ghplay Privacy Policy

ghplay operates the online casino and sports betting platform accessible at ghplay.vip, offering Filipino players access to live casino games, slot machines, sports betting, bingo, Teen Patti 20-20, and related gaming services.

In the course of providing these services, ghplay collects and processes personal data belonging to registered players and platform visitors. This Privacy Policy describes what personal data ghplay collects, the purposes for which it is processed, the legal bases underpinning that processing, and the rights available to you as a data subject under Philippine law.

This Policy applies to all personal data processed by ghplay in connection with the ghplay platform, regardless of the device or method used to access the platform. It should be read together with the ghplay Terms and Conditions and Responsible Gaming Policy, both available on the ghplay website.

For the purposes of the Philippine Data Privacy Act of 2012 (RA 10173), ghplay is the personal information controller in respect of personal data collected from players and visitors to the ghplay platform.

ghplay has appointed a Data Protection Officer (DPO) responsible for overseeing data privacy compliance. Contact details for the DPO are provided in Section 16 of this Policy. Players who have questions, requests, or complaints relating to their personal data should direct them to the DPO in the first instance.

ghplay collects the following categories of personal data in connection with player registration, account management, identity verification, and platform use:

• Full legal name (as it appears on government-issued Philippine ID);
• Date of birth;
• Email address;
• Philippine mobile number;
• Residential address (required during KYC verification).

• Copies of government-issued Philippine identification documents (e.g., PhilSys ID, UMID, Driver's License, Passport);
• Proof of address documents where required;
• Selfie or live photo where required for biometric verification;
• Source of funds declarations where requested under enhanced due diligence.

• GCash account identifier (number);
• PayMaya account identifier where used;
• Bank account details (BPI, BDO, Metrobank) where used for transactions;
• Transaction history including deposit amounts, withdrawal amounts, dates, and methods.

• Game session history, bet amounts, game type, and outcomes;
• Responsible gaming settings and limit configurations;
• Platform navigation behaviour and feature usage patterns;
• Customer support interaction history.

• IP address and geolocation data at login;
• Device type, operating system, and browser type;
• Session identifiers and login timestamps;
• Cookie data as described in Section 8.

ghplay collects personal data through the following channels and mechanisms:

• Directly from you — when you register a ghplay account, complete KYC verification, make a deposit or withdrawal, contact customer support, or update your account settings;
• Automatically — through cookies, session tracking, and server logs when you access and use the ghplay platform (see Section 8);
• From third-party payment processors — GCash, PayMaya, and partner banks may share transaction confirmation data with ghplay for payment reconciliation purposes;
• From identity verification service providers — third-party KYC and anti-money laundering screening services may provide verification status and risk signals to ghplay as part of the account verification process;
• From fraud prevention and security providers — IP reputation, device fingerprinting, and fraud screening data may be received from ghplay's security partners.

Under the Philippine Data Privacy Act, all personal data processing must have a valid legal basis. ghplay processes personal data on the following legal grounds:

• Contract performance: Processing necessary to provide the ghplay gaming and betting services you have registered to use, including account management, payment processing, and customer support;
• Legal obligation: Processing required to comply with applicable Philippine laws, including the Anti-Money Laundering Act (RA 9160 as amended), PAGCOR regulations, and the Data Privacy Act itself;
• Legitimate interests: Processing for fraud prevention, security monitoring, platform stability, and responsible gaming analytics, where ghplay's legitimate interests do not override your fundamental rights;
• Consent: Processing for direct marketing communications, where you have given explicit, informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

ghplay uses your personal data for the following specific purposes:

• Account creation and management: Creating, maintaining, and securing your ghplay account;
• Identity verification and age confirmation: Confirming your identity and that you meet the 21-year minimum age requirement under Philippine law;
• Payment processing: Processing deposits and withdrawals through GCash, PayMaya, BPI, BDO, Metrobank, and 7-Eleven;
• Anti-money laundering (AML) compliance: Screening transactions and account activity for suspicious patterns in compliance with RA 9160;
• Fraud prevention and platform security: Detecting and preventing unauthorised access, account takeover, and fraudulent transactions;
• Customer support: Responding to queries, complaints, and disputes submitted through live chat, email, or other support channels;
• Responsible gaming: Monitoring gaming behaviour to identify signs of problem gambling and administering deposit limits, self-exclusion requests, and cooling-off periods;
• Platform improvement: Analysing aggregated usage data to improve the ghplay platform experience for Filipino players;
• Marketing (with consent): Sending promotional communications about ghplay offers, new games, and events, where you have opted in to receive such communications.

ghplay does not sell your personal data. ghplay shares personal data with third parties only in the following controlled circumstances:

Transaction data is shared with GCash, PayMaya, partner banks (BPI, BDO, Metrobank), and 7-Eleven solely for the purpose of processing deposits and withdrawals. These processors act under binding data processing agreements and are not permitted to use your data for any other purpose.

Identity document data is shared with third-party KYC verification and AML screening providers for the purpose of fulfilling ghplay's legal identity verification obligations. These providers are bound by confidentiality and data security obligations.

Gaming session data (pseudonymised where possible) is shared with ghplay's game software providers (e.g., Pragmatic Play, Jili, PG Soft) solely to deliver the game functionality. These providers do not receive your identity documents or financial data.

ghplay will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other relevant Philippine government authorities where required by law, regulation, court order, or legal process.

In the event of a merger, acquisition, or sale of all or part of ghplay's business, personal data may be transferred to the acquiring entity as part of that transaction. Affected players will be notified prior to any such transfer and their consent will be sought where required by law.

The ghplay platform uses cookies and similar technologies to deliver core platform functionality, maintain session security, and analyse platform performance.

