ghplay Privacy Policy

1. Introduction

ghplay ("ghplay," "we," "us," or "our") operates the online gaming platform accessible at ghplay.app. We are committed to protecting the privacy and personal data of every Filipino player who uses our platform. This Privacy Policy describes how ghplay collects, uses, stores, shares, and protects your personal information when you access or use our website, mobile interface, games, sportsbook, and any related services (collectively, the "Platform").

This Privacy Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC"). It should be read together with our Terms & Conditions.

By registering an account on ghplay or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

2. Personal Data We Collect

2.1 Information You Provide Directly

When you register, verify your account, or interact with ghplay, we collect:

• Identity data: Full legal name, date of birth, nationality, and government-issued ID details (for KYC verification);
• Contact data: Email address, Philippine mobile number, and residential address;
• Financial data: GCash number, PayMaya account, bank account details (BPI, BDO, Metrobank), and transaction history — collected solely for payment processing and AML compliance;
• Account data: Username, password (stored in hashed form), account preferences, and communication preferences;
• Support data: Records of your communications with our customer support team, including chat logs and email correspondence.

2.2 Information Collected Automatically

When you use the Platform, we automatically collect:

• Device and technical data: IP address, device type, operating system, browser type and version, and screen resolution;
• Usage data: Pages visited, games played, bets placed, session duration, click patterns, and navigation paths;
• Location data: General geographic location derived from your IP address (used for regulatory compliance and fraud prevention);
• Cookie data: As described in Section 8 of this Policy.

2.3 Information from Third Parties

We may receive personal data about you from third-party identity verification providers, payment processors, fraud detection services, and PAGCOR or other regulatory bodies where required by law.

3. How We Use Your Personal Data

ghplay processes your personal data for the following purposes:

• Account management: To create, maintain, and administer your ghplay account;
• Identity verification (KYC): To verify your age (21+), identity, and eligibility to use the Platform in compliance with PAGCOR requirements;
• Payment processing: To process deposits, withdrawals, and refunds via GCash, PayMaya, and other accepted payment methods;
• Platform operation: To deliver games, sportsbook services, live casino, bingo, and all other features of the ghplay Platform;
• Customer support: To respond to your inquiries, complaints, and support requests;
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, and other illegal conduct;
• Regulatory compliance: To comply with PAGCOR licensing conditions, the Anti-Money Laundering Act, the DPA, and other applicable Philippine laws;
• Responsible gaming: To monitor gaming behavior and apply responsible gaming tools where appropriate;
• Marketing communications: To send you promotional offers and updates about ghplay, subject to your communication preferences. You may opt out at any time;
• Platform improvement: To analyze usage patterns and improve the functionality, performance, and user experience of the Platform.

4. Legal Basis for Processing

Under the Philippine Data Privacy Act, ghplay processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you (i.e., to operate your ghplay account and deliver our services);
• Legal obligation: Processing required to comply with PAGCOR regulations, AML laws, tax obligations, and other applicable Philippine legal requirements;
• Legitimate interests: Processing for fraud prevention, platform security, and business analytics, where these interests are not overridden by your privacy rights;
• Consent: Processing for marketing communications and non-essential cookies, where you have given explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Data Sharing and Disclosure

ghplay does not sell, rent, or trade your personal data to third-party marketers. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, Visa, and Mastercard — to process your financial transactions;
• Identity verification providers: Third-party KYC and AML service providers engaged to verify your identity and comply with regulatory requirements;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies, where required by law;
• Law enforcement: Philippine law enforcement agencies, where we are legally required or permitted to disclose information;
• Technology service providers: Cloud hosting, cybersecurity, analytics, and customer support platform providers engaged under strict data processing agreements that prohibit them from using your data for their own purposes;
• Business transfers: In the event of a merger, acquisition, or sale of all or part of ghplay's business, your data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third parties with whom ghplay shares personal data are required to handle that data in accordance with the DPA and ghplay's data protection standards.

6. Data Retention

ghplay retains your personal data for as long as your account is active and for a period thereafter as required by applicable law and PAGCOR regulations. Specifically:

• Account and transaction records are retained for a minimum of five (5) years following account closure, in compliance with PAGCOR and AML requirements;
• KYC and identity verification documents are retained for the period required by PAGCOR and the AMLC;
• Customer support records are retained for three (3) years from the date of the last interaction;
• Marketing preference data is retained until you withdraw consent or close your account.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with NPC guidelines.

