ggpaldo Privacy Policy

This Privacy Policy ("Policy") describes how ggpaldo ("the Company," "we," "us," or "our") collects, processes, uses, stores, and protects the personal data of users ("you," "Player," or "User") of the ggpaldo website at https://ggpaldo.net and all associated applications, services, and platforms (collectively, the "Platform").

ggpaldo is committed to protecting the privacy and personal data of all players in the Philippines in full compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC). We are also subject to data-related obligations under PAGCOR's licensing requirements and the Anti-Money Laundering Act of 2001 (Republic Act No. 9160, as amended).

This Policy applies to all personal data collected from registered players, visitors to the Platform, and individuals who contact ggpaldo's support channels. By accessing or using the Platform, you acknowledge that you have read, understood, and agree to the collection and processing of your personal data as described in this Policy.

For the purposes of the Data Privacy Act of 2012, the data controller responsible for your personal data is:

• Brand Name: ggpaldo
• Website: https://ggpaldo.net
• Jurisdiction: Republic of the Philippines
• Regulatory Authority: Philippine Amusement and Gaming Corporation (PAGCOR)
• Privacy Contact: [email protected]

ggpaldo has designated a Data Protection Officer (DPO) in accordance with the requirements of the Data Privacy Act and NPC regulations. The DPO is responsible for overseeing ggpaldo's data protection strategy, ensuring compliance with applicable privacy laws, and serving as the primary point of contact for data subject requests and NPC inquiries. You may reach the DPO at the contact address listed in Section 14 of this Policy.

ggpaldo collects the following categories of personal data, depending on how you interact with the Platform:

ggpaldo collects personal data through the following channels and methods:

• Direct Collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawal requests, submitting support tickets, or participating in promotions and surveys.
• Automated Technical Collection: Data collected automatically when you access and use the Platform, including IP addresses, device identifiers, browser fingerprints, and session activity logs. This is collected via server logs, cookies, and similar tracking technologies.
• Payment Provider Data: Transaction confirmation data received from GCash, PayMaya, BPI, BDO, Metrobank, and other payment partners when you initiate deposits or withdrawals. ggpaldo does not store full card or e-wallet account numbers — only masked references used for transaction reconciliation.
• Identity Verification Providers: Results and data outputs from third-party KYC verification services engaged to validate government-issued identification documents and perform liveness checks.
• Regulatory Databases: Information obtained from PAGCOR's self-exclusion registry and other regulatory databases as required for compliance screening.
• Support Interactions: Transcripts and records of your communications with ggpaldo's 24/7 support team via live chat and email.

Under the Data Privacy Act of 2012, ggpaldo processes your personal data on the following legal grounds:

• Contractual Necessity: Processing required to perform the contract between you and ggpaldo — specifically, to register and manage your player account, process deposits and withdrawals, and deliver gaming services.
• Legal Obligation: Processing required to comply with Philippine law, including PAGCOR licensing requirements, Anti-Money Laundering Act obligations (AMLA/R.A. 9160), and NPC data breach notification requirements.
• Legitimate Interests: Processing necessary for ggpaldo's legitimate business interests, including fraud prevention, security monitoring, platform performance optimization, and responsible gaming oversight — provided these interests are not overridden by your data protection rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — for example, for direct marketing communications. You may withdraw consent at any time by contacting support or updating your account preferences; withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

ggpaldo uses your personal data for the following specific purposes:

