Privacy Policy – greatph Data Protection & Your Rights

1 Introduction

This Privacy Policy ("Policy") describes how greatph ("greatph," "the Company," "we," "us," "our") collects, uses, stores, discloses, and protects personal information in connection with your use of the greatph Platform available at greatph.club (the "Platform"), including all associated games, payment services, account features, and customer support channels.

greatph is committed to protecting the privacy and personal data of all users in full compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). As a PAGCOR-regulated operator, greatph also complies with data protection requirements arising from the Anti-Money Laundering Act (RA 9160 as amended) and applicable PAGCOR circulars.

By registering an account, accessing the Platform, or providing any personal information to greatph, you acknowledge that you have read and understood this Policy and consent to the collection, use, and disclosure of your personal data as described herein. If you do not agree with any part of this Policy, please do not use the Platform.

Note: This Policy should be read alongside the greatph Terms & Conditions, which govern your use of the Platform in full. In the event of conflict between this Policy and the Terms, the Terms shall prevail except with respect to your data subject rights, where this Policy governs.

2 Data Controller

For the purposes of the Data Privacy Act of 2012, greatph is the Personal Information Controller (PIC) in respect of all personal data collected through the Platform. This means greatph determines the purposes for which your personal data is processed and the means by which it is processed.

greatph has registered its data processing systems with the National Privacy Commission in accordance with NPC Registration requirements. Our registered Data Protection Officer (DPO) can be contacted using the details provided in Section 16 of this Policy.

Certain third parties who process data on greatph's behalf — including payment processors, game studios, and identity verification providers — act as Personal Information Processors (PIP) under contractual data processing agreements that require them to handle your data only in accordance with greatph's instructions and in compliance with Philippine law.

3 Personal Data We Collect

3.1 Data You Provide Directly

Identity Data: Full legal name, date of birth, nationality, and government-issued Philippine ID number (driver's licence, passport number, or PhilSys RN);
Contact Data: Philippine mobile number (used as primary account identifier and OTP channel), email address, and residential address;
Payment Data: GCash registered mobile number, PayMaya account identifier, bank account details (BPI, BDO, Metrobank) for withdrawal processing. Note: greatph does not store full card numbers or bank login credentials;
KYC Documentation: Scanned or photographed copies of government-issued ID documents submitted for identity verification;
Source of Funds Documentation: Payslips, bank statements, or other financial records submitted in connection with AML compliance requests;
Communications: Records of your correspondence with greatph via live chat, email, or any other support channel, including call recordings where applicable.

3.2 Data Collected Automatically

Device & Technical Data: IP address, device type, operating system, browser type and version, mobile carrier, screen resolution, and device identifiers;
Usage Data: Pages visited, game sessions played, bet amounts, game outcomes, session duration, login timestamps, and navigation paths through the Platform;
Location Data: General geolocation data derived from IP address for jurisdictional compliance purposes. greatph does not collect precise GPS location;
Cookie and Tracking Data: As described in Section 6 of this Policy.

3.3 Sensitive Personal Information

greatph may collect Sensitive Personal Information (SPI) as defined by the Data Privacy Act of 2012 in the following limited circumstances:

Date of birth (to verify the 21+ age requirement mandated by PAGCOR);
Government-issued ID number (for KYC identity verification);
Financial account information (for payment processing and AML compliance);
Health-related information voluntarily disclosed in connection with responsible gaming self-exclusion applications (processed with your explicit consent).

Minimisation Principle: greatph processes SPI only where it is necessary for a specific, lawful purpose and with appropriate consent where required. You will always be informed when we are collecting SPI and of the specific purpose for doing so.

4 Legal Basis for Processing

Under the Data Privacy Act of 2012 and NPC guidelines, greatph processes your personal data on the following legal bases:

Consent: Where you have given freely, specifically, and informed consent to the processing — for example, for marketing communications (Section 14);
Performance of Contract: Where processing is necessary to fulfil our obligations to you under the greatph Terms & Conditions, including account management, game access, and payment processing;
Legal Obligation: Where processing is required to comply with Philippine law, including PAGCOR licensing conditions, the Anti-Money Laundering Act, and the Data Privacy Act itself;
Legitimate Interests: Where processing is necessary for greatph's legitimate interests — such as fraud prevention, platform security, and responsible gaming monitoring — and those interests are not overridden by your privacy rights;
Vital Interests: In exceptional circumstances where processing is necessary to protect your vital interests or those of another person — for example, in connection with a responsible gaming crisis situation.

