Privacy Policy —
cocoph Data Protection

cocoph ("we", "our", or "the Platform") is the Philippines' trusted online casino and sports betting platform, accessible at cocoph.net. We provide Filipino players across Metro Manila, Cebu, Davao, Iloilo, Cagayan de Oro, and all regions of the Philippines with access to slots, live dealer tables, sports betting, bingo, and sabong — all denominated in Philippine Peso (PHP / ₱).

This Privacy Policy describes how cocoph collects, uses, discloses, retains, and protects the personal information of individuals who register for, access, or interact with our platform. It has been prepared in accordance with Republic Act No. 10173, the Data Privacy Act of 2012, and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy should be read alongside our Terms & Conditions, which also form part of your agreement with cocoph. Defined terms used but not defined in this Policy carry the meanings given to them in the Terms & Conditions.

For the purposes of the Data Privacy Act of 2012 and applicable Philippine data protection regulations, cocoph is the Personal Information Controller in respect of the personal data collected through this platform. We determine the purposes and means by which your personal information is processed.

Our designated Data Protection Officer (DPO) is responsible for overseeing compliance with data protection obligations. You may contact the DPO for any privacy-related concerns at [email protected]. Please mark your subject line clearly as "Data Privacy Inquiry" to ensure your message is routed to the correct team.

cocoph collects the following categories of personal information:

cocoph collects your personal information through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or respond to a promotion;
• Automatically — through cookies, server logs, and session tracking technologies when you access and interact with the cocoph platform;
• From third-party service providers — including KYC and identity verification providers, payment processors (such as GCash, Maya, BPI, BDO, Metrobank), and fraud detection services, where necessary to validate your identity or process your transactions;
• From regulatory and compliance sources — where required by applicable Philippine anti-money laundering regulations, including cross-referencing against publicly available government databases or watchlists.

cocoph processes your personal data only where a lawful basis for processing exists under the Data Privacy Act of 2012. The table below summarises our processing purposes and the corresponding lawful basis:

Where cocoph relies on consent as its lawful basis (for example, for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

cocoph does not sell, rent, or otherwise trade your personal information. We may share your data with third parties only in the following limited circumstances:

• Payment Processors: GCash, Maya, GrabPay, BPI, BDO, Metrobank, Visa/Mastercard processing partners, InstaPay, PesoNet, and 7-Eleven CLiQQ — strictly to process your deposits and withdrawals;
• KYC & Identity Verification Providers: Third-party KYC service providers engaged to verify your identity and age in compliance with Philippine gaming and AML regulations;
• Game Content Providers: Licensed third-party game studios and software providers — shared data is limited to player session identifiers necessary for game delivery and fairness auditing;
• Regulatory Authorities: Philippine government bodies including PAGCOR, the Anti-Money Laundering Council (AMLC), and the National Privacy Commission (NPC), where disclosure is required by law or regulatory order;
• Fraud Prevention Services: Specialist fraud detection and risk management providers engaged to protect the integrity of the platform and the security of player accounts;
• Professional Advisers: Lawyers, auditors, and compliance consultants engaged to advise cocoph — all bound by confidentiality obligations.

All third-party service providers engaged by cocoph are required to process your personal data only for the specific purpose for which it was shared, and to maintain appropriate security measures in line with applicable Philippine data protection standards.

cocoph retains your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and regulation. The following retention periods apply:

• Account and identity data: Retained for the duration of your active account, plus a minimum of five (5) years after account closure, in compliance with AMLA record-keeping requirements;
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with applicable AML and tax record-keeping obligations;
• KYC documents: Retained for the duration of the account relationship plus five (5) years post-closure;
• Customer support communications: Retained for three (3) years from the date of the interaction;
• Technical and log data: Retained for up to twelve (12) months from collection, unless required for longer periods for security or compliance purposes.

