taraph Privacy Policy

This Privacy Policy ("Policy") is issued by taraph ("taraph," "we," "us," or "our"), the operator of the online gaming and casino platform available at taraph.one ("the Platform"). taraph is registered and operates in compliance with PAGCOR online gaming regulations applicable to the Philippines. This Policy sets out in full the personal data processing practices of taraph and the rights available to all data subjects whose information taraph handles.

This Policy is issued pursuant to Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations ("IRR") as promulgated by the National Privacy Commission ("NPC"). taraph is the Personal Information Controller ("PIC") in respect of all personal data processing activities described in this Policy.

1 Who We Are — Personal Information Controller

1.1 taraph operates taraph.one as a PAGCOR-regulated online gaming and casino platform serving Filipino players in the Philippines. As the operator of the Platform, taraph determines the purposes and means of processing personal data collected through the Platform and is therefore the Personal Information Controller under the DPA.

1.2 taraph has designated a Data Protection Officer ("DPO") in accordance with Section 21 of the DPA IRR. The DPO is responsible for ensuring taraph's ongoing compliance with data privacy obligations and serves as the primary point of contact for data subject enquiries and NPC communications. Contact details for the DPO are provided in Section 18 of this Policy.

2 Scope of This Privacy Policy

2.1 This Policy applies to all personal data processing activities conducted by taraph in connection with the Platform, including but not limited to: account registration and management; identity verification (KYC); payment processing and transaction monitoring; game play and activity logging; customer support interactions; marketing communications; and fraud prevention activities.

2.2 This Policy applies to all individuals who interact with the Platform regardless of whether they hold a registered Account, including visitors who browse the Platform without registering.

2.3 Where taraph engages third-party service providers who process personal data on taraph's behalf (Personal Information Processors, "PIPs"), taraph ensures appropriate contractual data processing agreements are in place binding those processors to obligations consistent with this Policy and the DPA.

3 Categories of Personal Data We Collect

3.1 taraph collects the following categories of personal data in connection with operating the Platform:

Identity and Contact Information

• Full legal name as it appears on a valid Philippine government-issued ID;
• Date of birth and age verification data;
• Residential address (city, municipality, province, ZIP code);
• Philippine mobile number (used for account authentication and SMS OTP);
• Email address (used for account notifications and support communications).

Identity Verification (KYC) Documents

• Images of valid government-issued Philippine photo identification (UMID, passport, driver's license, PhilSys National ID, PRC ID, or COMELEC voter ID);
• Selfie photographs submitted for identity matching purposes;
• Proof of address documentation where required (utility bills, bank statements, barangay certifications);
• Source-of-funds documentation where required under AMLA enhanced due diligence thresholds.

Financial and Transaction Data

• GCash registered mobile number and account reference (where GCash is used as a payment method);
• BPI, BDO, Metrobank, or other Philippine bank account numbers used for deposit or withdrawal;
• PayMaya/Maya account reference;
• Deposit amounts, dates, and transaction reference numbers;
• Withdrawal requests, amounts, processing status, and reference numbers;
• Full transaction history associated with your taraph Account.

Gaming Activity Data

• Game session logs including game titles played, bet amounts, outcomes, and session durations;
• Active bonus balances, wagering progress, and bonus redemption history;
• Responsible gaming tool usage including deposit limits set, session time limits applied, and self-exclusion requests.

Technical and Device Data

• IP address and approximate geographic location at the time of login;
• Device type, operating system version, and browser type;
• Session timestamps, authentication logs, and login activity history;
• Cookie identifiers and analytics data as described in Section 8.

4 How taraph Collects Your Personal Data

4.1 Directly from you: The majority of personal data taraph holds is provided directly by you during account registration, KYC verification, payment transactions, support interactions, and the completion of responsible gaming tool settings in your Account dashboard.

4.2 Automatically through the Platform: When you access the Platform, taraph's systems automatically record technical data including your IP address, device specifications, session timestamps, and browsing behaviour within the Platform (pages visited, games launched, session duration). This data is collected through server logs and first-party cookies as described in Section 8.

4.3 From payment service providers: When you initiate a deposit or withdrawal, taraph's payment processing partners (GCash, Maya, BPI, BDO, Metrobank, and InstaPay) transmit transaction confirmation data including payment reference numbers and transaction amounts to taraph for reconciliation and record-keeping purposes. taraph does not receive or store full bank account credentials or GCash PINs.