5 How We Use Your Personal Data

greatph uses the personal data we collect for the following purposes:

Creating, verifying, and administering your greatph account;
Processing deposits and withdrawals through GCash, PayMaya, and Philippine bank channels;
Complying with PAGCOR licensing requirements, including player identification and activity monitoring;
Fulfilling Anti-Money Laundering obligations under RA 9160, including customer due diligence and suspicious transaction reporting to AMLC;
Verifying that you meet the 21+ age requirement before granting access to gaming services;
Preventing fraud, collusion, bonus abuse, and other prohibited conduct as defined in the Terms & Conditions;
Providing customer support and resolving disputes or complaints;
Administering responsible gaming tools including deposit limits, self-exclusion, and cooling-off periods;
Analysing Platform usage data to improve game offerings, user experience, and promotional relevance (in aggregated and anonymised form where possible);
Sending transactional communications — deposit confirmations, withdrawal notifications, OTP codes, and account security alerts — that are essential to your use of the Platform;
Sending marketing communications about bonuses and promotions to players who have opted in (see Section 14).

Purpose Limitation: greatph will not use your personal data for any purpose that is incompatible with the purposes listed above without obtaining your prior consent or having a separate lawful basis for the new processing.

6 Cookies & Tracking Technologies

6.1 What We Use

greatph uses cookies and similar tracking technologies (session storage, local storage, pixel tags) on the Platform to maintain session state, support security features, and understand how players navigate the site. The following categories of cookies are in use:

Strictly Necessary Cookies: Required for the Platform to function. They maintain your login session, remember your preferred language, and support security features such as OTP verification flow. These cannot be disabled without disrupting Platform functionality;
Performance Cookies: Collect anonymous, aggregated data about how the Platform is used — which games load slowly, which pages generate errors — to help greatph identify and fix technical issues;
Functional Cookies: Remember preferences you have set, such as your last visited game category, so the Platform feels consistent across sessions;
Analytics Cookies: Used by greatph's internal analytics system to understand player behaviour patterns at an aggregate level. greatph does not use third-party advertising networks or share analytics data externally.

6.2 Cookie Control

You may control non-essential cookies through your browser's settings. Most modern browsers allow you to block or delete cookies on a site-by-site basis. Note that blocking strictly necessary cookies will prevent certain Platform features from working correctly, including the login session mechanism. Detailed cookie settings are available in the Platform's Cookie Preferences panel.

7 Data Sharing & Disclosure

greatph does not sell, rent, or trade your personal data to third parties. Disclosure occurs only in the following circumstances:

7.1 Regulatory Authorities

greatph is legally required to share certain player data with Philippine regulatory bodies including PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and law enforcement authorities where compelled by Philippine law. Such disclosures are made in accordance with applicable legal requirements and, where permitted, will be communicated to you in advance.

7.2 Payment Processors

greatph shares the minimum necessary payment information with GCash (Mynt), PayMaya (Maya Bank), BPI, BDO, and Metrobank to process your deposit and withdrawal transactions. These institutions operate under their own privacy policies and are subject to Bangko Sentral ng Pilipinas (BSP) data protection requirements.

7.3 Game Content Providers

Live dealer game studios and RNG slot providers may receive anonymised session identifiers and bet data necessary to deliver their games and confirm game outcomes. These providers do not receive your name, contact details, payment information, or KYC documents.

7.4 Identity Verification Providers

greatph uses a third-party KYC verification service to assist with automated document verification. Your ID document images and facial biometric data captured during KYC are processed by this provider under a data processing agreement that restricts its use to KYC purposes only and requires deletion of biometric data following verification.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of greatph's business assets, player personal data may be transferred to the successor entity, subject to the same privacy protections as set out in this Policy. Players will be notified of any such transfer via the Platform or registered contact details before it takes effect.