• Account Registration & Management: Creating and maintaining your player account, verifying your identity and eligibility (age 21+), managing your account preferences, and processing account closure requests.
• KYC & AML Compliance: Verifying your identity documents, screening against PAGCOR exclusion lists, performing source-of-funds checks for large transactions, and filing mandatory reports to the Anti-Money Laundering Council (AMLC) as required by R.A. 9160.
• Payment Processing: Facilitating deposits and withdrawals via GCash, PayMaya, and local bank channels; reconciling transactions; and investigating disputed transactions.
• Gaming Services: Delivering casino games, live dealer tables, sports betting markets, bingo, slots, and all other Platform features; tracking bet and wagering history for settlement purposes.
• Responsible Gaming: Monitoring wagering patterns for indicators of problem gambling; enforcing deposit limits, self-exclusion periods, and cooling-off requests; complying with PAGCOR's Responsible Gaming Framework.
• Promotions & Bonuses: Determining eligibility for and administering bonuses, free spins, cashback offers, and loyalty rewards.
• Customer Support: Responding to your inquiries, complaints, and dispute escalations; maintaining support records for quality assurance and regulatory audit purposes.
• Security & Fraud Prevention: Detecting and preventing unauthorized account access, fraudulent transactions, collusion, bonus abuse, and use of prohibited software or bots.
• Platform Improvement: Analyzing aggregated usage data to improve game performance, fix bugs, enhance the user interface, and optimize the overall player experience.
• Marketing Communications (Consent-Based): Sending promotional emails or SMS messages about new games, special offers, and tournaments — only where you have provided consent and only via channels you have authorized.
• Legal & Regulatory Compliance: Responding to lawful requests from PAGCOR, NPC, AMLC, or other Philippine government authorities; complying with court orders and legal proceedings.

ggpaldo does not sell your personal data. We share your data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• Payment Service Providers: GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, and other Philippine payment partners — for the sole purpose of processing your deposits and withdrawals.
• Identity Verification & KYC Providers: Third-party providers engaged to verify government-issued identification documents and conduct liveness checks as part of our KYC process. These providers are contractually prohibited from using your data for any purpose other than the KYC service rendered for ggpaldo.
• Regulatory Authorities: PAGCOR (as licensing authority), AMLC (for mandatory AML reports under R.A. 9160), the National Privacy Commission (NPC), and other Philippine government agencies as required by law or by lawful order.
• IT Infrastructure & Cloud Service Providers: Providers of hosting, database, and cloud infrastructure services used to operate the Platform. These providers are bound by strict data processing agreements and are not permitted to process your data for their own purposes.
• Game Content Providers: In limited cases, game providers whose titles are integrated into the Platform may receive anonymized session and bet data for game performance and integrity monitoring purposes. Personally identifiable data is not shared with game providers.
• Legal & Compliance Advisors: Philippine legal counsel and compliance consultants engaged to advise ggpaldo on regulatory matters, where access to specific player data is necessary and subject to professional confidentiality obligations.

Any third party that receives personal data from ggpaldo is required to handle it in accordance with the Data Privacy Act of 2012 and is contractually bound via a Data Sharing Agreement (DSA) or Data Processing Agreement (DPA) as applicable under NPC regulations.

ggpaldo does not transfer your personal data to recipients outside the Philippines unless there is a legal basis for the transfer and adequate data protection safeguards are in place, consistent with NPC guidelines on cross-border data transfers.

ggpaldo uses cookies and similar tracking technologies to operate the Platform, enhance your experience, and fulfill our security and compliance obligations. A cookie is a small text file stored on your device by your browser when you visit the Platform.

ggpaldo does not use third-party advertising or behavioral tracking cookies. You can manage or delete cookies through your browser settings; however, disabling strictly necessary or security cookies may prevent you from logging into or using the Platform correctly.

ggpaldo retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by Philippine law and PAGCOR regulations. The following retention periods apply:

• Account and KYC Records: Retained for a minimum of five (5) years following account closure, as required by PAGCOR licensing conditions and AMLA record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with R.A. 9160 and Bureau of Internal Revenue requirements.
• AML Suspicious Transaction Reports: Retained for a minimum of five (5) years from the date of the report, as mandated by AMLC regulations.
• Support and Communications Records: Retained for three (3) years from the date of the last interaction, for dispute resolution and quality assurance purposes.
• Technical and Usage Logs: Retained for twelve (12) months, after which logs are either deleted or anonymized for aggregated analytics purposes.
• Marketing Consent Records: Retained for the duration of the consent plus three (3) years following withdrawal of consent, to demonstrate compliance with consent requirements.

