This Privacy Policy describes how gfplay ("gfplay," "we," "us," or "our") collects, uses, stores, and protects the personal information of registered account holders and visitors to the gfplay platform at gfplay.vip. By creating a gfplay account or using the platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.
gfplay is an online gaming platform operated under a PAGCOR (Philippine Amusement and Gaming Corporation) license, providing casino games, sports betting, live sabong, bingo, and related entertainment services to eligible Filipino players. In the course of operating these services, gfplay necessarily collects and processes personal data belonging to account holders and platform visitors.
This Privacy Policy applies to all personal data collected through: (a) the gfplay website at gfplay.vip; (b) the gfplay account registration and login processes; (c) customer support communications; (d) payment processing activities; and (e) KYC (Know Your Customer) identity verification procedures.
This Policy does not apply to third-party websites, services, or platforms that may be referenced or accessible through links on gfplay, including game studio platforms, payment processors, or other external services. gfplay is not responsible for the privacy practices of third parties.
gfplay processes personal data in its capacity as a Personal Information Controller (PIC) as defined under Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations issued by the National Privacy Commission of the Philippines.
gfplay collects the following categories of personal data in connection with the provision of its services:
gfplay collects personal data through the following channels:
| Collection Method | Data Collected |
|---|---|
| Account Registration Form | Name, date of birth, mobile number, email address, chosen password |
| KYC Verification Portal | Government ID scans, selfie photo, proof of address documents |
| Payment Processing | GCash / Maya / bank account numbers, transaction amounts, reference numbers |
| Platform Usage (Automated) | IP address, device data, session logs, gameplay records, click activity |
| Customer Support | Communications content, account queries, dispute records |
| Third-Party Verification Services | Identity confirmation data from licensed KYC and AMLA compliance partners |
gfplay processes personal data only for specific, legitimate purposes directly connected to the provision of its licensed gaming services. The following table sets out the primary purposes for which each category of data is processed:
| Purpose | Data Categories Used |
|---|---|
| Account creation and authentication | Identity data, contact data, device data |
| Age verification (21+ PAGCOR requirement) | Date of birth, KYC documents |
| Payment processing and wallet management | Financial data, transaction history |
| AMLA compliance and fraud prevention | Identity data, KYC data, financial data, transaction history |
| Responsible gaming enforcement | Gameplay data, activity data, self-exclusion status |
| PAGCOR regulatory reporting | Identity data, transaction data, gameplay records |
| Customer support and dispute resolution | All account data, communications history |
| Platform security and fraud detection | Device data, IP data, session data, behavioral patterns |
| Service improvement and analytics | Aggregated, anonymized gameplay and usage data |
| Promotional communications (with consent) | Contact data, game preference data |
gfplay will only send promotional emails or SMS messages to your registered contact details if you have provided explicit consent at registration or through your account settings. You may withdraw consent to marketing communications at any time by updating your account preferences. Withdrawal of marketing consent does not affect gfplay's ability to send transactional communications required for account management.
Under the Data Privacy Act of 2012 and its Implementing Rules, gfplay processes personal data on the following legal bases:
gfplay does not sell your personal data to any third party for commercial purposes. Personal data is shared only where strictly necessary for the provision of gfplay's licensed services, in accordance with the following categories of recipients:
gfplay is legally required to disclose personal and financial data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities upon lawful request or as required by PAGCOR's reporting framework. These disclosures are mandatory and not subject to player consent.
Deposits and withdrawals involve the processing of your financial data by GCash (G-Xchange, Inc.), Maya (Paymaya Philippines, Inc.), BancNet, and other licensed Philippine payment service providers. Each processor handles your data under their own privacy policies and as required by Bangko Sentral ng Pilipinas (BSP) regulations.
gfplay engages licensed third-party KYC service providers to assist with identity verification and AMLA compliance screening. These providers process identity documents and verification data under strict contractual data processing agreements that impose obligations equivalent to or exceeding those required by the Data Privacy Act.
Game providers (including JILI, Pragmatic Play, PG Soft, and others integrated into the gfplay platform) may receive pseudonymized session data for the purpose of game delivery and dispute resolution. gfplay does not transmit full identity information to game studios beyond what is technically required for game session management.