4.4 From identity verification services: Where taraph uses third-party KYC/identity verification processors to assist with document verification, those processors may return confidence scores and verification outcomes to taraph. All raw identity documents are retained by taraph in its own secure storage infrastructure.

5 Legal Basis for Processing

5.1 taraph relies on the following legal bases for processing personal data, as recognised under Section 13 of the DPA:

• Contractual necessity (Sec. 13(b)): Processing of identity, contact, financial, and gaming activity data is necessary for the performance of taraph's contract with you — specifically, to create and maintain your Account, process your transactions, deliver gaming services, and pay verified winnings.
• Legal obligation (Sec. 13(c)): KYC verification, transaction monitoring, and regulatory reporting are required by PAGCOR licensing conditions, Republic Act No. 9160 (AMLA), and related BSP and AMLC issuances.
• Legitimate interests (Sec. 13(f)): Technical and device data processing for fraud prevention, platform security, and abuse detection is conducted on the basis of taraph's legitimate interests in maintaining a safe and fair gaming environment for all Filipino players.
• Consent (Sec. 13(a)): Marketing communications and optional data processing activities beyond the above are conducted only with your express prior consent, which can be withdrawn at any time.

6 How taraph Uses Your Personal Data

6.1 taraph processes your personal data for the following purposes:

• Creating, verifying, and administering your taraph Account and all associated gaming and financial services;
• Conducting KYC identity verification and ongoing customer due diligence in compliance with PAGCOR licensing conditions and RA 9160;
• Processing deposits and withdrawals in PHP via GCash, PayMaya, Philippine bank transfers, and other approved payment channels;
• Detecting, investigating, and preventing fraud, money laundering, account takeover, and other prohibited activities;
• Providing customer support through taraph's 24/7 Filipino-English live chat and email support channels;
• Administering bonuses, promotional offers, and the taraph loyalty programme where applicable;
• Monitoring for problem gambling indicators and administering responsible gaming tools including deposit limits, session timers, and self-exclusion in compliance with PAGCOR's responsible gaming requirements;
• Preparing and submitting regulatory reports required by PAGCOR, the AMLC, the NPC, or any other competent Philippine authority;
• Improving Platform functionality, game performance, and user experience through aggregated analytical data;
• Sending transactional notifications including deposit confirmations, withdrawal status updates, and Account security alerts;
• Sending marketing and promotional communications to Players who have provided express consent.

7 Data Sharing and Disclosure

7.1 taraph does not sell, rent, or commercially transfer personal data to unaffiliated third parties. Personal data is shared only in the following circumstances and strictly on a need-to-know basis:

Payment Processing Partners

Transaction data is shared with GCash, Maya, BPI, BDO, Metrobank, InstaPay, and other approved payment service providers solely for the purpose of processing deposits and withdrawals. These providers are contractually bound to handle shared data in accordance with applicable BSP regulations and data privacy standards.

KYC and Identity Verification Providers

Where third-party identity verification processors are engaged to assist with document verification and liveness checks, taraph shares the minimum necessary data (identity document images and applicant details) with those processors under binding contractual data processing agreements.

Regulatory and Law Enforcement Authorities

taraph discloses personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Bureau of Investigation (NBI), the Philippine National Police (PNP), or other competent Philippine authorities where required by applicable law, court order, or regulatory direction. Such disclosures will be made to the minimum extent required to fulfil the legal obligation.

Professional Advisors

taraph may share personal data with legal counsel, auditors, and compliance advisors under strict confidentiality obligations where necessary for the conduct of legal proceedings, regulatory submissions, or financial audits.

Group Companies

Where taraph operates within a corporate group structure, personal data may be shared with affiliated entities within that group under binding intra-group data processing agreements, solely for the purposes described in this Policy and subject to equivalent data protection standards.

8 Cookies and Tracking Technologies

8.1 taraph uses first-party cookies and similar session technologies on the Platform for the following purposes:

• Strictly Necessary Cookies: Session authentication cookies that maintain your logged-in state, CSRF protection tokens, and load balancing cookies required for the Platform to function. These cannot be disabled without preventing access to the Platform.
• Functional Cookies: Cookies that remember your Platform preferences such as display language, game lobby view settings, and responsible gaming tool configurations.
• Analytics Cookies: First-party analytics data collected to understand aggregate platform usage patterns, identify technical performance issues, and improve the overall Filipino player experience. Analytics data is processed in aggregated, anonymised form.
• Security Cookies: Device fingerprinting and session integrity cookies used to detect and prevent account takeover, credential stuffing, and fraudulent login attempts.

