romaph Privacy Policy

romaph ("romaph," "we," "us," or "our") is committed to protecting the privacy and personal data of all individuals who access or use the romaph online gaming platform at romaph.app (the "Platform"). This Privacy Policy describes how romaph collects, uses, stores, shares, and protects personal information in connection with your use of the Platform and any related services.

This Privacy Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). By registering an account on romaph or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

This Privacy Policy should be read alongside romaph's Terms & Conditions and Responsible Gaming Policy, which together govern your relationship with romaph.

For the purposes of the Data Privacy Act of 2012 and its Implementing Rules and Regulations, romaph is the personal information controller in respect of the personal data collected through the Platform. romaph determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out in accordance with applicable Philippine data protection law.

romaph has designated a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Privacy Policy and applicable data protection legislation. You may contact the DPO using the contact details provided in Section 14 of this Policy.

romaph collects personal data from you in the following categories:

romaph does not intentionally collect sensitive personal information beyond what is strictly necessary for identity verification and regulatory compliance. Where sensitive personal information is collected (such as government ID numbers), it is processed under the lawful bases described in Section 5 and is subject to enhanced security measures.

romaph uses the personal data we collect for the following purposes:

• Account management: To create, maintain, and administer your romaph player account, including processing your registration, verifying your identity, and managing your account settings.
• Transaction processing: To process deposits and withdrawals in Philippine Peso (PHP) via GCash, PayMaya, and Philippine bank transfers, and to maintain accurate financial records of all transactions.
• Regulatory compliance: To comply with our obligations under Philippine law, including the Anti-Money Laundering Act (AMLA), its implementing rules, and any requirements imposed by relevant gaming regulatory authorities. This includes conducting Know Your Customer (KYC) checks and filing Suspicious Transaction Reports (STRs) where required.
• Responsible gaming: To monitor gaming activity for signs of problem gambling, to enforce self-exclusion requests, and to apply deposit and loss limits set by you or required by applicable regulations.
• Platform improvement: To analyze usage patterns, troubleshoot technical issues, and improve the features, performance, and security of the romaph Platform.
• Customer support: To respond to your queries, complaints, and requests, and to maintain records of our communications with you.
• Marketing communications: To send you promotional offers, bonuses, and updates about romaph, where you have provided consent to receive such communications. You may opt out at any time.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, cheating, money laundering, and other prohibited conduct on the Platform.

Under the Data Privacy Act of 2012, romaph processes your personal data on the following legal bases:

• Contractual necessity: Processing is necessary to perform the contract between you and romaph – specifically, to operate your player account, process transactions, and deliver the gaming services you have requested.
• Legal obligation: Processing is required to comply with romaph's obligations under Philippine law, including anti-money laundering regulations, gaming regulations, and tax reporting requirements.
• Legitimate interests: Processing is necessary for romaph's legitimate interests in preventing fraud, ensuring platform security, improving our services, and managing our business operations, provided those interests are not overridden by your rights and interests.
• Consent: For certain processing activities, such as sending you marketing communications or using non-essential cookies, romaph relies on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

romaph may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment processors: GCash, PayMaya, and Philippine banking partners (BPI, BDO, Metrobank) receive the financial data necessary to process your deposits and withdrawals.
• Identity verification providers: Third-party KYC and AML service providers who assist romaph in verifying your identity and screening against sanctions and watchlists.
• Game content providers: Licensed third-party game studios and live casino operators who supply game content to the romaph Platform. These providers may receive limited technical data necessary to deliver their games.
• Regulatory and law enforcement authorities: The Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Philippine National Police (PNP), and other competent Philippine authorities, where disclosure is required by law or court order.
• IT and infrastructure providers: Cloud hosting, data storage, and cybersecurity service providers who process data on romaph's behalf under strict data processing agreements.
• Professional advisers: Lawyers, auditors, and accountants who require access to data in the course of providing professional services to romaph, subject to professional confidentiality obligations.

Where romaph engages third-party processors, we require them to process personal data only on our documented instructions and to implement appropriate technical and organizational security measures. romaph remains responsible for ensuring that such processing complies with the Data Privacy Act of 2012.

romaph uses cookies, web beacons, pixel tags, and similar tracking technologies to enhance your experience on the Platform, maintain your session, and gather analytics data. The types of cookies we use are described below:

You can manage or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair your ability to use the romaph Platform, including logging in and processing transactions. For more information on managing cookies, refer to your browser's help documentation.

romaph retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with AMLA record-keeping requirements.
• Transaction and financial data: Retained for a minimum of five (5) years from the date of the transaction, as required under Philippine anti-money laundering regulations.
• Gaming activity data: Retained for a minimum of three (3) years from the date of the relevant gaming session.
• Customer support communications: Retained for two (2) years from the date of the last communication, unless a longer period is required for dispute resolution purposes.
• Marketing consent records: Retained for the duration of your consent and for one (1) year following withdrawal of consent, as evidence of the consent given.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with romaph's data disposal procedures. Where data is anonymized, it may be retained indefinitely for statistical and analytical purposes, as it no longer constitutes personal data.

romaph implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Transport Layer Security (TLS/SSL) encryption for all data transmitted between your device and the romaph Platform;
• AES-256 encryption for sensitive personal and financial data stored on romaph's servers;
• Multi-factor authentication (MFA) options for player accounts;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• Intrusion detection and prevention systems monitoring the Platform for suspicious activity;
• Documented incident response procedures for managing and reporting personal data breaches in accordance with NPC requirements.

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights in relation to your personal data held by romaph:

• Right to be informed: You have the right to be informed of how your personal data is being collected and processed, which this Privacy Policy fulfils.
• Right of access: You have the right to request a copy of the personal data romaph holds about you, along with information about how it is being processed.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You may update certain information directly through your account settings.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to romaph's legal retention obligations.
• Right to object: You have the right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe that romaph has processed your personal data in violation of the Data Privacy Act of 2012.

To exercise any of the above rights, please contact romaph's Data Protection Officer using the contact details in Section 14. romaph will respond to all verified data rights requests within fifteen (15) business days of receipt, in accordance with NPC guidelines. We may need to verify your identity before processing your request.

The romaph Platform is strictly intended for individuals who are 21 years of age or older, in accordance with Philippine gaming regulations. romaph does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the registration process, and romaph reserves the right to request additional proof of age at any time.

If romaph becomes aware that personal data has been collected from an individual under the age of 21 without appropriate parental or guardian consent, we will take immediate steps to delete that data and close the associated account. If you believe that a minor has registered on romaph, please contact us immediately using the details in Section 14.

The romaph Platform may contain references to third-party services, such as payment processors and game content providers. romaph is not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of romaph.

romaph's Privacy Policy applies solely to data collected and processed by romaph through the Platform. It does not apply to data collected by third-party payment processors, game providers, or any other external services, even where those services are accessed through or in connection with the romaph Platform.

romaph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The date of the most recent revision is indicated at the top of this page.

Where changes are material, romaph will notify registered players via email or a prominent notice on the Platform prior to the changes taking effect. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgment of the revised Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how romaph is protecting your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or romaph's handling of your personal data, please contact our Data Protection Officer. We are committed to addressing all privacy-related inquiries promptly and transparently.