After the applicable retention period has expired, personal data is securely deleted or anonymised in accordance with cocoph's internal data lifecycle management procedures.

cocoph implements a comprehensive set of technical, organisational, and physical security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption: All data transmitted between your device and cocoph's servers is protected using TLS (Transport Layer Security) encryption. Data stored at rest is encrypted using industry-standard algorithms;
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All cocoph personnel with data access undergo background verification and are bound by confidentiality obligations;
• Two-Factor Authentication: cocoph offers two-factor authentication (2FA) for player accounts and mandates it for administrative access to systems containing personal data;
• Penetration Testing: cocoph's platform undergoes regular independent security assessments and penetration testing to identify and remediate vulnerabilities;
• Incident Response: cocoph maintains a documented data breach response procedure. In the event of a data breach that poses a risk to your rights, cocoph will notify affected players and the NPC in accordance with the requirements of the Data Privacy Act of 2012.

cocoph uses cookies and similar tracking technologies (such as pixel tags and session storage) to operate the platform, maintain your login session, remember your preferences, and analyse how players use our services. We do not use cookies to build advertising profiles or share your browsing behaviour with third-party advertisers.

The types of cookies cocoph uses are as follows:

• Strictly Necessary Cookies: Essential for the operation of the platform. These include session authentication cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled without affecting core platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings and responsible gaming limit configurations, to personalise your experience on the platform.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players navigate and use the cocoph platform. This information helps us identify areas for improvement and optimise the user experience.
• Security Cookies: Used to detect and prevent fraudulent activity, identify unusual login behaviour, and protect your account from unauthorised access.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may prevent you from logging in or using certain features of the cocoph platform.

Under the Data Privacy Act of 2012, you have the following rights in relation to the personal data cocoph holds about you:

• Right to be Informed: The right to be notified of the collection and processing of your personal information, as set out in this Privacy Policy;
• Right of Access: The right to request a copy of the personal data cocoph holds about you, together with information about how it is being used;
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data in your cocoph account;
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations (such as AMLA record-keeping);
• Right to Data Portability: The right to receive a structured, commonly used copy of the personal data you have provided to cocoph, where technically feasible;
• Right to Object: The right to object to the processing of your personal data where cocoph relies on legitimate interest as its lawful basis, including objecting to direct marketing communications;
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data rights have been violated.

To exercise any of the above rights, please contact our Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request". We will acknowledge your request within three (3) business days and respond in full within fifteen (15) business days, in accordance with NPC guidelines.

cocoph strictly prohibits the use of its platform by anyone under the age of 21 years, in accordance with the minimum age requirements for gambling participation under applicable Philippine gaming regulations. The cocoph platform is not directed at, and does not knowingly collect personal information from, any individual under the age of 21.

If cocoph discovers or reasonably suspects that a player is under the age of 21, their account will be immediately suspended, any deposits will be returned where practicable, and all gaming activity will be voided. The collection of data from underage individuals is an error we take seriously, and such data will be deleted from our systems promptly upon confirmation.

In the ordinary course of operating the cocoph platform, certain personal data may be transferred to, stored, or processed in countries outside the Philippines — for example, where third-party game providers or cloud infrastructure providers operate data centres outside Philippine territory.

Any such cross-border transfer of personal data is carried out only where cocoph has implemented appropriate safeguards to ensure that your data receives a level of protection equivalent to that required under the Data Privacy Act of 2012. These safeguards may include contractual data processing agreements incorporating standard data protection clauses approved by the NPC, or transfers to recipients in jurisdictions with an adequate level of data protection as recognised under applicable Philippine regulations.

If you wish to obtain more information about the specific safeguards in place for cross-border data transfers affecting your personal information, please contact our Data Protection Officer.

cocoph reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, or the services we offer. The "Last Updated" date at the top of this page indicates when the most recent revision was made.

For material changes that significantly affect your privacy rights or the way we process your personal data, cocoph will notify registered players via the platform's notification system or by email to your registered address, where practicable, before the changes take effect.

Continued use of the cocoph platform after any updates to this Privacy Policy have been posted constitutes your acknowledgement of the revised policy. We encourage you to review this page periodically.

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by cocoph, please contact our Data Protection Officer:

Email: [email protected]
Subject Line: Data Privacy Inquiry

Live Chat: Available 24/7 directly from the cocoph platform. Filipino-speaking agents are available during Manila business hours (approximately 8:00 AM to 10:00 PM Philippine Standard Time, PST / UTC+8).

If you are not satisfied with cocoph's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which is the independent regulatory authority responsible for enforcing the Data Privacy Act of 2012. Information about filing a complaint with the NPC is available through official Philippine government channels.