8 Cross-Border Data Transfers

Some of greatph's service providers — particularly live casino studio operators and cloud infrastructure providers — may process personal data outside of the Philippines. Where such cross-border processing occurs, greatph ensures that:

The recipient country offers adequate data protection as assessed by the NPC, or;
Contractual protections equivalent to Philippine data privacy standards are in place through Data Processing Agreements with all offshore processors;
Such transfers are limited to the minimum data necessary for the specific service being provided.

NPC Notification: Where required by NPC regulations, greatph notifies the Commission of cross-border data sharing arrangements as part of its annual data processing system registration obligations.

9 Data Retention

greatph retains personal data only for as long as necessary to fulfil the specific purpose for which it was collected, or as required by applicable Philippine law. Our documented data retention schedule includes the following key periods:

Account and KYC Records: Retained for a minimum of 5 years following account closure, as required by PAGCOR licensing conditions and AML regulations (RA 9160);
Transaction Records: Retained for 5 years from the date of each transaction, consistent with AML requirements;
Game History and Bet Records: Retained for 3 years for dispute resolution and regulatory audit purposes;
Customer Support Communications: Retained for 2 years from the date of the last interaction, or longer where a complaint or dispute remains unresolved;
Marketing Preferences: Retained while your account is active and for 1 year following account closure or opt-out, to honour suppression requests;
Cookie and Session Data: Retained for the duration of your browser session (session cookies) or up to 12 months (persistent analytics cookies).

Following the expiry of the applicable retention period, personal data is either securely deleted or anonymised such that it can no longer be attributed to an identifiable individual.

10 Security Measures

greatph implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key measures include:

Transport Layer Security (TLS 1.3) and 256-bit SSL encryption for all data in transit between your device and greatph's servers;
Encryption of sensitive data at rest in greatph's database infrastructure;
Role-based access controls limiting staff access to personal data to those with a documented operational need;
Multi-factor authentication for all administrative access to systems containing personal data;
Regular third-party security penetration testing and vulnerability assessments;
A documented Incident Response Plan aligned with NPC breach notification requirements;
Staff training on data privacy obligations under Philippine law, conducted at least annually.

Your Responsibility: While greatph implements robust security measures on our end, the security of your account also depends on you. Never share your password or OTP codes with anyone, including individuals claiming to be greatph staff. greatph personnel will never ask for your password.

11 Your Rights as a Data Subject

The Data Privacy Act of 2012 grants you the following rights in relation to your personal data held by greatph. You may exercise any of these rights by contacting our Data Protection Officer (see Section 16). greatph will respond to verified requests within 15 business days.

Right	What It Means for You	How to Exercise It
Right to Access	Request a copy of the personal data greatph holds about you and information about how it is being processed.	Submit a written request to the DPO. greatph will provide a structured data export within 15 business days.
Right to Rectification	Request correction of inaccurate, incomplete, or outdated personal data.	Contact customer support or the DPO with supporting documentation of the correct information.
Right to Erasure	Request deletion of your personal data where it is no longer necessary, your consent has been withdrawn, or the data was unlawfully processed.	Note: Erasure may be refused where data must be retained for PAGCOR, AML, or other legal compliance purposes.
Right to Data Portability	Receive your personal data in a structured, commonly used, machine-readable format for transfer to another service.	Submit a written request to the DPO specifying the data categories required.
Right to Object	Object to processing of your personal data for direct marketing or where processing is based on legitimate interests.	For marketing: use the unsubscribe link in any email or contact support. For other processing: contact the DPO.
Right to Damages	Seek compensation for damages suffered as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of your personal data.	Contact the DPO in the first instance. Unresolved matters may be escalated to the National Privacy Commission.
Right to File a Complaint	Lodge a complaint with the National Privacy Commission if you believe greatph has violated your rights under the Data Privacy Act.	Complaints to the NPC should be filed through the Commission's official complaints portal at privacy.gov.ph.

Identity Verification for Rights Requests: To protect your privacy, greatph will verify your identity before processing any data subject rights request. This typically involves confirming your registered mobile number via OTP or requesting a copy of a government-issued ID. This verification step is mandatory and cannot be waived.

