gp88 Privacy Policy

1. Introduction

1.1 gp88 is committed to protecting the privacy and security of your personal information. We understand that Filipino players trust us with sensitive data, and we take that responsibility seriously. This Policy explains in plain language what information we collect, why we need it, and how we protect it.

1.2 This Policy applies to all personal data collected through the gp88 website at gp88.one, the gp88 mobile application, customer support interactions, and any other touchpoint through which you interact with gp88.

1.3 This Policy should be read together with our Terms & Conditions, which govern your use of the gp88 platform. Capitalised terms not defined in this Policy have the meanings given to them in the Terms & Conditions.

1.4 If you have any questions about this Policy or how gp88 handles your personal data, please contact our Data Protection Officer using the details in Section 14.

2. Data Controller

2.1 For the purposes of the DPA 2012, gp88 is the personal information controller in respect of the personal data it collects and processes in connection with the operation of the gp88 platform.

2.2 gp88 has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data protection laws. The DPO can be contacted at the details provided in Section 14 of this Policy.

2.3 gp88 is registered with the National Privacy Commission of the Philippines as required under the DPA 2012 and its Implementing Rules and Regulations.

3. Personal Data We Collect

3.1 gp88 collects personal data that is necessary for the operation of the platform, compliance with legal obligations, and the provision of a safe and personalised gaming experience. The categories of personal data we collect are set out below.

3.2 Sensitive Personal Information. gp88 may collect sensitive personal information as defined under the DPA 2012, including government-issued identification numbers, where required for KYC verification and PAGCOR compliance. Such data is handled with heightened security measures and is accessed only by authorised personnel on a strict need-to-know basis.

3.3 Data from Third Parties. gp88 may receive personal data about you from third-party identity verification providers, payment processors, and fraud prevention services engaged to support the operation of the platform. All such third parties are contractually required to handle your data in accordance with applicable law.

4. How We Use Your Personal Data

4.1 gp88 uses your personal data only for the purposes described in this Policy. We do not use your data in ways that are incompatible with the purposes for which it was originally collected. The primary purposes for which we process your personal data are:

• Account registration and management — to create and maintain your gp88 account, verify your identity, and manage your account settings;
• Platform operation — to provide access to games, process wagers, calculate winnings, and deliver the core gaming experience;
• Payment processing — to process deposits and withdrawals via GCash, PayMaya, and Philippine bank transfers, and to verify payment method ownership;
• KYC and age verification — to verify that you meet the 21+ age requirement and to comply with PAGCOR identity verification obligations;
• Legal and regulatory compliance — to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act, the DPA 2012, and other applicable Philippine laws;
• Fraud prevention and security — to detect, investigate, and prevent fraudulent activity, money laundering, and other prohibited conduct;
• Customer support — to respond to your enquiries, resolve disputes, and manage complaints;
• Responsible gaming — to monitor gaming patterns, apply responsible gaming tools, and identify players who may need support;
• Platform improvement — to analyse usage patterns and improve the functionality, performance, and user experience of the gp88 platform;
• Marketing communications — to send you promotional offers and updates about gp88, where you have consented to receive such communications.

4.2 You may opt out of marketing communications at any time by updating your communication preferences in your account settings or by contacting our support team. Opting out of marketing will not affect the processing of your data for other purposes described above.

5. Legal Basis for Processing

5.1 Under the DPA 2012, gp88 processes your personal data on the following legal bases:

• Contractual necessity — processing required to perform our contract with you, including account management, game provision, and payment processing;
• Legal obligation — processing required to comply with PAGCOR regulations, the AMLA, the DPA 2012, and other applicable Philippine laws;
• Legitimate interests — processing necessary for gp88's legitimate interests in fraud prevention, platform security, and service improvement, where such interests are not overridden by your rights;
• Consent — processing based on your freely given, specific, and informed consent, including for marketing communications and certain uses of sensitive personal information.

5.2 Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing & Disclosure

6.1 gp88 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your personal data only in the circumstances described below.

6.2 Service Providers

gp88 engages trusted third-party service providers to assist in operating the platform. These include identity verification providers, payment processors (GCash, PayMaya, Philippine banks), cloud hosting providers, customer support platforms, and fraud detection services. All service providers are bound by data processing agreements that require them to process your data only on gp88's instructions and in accordance with applicable law.

6.3 Regulatory and Law Enforcement Authorities

gp88 is required by law to share certain personal data with Philippine regulatory and law enforcement authorities, including:

• The Philippine Amusement and Gaming Corporation (PAGCOR) — for licensing compliance and player protection purposes;
• The Anti-Money Laundering Council (AMLC) — for suspicious transaction reporting under the AMLA;
• The National Privacy Commission (NPC) — in the event of a data breach or upon regulatory request;
• Other law enforcement agencies — where required by a valid court order or legal process.

6.4 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of gp88's assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and the privacy practices of the acquiring entity prior to the transfer taking effect.