8.2 taraph does not use third-party advertising cookies or cross-site tracking technologies on the Platform. You can manage cookie preferences through your browser settings, though disabling strictly necessary cookies will prevent normal Platform operation.

9 Data Security Measures

9.1 taraph implements a comprehensive set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure:

• Encryption in transit: All data transmitted between your device and the taraph Platform is encrypted using TLS 1.2 or higher. The Platform enforces HTTPS on all pages and sub-domains.
• Encryption at rest: Personal data stored in taraph's databases — including KYC document images, financial records, and Account credentials — is encrypted using AES-256 encryption.
• Password hashing: Account passwords are stored exclusively as one-way cryptographic hashes using a modern hashing algorithm with per-user salting. taraph never stores passwords in retrievable plain text.
• Access controls: Access to personal data by taraph staff is restricted by role-based access control (RBAC). Access to sensitive data categories such as KYC documents and financial records requires specific authorisation and is logged for audit purposes.
• Intrusion detection: taraph's infrastructure includes network-level and application-level intrusion detection and prevention systems. Anomalous access patterns trigger automated security responses and alert notifications to the security team.
• Regular security assessments: taraph conducts regular vulnerability assessments and periodic third-party penetration testing of Platform infrastructure and applications.

9.2 Notwithstanding the above measures, no data transmission or storage system is completely secure. taraph cannot guarantee absolute security against all possible threats. In the event of a security incident affecting your personal data, taraph will notify you and the NPC in accordance with the procedure described in Section 15 of this Policy.

10 Data Retention Periods

10.1 taraph retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to the following mandatory minimum retention periods required under Philippine law and PAGCOR regulations:

• Account and identity data: For the duration of the active Account relationship plus a minimum of five (5) years following Account closure, as required by PAGCOR licensing conditions.
• KYC documents: Minimum five (5) years from the date of Account closure or the date of the most recent KYC update, as required under RA 9160 and its implementing rules.
• Transaction records: Minimum five (5) years from the date of each transaction, as required by the AMLC under RA 9160.
• Gaming activity logs: Minimum three (3) years, or for the duration of any unresolved dispute relating to that gaming activity, whichever is longer.
• Support interaction records: Minimum two (2) years from the date of the interaction.
• Technical and device data: Minimum ninety (90) days for security and fraud investigation purposes; aggregated analytics data is retained indefinitely in anonymised form.

10.2 Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents reconstruction of the original personal data.

11 International Data Transfers

11.1 Where taraph engages service providers or technology partners whose infrastructure is located outside the Philippines (for example, cloud hosting providers or third-party analytics processors), personal data may be transferred to or processed in jurisdictions outside the Philippines.

11.2 Any such international transfer of personal data will only be made where taraph has confirmed that adequate protective measures are in place, including contractual data processing agreements requiring the recipient to maintain protection standards equivalent to those required under the DPA and NPC regulations. taraph will not transfer personal data to jurisdictions that do not provide adequate data protection standards without implementing appropriate safeguards.

12 Minors and Age Restriction

12.1 The taraph Platform is strictly restricted to persons who are at least 21 years of age. taraph does not knowingly collect personal data from individuals under 21 years of age. Where taraph discovers that personal data has been collected from a person under 21, taraph will immediately close the associated Account, forfeit any balance in accordance with the Terms & Conditions, delete the collected data to the extent permitted by applicable law and regulatory retention obligations, and report the incident to PAGCOR as required.

12.2 If you have reason to believe that a person under 21 years of age has submitted personal data to taraph, please contact taraph's Data Protection Officer immediately at the contact details set out in Section 18 of this Policy.

13 Exercising Your Data Subject Rights

13.1 Subject to the conditions and limitations prescribed by the DPA and applicable PAGCOR and AMLA regulations, you have the following rights in respect of your personal data held by taraph:

• Right to be informed: The right to receive clear information about what personal data taraph collects, on what basis, and for what purposes — provided through this Policy and at the point of collection.
• Right of access: The right to request a copy of the personal data taraph holds about you and information about how that data is being processed.
• Right to rectification: The right to have inaccurate or incomplete personal data corrected. Basic account information can be updated directly through your Account settings; corrections to KYC-verified data require supporting documentation.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the original collection purpose, subject to taraph's mandatory regulatory retention obligations under PAGCOR, AMLA, and other applicable Philippine laws.
• Right to object: The right to object to personal data processing conducted on the basis of legitimate interests or for direct marketing purposes.
• Right to data portability: The right to receive a copy of your personal data in a structured, commonly used, machine-readable format where technically feasible.
• Right to damages: The right to claim compensation for actual damages suffered as a direct result of taraph's non-compliance with the DPA.

