ghplay Privacy Policy

1. Data Controller

ghplay ("ghplay," "we," "us," "our") is the data controller for personal data collected through the ghplay platform at ghplay.club. As data controller, ghplay determines the purposes for which and the means by which personal data is processed. For all data protection enquiries, please contact our support team using the details in Section 14 of this Policy.

This Privacy Policy applies to all registered ghplay account holders, visitors to the ghplay website, and any individual who interacts with ghplay's customer support channels. It does not apply to third-party websites or services that may be linked from the ghplay platform.

2. Personal Data We Collect

ghplay collects the following categories of personal data from its users:

ghplay does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information, and requests that you do not provide such information through the platform.

3. How We Collect Personal Data

ghplay collects personal data through the following means:

• Direct collection: Information you provide when registering a ghplay account, completing KYC verification, making deposits or withdrawals, or contacting ghplay customer support.
• Automated collection: Technical data (IP address, device identifiers, browser type, session data) collected automatically when you access the ghplay platform through cookies, server logs, and similar technologies.
• Third-party sources: Payment processor confirmation data from GCash, Maya, BPI, BDO, and other payment partners, solely for the purpose of verifying and reconciling financial transactions.
• Identity verification providers: Where ghplay uses a third-party KYC verification service, identity document data may be processed by that provider as a data processor under contract with ghplay.

4. Purposes of Data Processing

ghplay processes your personal data for the following purposes:

• Creating and maintaining your ghplay account and verifying your identity.
• Processing deposits, withdrawals, and other financial transactions in Philippine Peso.
• Complying with anti-money laundering (AML), counter-terrorism financing (CTF), and Know Your Customer (KYC) obligations under Philippine law.
• Preventing and detecting fraud, cheating, and other prohibited activities on the platform.
• Providing customer support and responding to your enquiries.
• Sending transactional communications (account alerts, OTPs, security notifications).
• Sending promotional communications, where you have opted in to receive them.
• Analysing platform usage to improve ghplay's products and services.
• Enforcing ghplay's Terms & Conditions and other applicable policies.
• Complying with orders, investigations, or requests from Philippine regulatory authorities, including PAGCOR, the AMLC, and law enforcement agencies.

5. Legal Basis for Processing

ghplay processes your personal data on the following legal bases under applicable Philippine data protection law (Republic Act No. 10173, the Data Privacy Act of 2012, and its Implementing Rules and Regulations):

• Contractual necessity: Processing required to fulfil our obligations under the ghplay Terms & Conditions, including account management, transaction processing, and customer support.
• Legal obligation: Processing required to comply with AML, KYC, tax, and other regulatory obligations applicable to ghplay as a Philippine-regulated gaming operator.
• Legitimate interests: Processing for fraud prevention, platform security, and analytics that does not override your fundamental rights and freedoms.
• Consent: Processing for marketing communications, where you have provided explicit, informed consent. You may withdraw consent at any time.

6. Data Sharing and Disclosure

ghplay does not sell, rent, or commercially trade your personal data. We may share your data with the following categories of recipients for the purposes described in this Policy:

• Payment processors: GCash (Globe Fintech Innovations), Maya (Voyager Innovations), and Philippine commercial banks — solely for transaction processing.
• Game providers: Technology providers such as Pragmatic Play, PG Soft, Jili, and others who provide the games accessible through the ghplay platform. These providers process technical data (e.g., session tokens) necessary to deliver the game experience.
• KYC/identity verification providers: Third-party identity verification services engaged by ghplay to process KYC documents under data processing agreements.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and Philippine law enforcement agencies, where ghplay is legally required or compelled to disclose information.
• Legal and professional advisors: Lawyers, auditors, and other professional service providers, under strict confidentiality obligations.

All third-party data processors engaged by ghplay are contractually bound to process your data only on ghplay's documented instructions and to maintain appropriate technical and organisational security measures.

7. International Data Transfers

Some of ghplay's technology providers and game studios are based outside the Philippines. Where personal data is transferred to a country or territory that does not provide an equivalent level of data protection to the Philippines, ghplay ensures that such transfers are governed by appropriate contractual safeguards, including standard contractual clauses or equivalent mechanisms, in accordance with the Data Privacy Act of 2012 and the guidelines of the National Privacy Commission.

