gfplay Privacy Policy

gfplay acts as the data controller in respect of personal information collected through the gfplay platform. As data controller, gfplay determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable Philippine data privacy laws.

For all data privacy enquiries, requests, or complaints, you may contact the gfplay Data Protection Officer (DPO) at the contact details provided in Section 13 of this Policy.

gfplay collects the following categories of personal information:

2.1 Registration Data

• Full legal name;
• Date of birth;
• Residential address in the Philippines (including city, province, and postal code);
• Email address;
• Mobile phone number;
• Username and encrypted password.

2.2 Identity Verification (KYC) Data

• Copies of government-issued identification documents (e.g., Philippine Passport, Driver's Licence, PhilSys National ID, UMID, Voter's ID);
• Proof of address documents (e.g., utility bills, bank statements);
• Proof of payment method ownership where required.

2.3 Financial Data

• Deposit and withdrawal transaction records;
• Payment method details (e.g., GCash account reference, bank account details, card details — stored in tokenised form only);
• Account balance history.

2.4 Gaming Activity Data

• Game history, wager amounts, and outcomes;
• Bonus and promotion usage;
• Session duration and frequency of play.

2.5 Technical Data

• IP address and approximate geolocation;
• Device type, operating system, and browser information;
• Cookie identifiers and session tokens;
• Pages visited, links clicked, and time spent on the platform.

2.6 Communications Data

• Records of your communications with gfplay customer support (live chat transcripts, email correspondence);
• Feedback and survey responses.

gfplay collects personal data through the following means:

• Directly from you — when you register an Account, complete KYC verification, make a deposit or withdrawal, contact customer support, or participate in promotions;
• Automatically — through cookies, web beacons, and similar tracking technologies when you access and use the gfplay platform;
• From third parties — including payment processors (e.g., GCash, PayMaya, BPI, BDO, Metrobank), identity verification service providers, fraud prevention services, and analytics providers, where permitted by applicable law.

gfplay uses your personal data for the following purposes:

• To create and manage your gfplay Account;
• To verify your identity and age in compliance with KYC and anti-money laundering (AML) obligations;
• To process deposits, withdrawals, and other financial transactions;
• To provide access to games, promotions, and other platform features;
• To detect, investigate, and prevent fraud, cheating, money laundering, and other prohibited activities;
• To comply with applicable Philippine legal and regulatory obligations, including reporting requirements;
• To provide customer support and respond to your enquiries;
• To send you transactional communications (e.g., deposit confirmations, withdrawal notifications, security alerts);
• To send you promotional and marketing communications, where you have consented to receive them;
• To monitor and enforce responsible gaming obligations, including identifying players who may be at risk of problem gambling;
• To analyse platform usage and improve the gfplay user experience;
• To enforce the gfplay Terms & Conditions.

gfplay processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity — processing required to perform our obligations under the gfplay Terms & Conditions, including Account management, payment processing, and game provision;
• Legal obligation — processing required to comply with applicable Philippine laws and regulations, including KYC, AML, and responsible gaming obligations;
• Legitimate interests — processing for fraud prevention, platform security, and improving our services, where such interests are not overridden by your privacy rights;
• Consent — processing for marketing communications and non-essential cookies, where you have provided explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

gfplay does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis:

• Payment processors — GCash, PayMaya, BPI, BDO, Metrobank, Visa, and Mastercard, for the purpose of processing your financial transactions;
• Identity verification providers — third-party KYC and AML service providers engaged to assist with identity verification and fraud prevention;
• Game providers — licensed third-party game suppliers whose games are available on the gfplay platform, to the extent necessary to provide game services;
• Analytics and technology providers — service providers who assist gfplay in operating and improving the platform, subject to strict data processing agreements;
• Regulatory and law enforcement authorities — where required by applicable Philippine law, court order, or regulatory direction, including reporting to PAGCOR or other competent authorities;
• Professional advisers — lawyers, accountants, and auditors, where necessary for the conduct of gfplay's business, subject to professional confidentiality obligations.

Where gfplay engages third-party data processors, we require them to process personal data only on our instructions and in accordance with applicable data privacy laws.

7.1 gfplay uses cookies and similar tracking technologies (such as web beacons and pixel tags) to operate and improve the platform. Cookies are small text files stored on your device when you visit the gfplay website.

7.2 gfplay uses the following categories of cookies:

• Strictly necessary cookies — essential for the platform to function, including session management and security. These cannot be disabled.
• Functional cookies — remember your preferences (e.g., language, display settings) to personalise your experience.
• Analytics cookies — collect anonymised data about how players use the platform, helping us identify areas for improvement.
• Marketing cookies — used to deliver relevant promotional content. These are only set with your consent.

7.3 You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the gfplay platform.

8.1 gfplay retains your personal data for as long as your Account remains active and for such additional period as is required to comply with applicable legal, regulatory, and contractual obligations.

8.2 In general, gfplay applies the following retention periods:

• Account registration and KYC data — retained for a minimum of five (5) years following Account closure, in compliance with AML and gaming regulatory requirements;
• Financial transaction records — retained for a minimum of five (5) years from the date of the transaction;
• Gaming activity data — retained for a minimum of three (3) years from the date of the activity;
• Customer support communications — retained for two (2) years from the date of the last communication;
• Marketing consent records — retained for the duration of your consent and for one (1) year following withdrawal of consent.

8.3 Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with gfplay's data disposal procedures.

9.1 gfplay implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the gfplay platform;
• Encryption of sensitive data at rest, including payment method details and identity documents;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Regular security assessments and penetration testing;
• Multi-factor authentication for Account access and administrative systems.

9.2 While gfplay takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, gfplay will notify you and the National Privacy Commission in accordance with applicable Philippine law.

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by gfplay:

• Right to be informed — the right to know how your personal data is being collected and processed;
• Right of access — the right to request a copy of the personal data gfplay holds about you;
• Right to rectification — the right to request correction of inaccurate or incomplete personal data;
• Right to erasure — the right to request deletion of your personal data, subject to applicable legal retention obligations;
• Right to object — the right to object to the processing of your personal data for direct marketing purposes;
• Right to data portability — the right to receive your personal data in a structured, commonly used format;
• Right to lodge a complaint — the right to file a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

To exercise any of the above rights, please contact the gfplay Data Protection Officer using the contact details in Section 13. gfplay will respond to all verified requests within fifteen (15) business days, in accordance with NPC guidelines.

The gfplay platform is strictly intended for persons aged 21 years and above. gfplay does not knowingly collect personal data from individuals under the age of 21. If gfplay becomes aware that personal data has been collected from a person under 21, the relevant Account will be immediately closed and all associated personal data will be deleted in accordance with applicable law. If you believe a minor has registered on the gfplay platform, please contact us immediately at the details provided in Section 13.

12.1 gfplay reserves the right to update or amend this Privacy Policy at any time. Where changes are material, gfplay will notify registered Players via email or a prominent notice on the platform prior to the changes taking effect.

12.2 The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. Your continued use of the gfplay platform following the effective date of any revised Policy constitutes your acceptance of the updated terms.

For any questions, requests, or complaints regarding this Privacy Policy or gfplay's data practices, please contact the gfplay Data Protection Officer:

• Email: [email protected]
• Live Chat: Available 24/7 on all pages of the gfplay platform
• Response Time: Within 15 business days of receipt of your request

If you are not satisfied with gfplay's response, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC) at privacy.gov.ph.