romaph is committed to protecting the personal information of every player on our platform. This Privacy Policy explains what data we collect, why we collect it, how it is used, who it is shared with, and your rights under Philippine law — particularly Republic Act No. 10173, the Data Privacy Act of 2012.
Six core commitments that guide how romaph handles the personal information you entrust to us.
romaph collects only the personal data that is genuinely necessary for account operation, KYC compliance, payment processing, and regulatory obligations. We do not collect data speculatively or for undefined future use.
We tell you exactly what data we hold about you, why we hold it, how long we keep it, and who we share it with. This Privacy Policy is written in plain language — no buried clauses or deliberately confusing legal language.
All personal and financial data stored by romaph is protected using industry-standard encryption at rest and in transit. Access to personal data is restricted to authorised personnel on a strict need-to-know basis.
You have the right to access, correct, and in certain circumstances request deletion of your personal data. romaph provides clear channels through which you can exercise these rights at any time.
romaph does not sell, rent, or trade your personal information to third-party marketers. Data sharing with third parties is limited to what is required for platform operation, legal compliance, and regulated payment processing.
romaph operates in full compliance with Republic Act No. 10173, the Data Privacy Act of 2012, and the implementing rules and regulations issued by the National Privacy Commission of the Philippines.
This Privacy Policy applies to all personal information collected, processed, stored, and disclosed by romaph ("romaph," "we," "us," "the Platform") in connection with your use of the romaph online gaming platform, accessible at romaph.org and all associated subdomains and mobile interfaces.
romaph is the personal information controller ("PIC") for all data collected through the Platform, as defined under Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations ("IRR"). As PIC, romaph determines the purposes and means of processing personal information and is responsible for ensuring that all processing activities comply with applicable Philippine data privacy law.
This Policy should be read together with romaph's Terms & Conditions and Responsible Gaming Policy. By registering a romaph account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy.
romaph collects personal information through various means, including direct submission by you, automated collection during your use of the Platform, and from third-party sources where lawfully permitted. The categories of data collected are described below.
When you create a romaph account, we collect your full legal name, date of birth, email address, Philippine mobile number, and residential address. This data is required to create your account and verify your eligibility to use the Platform.
For withdrawal processing and anti-money laundering compliance, romaph requires identity verification documents. This includes a copy of a valid Philippine government-issued photo ID (passport, driver's licence, SSS, UMID, PhilHealth ID, or Voter's ID), and where required, a selfie holding the ID and proof of residential address (utility bill, bank statement, or barangay certificate).
We collect records of all deposit and withdrawal transactions, including amounts, timestamps, payment methods used (GCash number, Maya account, bank account details), and transaction reference numbers. Detailed card numbers and full bank account credentials are not stored by romaph — payment processing is handled by third-party PCI-DSS compliant payment processors.
romaph records your gameplay history, including game sessions, wager amounts, game outcomes, bonuses claimed, and account balance movements. This data is used for account management, dispute resolution, and responsible gaming monitoring.
When you access romaph, our systems automatically collect your IP address, device type and model, operating system, browser type and version, session duration, pages visited, and referring URL. This data is used for security monitoring, fraud detection, and platform performance optimisation.
romaph retains records of communications between you and our customer support team, including live chat transcripts, email correspondence, and any documents submitted in connection with a complaint or query.
| Data Category | Examples | Collection Method |
|---|---|---|
| Identity | Full name, DOB, address | Submitted by you at registration |
| KYC Documents | Gov't ID, selfie, proof of address | Submitted by you for verification |
| Financial | Transaction history, e-wallet IDs | Generated during Platform use |
| Gaming Activity | Bets, wins, session history | Automatically recorded by Platform |
| Technical | IP address, device ID, browser | Automatically collected via cookies/logs |
| Communications | Support chats, emails | Recorded during support interactions |
romaph uses personal data only for the purposes set out below. We do not use personal data in ways that are incompatible with the purpose for which it was originally collected without your consent or other lawful basis.
Under Republic Act No. 10173, romaph processes personal information on the following lawful bases:
romaph does not sell, rent, or trade your personal information to any third party for marketing purposes. We share personal data only in the following limited circumstances, and only to the minimum extent necessary:
romaph uses cookies and similar tracking technologies (such as web beacons, pixel tags, and local storage) to operate and improve the Platform. By using the romaph website, you consent to the use of cookies as described in this section.