7. Cookies & Tracking Technologies

7.1 gp88 uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyse usage patterns. The types of cookies we use are:

• Strictly necessary cookies — essential for the platform to function, including session management and security tokens. These cannot be disabled.
• Functional cookies — used to remember your preferences such as language settings and game display options.
• Analytics cookies — used to collect aggregated, anonymised data about how players use the platform, helping us improve performance and user experience.
• Responsible gaming cookies — used to track session duration and display reality check notifications in accordance with your responsible gaming settings.

7.2 You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the gp88 platform. Strictly necessary cookies cannot be disabled as they are essential for platform operation.

7.3 gp88 does not use third-party advertising cookies or allow third-party advertisers to place cookies on the gp88 platform.

8. Data Retention

8.1 gp88 retains your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

8.2 The following retention periods apply as a general guide:

• Account and identity data — retained for the duration of your account and for a minimum of five (5) years following account closure, as required by PAGCOR regulations and the AMLA;
• Financial transaction records — retained for a minimum of five (5) years from the date of the transaction, in accordance with AMLA requirements;
• Customer support records — retained for three (3) years from the date of the interaction;
• Technical and usage logs — retained for twelve (12) months from the date of collection, unless required for longer for fraud investigation or legal proceedings;
• Marketing consent records — retained for the duration of your consent and for three (3) years following withdrawal of consent.

8.3 When personal data is no longer required, gp88 will securely delete or anonymise it in accordance with our data destruction procedures.

9. Data Security

9.1 gp88 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include:

• TLS 1.3 encryption for all data in transit between your device and gp88 servers;
• AES-256 encryption for sensitive data stored at rest;
• Multi-factor authentication for all administrative access to systems containing personal data;
• Regular penetration testing and vulnerability assessments conducted by independent security firms;
• Role-based access controls ensuring that personal data is accessible only to authorised personnel with a legitimate need;
• Comprehensive staff training on data protection and information security;
• Incident response procedures for detecting, reporting, and managing personal data breaches.

9.2 Data Breach Notification. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, gp88 will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with the DPA 2012.

9.3 While gp88 takes all reasonable steps to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. You are responsible for maintaining the security of your account credentials and for notifying gp88 immediately if you suspect any unauthorised access to your account.

10. Your Data Subject Rights

10.1 Under the DPA 2012, you have the following rights in relation to your personal data held by gp88:

• Right to be informed — the right to be informed about how your personal data is collected and used, as set out in this Policy;
• Right of access — the right to request a copy of the personal data gp88 holds about you;
• Right to rectification — the right to request correction of inaccurate or incomplete personal data;
• Right to erasure — the right to request deletion of your personal data, subject to gp88's legal retention obligations;
• Right to object — the right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests;
• Right to data portability — the right to receive your personal data in a structured, commonly used, and machine-readable format;
• Right to lodge a complaint — the right to lodge a complaint with the National Privacy Commission if you believe your data protection rights have been violated.

10.2 To exercise any of your data subject rights, please submit a written request to our Data Protection Officer using the contact details in Section 14. gp88 will respond to your request within thirty (30) days of receipt. In complex cases, this period may be extended by a further thirty (30) days, and you will be notified of any extension.

11. Children's Privacy

11.1 The gp88 platform is strictly intended for persons aged twenty-one (21) years and above. gp88 does not knowingly collect personal data from persons under the age of 21.

11.2 If gp88 becomes aware that it has inadvertently collected personal data from a person under the age of 21, it will immediately suspend the relevant account, delete the personal data, and report the matter to PAGCOR as required.

11.3 If you are a parent or guardian and believe that your child has registered an account with gp88, please contact our support team immediately using the details in Section 14.

12. International Data Transfers

12.1 gp88 primarily stores and processes personal data within the Philippines. Where it is necessary to transfer personal data outside the Philippines — for example, to cloud infrastructure providers or technology partners — gp88 ensures that such transfers are made in accordance with the DPA 2012 and that the recipient provides an adequate level of data protection.

12.2 International transfers of personal data are protected by appropriate safeguards, including standard contractual clauses approved by the National Privacy Commission, binding corporate rules, or transfers to countries recognised as providing adequate data protection.

13. Changes to This Policy

13.1 gp88 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes, we will notify you by email to your registered address and by posting a prominent notice on the gp88 platform at least seven (7) days before the changes take effect.

13.2 The "Last Updated" date at the top of this Policy indicates when it was most recently revised. We encourage you to review this Policy periodically to stay informed about how gp88 protects your personal data.

13.3 Your continued use of the gp88 platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you must cease using the platform and may close your account in accordance with the Terms & Conditions.

14. Contact Our Data Protection Officer

14.1 If you have any questions, concerns, or requests relating to this Privacy Policy or the way gp88 handles your personal data, please contact our Data Protection Officer:

14.2 If you are not satisfied with gp88's response to your data protection concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). Information about how to contact the NPC is available through official Philippine government channels.

14.3 For general customer support enquiries unrelated to data privacy, please contact our 24/7 support team at [email protected].