8. Data Retention

ghplay retains personal data for as long as necessary to fulfil the purposes described in this Policy, and in any event for minimum periods required by Philippine law. The following general retention periods apply:

• Account data: Retained for the life of your ghplay account and for a minimum of 5 years after account closure, as required by Philippine AML regulations.
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction.
• KYC documents: Retained for a minimum of 5 years from submission, or longer if required by a regulatory investigation.
• Customer support communications: Retained for 2 years from the date of the last interaction.
• Marketing consent records: Retained for 3 years from the date consent was given or withdrawn.

Upon expiry of the applicable retention period, ghplay will securely delete or anonymise your personal data.

9. Security Measures

ghplay implements technical and organisational measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and the ghplay platform.
• Hashed (bcrypt) storage of account passwords — ghplay does not store passwords in plain text.
• Tokenisation of payment method identifiers — ghplay does not store full GCash numbers or bank account numbers in recoverable form.
• Role-based access controls limiting ghplay staff access to personal data on a need-to-know basis.
• OTP two-factor authentication for account login and sensitive account changes.
• Regular security assessments and penetration testing of the ghplay platform.

While ghplay takes all reasonable steps to protect your data, no digital platform can guarantee absolute security. In the event of a personal data breach that is likely to result in harm to affected individuals, ghplay will notify the National Privacy Commission and affected players in accordance with the requirements of the Data Privacy Act of 2012.

10. Your Data Protection Rights

Under the Data Privacy Act of 2012 (Republic Act No. 10173), you have the following rights in relation to your personal data held by ghplay:

• Right to be informed: You have the right to be informed about how ghplay collects and processes your personal data — which this Policy fulfils.
• Right of access: You may request a copy of the personal data ghplay holds about you by contacting our support team.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data held by ghplay.
• Right to erasure: You may request deletion of your personal data, subject to ghplay's legal retention obligations under Philippine AML and gaming regulations.
• Right to object: You may object to processing of your personal data for direct marketing purposes at any time.
• Right to data portability: You may request a machine-readable copy of personal data you have provided to ghplay, where technically feasible.
• Right to lodge a complaint: If you believe ghplay has not handled your personal data lawfully, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

To exercise any of these rights, contact ghplay support via live chat or email at [email protected]. ghplay will respond to verified requests within 15 business days.

11. Cookies and Similar Technologies

ghplay uses cookies and similar technologies on the ghplay platform. Cookies are small text files stored on your device that help ghplay deliver a functional and personalised experience. The cookies used by ghplay fall into the following categories:

• Essential cookies: Required for the platform to function — maintaining your login session, security tokens, and language preferences. These cannot be disabled without affecting platform functionality.
• Analytics cookies: Used to collect aggregated, anonymised data about how players navigate the ghplay platform — pages visited, session duration, and feature usage. This data is used solely to improve the platform and is not linked to your personal identity.
• Preference cookies: Stores your platform settings and preferences (e.g., preferred game category, display settings) to improve your experience on return visits.

ghplay does not use third-party advertising or retargeting cookies. You can control and delete cookies through your browser settings. Disabling essential cookies may affect your ability to use certain ghplay features, including the login process.

12. Minors and Age Restriction

ghplay is strictly an adults-only platform. The minimum age to register and use ghplay is 21 years, in accordance with Philippine gaming regulations. ghplay does not knowingly collect or process personal data from any individual under 21 years of age. If ghplay discovers or is notified that an account has been opened by or on behalf of a person under 21, the account will be immediately suspended, all balances will be forfeited, and any personal data associated with the account will be deleted in accordance with our data retention schedule.

If you believe a minor has registered a ghplay account, please notify ghplay support immediately at [email protected] so that appropriate action can be taken without delay.

13. Changes to This Privacy Policy

ghplay reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or platform functionality. Material changes will be communicated to registered ghplay players via email to the registered address or via an in-platform notification. The "Last updated" date at the top of this Policy will always reflect when the most recent revision was made. Your continued use of the ghplay platform following notification of a change constitutes your acceptance of the revised Policy.

14. Contact and Data Privacy Enquiries

For all privacy-related enquiries, requests to exercise your data rights, or to report a potential data protection issue, please contact the ghplay data protection team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via the ghplay platform. Response time under 5 minutes for support queries; data rights requests responded to within 15 business days.

For complaints that cannot be resolved through ghplay's internal process, you may contact the National Privacy Commission of the Philippines (NPC). Contact details for the NPC are publicly available through official Philippine government channels.