ghplay Privacy Policy

This Privacy Policy ("Policy") is issued by ghplay ("ghplay", "we", "our", or "us"), the operator of the online gaming platform accessible at ghplay.cam, including its associated mobile applications and related digital services (the "Platform").

This Policy applies to all personal data collected from individuals who register an account, visit the Platform, or interact with ghplay in any capacity. It sets out the basis on which personal data is collected, processed, stored, and transferred in connection with the operation of the ghplay Platform.

ghplay processes personal data in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules and regulations, and the applicable issuances of the National Privacy Commission (NPC) of the Philippines. ghplay is registered with the NPC as a personal information controller in accordance with the requirements of the Data Privacy Act.

ghplay collects personal data from you directly when you register, verify, or interact with the Platform, and automatically through the use of our technology infrastructure. The categories of personal data we collect include:

ghplay does not knowingly collect sensitive personal information beyond what is strictly required for KYC verification and regulatory compliance. We do not collect biometric data, medical records, or political affiliations.

ghplay uses your personal data for the following purposes:

• Account creation and management: To register your ghplay account, verify your identity, and maintain your player profile.
• KYC and age verification: To verify that you meet the eligibility requirements, including the 21-year minimum age requirement under PAGCOR regulations, before permitting access to real-money gaming.
• Payment processing: To process deposits via GCash, Maya, BPI, BDO, Metrobank, and other accepted Philippine payment channels, and to process withdrawal requests to your verified payment method.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, account takeovers, money laundering, bonus abuse, and other prohibited conduct on the Platform.
• Regulatory compliance: To meet our obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), and the reporting requirements of the Anti-Money Laundering Council (AMLC).
• Customer support: To respond to your queries, resolve disputes, and manage escalations through our 24/7 Philippine-based support team.
• Responsible gaming: To monitor gaming behaviour and apply responsible gaming interventions — including deposit limits, loss alerts, and self-exclusion tools — in accordance with PAGCOR player protection requirements.
• Platform improvement: To analyse aggregate, anonymised usage data to improve the performance, stability, and features of the ghplay Platform.
• Marketing communications (where consented): To send you promotional offers, bonus notifications, and ghplay news via SMS or email, where you have provided consent and have not subsequently opted out.

ghplay does not use your personal data for purposes beyond those listed above without first obtaining your explicit consent or as otherwise required by applicable law.

Under the Philippine Data Privacy Act of 2012, ghplay processes your personal data on one or more of the following lawful bases:

• Contractual necessity: Processing is necessary to perform the contract entered into when you register a ghplay account and agree to these Terms and Conditions — including account management, payment processing, and game access.
• Legal obligation: Processing is required for ghplay to comply with applicable Philippine law, including PAGCOR licensing requirements, the AMLA, and NPC registration obligations.
• Legitimate interests: Processing is necessary for purposes of fraud prevention, platform security, responsible gaming monitoring, and improving the quality of our services — where such interests are not overridden by your rights and freedoms.
• Consent: For marketing communications and certain optional data collections, processing is based on your explicit consent, which may be withdrawn at any time without affecting the lawfulness of prior processing.

ghplay does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share your personal data only in the following limited circumstances:

• Payment processors: We share necessary transaction data with GCash, Maya, BPI, BDO, Metrobank, and other payment service providers to process your deposits and withdrawals. These providers process data only for the specific payment transaction and are bound by data processing agreements.
• KYC and identity verification providers: We use certified third-party identity verification services to process government-issued ID documents during the KYC process. These providers operate under strict data security requirements and process data solely for verification purposes.
• Fraud prevention and security services: We use fraud detection and cybersecurity partners to protect the ghplay Platform and its players. These services process limited technical data (such as IP address and device fingerprint) to identify suspicious activity.
• Game software providers: Certain gameplay data may be shared with licensed third-party game providers (such as Evolution Gaming and Pragmatic Play) to the extent necessary to deliver and audit game outcomes. These providers are bound by their own privacy commitments and gaming certification obligations.
• Regulatory authorities: ghplay is legally required to share information with PAGCOR, the AMLC, the NPC, and other Philippine government bodies upon lawful request or as mandated by applicable regulations — including reporting of suspicious transactions under the AMLA.
• Professional advisers: ghplay may share information with legal counsel, auditors, and other professional advisers where necessary and subject to professional confidentiality obligations.

ghplay implements technical, administrative, and physical security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and ghplay servers.
• Encryption of sensitive data fields (including payment details and government ID numbers) at rest in our database infrastructure.
• Role-based access controls ensuring that only authorised ghplay personnel with a legitimate business need may access player data.
• Multi-factor authentication for all internal administrative systems that process personal data.
• Regular third-party security audits and penetration testing of the ghplay Platform.
• Comprehensive security incident response procedures, including mandatory breach notification to the NPC and affected players where required under the Data Privacy Act.