Legal, accounting, and compliance advisors may access personal data where strictly necessary for the provision of professional services to gfplay — subject to applicable professional privilege and confidentiality obligations.
gfplay retains personal data for as long as necessary to fulfill the purposes set out in this Privacy Policy and to comply with applicable legal and regulatory obligations. The following retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | PAGCOR / AMLA legal obligation |
| KYC identity documents | Duration of account + 5 years post-closure | Republic Act No. 9160 (AMLA) |
| Transaction / financial records | Minimum 5 years from transaction date | AMLA / PAGCOR reporting |
| Gameplay session records | 3 years from session date | PAGCOR compliance / dispute resolution |
| Customer support records | 3 years from last interaction | Contractual / dispute resolution |
| Marketing consent records | Duration of consent + 2 years | NPC accountability requirements |
Upon expiry of the applicable retention period, personal data will be securely destroyed or permanently anonymized in accordance with gfplay's data disposal protocols and NPC guidelines on secure disposal of personal data.
gfplay implements organizational, physical, and technical security measures designed to protect your personal data from unauthorized access, disclosure, alteration, loss, or destruction. These measures include, but are not limited to:
In the event of a personal data breach that is likely to result in harm to affected data subjects, gfplay will comply with its mandatory breach notification obligations under the Data Privacy Act and NPC Circular No. 16-03 — notifying the NPC within 72 hours of becoming aware of the breach and notifying affected users without undue delay.
Under the Data Privacy Act of 2012 and NPC regulations, all gfplay account holders who are Philippine data subjects are entitled to the following rights regarding their personal data held by gfplay. To exercise any right below, contact gfplay at [email protected] with the subject line "Data Subject Rights Request."
You have the right to request a copy of the personal data gfplay holds about you and information about how it is being processed.
You have the right to request correction of inaccurate or incomplete personal data held in your gfplay account records.
You may request deletion of personal data where it is no longer necessary for the purposes for which it was collected — subject to legal retention obligations.
You may object to processing carried out on the basis of gfplay's legitimate interests, including direct marketing, at any time.
You may request a structured, machine-readable copy of personal data you provided to gfplay in a commonly used format.
If you believe gfplay has not handled your personal data in accordance with the DPA, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.
gfplay will acknowledge all data subject rights requests within five (5) business days of receipt and will endeavor to fulfill or formally respond to the request within fifteen (15) calendar days, in accordance with NPC guidelines. Where a request is complex or involves a large volume of data, gfplay may extend this period by a further fifteen (15) days with prior notification to the requesting party.
gfplay uses cookies and similar tracking technologies on the gfplay.vip website to operate the platform, maintain login sessions, and improve the user experience. The following categories of cookies are used:
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Strictly Necessary | Login session management, security tokens, CSRF protection. Required for the platform to function. | No — essential for service |
| Functional | Language preferences, game lobby display settings, remembered login details (where enabled by user). | Yes — via account settings |
| Analytics | Aggregate platform usage data to understand feature popularity and improve the gfplay experience. Data is anonymized. | Yes — via cookie consent |
| Security / Fraud Detection | Device fingerprinting for duplicate account detection, unusual login pattern identification, and fraud prevention. | No — required for platform security |
You can manage your cookie preferences through your browser settings. Disabling strictly necessary or security cookies may prevent you from accessing certain features of the gfplay platform, including the login function. gfplay does not use third-party advertising cookies or cross-site behavioral tracking technologies.
The gfplay platform is strictly for adults aged 21 years and older, as required by PAGCOR and applicable Philippine law. gfplay does not knowingly collect or process personal data from any person under the age of 21. Age is verified at registration through the mandatory age declaration and through KYC document verification. If gfplay discovers that an account has been created by or on behalf of a person under 21 years of age, that account will be immediately suspended, all associated data will be reviewed, and the account will be permanently closed. The incident may be reported to PAGCOR in accordance with gfplay's regulatory reporting obligations.
