meryph Privacy Policy

1Who We Are

meryph is an online gaming platform accessible at meryph.club, operated for and serving Filipino players across the Philippines. meryph acts as the Personal Information Controller (as defined under Republic Act No. 10173, the Data Privacy Act of 2012) in respect of the personal data it collects from users of the Platform.

This means meryph determines the purposes for which your personal data is collected and the manner in which it is processed. Where meryph engages third-party service providers to process data on its behalf — such as payment processors or KYC verification services — those parties act as Personal Information Processors and are subject to meryph's data processing instructions and confidentiality obligations.

2Scope of This Privacy Policy

This Privacy Policy applies to all personal data collected by meryph through:

• The meryph website and all associated web pages at meryph.club.
• The account registration and verification process.
• Deposits, withdrawals, and all financial transactions conducted on the Platform.
• All games, betting markets, and interactive features accessible after login.
• Communications with the meryph support team via live chat, email, or any other channel.
• Marketing communications sent by meryph where you have provided consent.

This Policy should be read alongside the meryph Terms and Conditions and any game-specific or promotion-specific terms published on the Platform.

3Personal Data We Collect

meryph collects only the personal data that is necessary for the purposes described in Section 5. The categories of data collected are set out in the table below:

meryph does not collect sensitive personal information (as defined in Section 3(l) of RA 10173) — such as race, health, or political affiliations — except where strictly required to verify age or comply with regulatory obligations.

4How We Collect Your Data

meryph collects personal data through the following channels:

• Direct collection: Information you provide when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting support, or filling in any form on the Platform.
• Automated collection: Technical and usage data collected automatically by meryph's servers when you access the Platform, including through cookies and similar tracking technologies. See Section 9.
• Third-party sources: meryph may receive identity verification data from regulated KYC service providers and fraud-screening partners, and financial transaction data from payment processors such as GCash, PayMaya, BDO, BPI, and Metrobank.
• Anti-money laundering screening: meryph may receive or verify data against government watchlists, sanction lists, and politically exposed persons (PEP) databases as required under the Anti-Money Laundering Act (Republic Act No. 9160, as amended).

5How We Use Your Personal Data

meryph uses the personal data it collects for the following purposes:

• Account creation and management: To register, maintain, and administer your meryph Account, including password resets, OTP delivery, and security alerts.
• Identity and age verification (KYC): To confirm your identity and verify that you meet the minimum age requirement of 21 years as required under Philippine regulations.
• Payment processing: To process deposits from and withdrawals to your GCash, PayMaya, or Philippine bank account, and to maintain transaction records as required by law.
• Platform provision: To make available the meryph games, live casino, bingo, and sports betting services to which you have access.
• Fraud prevention and security: To detect, investigate, and prevent unauthorised account access, fraudulent transactions, money laundering, and other prohibited activities.
• Legal and regulatory compliance: To fulfil meryph's obligations under Philippine law, including the Anti-Money Laundering Act, the Data Privacy Act, and applicable gaming regulations.
• Responsible gaming: To monitor gaming patterns and, where appropriate, contact players who may exhibit signs of problem gambling, and to enforce self-exclusion and deposit limit settings.
• Customer support: To respond to inquiries, complaints, and disputes raised through meryph's support channels.
• Service improvement: To analyse usage data and improve the meryph Platform, fix technical issues, and develop new features.
• Marketing communications: To send you promotional offers, bonus notifications, and news about meryph, where you have provided consent or where this is permitted under applicable Philippine law.

6Legal Bases for Processing

Under the Data Privacy Act of 2012, meryph processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract represented by the meryph Terms and Conditions — including Account management, payment processing, and Platform provision.
• Legal obligation: Processing required to comply with Philippine laws, including KYC and AML obligations under the Anti-Money Laundering Act and AMLA regulations.
• Legitimate interests: Processing for fraud prevention, platform security, and service improvement, where meryph's legitimate interests are not overridden by your data protection rights.
• Consent: Processing for marketing communications and optional analytics features, where you have provided explicit, freely given consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7Sharing Your Personal Data

meryph does not sell or commercially trade your personal data. meryph may share your data with the following categories of recipient, strictly to the extent necessary for the described purpose:

• Payment processors: GCash, PayMaya, and Philippine banks (BDO, BPI, Metrobank) receive transaction data necessary to process deposits and withdrawals. These entities operate under their own privacy policies and applicable BSP regulations.
• KYC and identity verification providers: Regulated third-party services that assist meryph in verifying player identity and age as required by Philippine gaming regulations. These providers are bound by data processing agreements with meryph.
• Fraud and AML screening services: Providers that screen transactions and player data against regulatory watchlists and sanctions databases as required under the Anti-Money Laundering Act.
• IT infrastructure and hosting providers: Cloud and server providers that host the meryph Platform. These providers process data on meryph's instructions and are subject to confidentiality obligations.
• Regulatory and law enforcement authorities: The Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies where meryph is legally required to disclose data.
• Legal advisers: Philippine legal counsel engaged to advise meryph in connection with legal disputes or regulatory matters, subject to professional confidentiality obligations.

8Payment Data

meryph processes all financial transactions through regulated payment channels including GCash, PayMaya, BDO, BPI, and Metrobank. meryph does not store full payment card numbers, GCash PINs, PayMaya passwords, or internet banking credentials. Only transaction reference IDs, transaction amounts in Philippine Peso, timestamps, and the name of the payment channel are retained by meryph for record-keeping and compliance purposes.

