-in consent.

6. How We Use Your Personal Data

romaph uses the personal data we collect for the following specific purposes:

• To create, verify, and manage your romaph account, including enforcing the 21+ age restriction.
• To process deposits and withdrawals via GCash, Maya, bank transfer, and other supported Philippine payment channels.
• To provide access to all games and services available on the Platform, including slots, live dealer, bingo, Super Keno, and sports betting.
• To send OTPs and account security notifications to your registered Philippine mobile number.
• To conduct KYC identity verification before processing your first withdrawal.
• To detect, investigate, and prevent fraud, money laundering, and prohibited conduct as outlined in the Terms & Conditions.
• To provide 24/7 customer support and respond to your enquiries.
• To comply with PAGCOR regulatory requirements and applicable Philippine law.
• To enforce responsible gaming obligations, including age verification, deposit limit management, and self-exclusion processing.
• To send promotional communications where you have opted in to receive them. You may withdraw consent at any time via account settings or by contacting support.
• To analyse Platform usage patterns for product improvement, provided such analysis does not result in decisions that significantly affect you on an automated basis without human oversight.

7. Data Sharing & Disclosure

romaph does not sell, rent, or trade your personal data to third parties for marketing purposes. We share personal data only in the following circumstances:

• Payment processors: We share necessary transaction data (name, account number, amount) with GCash, Maya, BPI, BDO, Metrobank, and other payment partners to process your deposits and withdrawals.
• KYC verification providers: Where we use third-party identity verification services, your ID documents and related data are transmitted securely to those providers for the sole purpose of identity confirmation.
• Regulatory and law enforcement authorities: romaph is required to disclose certain data to PAGCOR, the Anti-Money Laundering Council (AMLC), and other Philippine authorities in response to valid legal requests, court orders, or regulatory obligations.
• Game software providers: Limited technical session data may be shared with game providers to enable game functionality, RNG certification audits, and dispute resolution. Game providers do not receive your financial or identity data.
• Service providers acting as processors: Cloud hosting, analytics, security monitoring, and support platform vendors who process data on our behalf under data processing agreements that bind them to the same standards as this Policy.

8. Cookies & Tracking Technologies

romaph uses cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies we use are:

• Strictly necessary cookies: Required for the Platform to function — session management, login state, and security tokens. Cannot be disabled without breaking core Platform functionality.
• Functional cookies: Store your preferences such as language settings and game display options to improve your experience on return visits.
• Analytics cookies: Used to understand how players navigate romaph — pages visited, time on page, and error events. This data is aggregated and anonymised where possible. You may opt out via your account settings.
• Marketing cookies: Only placed where you have explicitly consented to receive targeted promotional content. You may withdraw consent at any time.

You may control cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the romaph Platform.

9. Data Retention

romaph retains personal data for the period necessary to fulfil the purposes described in this Policy, subject to the following minimum retention periods:

• Account & KYC data: Retained for a minimum of five (5) years following account closure, as required by PAGCOR regulations and AMLA obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction.
• Support communications: Retained for a minimum of two (2) years.
• Technical/usage logs: Retained for up to twelve (12) months unless extended for ongoing security investigations or legal proceedings.

Following the applicable retention period, data is securely deleted or anonymised in a manner that makes re-identification impossible.

10. Data Security

romaph implements technical and organisational security measures appropriate to the sensitivity of the personal data we process:

• SSL/TLS encryption for all data in transit between your device and romaph's servers.
• Password hashing using industry-standard one-way cryptographic functions — romaph never stores passwords in plain text.
• OTP-based device verification for new device logins, protecting your account even if credentials are compromised.
• Access controls that restrict access to personal data to authorised personnel on a need-to-know basis.
• Regular security assessments including vulnerability scanning and penetration testing.
• Incident response procedures consistent with the Data Privacy Act's mandatory breach notification requirements.

In the event of a personal data breach that is likely to result in harm to affected data subjects, romaph will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where required by law.

11. Your Data Subject Rights

Under the Data Privacy Act of the Philippines, you have the following rights in relation to your personal data held by romaph:

romaph will respond to verified data subject rights requests within thirty (30) days of receipt. We may request proof of identity before processing requests to protect against fraudulent access to personal data.

12. Children's Privacy

romaph's services are strictly restricted to individuals aged 21 years and above. We do not knowingly collect personal data from individuals under 21. Age verification is conducted during the KYC process before any withdrawal is processed.

If romaph discovers that personal data has been collected from an individual who is under 21 years of age, we will immediately terminate the associated account, delete the collected data to the extent not required for legal retention purposes, and report the matter to applicable authorities where required by Philippine law.

Parents or guardians who believe that a minor may have registered on romaph should contact our support team immediately via live chat so that the account can be investigated and closed without delay.

13. Changes to This Privacy Policy

romaph reserves the right to update this Privacy Policy at any time. When material changes are made, we will notify registered players by posting a notice on the Platform and, where practicable, by sending an email notification to your registered address. The date of the most recent revision is shown at the top of this page.

Your continued use of romaph following the posting of an updated Policy constitutes your acceptance of the changes. If you do not agree with a material change, you may close your account before the change takes effect.

14. Contact Our Data Protection Officer

For any privacy-related enquiries, data subject rights requests, or to report a suspected data breach involving your romaph account, please contact us through the following channels:

Please include "Privacy Request" in the subject line of email enquiries and provide your registered mobile number or email so we can verify your identity before processing any data subject rights request.