ggmaya Privacy Policy

ggmaya is the Philippines' trusted online casino and sports betting platform, accessible at ggmaya.net. We are fully committed to protecting the privacy and personal data of every player, visitor, and registered user who interacts with our platform. This Privacy Policy ("Policy") has been prepared in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR), as enforced by the National Privacy Commission (NPC) of the Philippines.

This Policy applies to all personal data we collect and process in connection with the ggmaya platform — whether accessed via web browser on desktop or mobile, or via any other interface we may make available. It covers data collected at the point of registration, during ongoing account use, in the course of financial transactions, and through our customer support channels.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference into this document. Together, these documents form the complete contractual and compliance framework governing your use of the ggmaya platform.

For the purposes of the Data Privacy Act of 2012, ggmaya acts as the Personal Information Controller (PIC) in respect of all personal data collected through the ggmaya platform. As PIC, we are responsible for determining the purposes and means of processing your personal data and for ensuring that all such processing is conducted lawfully, fairly, and transparently.

ggmaya operates within the regulatory framework established by the Philippine Amusement and Gaming Corporation (PAGCOR). Our operations are subject to PAGCOR's oversight, including its data governance requirements for licensed online gaming operators. Where PAGCOR's requirements impose additional or more stringent data protection obligations, ggmaya will comply with those requirements in addition to the baseline standards set by the DPA.

Our designated Data Protection Officer (DPO) is responsible for overseeing compliance with this Policy and with the DPA. You may contact our DPO at any time by writing to [email protected] with the subject line "Data Protection Officer."

ggmaya collects personal data across several categories. The table below summarises the main types of data we collect and their primary purpose:

ggmaya does not intentionally collect sensitive personal information (as defined under Section 3(l) of the DPA) unless strictly required for regulatory compliance — for example, where government-issued ID documents incidentally contain information such as religion or civil status. Where sensitive data is collected, we apply heightened security and access controls.

ggmaya collects personal data through the following channels:

• Direct collection at registration: When you create a ggmaya account, you voluntarily provide your name, date of birth, contact details, and other registration information.
• KYC verification submissions: When you submit identity documents and proof of address to complete account verification, we collect and store those documents securely.
• Financial transactions: When you make a deposit or request a withdrawal via GCash, Maya, BPI, BDO, Metrobank, or any other accepted payment method, our payment processing infrastructure captures the relevant financial data necessary to complete the transaction.
• Gameplay activity: Our gaming platform automatically logs all game sessions, bets placed, results, and account balance changes as part of our standard operational and regulatory record-keeping obligations.
• Technical and device data: Our servers automatically capture technical data such as your IP address, device identifiers, and browser information each time you access the ggmaya platform.
• Customer support interactions: Any time you contact our support team — whether by email, live chat, or any other channel we make available — the content of that communication is recorded and stored for service and compliance purposes.
• Cookies and tracking technologies: Our platform uses cookies and similar technologies to manage sessions, remember preferences, and collect analytics data. See Section 8 for details.

ggmaya processes your personal data for the following specific, declared purposes:

• Account creation and management: To register your account, verify your identity, and maintain your player profile throughout your relationship with ggmaya.
• Service delivery: To provide you with access to all ggmaya gaming services, including slots, live casino, bingo, jackpot games, and sports betting.
• KYC and AML compliance: To meet our legal obligations under PAGCOR regulations and Philippine anti-money laundering law, including the Anti-Money Laundering Act (AMLA) and its amendments.
• Financial transaction processing: To process your deposits and withdrawals accurately and securely through your chosen payment method.
• Fraud detection and prevention: To identify and prevent fraudulent activity, bonus abuse, account takeovers, and other security threats to our platform and to your account.
• Responsible gaming monitoring: To monitor gameplay patterns and identify indicators of problem gambling behaviour, enabling us to intervene appropriately in the player's best interest and in compliance with PAGCOR responsible gaming requirements.
• Customer support: To respond to your enquiries, resolve disputes, and provide technical assistance.
• Marketing communications (with consent): To send you personalised promotional offers, bonus notifications, and platform updates — but only where you have given your explicit consent to receive such communications. You may withdraw consent at any time.
• Legal and regulatory compliance: To comply with all applicable Philippine laws, PAGCOR directives, NPC regulations, court orders, and lawful requests from government authorities.
• Platform improvement: To analyse usage patterns, diagnose technical issues, and improve the performance and user experience of the ggmaya platform.