All payment data transmitted between your device and meryph's payment partners is encrypted using industry-standard TLS protocols. Withdrawal requests are processed only to payment methods registered in the same name as the verified meryph Account holder, which serves both as a fraud prevention measure and as a requirement under meryph's AML obligations.

9Cookies & Tracking Technologies

meryph uses cookies and similar tracking technologies (such as web beacons and session identifiers) when you access the Platform. Cookies are small data files stored on your browser or device that help meryph provide a functional, personalised, and secure Platform experience.

meryph uses the following categories of cookies:

• Strictly necessary cookies: Required for core Platform functionality including login session management, security tokens, and payment session integrity. These cannot be disabled without impairing Platform use.
• Functional cookies: Enable personalisation features such as remembering your language preference, game history display, and recently viewed sections. These may be disabled but doing so will reduce Platform convenience.
• Analytics cookies: Used by meryph to collect aggregated, anonymised data on how players navigate the Platform, which pages are most visited, and where technical errors occur. This data is used only for Platform improvement.
• Marketing cookies: Used with your consent to personalise promotional content shown to you on the meryph Platform. These are not used to serve advertising on third-party websites.

You may manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. Please note that blocking strictly necessary cookies will prevent you from logging in to your meryph Account. meryph's cookie preferences can also be updated from within your Account settings.

10Data Retention

meryph retains personal data for as long as is necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by Philippine law. The following retention guidelines apply:

Upon expiry of the applicable retention period, meryph will securely delete or anonymise your personal data in accordance with the National Privacy Commission's guidelines on data disposal.

11Your Rights as a Data Subject

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights in respect of your personal data held by meryph. These rights may be exercised by contacting the meryph Data Protection Officer as described in Section 16.

meryph will respond to all data subject requests within 15 calendar days of receipt. Where a request is complex or involves a large volume of data, meryph may extend this period by a further 15 days, with prior written notice to you. meryph will not charge a fee for reasonable data subject requests.

12Data Security Measures

meryph implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the meryph Platform.
• Encryption at rest for all personal data stored on meryph servers, including KYC documents and account details.
• Access controls: meryph employees and contractors are granted access to personal data only on a strict need-to-know basis, subject to confidentiality obligations.
• Two-factor authentication (2FA) available to all players via Philippine mobile OTP, strongly recommended for all meryph Accounts.
• Brute-force protection: Automated lockout of Accounts following repeated failed login attempts, with email notifications to the Account holder.
• Regular security assessments: meryph conducts periodic vulnerability assessments and penetration tests of its Platform infrastructure.
• Incident response procedures: meryph maintains documented procedures for responding to personal data breaches, including notification to the National Privacy Commission within 72 hours of discovering a qualifying breach, and notification to affected individuals as required by the NPC's breach notification rules.

Despite these measures, no online platform can guarantee absolute security. Players are encouraged to use strong, unique passwords for their meryph Account and to enable 2FA. Players who suspect their Account has been compromised should contact meryph support immediately.

13Children and Minors

The meryph Platform is strictly for individuals aged 21 years and above. meryph does not knowingly collect, process, or retain personal data relating to persons under the age of 21. Age verification is a mandatory step in the meryph Account registration and KYC process.

If meryph discovers that personal data has been collected from a person under the age of 21, it will immediately suspend the associated Account and delete the collected data as promptly as permitted by applicable law. If you are a parent or guardian and believe that a minor has created a meryph Account, please contact the meryph Data Protection Officer at [email protected] immediately.

14Cross-Border Data Transfers

meryph's primary data processing infrastructure is operated within the Philippines. In some circumstances, meryph may engage third-party service providers — such as cloud infrastructure providers or KYC verification services — whose servers are located outside the Philippines.

Where personal data is transferred outside the Philippines, meryph ensures that such transfers are conducted only to countries or organisations that provide an adequate level of data protection, or subject to appropriate safeguards such as data processing agreements incorporating the National Privacy Commission's standard contractual clauses. meryph does not transfer personal data to countries that lack adequate data protection frameworks without implementing such safeguards.

15Amendments to This Privacy Policy

meryph may update this Privacy Policy from time to time to reflect changes in the Platform, applicable Philippine law, or meryph's data processing practices. Material changes — meaning changes that significantly affect your rights or the way meryph processes your data — will be communicated to registered players via email to the address on their Account at least seven (7) calendar days before taking effect.

Non-material clarifications and corrections may be made without prior notice. The effective date at the top of this document will reflect the date of the most recent revision. Your continued use of the meryph Platform after the effective date of any amendment constitutes your acknowledgement of the updated Policy.

16Contact Us & Data Protection Officer

meryph has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and the Data Privacy Act of 2012. To exercise your data subject rights, ask a question about this Policy, or report a data privacy concern, please contact the meryph DPO through any of the following channels:

• Live Chat: Available 24/7 on the meryph Platform. This is the fastest channel for urgent privacy concerns.
• Email: [email protected] — mark your email with subject line "Data Privacy Request" for priority routing to the DPO.
• Support Page: Visit meryph Support for additional contact options and self-service resources.

If you are not satisfied with meryph's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. The NPC is the regulatory authority responsible for enforcing the Data Privacy Act of 2012 and can be reached through the NPC's official government channels.