Privacy Policy — starph.com

1 About This Policy

This Privacy Policy applies to all personal data collected, processed, and stored by starph.com in connection with the operation of the starph.com Platform at starphcom.club and its associated sub-domains. It covers data collected from registered players, visitors to the Platform who have not registered, and individuals who contact starph.com through support channels.

starph.com recognizes that personal data belongs to the individuals it relates to, and that the lawful, fair, and transparent processing of that data is both a legal obligation and an ethical responsibility. This policy is designed to explain clearly what data we collect, why we collect it, how it is used, and what your rights are with respect to it.

This policy is issued pursuant to Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and the applicable issuances of the National Privacy Commission (NPC) of the Philippines. It is also informed by PAGCOR licensing requirements concerning the handling of player data by regulated gaming operators.

2 Definitions

3 Personal Data We Collect

3.1 Registration Data

When you create an account on starph.com, we collect: your full legal name; date of birth; email address; Philippine mobile phone number; and a password of your choosing (stored in hashed, non-recoverable form).

3.2 Identity Verification (KYC) Data

To comply with PAGCOR licensing requirements and anti-money laundering (AML) legislation, we collect copies of government-issued Philippine identification documents when you apply for your first withdrawal or when required by our compliance procedures. Accepted documents include: UMID, Philippine Passport, Driver's License, and PhilSys National ID. We may also collect proof of address and, where source-of-funds verification is required, supporting financial documents.

3.3 Financial Data

We collect records of all deposits, withdrawals, and wagering transactions associated with your Account. We do not store complete GCash or PayMaya credentials or full bank account numbers. Payment instrument details are tokenized by our PCI-DSS compliant payment processors. Transaction records are retained for regulatory compliance and dispute resolution purposes.

3.4 Gaming and Behavioral Data

We collect data relating to your use of Platform features, including: game sessions played, bet amounts, game outcomes, session duration, responsible gaming tool settings, login times, and navigation patterns within the Platform. This data is used for personalization, platform improvement, fraud detection, and regulatory reporting.

3.5 Technical and Device Data

When you access starph.com, we automatically collect technical data including: IP address; device type, model, and operating system; browser type and version; screen resolution; referral URL; and session timestamps. This data is used for security monitoring, platform optimization, and fraud prevention.

3.6 Communications Data

We retain records of communications between you and the starph.com support team, including Live Chat transcripts, email correspondence, and any documents or media you submit in connection with a support request, dispute, or KYC submission.

4 How We Collect Personal Data

starph.com collects personal data through the following means:

• Directly from you — when you register an Account, complete KYC, make a deposit or withdrawal, contact support, or submit any form on the Platform;
• Automatically — through cookies, web beacons, server logs, and similar tracking technologies when you access or use the Platform (see Section 9);
• From third-party payment processors — transaction confirmation data returned by GCash, PayMaya, BPI, BDO, Metrobank, and UnionBank upon processing of deposits and withdrawals;
• From identity verification services — where starph.com uses a third-party KYC or document verification provider, data returned from that provider forms part of your verified identity record;
• From fraud prevention and AML partners — risk scoring, device fingerprinting, and behavioral analytics data generated through fraud detection tools integrated with the Platform.

5 Purpose & Legal Basis for Processing

starph.com processes your personal data for the purposes set out in the table below. Each purpose is supported by one or more lawful bases under the Data Privacy Act of 2012.

6 Data Sharing & Third-Party Disclosure

6.1 Service Providers (Data Processors)

starph.com shares personal data with carefully selected third-party service providers who process data on our behalf under written data processing agreements that require them to maintain data protection standards consistent with this policy. Categories of service provider include: payment processors (GCash, PayMaya, BPI, BDO, Metrobank, UnionBank); KYC and identity verification providers; fraud detection and AML screening services; cloud infrastructure and hosting providers; customer support platform providers; and game content providers who require account verification for access to their titles.

We do not permit third-party service providers to use your data for their own independent purposes beyond the specific services they are contracted to provide to starph.com.

6.2 Regulatory and Legal Disclosure

starph.com discloses personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other government bodies as required by applicable Philippine law, court order, or lawful regulatory demand. We will notify you of any such disclosure where we are legally permitted to do so.

6.3 Business Transfers

In the event of a merger, acquisition, sale of assets, or restructuring involving starph.com, your personal data may be transferred to the successor entity. You will be notified in advance of any such transfer and any changes to data processing arrangements that may result.

7 International Data Transfers

Some of the third-party service providers engaged by starph.com may operate servers or processing facilities outside the Philippines. Where personal data is transferred to a country or territory outside the Philippines, starph.com ensures that such transfers are made subject to appropriate safeguards, including: standard contractual data protection clauses; transfers to countries recognized by the NPC as providing an adequate level of personal data protection; or other mechanisms permitted under the Data Privacy Act and NPC regulations.

By using the starph.com Platform, you acknowledge and consent to the transfer of your personal data to countries outside the Philippines where necessary for the provision of services, subject to the safeguards described above.

8 Data Retention

starph.com retains personal data for no longer than is necessary for the purposes for which it was collected, subject to applicable legal retention obligations. The following retention periods apply:

• Account and registration data: Retained for the duration of the active account relationship and for a period of five (5) years following account closure, in compliance with PAGCOR licensing requirements and AML record-keeping obligations.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of verification or from the date of account closure, whichever is later, as required by Philippine AML legislation.
• Financial and transaction records: Retained for a minimum of five (5) years from the date of the transaction.
• Gaming and behavioral data: Retained for the duration of the active account relationship and for two (2) years following account closure, unless a longer period is required by applicable law.
• Support communications: Retained for two (2) years from the date of the communication, unless the communication relates to an unresolved dispute or regulatory inquiry, in which case it is retained until final resolution.
• Marketing consent records: Retained from the date consent is recorded until consent is withdrawn, plus an additional six (6) months for administrative purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with NPC data disposal guidelines. Where anonymization is applied, the resulting anonymized dataset is no longer considered personal data and is not subject to further retention limits.