Under the Data Privacy Act of 2012, ggmaya relies on the following legal bases when processing your personal data:

• Contractual necessity (Section 12(b), DPA): Processing that is necessary for the performance of our contract with you — i.e., operating your ggmaya account and delivering our gaming services.
• Legal obligation (Section 12(c), DPA): Processing required to comply with Philippine law, including PAGCOR regulatory requirements, AMLA obligations, NPC directives, and court orders.
• Legitimate interests (Section 12(f), DPA): Processing necessary for the legitimate interests of ggmaya, provided those interests are not overridden by your rights — including fraud prevention, platform security, and analytics.
• Consent (Section 12(a), DPA): Where we rely on your consent — primarily for optional marketing communications — we will obtain that consent clearly and separately, and you may withdraw it at any time without affecting the lawfulness of prior processing.

ggmaya does not sell, rent, or commercially exploit your personal data. We share your data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Licensed technology and service providers (Personal Information Processors): We engage third-party companies to help us operate the ggmaya platform — including game software providers, payment gateway operators, cloud hosting providers, KYC verification services, and customer support platforms. All such providers are contractually bound by data processing agreements that require them to process your data only on our instructions and in accordance with the DPA.
• Payment processors: When you make a deposit or withdrawal via GCash, Maya, GrabPay, BPI, BDO, Metrobank, InstaPay, PesoNet, or 7-Eleven CLiQQ, we share the minimum necessary financial data with the relevant payment provider to complete the transaction.
• PAGCOR: As a PAGCOR-regulated operator, ggmaya is required to submit player data and gaming activity reports to PAGCOR in the format and at the frequency prescribed by PAGCOR's regulatory directives.
• Anti-Money Laundering Council (AMLC): Where required under the Anti-Money Laundering Act and its implementing rules, ggmaya reports covered and suspicious transactions to the AMLC. This is a mandatory legal obligation.
• National Privacy Commission (NPC): ggmaya complies with all NPC orders, investigations, and data breach notification requirements.
• Law enforcement and courts: Where required by law, court order, or other compulsory legal process, ggmaya will disclose personal data to the relevant authority. We will, where legally permitted, notify you of any such disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of ggmaya's business or assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and your rights under the DPA will be preserved.

ggmaya uses cookies and similar tracking technologies on the ggmaya.net platform. Cookies are small text files stored on your device that help us deliver a better, more personalised experience. We use the following categories of cookies:

• Strictly necessary cookies: These cookies are essential for the platform to function. They manage your login session, maintain your account security state, and remember your language preferences. These cookies cannot be disabled without breaking core platform functionality.
• Performance and analytics cookies: These cookies collect anonymised data about how players interact with the platform — such as which pages are visited most frequently and where technical errors occur. This data helps us improve platform performance and user experience.
• Functional cookies: These cookies remember your preferences — such as your preferred game lobby view or notification settings — so you do not have to reconfigure them on each visit.
• Marketing cookies (with consent): Where you have given your consent, these cookies help us show you relevant promotional content and track the effectiveness of our marketing campaigns. You can withdraw consent for marketing cookies at any time via your cookie preferences.

You can manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies may prevent you from logging in or using certain features of the ggmaya platform. We do not use cookies to collect sensitive personal information or to track your activity on third-party websites unrelated to ggmaya.

ggmaya retains your personal data for as long as is necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by applicable Philippine law or PAGCOR regulations.

The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account, plus a minimum of 5 years after account closure, in compliance with PAGCOR record-keeping requirements and AMLA obligations.
• KYC documents: Retained for a minimum of 5 years from the date of submission, as required under the Anti-Money Laundering Act and PAGCOR regulations.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, in compliance with AMLA and PAGCOR financial record-keeping obligations.
• Gaming activity data: Retained for a minimum of 3 years from the date of each session, for regulatory reporting and responsible gaming monitoring purposes.
• Customer support correspondence: Retained for 3 years from the date of the last communication, for quality assurance and dispute resolution purposes.
• Marketing preference data: Retained until you withdraw consent or close your account, whichever is earlier.

When personal data is no longer required for any of the above purposes, ggmaya will securely delete or anonymise it in accordance with our internal data disposal procedures. Anonymised data (which cannot be used to identify you) may be retained indefinitely for statistical and analytical purposes.

