merryph Privacy Policy

1. Overview

This Privacy Policy ("Policy") applies to all personal data collected, processed, and stored by merryph ("merryph," "we," "us," or "our") in connection with your use of the merryph online gaming platform accessible at merryph.one (the "Platform"). It covers data collected through the Platform, our customer support channels, and any other interactions you have with merryph.

By registering an account with merryph or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you should not use the Platform.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, which together govern your use of the merryph Platform.

2. Data Controller

merryph is the data controller responsible for your personal data collected through the Platform. As data controller, merryph determines the purposes and means of processing your personal data and is accountable for ensuring that such processing complies with applicable data protection laws, including the Philippine Data Privacy Act of 2012 (RA 10173).

merryph has designated a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data protection legislation. You may contact the DPO at any time using the contact details provided in Section 15 of this Policy.

3. Personal Data We Collect

merryph collects the following categories of personal data:

merryph does not collect sensitive personal information (as defined under RA 10173) unless strictly necessary for regulatory compliance, such as government-issued ID details required for KYC verification. We do not collect information about your race, religion, health, or political affiliations.

4. How We Collect Your Data

merryph collects personal data through the following means:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated technologies: Data collected automatically when you use the Platform, including cookies, web beacons, log files, and similar tracking technologies that record your device information, IP address, and browsing behavior on the Platform.
• Third-party sources: Data received from payment processors (e.g., GCash, PayMaya, banks) to verify transactions; identity verification service providers for KYC purposes; and fraud prevention and anti-money laundering screening services.
• Regulatory sources: Data received from PAGCOR or other regulatory authorities in connection with licensing, compliance, or investigation requirements.

5. How We Use Your Personal Data

merryph uses your personal data for the following purposes:

• Account management: To register and maintain your merryph player account, verify your identity and age (21+), and manage your account settings and preferences.
• Service delivery: To provide access to games, process deposits and withdrawals, credit bonuses, and deliver all features of the merryph Platform.
• Legal and regulatory compliance: To comply with our obligations under Philippine law, including PAGCOR licensing requirements, the Anti-Money Laundering Act (AMLA), and the Data Privacy Act of 2012. This includes conducting KYC checks, filing suspicious transaction reports, and responding to lawful requests from authorities.
• Responsible gaming: To monitor gaming activity for signs of problem gambling, enforce self-exclusion requests, apply account limits, and fulfill our responsible gaming obligations.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent transactions, unauthorized account access, and other illegal or prohibited activities on the Platform.
• Customer support: To respond to your inquiries, resolve disputes, and improve the quality of our support services.
• Marketing communications: To send you promotional offers, bonuses, and updates about merryph — but only where you have given your consent or where we have a legitimate interest in doing so. You may opt out at any time.
• Platform improvement: To analyze usage patterns, conduct research, and improve the functionality, performance, and user experience of the merryph Platform.

6. Legal Basis for Processing

merryph processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Consent: Where you have given clear, informed consent to the processing of your data for a specific purpose, such as receiving marketing communications.
• Contractual necessity: Where processing is necessary to perform our contract with you — i.e., to provide the merryph gaming services you have registered for.
• Legal obligation: Where processing is required to comply with a legal or regulatory obligation, including PAGCOR licensing conditions, AMLA reporting requirements, and court orders.
• Legitimate interests: Where processing is necessary for our legitimate business interests, such as fraud prevention, platform security, and improving our services, provided these interests are not overridden by your rights and interests.

7. Sharing Your Personal Data

merryph does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment processors: GCash, PayMaya, and Philippine banks, to process your deposits and withdrawals.
• Identity verification providers: Third-party KYC and AML screening services used to verify your identity and comply with regulatory requirements.
• Game software providers: Third-party game developers whose games are hosted on the merryph Platform, to the extent necessary to deliver gameplay.
• IT and infrastructure providers: Cloud hosting, data storage, and cybersecurity service providers who process data on our behalf under strict data processing agreements.
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), law enforcement agencies, and courts, where required by law or regulatory directive.
• Professional advisers: Lawyers, auditors, and accountants, where necessary for legal, compliance, or financial purposes, subject to professional confidentiality obligations.

All third parties with whom merryph shares personal data are required to process such data in accordance with applicable data protection laws and merryph's data protection standards.

8. Data Retention

merryph retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

• Account data: Retained for the duration of your account and for a minimum of five (5) years after account closure, in compliance with PAGCOR licensing requirements and AMLA obligations.
• Transaction and gaming records: Retained for a minimum of five (5) years from the date of the transaction, as required by AMLA and PAGCOR regulations.
• KYC documents: Retained for a minimum of five (5) years after the end of the business relationship, or longer if required by law.
• Marketing data: Retained until you withdraw your consent or opt out of marketing communications, after which it will be deleted or anonymized within thirty (30) days.
• Support communications: Retained for three (3) years from the date of the last interaction, unless a longer retention period is required for dispute resolution or legal proceedings.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized so that it can no longer be associated with you.