9 Cookies & Tracking Technologies

9.1 What Are Cookies

Cookies are small text files placed on your device by the starph.com Platform when you access it. They allow the Platform to recognize your device, maintain session state, remember your preferences, and collect analytical and behavioral data. starph.com also uses related technologies including web beacons, pixel tags, and browser local storage for similar purposes.

9.2 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the Platform to function. These include session cookies that maintain your login state and security cookies that protect against cross-site request forgery. These cannot be disabled.
• Functional Cookies: Remember your preferences such as preferred game lobby view, language settings, and responsible gaming tool configurations. Disabling these may affect platform usability.
• Analytics Cookies: Collect aggregated data about how Players use the Platform — which pages are visited most frequently, how long sessions last, and which features are used. This data is used to improve the platform.
• Security and Fraud Prevention Cookies: Used by our fraud detection systems to identify unusual access patterns and flag potentially fraudulent activity.

9.3 Managing Cookies

You may configure your browser to refuse cookies or to alert you when cookies are being sent. Note that disabling cookies beyond strictly necessary cookies may affect your ability to use certain features of the starph.com Platform. Instructions for managing cookies are available in your browser's help documentation.

10 Security Measures

starph.com implements a multi-layered approach to data security designed to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Security measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and Platform servers;
• Encryption of personal and financial data at rest on Platform servers;
• Password hashing using bcrypt or equivalent industry-standard one-way hash functions — starph.com cannot recover your password;
• PCI-DSS compliant payment processing — complete payment instrument details are not stored on starph.com's servers;
• Two-factor authentication (2FA) available to all registered players;
• Automated suspicious login detection, rate limiting, and account lockout controls;
• Access controls limiting staff access to personal data on a strict need-to-know basis;
• Regular internal security audits and third-party penetration testing;
• Incident response procedures for data security events.

11 Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by starph.com. Requests to exercise any of these rights may be submitted to our Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request." We will respond within fifteen (15) business days of receiving a complete request.

If you are not satisfied with how starph.com has handled a data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. Information on filing an NPC complaint is available at the NPC's official website.

12 Children's Privacy

The starph.com Platform is strictly intended for persons who are 21 years of age and older in accordance with PAGCOR regulations. starph.com does not knowingly collect personal data from persons under the age of 21. If you have reason to believe that a person under 21 has registered an account or submitted personal data to starph.com, please contact us immediately at [email protected] so that the account can be investigated and the data deleted.

13 Marketing Communications

13.1 Opt-In Consent

starph.com will only send you promotional communications — including bonus offers, event announcements, and game update notifications — where you have provided explicit consent to receive such communications during registration or subsequently through your Account notification settings. Marketing communications will clearly identify starph.com as the sender and will include a simple, one-click unsubscribe mechanism.

13.2 Opting Out

You may withdraw your consent to receive marketing communications at any time by: (a) clicking the unsubscribe link in any marketing email; (b) adjusting notification preferences in your starph.com Account settings; or (c) contacting support at [email protected]. Opt-out requests are processed within five (5) business days.

13.3 Service Communications

Withdrawal of marketing consent does not affect transactional and service communications that are necessary for account management, including: deposit and withdrawal confirmations; security alerts and 2FA codes; KYC verification requests; responsible gaming notifications; and amendments to these Terms or this Privacy Policy. These communications are sent on the basis of contractual necessity, not consent, and cannot be disabled while your Account is active.

14 Third-Party Services & Linked Content

The starph.com Platform may incorporate game content, payment processing, and other functionality provided by third-party partners. These third parties may process personal data — such as game session data or payment confirmation data — as described in their own privacy policies. starph.com selects third-party partners that maintain data protection standards consistent with the Data Privacy Act and our own privacy obligations; however, starph.com is not responsible for the independent data processing practices of third parties beyond what is governed by our data processing agreements with them.

starph.com does not include links to external websites outside of the platform. If you encounter any external links within the Platform that are not operated by starph.com, please report them to our support team immediately.

15 Data Breach Notification

In the event of a personal data breach that is reasonably likely to give rise to a serious risk of harm to affected individuals, starph.com will:

1. Notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular No. 16-03 and subsequent NPC issuances on personal data breach management;
2. Notify affected data subjects — including starph.com players whose personal data may have been compromised — as soon as practicable following NPC notification, providing clear information about the nature of the breach, the data categories involved, the likely consequences, and the measures taken or proposed to address the breach;
3. Take immediate remedial action to contain the breach, secure affected systems, and prevent further unauthorized access.

Where a breach does not give rise to a serious risk of harm, it will be documented internally and reported to the NPC on the next available periodic reporting cycle.

16 Changes to This Privacy Policy

starph.com may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or Platform functionality. When material changes are made, we will notify registered players by email to the address associated with their Account and post a notice on the Platform.

The updated policy will take effect on the date specified in the notification. Continued use of the Platform after that date constitutes your acceptance of the revised policy. We encourage you to review this policy periodically. The most current version will always be available at starphcom.club/privacy-policy.

17 Contact & Data Protection Officer

starph.com has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and the Data Privacy Act of 2012. If you have any questions about this policy, wish to exercise your data subject rights, or have concerns about how your personal data has been handled, please contact:

• Data Protection Officer, starph.com
• Email: [email protected] (subject line: "Privacy / DPO Enquiry")
• Live Chat: Available 24 hours a day, 7 days a week on all pages of the Platform
• Response Time: Within 15 business days for data subject rights requests; within 3 business days for general privacy enquiries