Privacy Policy for ggpa

This Privacy Policy ("Policy") is issued by ggpa ("ggpa," "we," "our," or "us") and applies to all personal data collected from users ("you," "Player," or "User") who access or use the ggpa website at ggpa.app and all related services, features, games, and promotions (collectively, the "Platform").

ggpa is committed to protecting the privacy and personal data of every Filipino player on our Platform. We operate in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the guidelines issued by the National Privacy Commission (NPC) of the Philippines.

By registering an account or otherwise using the ggpa Platform, you acknowledge that you have read and understood this Policy and consent to the collection, processing, and use of your personal data as described herein. If you do not agree with any part of this Policy, please discontinue use of the Platform immediately.

ggpa collects only the personal data that is reasonably necessary to provide you with a secure, compliant, and enjoyable online gaming experience. The categories of data we collect are described below:

ggpa collects personal data through the following channels:

• Direct submission: When you register an account, complete identity verification, make a deposit or withdrawal, contact customer support, or participate in a promotion, you provide data directly to ggpa.
• Automated technologies: When you access the Platform, our servers automatically record technical data such as your IP address, device identifiers, browser type, and session activity through log files, cookies, and similar technologies.
• Third-party verification providers: For KYC and AML compliance, ggpa may receive identity verification results and fraud risk signals from licensed third-party verification service providers operating within the Philippines.
• Payment processors: When you transact via GCash, Maya, BPI, BDO, or other approved payment channels, transaction confirmation data is shared with ggpa by those payment service providers to the extent necessary to process and reconcile your account balance.
• Regulatory bodies: In certain circumstances, ggpa may receive data from PAGCOR or other competent Philippine authorities in connection with regulatory compliance, licensing conditions, or law enforcement requests.

ggpa processes your personal data for the following specific and legitimate purposes:

• Account creation and management: To register your account, verify your identity and age (21+ requirement), and manage your ongoing relationship with ggpa.
• Payment processing: To process deposits, withdrawals, and related financial transactions through approved Philippine payment channels including GCash, Maya, BPI, BDO, Metrobank, Coins.ph, 7-Eleven, and USDT.
• Regulatory compliance: To fulfil ggpa's obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), and the Data Privacy Act of 2012, including the filing of covered and suspicious transaction reports where required.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and other prohibited conduct on the Platform.
• Customer support: To respond to your enquiries, resolve disputes, process responsible gaming requests such as self-exclusion, and provide technical assistance.
• Promotions and communications: To send you information about bonuses, promotions, and Platform updates that may be of interest to you, where you have provided consent or where ggpa has a legitimate interest in doing so. You may opt out of marketing communications at any time.
• Platform improvement: To analyse usage patterns, troubleshoot technical issues, test new features, and improve the overall quality and performance of the ggpa Platform for Filipino players.
• Legal and dispute resolution: To establish, exercise, or defend legal claims, comply with court orders, and cooperate with regulatory investigations.

Under the Data Privacy Act of 2012 and applicable NPC guidelines, ggpa relies on the following legal bases when processing your personal data:

• Contractual necessity: Processing is necessary to perform the contract between you and ggpa — that is, to provide you with access to the Platform, process your bets and financial transactions, and manage your account.
• Legal obligation: Processing is required to comply with ggpa's obligations under Philippine law, including PAGCOR regulations, AMLA requirements, and tax reporting obligations.
• Legitimate interests: ggpa has legitimate interests in processing certain data for fraud prevention, Platform security, customer support, and service improvement, provided those interests are not overridden by your rights and freedoms.
• Consent: For certain processing activities, such as sending marketing communications or using non-essential cookies, ggpa will seek your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

ggpa does not sell, rent, or trade your personal data. We may share your data with the following categories of recipients only to the extent strictly necessary for the purposes described in this Policy:

• Game providers and platform technology partners: Licensed game studios and platform software providers who require limited session and account data to deliver game services on the ggpa Platform. These partners are bound by data processing agreements consistent with RA 10173.
• Payment service providers: GCash, Maya, BPI, BDO, Metrobank, Coins.ph, and other approved payment processors receive the minimum financial data required to execute your transaction.
• Identity verification and fraud prevention services: Third-party KYC and AML compliance providers who assist ggpa in verifying player identities and assessing fraud risk, operating under strict confidentiality and data processing agreements.
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government bodies, where ggpa is legally required to disclose data or where ggpa voluntarily reports suspicious activity.
• Professional advisors: Legal counsel, auditors, and compliance consultants who are bound by professional confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all assets of ggpa, your personal data may be transferred as part of that transaction, subject to equivalent privacy protections.

ggpa uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file stored on your device by your web browser when you visit our site. The types of cookies we use are as follows:

• Strictly necessary cookies: These are essential for the Platform to function. They enable session management, authentication, and security features. These cookies cannot be disabled without impairing Platform functionality.
• Performance and analytics cookies: These cookies collect anonymised information about how players use the ggpa Platform — such as which pages are visited most frequently and whether error messages are encountered. This data helps us improve the Platform experience.
• Functional cookies: These cookies allow the Platform to remember your preferences, such as your language setting or display options, so you do not have to re-enter them on each visit.

ggpa does not use advertising or cross-site tracking cookies. You can manage or delete cookies through your browser settings at any time. Disabling strictly necessary cookies may affect your ability to log in or use certain Platform features.

ggpa retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account relationship with ggpa, plus a minimum of five (5) years after account closure, as required under AMLA and PAGCOR regulations.
• Transaction and financial data: Retained for a minimum of five (5) years from the date of the transaction, consistent with Philippine AML reporting obligations.
• Technical and usage data: Retained for up to twelve (12) months from collection, unless retention is extended for security investigation purposes.
• Customer support communications: Retained for up to three (3) years from the date of the interaction for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for the duration of your account plus a reasonable period thereafter to demonstrate compliance with consent requirements.

Upon expiry of the applicable retention period, ggpa will securely delete or anonymise your personal data in accordance with NPC-approved data disposal procedures.

ggpa implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• Encryption in transit: All data transmitted between your device and ggpa's servers is encrypted using TLS 1.3 (Transport Layer Security) protocol.
• Encryption at rest: Sensitive data stored in ggpa's databases, including financial account details and identity documents, is encrypted using AES-256 encryption.
• Access controls: Access to personal data within ggpa is strictly controlled on a need-to-know basis, with role-based access controls, multi-factor authentication for administrative systems, and comprehensive audit logging.
• Two-factor authentication (2FA): All registered ggpa player accounts are protected by 2FA using your registered Philippine mobile number.
• Regular security assessments: ggpa conducts regular vulnerability assessments and penetration testing of its Platform to identify and remediate security weaknesses proactively.
• Incident response: In the event of a personal data breach that poses a risk to your rights and freedoms, ggpa will notify the National Privacy Commission within seventy-two (72) hours and will inform affected players without undue delay.

Under the Data Privacy Act of 2012 and NPC regulations, you have the following rights with respect to your personal data held by ggpa:

• Right to be informed: You have the right to be told how your personal data is being collected, used, and shared — which is the purpose of this Privacy Policy.
• Right of access: You may request a copy of the personal data ggpa holds about you, along with information about how it is processed.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction.
• Right to erasure: In certain circumstances, you may request the deletion of your personal data. Note that some data must be retained for regulatory compliance periods as described in Section 8.
• Right to object: You have the right to object to processing of your personal data where it is based on legitimate interests or where it is used for direct marketing purposes.
• Right to data portability: You may request that ggpa provide your personal data in a structured, commonly used, and machine-readable format, to be transmitted to you or to another data controller where technically feasible.
• Right to lodge a complaint: If you believe ggpa has not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any of these rights, please contact ggpa's Data Protection Officer (DPO) at [email protected] with the subject line "Data Subject Rights Request." We will acknowledge your request within three (3) business days and aim to fulfil it within thirty (30) calendar days. Complex requests may require an extension of up to an additional thirty (30) days, of which you will be notified.

The ggpa Platform is strictly restricted to individuals who are 21 years of age or older, in accordance with PAGCOR regulations governing online gambling in the Philippines. ggpa does not knowingly collect personal data from persons under 21 years of age.

During the registration process, ggpa requires date of birth information and conducts mandatory age verification as part of its KYC process. Any account found to have been registered using false age information will be immediately suspended, all associated funds will be frozen, and the matter will be referred to the appropriate regulatory authority.

The ggpa Platform may contain links to third-party websites, including payment processor portals and game provider interfaces. These third-party sites operate under their own privacy policies, which ggpa does not control and is not responsible for.

We encourage you to review the privacy policy of any third-party site you visit before providing personal data. ggpa's Privacy Policy applies solely to data collected directly through the ggpa Platform at ggpa.app and its subdomains.

ggpa may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or Platform functionality. When we make material changes, we will notify you by posting a prominent notice on the ggpa Platform and, where practicable, sending a notification to your registered email address at least fourteen (14) days before the changes take effect.

The "Last updated" date at the top of this Policy reflects the date of the most recent revision. Your continued use of the Platform after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Policy, you should cease using the Platform and may request account closure by contacting our support team.

Previous versions of this Privacy Policy are archived and may be requested by contacting ggpa's Data Protection Officer.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by ggpa, please contact our Data Protection Officer using the details below. We aim to respond to all privacy-related enquiries within three (3) business days.