9. Data Security

merryph implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption: All data transmitted between your device and the merryph Platform is encrypted using 256-bit SSL/TLS technology. Sensitive data stored in our systems is encrypted at rest.
• Access controls: Access to personal data is restricted to authorized merryph personnel and service providers who require it to perform their duties, on a strict need-to-know basis.
• Two-factor authentication: merryph supports two-factor authentication (2FA) for player accounts to provide an additional layer of security.
• Regular security audits: Our systems and infrastructure are subject to regular security assessments, penetration testing, and vulnerability scans conducted by qualified security professionals.
• Incident response: merryph maintains a data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the National Privacy Commission (NPC) and affected individuals in accordance with the requirements of RA 10173 and its IRR.

While merryph takes all reasonable steps to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. You are also responsible for keeping your account credentials confidential and for notifying us immediately if you suspect any unauthorized access to your account.

10. Your Data Privacy Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by merryph:

• Right to be informed: You have the right to be informed of how your personal data is being collected and processed, including the purposes of processing, the scope and method of processing, and the recipients of your data.
• Right of access: You have the right to request a copy of the personal data merryph holds about you, along with information about how it is being processed.
• Right to rectification: You have the right to request correction of any inaccurate, incomplete, or outdated personal data we hold about you.
• Right to erasure or blocking: You have the right to request the deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn your consent and there is no other legal basis for processing.
• Right to object: You have the right to object to the processing of your personal data, including processing for direct marketing purposes. Where you object to marketing, we will cease processing your data for that purpose immediately.
• Right to data portability: You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to request that it be transmitted to another data controller where technically feasible.
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe that merryph has violated your data privacy rights.

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 15. We will respond to all verified requests within thirty (30) days. In complex cases, we may extend this period by a further thirty (30) days, in which case we will notify you of the extension and the reason for it.

11. Cookies & Tracking Technologies

merryph uses cookies and similar tracking technologies to enhance your experience on the Platform, analyze usage patterns, and support security and fraud prevention measures. A cookie is a small text file placed on your device when you visit the Platform.

merryph uses the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function correctly. These include session cookies that keep you logged in and security cookies that help protect your account. These cannot be disabled.
• Functional cookies: Remember your preferences and settings, such as your preferred language and display options, to provide a more personalized experience.
• Analytics cookies: Collect anonymized information about how visitors use the Platform, such as which pages are visited most frequently and how users navigate between pages. This data helps us improve the Platform.
• Security and fraud prevention cookies: Help us detect and prevent fraudulent activity, unauthorized access, and other security threats on the Platform.

You can control and manage cookies through your browser settings. Most browsers allow you to refuse or delete cookies. However, disabling strictly necessary cookies may affect the functionality of the Platform and your ability to log in or use certain features. For more information on managing cookies, refer to your browser's help documentation.

12. Minors & Age Restriction

merryph employs age verification procedures during the registration process and may request additional proof of age at any time. If you are a parent or guardian and believe that a minor has registered an account with merryph, please contact us immediately at the details provided in Section 15 so that we can take appropriate action.

merryph supports the use of parental control tools and third-party software that can restrict access to online gaming platforms. We encourage parents and guardians to make use of such tools to prevent underage access to gambling content.

13. International Data Transfers

merryph primarily processes and stores your personal data within the Republic of the Philippines. However, some of our third-party service providers — including cloud infrastructure providers and game software developers — may be located in other countries, which means your personal data may be transferred to and processed in jurisdictions outside the Philippines.

Where such transfers occur, merryph ensures that appropriate safeguards are in place to protect your personal data, including contractual clauses that require the recipient to process your data in accordance with standards equivalent to those required under Philippine law. merryph will not transfer your personal data to a country that does not provide an adequate level of data protection without first implementing appropriate safeguards.

14. Changes to This Privacy Policy

merryph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or regulatory obligations. When material changes are made, we will notify registered players via email or a prominent notice on the Platform at least seven (7) days before the changes take effect.

The "Last Updated" date at the top of this Policy indicates when it was most recently revised. We encourage you to review this Policy periodically to stay informed about how merryph protects your personal data. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the changes.

If you have any concerns about changes to this Policy, you may contact our Data Protection Officer or request account closure in accordance with the Terms & Conditions.

15. Contact Us & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the way merryph handles your personal data, please contact our Data Protection Officer:

You also have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated. The NPC is the government body responsible for administering and implementing the Data Privacy Act of 2012.