13.2 To exercise any of the above rights, please submit a written request to taraph's Data Protection Officer through the Platform's official support channel. taraph will acknowledge your request within three (3) business days and complete the requested action or provide a substantive response within fifteen (15) business days of receiving a complete and valid request.

13.3 Where taraph is unable to fully comply with a request — for example, because fulfilling it would conflict with a mandatory regulatory retention obligation under RA 9160 — taraph will provide a written explanation of the specific legal basis for the refusal.

13.4 If you believe taraph has not adequately addressed your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

14 Marketing Communications

14.1 taraph will only send promotional and marketing communications — including bonus offers, new game announcements, Philippine Fiesta event promotions, and seasonal campaign updates — to Players who have expressly consented to receive such communications at registration or through their Account notification settings.

14.2 Marketing consent is collected separately from the acceptance of the Terms & Conditions and this Privacy Policy. Declining marketing consent will not affect your ability to access or use the Platform's gaming and payment services.

14.3 You may withdraw marketing consent at any time by updating your notification preferences in the Account settings section. Withdrawal of consent will take effect within five (5) business days. Withdrawal of marketing consent does not affect the lawfulness of processing conducted prior to withdrawal.

14.4 Transactional notifications — including deposit confirmations, withdrawal status updates, KYC verification notices, and Account security alerts — are sent to all registered Players regardless of marketing consent status, as these communications are necessary for the performance of taraph's contractual obligations and for regulatory compliance purposes.

15 Personal Data Breach Procedure

15.1 In the event of a personal data breach that taraph determines poses a real risk of serious harm to affected data subjects, taraph will:

1. Notify the National Privacy Commission within seventy-two (72) hours of the breach being discovered, in the format prescribed by NPC Circular No. 16-03 and subsequent NPC issuances;
2. Notify all affected data subjects as soon as practicable following NPC notification, providing clear information about the nature of the breach, the categories of data affected, the likely consequences, and the remedial measures taraph is taking or has taken;
3. Conduct a thorough investigation into the cause and extent of the breach and implement corrective and preventive measures to avoid recurrence;
4. Maintain a breach register documenting all known or suspected personal data breaches, their cause, their impact, and the response actions taken.

15.2 If you suspect that your taraph Account has been compromised, or that your personal data has been accessed by an unauthorised party, please contact taraph support immediately through the Platform's live chat channel so that appropriate containment and remediation steps can be initiated without delay.

16 Third-Party Links and Services

16.1 The Platform may contain references to or integrations with third-party service providers (such as payment processors) whose own privacy practices govern the personal data they collect independently. taraph is not responsible for the privacy practices of those third parties. When you interact directly with a third-party service — for example, completing a GCash authorisation within the GCash app — that interaction is governed by GCash's own privacy policy.

16.2 taraph does not embed third-party social media widgets, advertising networks, or cross-site tracking tools on the Platform. The Platform does not link to external websites beyond the payment provider flows necessary to complete transactions.

17 Changes to This Privacy Policy

17.1 taraph may amend this Privacy Policy from time to time to reflect changes in data processing practices, regulatory requirements, or Platform functionality. The updated Policy will be published on the Platform with a revised effective date prominently displayed at the top of the document.

17.2 Where changes are material — meaning they significantly affect your rights or the way taraph processes your personal data — taraph will notify active Account holders through the Platform's notification system or by email to the registered Account address at least fourteen (14) days before the changes take effect.

17.3 Continued use of the Platform following the effective date of any amended Privacy Policy constitutes your acknowledgment of and agreement to the amended Policy. If you do not agree to material changes, you should cease using the Platform and request Account closure prior to the effective date of the changes.

18 Contact Information and Data Protection Officer

18.1 For all privacy-related enquiries, data subject rights requests, concerns about taraph's personal data processing practices, or to report a suspected data breach or privacy incident, please contact taraph's designated Data Protection Officer through the following channel:

18.2 If you are not satisfied with taraph's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines, which acts as the supervisory authority for data privacy matters in the Philippines under the DPA.

18.3 This Privacy Policy was last reviewed and updated on 1 January 2026. The version published on the Platform at any given time is the current operative version.