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that keep you logged in during a gaming session. These cannot be disabled without preventing platform use.
• Functional cookies: Remember your preferences (e.g., language, game lobby layout) to improve your experience on return visits.
• Performance and analytics cookies: Collect anonymous aggregate data about how players use the ghplay platform, which pages are visited most, and where errors occur. This data helps ghplay improve the platform for Filipino users.

You can manage or block non-essential cookies through your browser settings. Please note that disabling cookies may affect the functionality of the ghplay platform. Strictly necessary cookies cannot be blocked without preventing access to the platform entirely.

ghplay does not use third-party advertising network cookies or allow external ad networks to place tracking cookies on your device through the ghplay platform.

ghplay retains personal data only for as long as necessary for the purposes described in this Policy and to meet applicable legal and regulatory obligations. Specific retention periods by data category are as follows:

At the end of the applicable retention period, ghplay will securely delete or anonymise personal data in accordance with its data destruction procedures. Anonymised data that cannot be re-identified may be retained indefinitely for statistical purposes.

ghplay implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, and destruction:

• Transport encryption: All data transmitted between your device and ghplay servers is encrypted using 256-bit SSL/TLS;
• Password security: Passwords are hashed using industry-standard cryptographic algorithms. ghplay never stores passwords in plain text and no ghplay employee can read your password;
• Access controls: Access to personal data within ghplay is restricted on a strict need-to-know basis. Staff access rights are reviewed regularly and revoked upon role change or departure;
• Two-factor authentication: ghplay offers 2FA for player accounts and enforces it for internal staff systems accessing personal data;
• Monitoring: ghplay's security systems monitor for anomalous login behaviour, brute-force attempts, and data exfiltration in real time;
• Third-party security audits: ghplay engages independent security firms to conduct periodic penetration testing and security assessments of its systems.

To exercise any of the data subject rights described in this Policy — access, rectification, erasure, objection, data portability, or complaint — please contact the ghplay Data Protection Officer using the contact details provided in Section 16.

Please include in your request:

• Your full legal name and registered ghplay email address;
• A clear description of the right you wish to exercise;
• Any relevant details that will help ghplay locate your data or understand the nature of your request.

ghplay will respond to verified data subject requests within 15 business days of receipt. Where the request is complex or involves a large volume of data, ghplay may extend this period by a further 15 business days and will notify you accordingly.

ghplay will not charge a fee for standard data subject requests. However, ghplay reserves the right to charge a reasonable administrative fee or refuse manifestly unfounded or excessive requests.

To protect your data, ghplay will verify your identity before processing any data subject request. You may be asked to provide confirmation of your registered email address, mobile number, or a copy of your ID document.

If you are unsatisfied with ghplay's response to your data subject request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. Further information about the NPC and how to file a complaint is available on the NPC's official website.

ghplay may send you promotional communications about new games, special offers, bonuses, and ghplay platform updates where you have provided explicit consent to receive such communications at the time of account registration or subsequently through your account settings.

You may withdraw consent to marketing communications at any time by:

• Using the unsubscribe link included in any ghplay marketing email;
• Updating your communication preferences in your ghplay account settings;
• Contacting ghplay support directly and requesting removal from all marketing lists.

Withdrawal of marketing consent will not affect your access to the ghplay platform or the processing of your personal data for account management, KYC, payment, or legal compliance purposes. Following withdrawal, ghplay will process your opt-out within 5 business days.

ghplay does not engage in unsolicited SMS marketing to unregistered individuals. SMS communications are sent only to registered players who have provided a Philippine mobile number and consented to SMS notifications.

The ghplay platform is strictly intended for individuals aged 21 years and older in accordance with Philippine law. ghplay does not knowingly collect or process personal data belonging to individuals under the age of 21.

If ghplay discovers or is notified that personal data has been collected from a person under the age of 21, it will:

• Immediately suspend the associated account;
• Delete all personal data collected from the minor as expeditiously as possible, consistent with legal obligations;
• Refund any deposits made to the account via the original payment method.

Parents and guardians who believe a minor may have registered a ghplay account should contact ghplay support immediately. ghplay takes underage access seriously and will act promptly on all such reports.

In the event of a personal data breach that is likely to result in risk to the rights and freedoms of affected data subjects, ghplay will:

• Notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, as required under the Data Privacy Act and its Implementing Rules;
• Notify affected players without undue delay where the breach is likely to result in high risk to their rights, providing clear information about the nature of the breach, the data involved, and the steps ghplay is taking in response;
• Document the breach, its cause, its impact, and the remedial actions taken, in accordance with ghplay's data breach response procedures.

ghplay maintains a dedicated data breach response team and tests its incident response procedures regularly. All staff with access to personal data receive training on how to identify and report potential breaches promptly.

ghplay reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or ghplay's data processing practices. When material changes are made, ghplay will notify registered players through in-platform notifications and email to the registered address.

The effective date at the top of this Policy will be updated whenever a new version is published. Continued use of the ghplay platform following notification of changes to this Policy constitutes acceptance of the updated version. If you do not agree with any change, you should cease using the platform and request closure of your account.

Previous versions of this Privacy Policy are available upon request from the ghplay Data Protection Officer.

For all privacy-related enquiries, data subject requests, or concerns regarding this Privacy Policy or ghplay's data processing practices, please contact the ghplay Data Protection Officer. Filipino-English support is available 24 hours a day, 7 days a week.

For complaints that cannot be resolved directly with ghplay, you have the right to escalate to the National Privacy Commission (NPC) of the Philippines. The NPC is the regulatory authority responsible for enforcing the Data Privacy Act of 2012.