12 Children, Minors, and the 21+ Requirement

The greatph Platform is strictly intended for individuals who are 21 years of age or older. This age restriction applies to all gaming services and is mandated by PAGCOR for all Philippine-licensed online gaming operators.

greatph does not knowingly collect personal data from any individual under the age of 21. If greatph becomes aware that a user has provided personal data and is under the minimum age, their account will be immediately suspended, their data will be deleted, and any balances will be reviewed pursuant to PAGCOR requirements.

If you are a parent or guardian and believe that a minor in your care has registered at greatph or provided personal information without your knowledge, please contact our DPO immediately.

13 Third-Party Links and Services

The greatph Platform may contain informational references to third-party service providers (such as GCash or PayMaya) in the context of explaining payment options. greatph does not embed third-party advertising networks, social media widgets, or external tracking scripts on the Platform.

If you navigate to any third-party website or service through a link provided outside of the Platform itself, please be aware that greatph has no control over and accepts no responsibility for the privacy practices of those third parties. You should review the privacy policies of any third-party service you use.

14 Marketing Communications

greatph may send you marketing communications about bonuses, promotions, new games, and platform updates via SMS and email, subject to your having provided consent for marketing at registration or having opted in through your account settings.

Every marketing communication from greatph includes a clear and easy mechanism to opt out. You can withdraw your marketing consent at any time by:

Clicking the "Unsubscribe" link in any marketing email;
Replying "STOP" to any marketing SMS;
Updating your communication preferences in the Account Settings section of your logged-in greatph account;
Contacting customer support or the DPO directly.

Withdrawal of marketing consent does not affect your ability to receive transactional communications, which are essential to the operation of your account (e.g., deposit confirmations, withdrawal notifications, OTP codes, security alerts). These cannot be unsubscribed from while your account is active.

No Third-Party Marketing: greatph does not share your contact details with third-party marketers or advertising networks. Your mobile number and email address will never be passed to a third party for their own marketing purposes.

15 Data Breach Notification

In the event of a personal data breach — defined as a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data — greatph will respond in accordance with the following procedure:

greatph will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of a breach involving sensitive personal information or data likely to result in harm to affected individuals;
Affected data subjects will be notified as soon as practicable following NPC notification, unless law enforcement advises a delay to preserve an investigation;
Breach notifications will describe the nature of the breach, the categories and approximate number of affected records, the likely consequences, and the measures taken or proposed to address the breach;
greatph will document all breaches — including those not requiring NPC notification — in its Data Breach Register for internal accountability and future audit purposes.

16 Data Protection Officer

greatph has appointed a Data Protection Officer (DPO) in accordance with the Data Privacy Act of 2012 and NPC Circular No. 16-01. The DPO is responsible for ensuring that greatph's data processing activities comply with Philippine privacy law, for handling data subject rights requests, and for serving as the point of contact with the National Privacy Commission.

You may contact the greatph Data Protection Officer by writing to:

Data Protection Officer — greatph
Email (plain text, non-clickable): [email protected]
Subject Line: "Data Privacy Request — [Your Registered Mobile Number]"

Please do not include your password, full payment details, or OTP codes in any communication with the DPO.

All DPO correspondence will be acknowledged within 3 business days, and substantive responses will be provided within 15 business days from the date identity verification is completed.

17 Amendments to This Policy

greatph reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or PAGCOR and NPC regulatory requirements. The date of the most recent revision is always displayed at the top of this page.

For material changes — defined as changes that affect the purpose for which your data is used, the categories of data collected, or your rights as a data subject — greatph will notify registered players via SMS to their registered Philippine number and/or via email at least 14 days before the changes take effect. Non-material amendments (such as clarifications of existing language or contact detail updates) take effect upon publication.

Your continued use of the greatph Platform after the effective date of any amendment constitutes your acknowledgement of the revised Policy. If you object to an amendment, you may close your account before the effective date. Pending verified balances will be processed in accordance with the Terms & Conditions.

NPC Registration: The current version of this Privacy Policy is consistent with greatph's registered data processing systems on file with the National Privacy Commission. Registered players may contact the DPO to request a copy of greatph's NPC registration confirmation.

greatph Privacy Policy — Your Data, Your Rights, Our Obligations

How greatph Treats Your Personal Data