While ghplay takes all reasonable precautions to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the security of your ghplay login credentials and should immediately notify our support team if you suspect any unauthorised access to your account.

ghplay retains your personal data for as long as necessary to fulfil the purposes for which it was collected, or as otherwise required by Philippine law. Specific retention periods are governed by the following considerations:

• Active accounts: Personal data associated with an active ghplay account is retained for the duration of the account and for a minimum of five (5) years following account closure, in accordance with PAGCOR record-keeping requirements and AMLA obligations.
• KYC documents: Identity verification documents are retained for a minimum of five (5) years from the date of verification, or longer where required by applicable AML regulations.
• Transaction records: Financial transaction records are retained for a minimum of five (5) years from the date of the transaction in compliance with AMLC reporting requirements.
• Gaming logs: Game session and betting history logs are retained for a minimum of three (3) years for dispute resolution and regulatory audit purposes.
• Customer support records: Live chat transcripts and support ticket records are retained for two (2) years following closure of the relevant support interaction.
• Marketing data: Where you have consented to marketing communications, your contact details are retained for this purpose until you withdraw consent or request deletion.

When personal data is no longer required and its retention is not mandated by law, ghplay will securely delete or anonymise it in accordance with our data disposal procedures.

ghplay uses cookies and similar tracking technologies — including web storage (localStorage and sessionStorage), pixel tags, and session identifiers — to operate and improve the Platform. The cookies we deploy fall into the following categories:

• Strictly necessary cookies: Required to maintain your login session, enforce security protections, and ensure the Platform functions correctly. These cannot be disabled without affecting platform functionality.
• Functional cookies: Used to remember your preferences — such as language settings, game lobby filters, and responsible gaming limit configurations. Disabling these does not prevent platform access but may reduce your experience.
• Performance and analytics cookies: Used to collect anonymised, aggregate data on how players navigate the Platform — page load times, error rates, and feature usage. This data is used exclusively for platform performance improvement.

ghplay does not deploy third-party advertising cookies or cross-site tracking cookies. We do not allow advertising networks or social media platforms to place tracking technologies on the ghplay Platform.

You may manage or disable cookies through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to your ghplay account.

Under the Philippine Data Privacy Act of 2012, you hold the following rights with respect to your personal data held by ghplay:

• Right to be informed: The right to be notified of the purpose and basis for which your data is being processed — which this Policy fulfils.
• Right to access: The right to request a copy of the personal data ghplay holds about you, including information on how it is being processed.
• Right to correct: The right to request correction of inaccurate or incomplete personal data in your ghplay account. Basic account information (name, address) can be updated directly; corrections to KYC records require identity re-verification.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the original purpose and no overriding legal obligation requires retention.
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes. You may opt out of marketing communications at any time by contacting support or updating your account notification preferences.
• Right to damages: The right to claim compensation for any damages you sustain as a result of ghplay's violation of the Data Privacy Act.
• Right to file a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data rights have been violated.

The ghplay Platform is strictly intended for individuals who are 21 years of age or older, in accordance with the minimum age for online casino gaming as prescribed by PAGCOR regulations in the Philippines.

ghplay does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the ghplay registration process, and accounts are not activated for real-money gaming until satisfactory age verification has been completed.

Parents and guardians who believe that a minor has registered a ghplay account should contact our support team immediately so the account can be investigated and closed without delay.

The ghplay Platform is operated primarily from the Philippines, and the majority of personal data processing occurs within the Philippines. However, certain service providers used by ghplay — including game software providers, cloud infrastructure partners, and fraud prevention services — may process data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, ghplay ensures that such transfers are made only to jurisdictions that provide an adequate level of data protection, or pursuant to contractual mechanisms that require the recipient to maintain data security standards consistent with those required by the Philippine Data Privacy Act.

ghplay does not transfer your personal data to jurisdictions for the purpose of avoiding Philippine data protection requirements. All international data processing arrangements are subject to the same data processing agreement protections applicable to domestic processing.

ghplay may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or platform functionality. Material changes to this Policy will be communicated to registered players via the mobile number or email address on their ghplay account, with a minimum of 14 days' notice before the updated Policy takes effect.

The "Last Updated" date at the top of this Policy indicates when the most recent version was issued. Continued use of the ghplay Platform after the effective date of any updated Privacy Policy constitutes your acceptance of that updated Policy.

We encourage you to review this Privacy Policy periodically. The current version is always accessible on the ghplay Platform at ghplay.cam/privacy-policy.

ghplay has appointed a Data Privacy Officer (DPO) in accordance with the requirements of the Philippine Data Privacy Act. The DPO is responsible for overseeing ghplay's data protection compliance and serves as the point of contact for player data rights requests, privacy complaints, and regulatory enquiries from the National Privacy Commission.

If you wish to exercise your data rights under this Policy, raise a privacy concern, or submit a data subject request, please contact us through the following channels:

• Live chat: Available 24/7 on the ghplay Platform — Philippine Standard Time, all days of the year. Mark your query as a "Data Privacy Request" when initiating the chat.
• Email: [email protected] — please use the subject line "Data Privacy Request" and include your registered ghplay username.

ghplay will acknowledge receipt of your request within 3 business days and will aim to resolve data rights requests within 30 calendar days. Where a request is complex or voluminous, we may extend this period by a further 30 days, in which case we will notify you of the extension before the original deadline.