As a data subject under Republic Act No. 10173, you have the following rights with respect to your personal data held by ggmaya:

• Right to be informed: You have the right to be told what personal data ggmaya holds about you, how it is being used, and with whom it has been shared. This Privacy Policy is the primary means by which we fulfil this obligation.
• Right of access: You may request a copy of the personal data ggmaya holds about you at any time. We will respond to verified access requests within 15 business days.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update most account information directly in your account settings.
• Right to erasure (Right to be Forgotten): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations under PAGCOR regulations and the AMLA. We will inform you if a deletion request cannot be fully honoured due to these obligations.
• Right to data portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format, where technically feasible.
• Right to object: You may object to the processing of your personal data for marketing purposes at any time. You may also object to processing based on our legitimate interests, though we may be required to continue processing where we have compelling legitimate grounds or a legal obligation to do so.
• Right to file a complaint: If you believe ggmaya has violated your data privacy rights, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines.

ggmaya implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our key security controls include:

• Transport encryption: All data transmitted between your device and our servers is encrypted using TLS 1.3 protocol.
• At-rest encryption: Sensitive data stored in our databases — including KYC documents, financial records, and identity information — is encrypted using AES-256 encryption.
• Role-based access control: Access to personal data is strictly limited to ggmaya employees and contractors who have a legitimate operational need. All access is logged and regularly audited.
• Multi-factor authentication: ggmaya staff with access to systems containing personal data are required to use multi-factor authentication.
• Penetration testing: We conduct regular security assessments and penetration tests to identify and remediate vulnerabilities in our systems.
• Incident response: ggmaya maintains a documented data breach incident response procedure. In the event of a breach affecting your personal data, we will notify you and the NPC within the timelines required by NPC Circular 16-03.

While ggmaya takes all reasonable precautions to secure your data, no online system can be guaranteed to be 100% secure. You also have a role to play in keeping your account secure — please ensure you use a strong, unique password and enable OTP verification on your account. If you suspect any unauthorised access to your ggmaya account, please contact our support team immediately at [email protected].

ggmaya's gaming services are strictly intended for adults aged 21 years and above, in accordance with Philippine law and PAGCOR regulations governing online gambling. We do not knowingly collect, process, or retain personal data belonging to persons under the age of 21.

During account registration, all applicants are required to provide their date of birth and to submit government-issued identification confirming they meet the minimum age requirement. Any account found to have been registered by a person under 21 years of age will be immediately suspended and all funds will be handled in accordance with our Terms & Conditions and applicable law.

If you are a parent or guardian and you believe that a minor in your care has registered an account with ggmaya or submitted personal data to our platform, please contact us immediately at [email protected]. We will investigate and take prompt corrective action, including deletion of the minor's data where appropriate.

Some of ggmaya's technology service providers — including cloud infrastructure providers and game software vendors — may be located outside the Philippines. Where your personal data is transferred to a country outside the Philippines, ggmaya ensures that appropriate safeguards are in place to protect your data in accordance with the standards required by the Data Privacy Act of 2012 and NPC guidelines on cross-border data flows.

Such safeguards may include:

• Data processing agreements incorporating NPC-approved standard contractual clauses;
• Transfers to jurisdictions that the NPC has recognised as providing an adequate level of data protection; and
• Binding corporate rules where applicable within group structures.

You may request information about the specific safeguards in place for any cross-border transfer of your personal data by contacting our Data Protection Officer at [email protected].

ggmaya reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, NPC or PAGCOR regulatory requirements, or our platform's features and services. When we make material changes to this Policy, we will notify registered users by email and/or by posting a prominent notice on the ggmaya platform prior to the changes taking effect.

The "Effective Date" at the top of this Policy indicates when the current version came into force. We encourage you to review this Policy periodically to stay informed about how ggmaya is protecting your personal data. Your continued use of the ggmaya platform after any changes to this Policy have taken effect constitutes your acknowledgment of the updated Policy.

Previous versions of this Privacy Policy are available upon request by contacting our Data Protection Officer.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way ggmaya handles your personal data, please do not hesitate to get in touch with us. Our Data Protection Officer is dedicated to addressing all data privacy matters promptly and professionally.

If you are not satisfied with our response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines through their official regulatory channels. ggmaya fully cooperates with NPC investigations and takes all regulatory correspondence seriously.