Privacy Policy

gfplay is committed to protecting the personal data of every individual who interacts with our platform. This Policy applies to all personal data collected from Users who register an Account, use any Service, visit the gfplay website, or otherwise interact with gfplay through any channel including live chat and email correspondence.

This Policy does not apply to third-party websites, services, or platforms that may be referenced or linked from gfplay. We have no control over, and accept no responsibility for, the privacy practices of third parties. You are encouraged to review the privacy policies of any third-party service you use in connection with your gfplay Account.

gfplay acts as the Personal Information Controller (PIC) with respect to the personal data described in this Policy. We determine the purposes and means by which your personal data is processed. Certain third-party service providers who process data on our behalf act as Personal Information Processors (PIPs) and are bound by contractual obligations consistent with this Policy and applicable law.

Depending on how you use gfplay, we may collect the following categories of personal data:

2.1 Identity and Contact Information

• Full legal name as it appears on your government-issued identification;
• Date of birth and age verification data;
• Registered Philippine mobile number;
• Email address;
• Residential address (for KYC and regulatory purposes).

2.2 Identity Verification (KYC) Documents

• Copies of Philippine government-issued identification documents (e.g., PhilSys, UMID, Driver's License, Passport, Voter's ID, PRC ID);
• Selfie or facial image where required for biometric verification;
• Proof of address documents where applicable;
• Source of funds documentation where requested by our compliance team.

2.3 Financial and Transaction Data

• Payment method details (GCash registered number, Maya linked account, bank account name — not full card or account numbers);
• Deposit and withdrawal transaction history;
• Account wallet balance and movement records;
• Currency conversion records where applicable.

2.4 Gaming and Activity Data

• Game session history, bet amounts, game outcomes, and winnings;
• Bonus and promotional activity records;
• Sports betting selections and results;
• Responsible gaming tool settings (deposit limits, self-exclusion status).

2.5 Technical and Device Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser information;
• Session timestamps and duration;
• Cookie identifiers and similar tracking technologies (see Section 9).

2.6 Communications Data

• Customer support chat transcripts;
• Email correspondence with gfplay;
• Feedback and survey responses where voluntarily submitted.

gfplay collects personal data through the following means:

• Directly from you: When you register an Account, complete KYC verification, make a deposit or withdrawal, contact customer support, participate in promotions, or update your Account settings;
• Automatically: When you use the Platform, we automatically collect technical and device data, session information, and usage data through cookies and server logs (see Section 9);
• From payment service providers: Transaction confirmation data from GCash, Maya, BPI, BDO, and other payment processors used to complete deposits and withdrawals;
• From identity verification services: Where gfplay uses third-party KYC service providers to assist with document verification and age confirmation;
• From regulatory authorities: Where gfplay receives information from PAGCOR or other regulatory bodies in connection with compliance or enforcement activities.

gfplay processes your personal data for the following purposes:

Under the Data Privacy Act of 2012 and its IRR, gfplay relies on the following legal bases for processing your personal data:

• Contractual Necessity: Processing is necessary to perform the contract between you and gfplay — including operating your Account, processing transactions, and delivering game services;
• Legal Obligation: Processing is required to comply with applicable laws including the Anti-Money Laundering Act (AMLA), PAGCOR regulatory requirements, and NPC directives;
• Legitimate Interests: Processing is necessary for gfplay's legitimate interests in fraud prevention, platform security, and service improvement, provided such interests are not overridden by your rights and freedoms;
• Consent: For marketing communications and optional data uses, we rely on your explicit consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

gfplay does not sell your personal data to third parties. We do not share your personal data with advertisers or marketing networks without your explicit consent. We may, however, share your data with the following categories of recipients under the circumstances described:

6.1 Payment Service Providers

We share transaction-related data with GCash, Maya, BPI, BDO, Metrobank, UnionBank, 7-Eleven (Cliqq), Coins.ph, and other payment processors strictly to the extent necessary to complete deposit and withdrawal transactions. These providers process data in accordance with their own privacy policies and applicable Philippine financial regulations.

6.2 Identity Verification and KYC Providers

We share identity documents and verification data with certified third-party KYC service providers who assist us in confirming the identity and age of our Users. These providers act as PIPs and are contractually bound to process data only for the specific purpose of identity verification and only to the extent instructed by gfplay.

6.3 Regulatory and Law Enforcement Authorities

We are required by law to share certain data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities where required for regulatory reporting, compliance investigations, or in response to lawful court orders. gfplay will notify affected Users of such disclosures to the extent permitted by law.

6.4 Technology and Infrastructure Providers

We share data with cloud hosting providers, content delivery networks, cybersecurity services, and other technology vendors who process data on our behalf under strict contractual data processing agreements. All such providers are bound by obligations no less protective than those in this Policy.