You may manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the romaph Platform, including your ability to log in and access your account. romaph does not use cookies to serve third-party advertising.
romaph retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and as required by applicable Philippine law and regulatory obligations. The general retention periods applicable to different categories of data are as follows:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & Identity Data | Duration of account + 5 years post-closure | Legal obligation / AML |
| KYC Documents | 5 years from date of verification | AMLA / PAGCOR requirements |
| Transaction Records | 5 years from transaction date | Legal / Tax / AML obligation |
| Gaming Activity Logs | 3 years from session date | Dispute resolution / PAGCOR |
| Support Communications | 3 years from last interaction | Complaint management |
| Marketing Preferences | Until opt-out or account closure | Consent-based processing |
Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents reconstruction. Where anonymisation is used, the resulting data may be retained indefinitely for statistical or research purposes.
romaph implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, disclosure, alteration, or destruction. These measures include:
Some of romaph's service providers and game technology partners may process personal data outside the Philippines. Where personal data is transferred internationally, romaph ensures that adequate safeguards are in place, including:
romaph does not transfer personal data to jurisdictions that lack adequate data protection frameworks without implementing appropriate contractual or technical safeguards as required under RA 10173 and its IRR.
As a data subject under Republic Act No. 10173, you have the following rights with respect to your personal information held by romaph. These rights may be exercised by contacting our Data Protection Officer (DPO) at the contact details in Section 15.
Request a copy of the personal data romaph holds about you, together with information about how it is processed.
Request correction of inaccurate or incomplete personal data that romaph holds about you.
Request deletion of your personal data where retention is no longer necessary or lawful, subject to our legal retention obligations.
Object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interest.
Receive a copy of your personal data in a structured, commonly used, machine-readable format where technically feasible.
Request that romaph restrict the processing of your personal data in certain circumstances, such as while a rectification request is under review.
romaph will respond to verified data subject rights requests within thirty (30) calendar days of receipt. In complex cases, this period may be extended by a further thirty (30) days with notification to you. We may require you to verify your identity before processing a data subject rights request to protect against unauthorised access to your data.
If you believe romaph has not handled your personal data in accordance with RA 10173, you have the right to lodge a complaint with the National Privacy Commission of the Philippines at privacy.gov.ph.
The romaph Platform is strictly intended for adults aged 21 years and above, in accordance with PAGCOR regulations. romaph does not knowingly collect, process, or store personal information from individuals under the age of 21.
Where romaph becomes aware or has reasonable grounds to suspect that personal information has been collected from an individual under 21 years of age, we will take immediate steps to suspend the associated account, delete or anonymise the relevant personal data, and report the matter to the appropriate regulatory authorities as required.
If you are a parent or guardian and believe that a minor under 21 has registered on romaph using your or their own information, please contact our Data Protection Officer immediately using the contact details in Section 15.
With your consent, romaph may send you promotional emails, SMS messages, and in-platform notifications about bonus offers, new games, promotions, and platform updates. These communications are sent to the contact details you provided during registration.
You may withdraw your consent to marketing communications at any time by:
Withdrawal of consent for marketing communications will not affect any processing that has already occurred on the basis of prior consent, and will not affect the processing of personal data necessary for account operation or legal compliance.
Please note that certain account-related communications (such as transaction confirmations, security alerts, and responsible gaming notifications) are not marketing communications and cannot be opted out of while your account remains active.
The romaph Platform may, in certain contexts, reference or link to third-party services, payment providers, or game developers. romaph is not responsible for the privacy practices of any third-party website or service that is not directly operated by romaph. We encourage you to review the privacy policies of any third parties whose services you access in connection with the Platform.
Third-party payment providers (such as GXI/GCash and PayMaya/Maya Philippines) process payment data under their own privacy policies, which are separate from this Policy. romaph is not responsible for the data practices of these providers beyond the terms of our contractual arrangements with them.
romaph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. Where changes are material, we will notify registered players by email and/or through a prominent notice on the Platform at least fourteen (14) days before the changes take effect.
Non-material amendments — such as clarifications, corrections, or updates that do not change the substantive rights of data subjects — may be made without prior notice. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision.
Your continued use of the romaph Platform after a material amendment has taken effect constitutes acceptance of the updated Privacy Policy. If you do not agree to any amendment, you should stop using the Platform and may request account closure.
romaph has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. To exercise your data subject rights, lodge a privacy concern, or request information about how your data is handled, please contact:
Data Protection Officer
romaph Data Privacy Office
Email Contact
[email protected]Response Timeframe
Data subject rights requests are acknowledged within 5 business days and resolved within 30 calendar days. Urgent privacy concerns (suspected data breaches affecting your account) are treated as a priority and escalated immediately to our security team.
If you are not satisfied with romaph's response to your privacy concern, you have the right to file a complaint with the National Privacy Commission of the Philippines, which oversees compliance with RA 10173 by all personal information controllers operating in or processing data of Philippine residents.
Your data is protected, your transactions are secured, and your privacy is respected. romaph is built for Filipino players who want a safe, fair, and enjoyable online gaming experience.
21+ only. Gamble responsibly. Data protected under RA 10173.