Parents and guardians who believe that a person under 21 in their care has created a gfplay account should contact gfplay immediately at [email protected]. gfplay will treat such reports as a priority and process the resulting account review within one (1) business day.
Some of gfplay's third-party service providers — including game studio technology partners and KYC verification services — may process or store personal data on servers located outside of the Republic of the Philippines. Where such cross-border transfers occur, gfplay ensures that appropriate safeguards are in place in accordance with NPC guidelines on cross-border data transfers, including:
gfplay's primary server infrastructure is located in data centers with ISO 27001 certification and PCI-DSS compliant payment processing environments.
gfplay reserves the right to amend this Privacy Policy at any time to reflect changes in law, regulatory guidance, platform features, or data processing practices. When material changes are made, gfplay will provide notice through one or more of the following methods: (a) a prominent notice on the gfplay platform at your next login; (b) an email notification to your registered address; or (c) an SMS notification to your registered Philippine mobile number.
The effective date of any revised Privacy Policy will be stated at the top of the updated document. Your continued use of the gfplay platform after the effective date of a revised Privacy Policy constitutes your acknowledgment of and consent to the updated terms, to the extent permitted by the Data Privacy Act. If you do not agree to a revised Privacy Policy, you should cease use of the gfplay platform and contact support to close your account.
The current version of this Privacy Policy is always accessible at gfplay.vip/privacy-policy. gfplay maintains an internal archive of all prior Privacy Policy versions, which are available to data subjects upon written request.
gfplay has appointed a Data Protection Officer (DPO) in accordance with Section 21 of the Data Privacy Act of 2012 and NPC Circular No. 17-01. The DPO is responsible for overseeing gfplay's data governance framework, ensuring compliance with the DPA, and acting as the primary point of contact for data subject rights requests and regulatory inquiries.
For any privacy-related inquiries, data subject rights requests, consent withdrawals, or data breach reports, please contact gfplay's Data Protection Officer using the details below. All communications must be in English and include your registered mobile number or email address for identity verification purposes.
| Contact Type | Contact Detail | Response Time |
|---|---|---|
| Data Subject Rights Requests | [email protected] | Within 5 business days (acknowledgment) |
| Marketing Opt-Out / Consent Withdrawal | [email protected] | Within 2 business days |
| Suspected Data Breach Reporting | [email protected] | Immediate priority handling |
| General Privacy Inquiries | [email protected] | Within 3 business days |
If you are unsatisfied with gfplay's response to your data subject rights request or privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines through NPC's official complaint procedures.
Six core commitments that define how gfplay handles every Filipino player's personal data
gfplay is fully compliant with Republic Act No. 10173 (Data Privacy Act of 2012) and all NPC Implementing Rules. Every data processing activity is documented, lawfully based, and aligned with Philippine data governance standards — not foreign frameworks bolted on as an afterthought.
gfplay does not sell, lease, or trade your personal information to any third party for commercial purposes — full stop. Data is shared only where legally required by PAGCOR and AMLA regulations, or with service providers that directly support your gfplay account under strict contractual protections.
Your personal and financial data is protected with 256-bit TLS encryption in transit and AES-256 encryption at rest — the same standards used by BSP-supervised financial institutions in the Philippines. Your GCash number, bank account, and identity documents are encrypted at every layer.
gfplay recognizes your full set of rights under the Data Privacy Act — access, rectification, erasure, objection, and data portability. Rights requests are acknowledged within five business days. gfplay cooperates fully with NPC complaint procedures for any unresolved privacy concerns.
gfplay has appointed a DPO in compliance with NPC Circular No. 17-01. The DPO is responsible for overseeing data governance, handling rights requests, and ensuring gfplay's data practices remain aligned with the DPA and evolving NPC guidance — not just at launch, but continuously.
gfplay does not knowingly collect personal data from any person under 21 years of age. Age is verified at registration through mandatory date-of-birth declaration and KYC document review. Accounts found to belong to underage persons are closed immediately and the matter reported to PAGCOR.
Your data is protected under Philippine law and gfplay's PAGCOR-regulated privacy framework. Create your account knowing exactly how your information is handled. 21+ only. Play responsibly.