goldph Privacy Policy

1.1 This Privacy Policy applies to all personal data collected, stored, processed, and used by goldph in connection with the operation of the goldph Platform at goldph.org, including all related services, Account management functions, payment processing, and customer support interactions.

1.2 This Policy applies to all individuals who interact with goldph in any of the following capacities: registered Players holding a goldph Account; visitors browsing the goldph Platform without registering; and individuals who contact goldph through support channels without being registered Players.

1.3 This Policy does not govern the privacy practices of third-party payment processors, game software providers, or any other external service providers whose own privacy policies govern the handling of any data you provide directly to those parties. goldph is not responsible for the data practices of any third-party service whose platform, website, or application you may access in connection with your use of the goldph Platform.

1.4 This Privacy Policy should be read alongside the goldph Terms & Conditions, which govern the overall contractual relationship between goldph and registered Players.

2.1 For the purposes of the Data Privacy Act of 2012, goldph acts as the Personal Information Controller (PIC) in respect of personal data collected through the goldph Platform. goldph determines the purposes and means of processing personal data described in this Policy.

2.2 goldph has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. The DPO may be contacted via the details set out in Section 15 of this Policy.

2.3 goldph has registered its data processing systems with the National Privacy Commission in compliance with NPC registration requirements applicable to personal information controllers of a significant scale of data processing.

3.1 goldph collects the following categories of personal data from registered Players and Platform visitors. Collection of each category is proportionate to the purpose for which it is processed, consistent with the principle of proportionality under the Data Privacy Act of 2012:

4.1 goldph collects personal data through the following means:

• Direct Collection: Information you provide directly when registering a goldph Account, completing KYC verification, making deposits or withdrawal requests, contacting goldph support, or responding to surveys or promotions.
• Automated Technical Collection: Technical data (IP address, device information, browser data, session timestamps) collected automatically when you access the goldph Platform through server logs, analytics systems, and security monitoring tools.
• Payment Processor Data: Transaction reference data and payment status information received from goldph's payment processing partners (GCash, Maya, InstaPay network participants, and banking partners) in connection with deposit and withdrawal processing.
• Game Platform Data: Game session data, bet history, and results data generated by goldph's game software providers and returned to goldph's systems in connection with your gameplay activity.
• Cookies and Tracking Technologies: Data collected through cookies and similar technologies as described in Section 9 of this Policy.
• Third-Party Verification Services: Identity verification data returned by third-party KYC verification service providers used by goldph to validate government-issued Philippine ID documents.

5.1 goldph processes personal data only for specified, legitimate purposes. The following table summarises the primary purposes for which goldph processes your personal data and the legal basis for each under the Data Privacy Act of 2012:

5.2 goldph will not use your personal data for any purpose materially incompatible with the purposes listed above without obtaining your express prior consent, except where further processing is required to comply with a legal obligation.

6.1 goldph does not sell, rent, or commercially trade your personal data to any third party. Disclosure of your personal data is limited to the following categories of recipients and circumstances:

• Payment Service Providers: GCash, Maya, GrabPay, BPI, BDO, Metrobank, and InstaPay network participants receive the minimum personal and financial data required to process your deposit or withdrawal transactions. Each provider operates under its own privacy policy and Philippine financial regulations.
• Game Software Providers: goldph's certified game software partners receive session identifiers and bet data necessary to operate games and return results. These providers do not receive your full identity data unless required for their own regulatory compliance.
• KYC Verification Services: Third-party identity verification providers receive copies of your submitted government ID documents solely for the purpose of verifying your identity. These providers are contractually bound to handle your data securely and solely for verification purposes.
• Regulatory Authorities: goldph is legally required to disclose certain player data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other Philippine governmental authorities pursuant to legal obligations under applicable law. Such disclosures are made without prior notice to the Player where legally required.
• Law Enforcement: goldph may disclose personal data to Philippine law enforcement agencies in response to valid legal process, court orders, or where disclosure is necessary to prevent an imminent risk of harm.
• Professional Advisers: goldph's legal, financial, and compliance advisers may access personal data where necessary to provide professional services, subject to professional confidentiality obligations.

7.1 goldph's primary data processing infrastructure is located within the Philippines. However, certain service providers engaged by goldph — including game software platforms and cloud infrastructure providers — may process data in servers located outside the Philippines.

7.2 Where personal data is transferred outside the Philippines, goldph ensures that such transfers are conducted in accordance with Section 21 of the Data Privacy Act of 2012 and applicable NPC regulations, including through the use of appropriate contractual safeguards (such as data processing agreements incorporating data protection clauses) to ensure that transferred data receives a standard of protection equivalent to that afforded under Philippine law.

7.3 By using the goldph Platform, you acknowledge and consent to the cross-border transfer of your data to the extent necessary for goldph to provide its services, subject to the safeguards described in this Section.

8.1 goldph retains personal data for the period necessary to fulfil the purposes for which it was collected, as described in this Policy, and to comply with applicable legal retention obligations. The following retention schedule applies:

• Account and Identity Data: Retained for the duration of the active Account relationship and for a minimum of five (5) years following Account closure, consistent with PAGCOR record-keeping requirements and AML retention obligations under RA 9160.
• Financial and Transaction Data: Retained for a minimum of five (5) years from the date of the transaction, as required under Philippine AML regulations and tax record-keeping requirements.
• KYC Documentation: Retained for a minimum of five (5) years following Account closure or the date of the most recent transaction, whichever is later.
• Gaming Activity Data: Retained for a minimum of three (3) years from the date of the gaming session, and longer where required for responsible gaming monitoring or dispute resolution.
• Technical and Log Data: Retained for up to twelve (12) months in standard logs and up to five (5) years in security and fraud monitoring archives.
• Marketing Preference Data: Retained until you withdraw consent for marketing communications, at which point your preferences are updated and marketing is ceased promptly.