7. Security Measures

ghplay implements industry-standard technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmissions between your device and the ghplay Platform;
• Encryption of sensitive data at rest, including passwords (stored as salted hashes) and financial account details;
• Multi-factor authentication options for player accounts;
• Regular penetration testing and vulnerability assessments conducted by independent security firms;
• Role-based access controls limiting employee access to personal data on a need-to-know basis;
• 24/7 security monitoring and intrusion detection systems;
• Regular staff training on data protection and information security best practices.

While ghplay takes all reasonable steps to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. In the event of a personal data breach that is likely to result in serious harm, ghplay will notify affected players and the NPC within 72 hours of becoming aware of the breach, in accordance with NPC Circular 16-03.

8. Cookies and Tracking Technologies

8.1 What Are Cookies

Cookies are small text files placed on your device when you visit the ghplay Platform. They help us recognize your device, remember your preferences, and understand how you use our services. We also use similar technologies such as web beacons, pixel tags, and local storage objects.

8.2 Types of Cookies We Use

• Essential cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled;
• Functional cookies: Remember your preferences such as language settings, game display options, and responsible gaming limits you have set;
• Analytics cookies: Help us understand how players navigate the Platform so we can improve performance and user experience. Data collected is aggregated and anonymized where possible;
• Marketing cookies: Used to deliver relevant promotional content within the ghplay Platform. We do not use third-party advertising networks that track you across external websites.

8.3 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the ghplay Platform. For detailed instructions on managing cookies in your browser, refer to your browser's help documentation.

9. Your Privacy Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by ghplay:

• Right to be informed: The right to know what personal data ghplay collects and how it is processed — as set out in this Privacy Policy;
• Right of access: The right to request a copy of the personal data ghplay holds about you, along with information about how it is being used;
• Right to rectification: The right to request correction of inaccurate or incomplete personal data. You can update most account information directly through your ghplay account settings;
• Right to erasure: The right to request deletion of your personal data, subject to ghplay's legal retention obligations under PAGCOR regulations and the AMLA;
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests;
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format;
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 13. We will respond to all verified requests within 15 business days. We may need to verify your identity before processing your request.

10. Children's Privacy

The ghplay Platform is strictly intended for individuals who are 21 years of age or older, in accordance with Philippine gambling regulations. ghplay does not knowingly collect personal data from persons under 21 years of age. If we become aware that personal data has been collected from a person under 21, we will immediately close the associated account and delete all related personal data.

If you are a parent or guardian and believe that a minor has registered on ghplay, please contact our support team immediately at [email protected] so we can take prompt action.

11. International Data Transfers

ghplay primarily stores and processes personal data within the Philippines. Where it is necessary to transfer personal data to service providers located outside the Philippines — for example, cloud infrastructure or cybersecurity providers — ghplay ensures that such transfers are subject to appropriate safeguards, including contractual data processing agreements that require the recipient to provide a level of data protection equivalent to that required under the Philippine DPA.

ghplay will not transfer your personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate safeguards and, where required, obtaining your prior consent.

12. Changes to This Privacy Policy

ghplay reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or regulatory requirements. When we make material changes, we will notify registered players via email or an in-platform notification at least seven (7) days before the changes take effect.

The "Last Updated" date at the top of this page reflects the date of the most recent revision. Your continued use of the ghplay Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. We encourage you to review this Policy periodically to stay informed about how we protect your data.

13. Contact Us & Data Protection Officer

ghplay has appointed a Data Protection Officer ("DPO") in accordance with the requirements of the Philippine Data Privacy Act. If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us:

Data Protection Officer — ghplay
Email: [email protected]
Support Hours: 24/7 (Philippine Standard Time)
Live Chat: Available within the ghplay Platform

If you are not satisfied with our response, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). The NPC can be reached through its official government channels.

Please note: This Privacy Policy applies exclusively to the ghplay Platform at ghplay.app. ghplay operates under PAGCOR regulations and the Philippine Data Privacy Act of 2012. For responsible gaming support, please visit our Responsible Gaming page.