diorph Privacy Policy

1. Who We Are

This Privacy Policy is issued by diorph ("diorph," "we," "us," or "our"), the operator of the online gaming platform accessible at diorph.one (the "Platform"). diorph is the data controller responsible for the personal information collected through the Platform.

diorph is committed to protecting the privacy and personal data of all players and visitors. This Privacy Policy has been prepared in alignment with the Republic of the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC).

By registering an account or using the diorph Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree, please discontinue use of the Platform.

2. Personal Data We Collect

diorph collects personal data that is necessary to provide you with a safe, compliant, and enjoyable gaming experience. The categories of data we collect include:

2.1 Registration & Identity Data

• Full legal name
• Date of birth (to verify the 21+ age requirement)
• Email address and mobile number
• Username and encrypted password
• Residential address (province, city/municipality, barangay)

2.2 Identity Verification (KYC) Data

• Government-issued photo ID (e.g., SSS ID, PhilHealth ID, driver's license, passport, UMID, Voter's ID)
• Proof of address documents
• Proof of payment method ownership (e.g., GCash or PayMaya account screenshot)
• Selfie or liveness check image where required

2.3 Financial & Transaction Data

• Deposit and withdrawal amounts and timestamps
• Payment method details (GCash number, PayMaya number, bank account name — not full account numbers)
• Transaction reference numbers
• Account balance history

2.4 Gaming Activity Data

• Games played, bet amounts, win/loss records, and session durations
• Bonus and promotion usage history
• Responsible gaming tool settings (deposit limits, self-exclusion status)

2.5 Technical & Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser
• Session logs and access timestamps
• Cookie identifiers and analytics data (see Section 6)

2.6 Communications Data

• Support chat transcripts and email correspondence
• Survey responses and feedback submissions
• Marketing preference settings

3. How diorph Uses Your Personal Data

diorph processes your personal data for the following purposes:

diorph does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review, except where required by law or expressly consented to by you.

4. Legal Basis for Processing

diorph processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to fulfil our obligations to you under the diorph Terms & Conditions, including account management, payment processing, and game provision.
• Legal obligation: Processing required to comply with applicable Philippine laws, including anti-money laundering (AML) regulations, PAGCOR licensing requirements, and tax obligations.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where such interests are not overridden by your rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have provided explicit, informed consent. You may withdraw consent at any time.

5. Data Sharing & Disclosure

diorph does not sell your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection agreements:

• Payment processors: GCash, PayMaya, and banking partners, for the purpose of processing deposits and withdrawals.
• Game providers: Licensed game software providers whose games are available on the diorph Platform, for the purpose of game delivery and fairness auditing.
• KYC and identity verification providers: Third-party services that assist with document verification and fraud detection.
• IT and hosting providers: Cloud infrastructure and security service providers that support the operation of the diorph Platform.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities, where required by law or court order.
• Professional advisers: Legal, accounting, and auditing firms, subject to professional confidentiality obligations.

All third-party service providers engaged by diorph are contractually required to process your data only for the specified purpose and to maintain appropriate security standards.

6. Cookies & Tracking Technologies

diorph uses cookies and similar tracking technologies to operate and improve the Platform. The types of cookies we use include:

• Strictly necessary cookies: Essential for the Platform to function, including session management and security tokens. These cannot be disabled.
• Functional cookies: Remember your preferences such as language settings and responsible gaming tool configurations.
• Analytics cookies: Collect aggregated, anonymised data about how players use the Platform, helping us identify areas for improvement. Used only with your consent.
• Marketing cookies: Used to deliver relevant promotional content within the diorph Platform. Used only with your consent.

You can manage your cookie preferences through your browser settings. Disabling non-essential cookies will not affect your ability to use the core diorph Platform, though some features may be limited.

7. Data Retention

diorph retains your personal data for as long as necessary to fulfil the purposes described in this Privacy Policy, subject to the following retention periods:

• Account and KYC data: Retained for a minimum of five (5) years following account closure, in compliance with AML regulations and PAGCOR requirements.
• Transaction and financial data: Retained for a minimum of five (5) years from the date of each transaction.
• Gaming activity data: Retained for three (3) years from the date of activity, or longer where required for responsible gaming monitoring or dispute resolution.
• Support communications: Retained for two (2) years from the date of the last interaction.
• Marketing data: Retained until you withdraw consent or request deletion, subject to legal minimum retention requirements.

Upon expiry of the applicable retention period, diorph will securely delete or anonymise your personal data in accordance with its data disposal procedures.

8. Data Security

diorph implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the diorph Platform
• Encryption of sensitive data at rest, including KYC documents and financial records
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis
• Multi-factor authentication for administrative access to diorph systems
• Regular security audits, penetration testing, and vulnerability assessments
• Incident response procedures for detecting, reporting, and managing personal data breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, diorph will notify the National Privacy Commission and affected players in accordance with the requirements of the Data Privacy Act of 2012.

9. Your Privacy Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by diorph:

• Right to be informed: The right to know what personal data diorph collects and how it is used — as set out in this Privacy Policy.
• Right of access: The right to request a copy of the personal data diorph holds about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure: The right to request deletion of your personal data, subject to legal retention obligations.
• Right to object: The right to object to the processing of your personal data for direct marketing or where processing is based on legitimate interests.
• Right to data portability: The right to receive your personal data in a structured, commonly used format.
• Right to withdraw consent: Where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe your data rights have been violated.

To exercise any of these rights, please contact the diorph Data Protection Officer at [email protected]. diorph will respond to verified requests within thirty (30) days.

10. Children's Privacy

The diorph Platform is strictly intended for individuals aged 21 years and above. diorph does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the diorph registration and KYC process, and accounts found to belong to underage individuals will be immediately suspended and all associated data deleted.

If you are a parent or guardian and believe that a minor has registered on the diorph Platform or provided personal data without your consent, please contact us immediately at [email protected] so that we may take prompt corrective action.

11. Changes to This Privacy Policy

diorph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. When material changes are made, diorph will notify registered players via email or a prominent notice on the Platform at least seven (7) days before the changes take effect.

The "Last Updated" date at the top of this page will always reflect the most recent revision. We encourage you to review this Privacy Policy periodically. Your continued use of the diorph Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy.

12. Contact Us & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data by diorph, please contact our Data Protection Officer:

• Email: [email protected]
• Subject Line: Privacy Request – [Your Registered Name]
• Response Time: diorph aims to acknowledge all privacy-related requests within 72 hours and resolve them within 30 days.

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines (NPC) if you believe your data privacy rights have been violated. Information on how to file a complaint is available through the NPC's official channels.