At the end of the applicable retention period, personal data is securely deleted, anonymized, or archived using methods that render re-identification impossible. Physical documents containing personal data are shredded; digital records are cryptographically erased.

ggpaldo implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data exchanged between your device and ggpaldo's servers is encrypted using TLS 1.2 or higher (256-bit SSL). The Platform enforces HTTPS exclusively — unencrypted HTTP connections are redirected automatically.
• Encryption at Rest: Sensitive data stored in ggpaldo's databases — including identity documents and financial records — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within ggpaldo's internal systems is restricted on a strict need-to-know basis. All staff with access to personal data undergo background screening and regular data privacy training as required by NPC regulations.
• Multi-Factor Authentication: Internal administrative access to production systems containing personal data requires multi-factor authentication (MFA). Players are also encouraged to enable MFA on their ggpaldo accounts.
• Intrusion Detection & Monitoring: ggpaldo's infrastructure is monitored 24/7 for anomalous activity, unauthorized access attempts, and potential data breaches using automated security information and event management (SIEM) tools.
• Penetration Testing: Regular third-party penetration testing is conducted to identify and remediate security vulnerabilities before they can be exploited.
• Data Breach Response: In the event of a personal data breach, ggpaldo will notify affected players and the National Privacy Commission (NPC) within 72 hours of discovery, as required under NPC Circular 16-03, where the breach is likely to result in harm to affected individuals.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by ggpaldo. These rights are real and enforceable — ggpaldo has a dedicated process for handling each type of request:

To exercise any of these rights, please submit a written request to our Data Protection Officer at [email protected] with the subject line "Data Subject Request." Please include your full name, registered email address, and a description of the right you wish to exercise. We may ask for additional verification to confirm your identity before processing the request. We will respond within 15 business days of receiving a complete, verified request.

The ggpaldo Platform is strictly for individuals who are 21 years of age or older, in accordance with Philippine law governing casino-style gambling and PAGCOR's regulatory requirements. ggpaldo does not knowingly collect, process, or store personal data from individuals under the age of 21.

During account registration, all applicants are required to declare their date of birth and provide government-issued identification confirming they meet the 21+ age requirement. ggpaldo's KYC process includes age verification as a mandatory step, and accounts found to belong to individuals under 21 will be immediately suspended and all associated funds returned after investigation.

If you are a parent or guardian and believe that a minor has accessed ggpaldo and provided personal data without your consent, please contact us immediately at [email protected]. We will investigate the matter promptly and delete any personal data collected from the individual if they are confirmed to be under 21.

ggpaldo reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable Philippine law, NPC guidelines, PAGCOR requirements, or our operational practices. The date at the top of this Policy indicates when it was last revised.

When we make material changes to this Policy — particularly changes that affect how we collect, use, or share your personal data — we will notify you by:

• Displaying a prominent notice on the Platform upon your next login, summarizing the key changes.
• Sending a notification to your registered email address at least seven (7) days before the updated Policy takes effect, where practicable.

Your continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Privacy Policy. If you do not agree with the revised Policy, you must discontinue use of the Platform and may request account closure in accordance with our Terms & Conditions.

We encourage you to review this Privacy Policy periodically. The current version is always available at https://ggpaldo.net/privacy-policy. Previous versions of this Policy are available upon written request to our Data Protection Officer.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by ggpaldo, please contact us through the following channels:

• Email (DPO & Privacy Requests): [email protected] — use subject line "Privacy Policy Inquiry" or "Data Subject Request" as appropriate.
• Live Chat: Available 24/7 via the chat widget on the Platform. For data subject requests, please follow up in writing via email to ensure a proper audit trail.
• Support Hours: Monday through Sunday, 24 hours a day.

ggpaldo aims to acknowledge all privacy-related inquiries within 24 hours and to provide a substantive response within 15 business days. Complex requests may take longer; in such cases, we will inform you of the extended timeline and the reason for the delay.

If you are not satisfied with ggpaldo's response to your privacy inquiry, you have the right to escalate your complaint to the National Privacy Commission (NPC), the regulatory authority responsible for enforcing the Data Privacy Act of 2012 in the Philippines. This Privacy Policy was last reviewed and updated in January 2026.