6.5 Professional Advisers

We may share data with lawyers, auditors, and other professional advisers in connection with legal proceedings, regulatory inquiries, or corporate governance matters, subject to professional confidentiality obligations.

gfplay retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

After the applicable retention period expires, gfplay securely destroys or anonymizes personal data in a manner that prevents reconstruction or recovery.

gfplay implements technical, organizational, and administrative security measures appropriate to the risks associated with the personal data we process. These include:

• Encryption in Transit: All data transmitted between your device and gfplay's servers is encrypted using TLS 1.3 with 256-bit SSL certificates. Data in transit is protected against interception;
• Encryption at Rest: Sensitive personal data and KYC documents stored on gfplay's systems are encrypted at rest using AES-256 or equivalent standards;
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. gfplay staff are granted access only to the data required to perform their specific job functions, enforced through role-based access controls (RBAC);
• Authentication Controls: Internal systems require multi-factor authentication. User-facing gfplay Accounts support OTP verification and optional two-factor authentication (2FA);
• Vulnerability Management: gfplay conducts regular security assessments, penetration testing, and vulnerability scanning of its platform infrastructure;
• Incident Response: gfplay maintains a documented personal data breach response procedure. In the event of a breach likely to result in risk to data subjects' rights, we will notify affected Users and the NPC in accordance with the timelines required by the DPA and NPC Circular 16-03.

While gfplay takes all reasonable precautions to protect your data, no transmission over the internet or electronic storage system is completely secure. You share responsibility for the security of your Account by maintaining a strong password, enabling 2FA, and protecting your login credentials.

gfplay uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit gfplay.co. The following categories of cookies are used:

gfplay does not use third-party advertising cookies or permit advertising networks to place cookies on your device through the Platform. You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies may impair the functionality of the Platform.

Under the Data Privacy Act of 2012 and its IRR, you have the following rights with respect to your personal data held by gfplay:

• Right to be Informed: You have the right to know how your personal data is being processed, the purposes for which it is used, and who it is shared with. This Policy constitutes our primary fulfillment of this obligation;
• Right to Access: You may request a copy of the personal data that gfplay holds about you, including transaction records, KYC documents submitted, and Account activity summaries;
• Right to Correction: You may request correction of inaccurate or incomplete personal data in your gfplay Account. Some corrections (such as name changes) may require supporting documentation;
• Right to Erasure or Blocking: You may request deletion or blocking of personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where it has been unlawfully processed — subject to gfplay's overriding legal retention obligations;
• Right to Data Portability: You may request a copy of your personal data in a structured, commonly used, and machine-readable format where technically feasible;
• Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests;
• Right to File a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your rights under the DPA have been violated. Contact information for the NPC is publicly available on the NPC's official website;
• Right to Damages: You have the right to claim compensation for damages sustained due to inaccurate, incomplete, outdated, false, or unlawfully obtained personal data processed by gfplay.

To exercise any of these rights, please contact gfplay's Data Protection Officer through the channels listed in Section 14. We will respond to all verifiable data subject requests within thirty (30) calendar days of receipt, unless an extension is required under applicable law.

Mandatory KYC age verification is a condition of full Account activation on gfplay. A User cannot access real-money gaming services until they have submitted and passed age verification using a valid Philippine government-issued ID confirming they are 21 years of age or older. This requirement is non-negotiable and enforced without exception.

If you are a parent or guardian and you believe that a minor may have registered or attempted to register a gfplay Account, please contact our customer support team immediately via live chat or email so we can investigate and take appropriate action.

Some of the third-party service providers used by gfplay (including cloud infrastructure providers, KYC verification platforms, and cybersecurity services) may store or process data in jurisdictions outside the Philippines. Where such cross-border transfers occur, gfplay takes the following steps to ensure your data is adequately protected:

• We transfer data only to countries or organizations that provide an adequate level of protection recognized by the NPC, or we implement standard contractual clauses approved for cross-border data transfers under the DPA framework;
• We verify that any overseas recipient of Philippine personal data is bound by obligations no less protective than those required by the DPA;
• We maintain records of all cross-border data transfers as required by NPC regulations.

You have the right to be informed of cross-border transfers affecting your data. If you wish to obtain more specific information about the safeguards in place for a particular transfer, please contact gfplay's Data Protection Officer.

gfplay may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When we make material changes, we will provide notice to registered Users via the Platform, by email to the registered address on file, or both, prior to the changes taking effect. The "Effective Date" at the top of this Policy will be updated to reflect the date of the most recent revision.

Your continued use of gfplay following the posting of a revised Policy constitutes your acceptance of the revised terms. If you do not agree with any changes, you have the right to close your Account and request deletion of your data in accordance with Section 10 (Right to Erasure), subject to gfplay's legal retention obligations.

We encourage you to review this Policy periodically. The current version is always available at gfplay.co/privacy-policy.

For all privacy-related inquiries, data subject rights requests, or concerns about how gfplay handles your personal data, you may contact us through the following channels:

• Live Chat: Available 24/7 within your gfplay Account dashboard. For urgent privacy concerns including suspected data breaches or unauthorized Account access, live chat is the fastest channel;
• Email (Data Privacy): [email protected] — please include "Privacy Request" in the subject line. Allow up to 30 calendar days for a response to formal data subject requests;
• Support Hours: 24 hours a day, 7 days a week, Philippine Standard Time (PST, UTC+8).

If you are not satisfied with our response to a privacy inquiry, you have the right to escalate the matter to the National Privacy Commission (NPC) of the Philippines. The NPC's contact information and complaint process are publicly available through official government channels.