8.2 At the end of applicable retention periods, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original personal information, in accordance with NPC guidelines on data disposal.

9.1 The goldph Platform uses cookies and similar tracking technologies to provide essential functionality, maintain your login session, and support security and fraud prevention. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the goldph Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without rendering the Platform inoperable. No consent is required for strictly necessary cookies under applicable law.
• Functional Cookies: Remember your preferences (such as language settings and notification preferences) to provide a personalised experience. These are set with your implicit consent through continued Platform use.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Players use the goldph Platform — which pages are visited, how long sessions last, and which features are used. This data is used to improve Platform performance and user experience. Analytics cookies are set only with your consent.
• Security and Fraud Prevention Cookies: Used to detect unusual access patterns, prevent automated attacks, and identify potentially fraudulent sessions. These are operationally necessary for the security of the goldph Platform and Player Accounts.

9.2 Most web browsers allow you to control cookies through browser settings. Disabling cookies beyond strictly necessary cookies may affect the functionality of the goldph Platform, including your ability to maintain a login session.

9.3 goldph does not use third-party behavioural advertising cookies or cross-site tracking technologies that profile your browsing activity outside the goldph Platform.

10.1 goldph implements a layered security framework to protect personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures include:

• Encryption in Transit: All data transmitted between your device and goldph servers is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to all login sessions, payment transactions, and any other data exchange on the goldph Platform.
• Encryption at Rest: Sensitive personal data stored in goldph's databases — including identity information and financial data — is encrypted at rest using industry-standard encryption protocols.
• Password Security: goldph stores Player passwords using one-way cryptographic hashing with salting. goldph staff cannot read any Player's actual password.
• Access Controls: Access to personal data within goldph's systems is restricted on a need-to-know basis using role-based access controls. All internal access to personal data is logged and audited.
• Two-Factor Authentication (2FA): goldph offers 2FA to all registered Players, adding a second verification layer (SMS OTP to your registered Philippine mobile number) to the login process.
• Penetration Testing: goldph's security infrastructure undergoes periodic third-party penetration testing to identify and remediate vulnerabilities.
• Incident Response: goldph maintains a data breach response procedure in compliance with NPC Circular 16-03 on Security Incident Notification, including notification to the NPC and affected Players within the timeframes prescribed by applicable regulations.

11.1 As a data subject under Republic Act No. 10173, you have the following rights with respect to your personal data held by goldph. goldph is committed to facilitating the exercise of these rights in a timely and transparent manner:

11.2 To exercise any of the above rights, please contact the goldph Data Protection Officer using the contact details in Section 15. goldph will respond to your request within the timeframe prescribed by applicable NPC regulations — generally within 30 calendar days. We may request identity verification before processing your request to ensure we do not disclose or modify your data in response to an unauthorised request.

11.3 Certain rights — particularly erasure — are subject to overriding legal obligations. goldph cannot delete personal data that is required to be retained under PAGCOR regulations, AML law, or other applicable Philippine legal requirements, even upon your request.

12.1 The goldph Platform is strictly intended for adults 21 years of age and older in accordance with Philippine gaming regulations enforced by PAGCOR. goldph does not knowingly collect personal data from individuals under 21 years of age.

12.2 goldph enforces age verification through KYC processes at the Account registration stage. Any Account found to belong to a person under 21 years of age will be immediately closed, and any personal data collected in connection with such Account will be securely deleted, except where retention is required for fraud prevention, AML compliance, or regulatory reporting purposes.

12.3 If you have reason to believe that a minor has registered a goldph Account using false age information, please contact the goldph Data Protection Officer immediately at the contact details in Section 15. goldph will investigate and take appropriate action promptly.

13.1 The goldph Platform may contain references to payment providers and game software platforms operated by third parties. Interactions with these services — such as initiating a GCash payment or launching a game powered by a third-party software provider — involve data exchanges governed by those providers' own privacy policies, which are separate from and independent of this goldph Privacy Policy.

13.2 goldph is not responsible for the data handling practices of any third-party service provider. goldph recommends that you review the privacy policies of any third-party service you interact with in connection with your use of the goldph Platform.

13.3 goldph does not operate social media plug-ins or embedded social sharing features on the goldph Platform that would result in your social media account data being shared with goldph without your explicit action.

14.1 goldph may update this Privacy Policy from time to time to reflect changes in applicable Philippine law, NPC guidance, PAGCOR requirements, or goldph's data processing practices. The most current version will always be published at goldph.org/privacy-policy, with the effective date prominently displayed.

14.2 Where amendments are material — meaning they significantly affect the manner in which goldph processes your personal data or your rights in relation to that data — goldph will provide advance notice via the email address registered to your Account, with a minimum of 14 calendar days' notice prior to the effective date, except where immediate amendment is required by law or regulatory direction.

14.3 Continued use of the goldph Platform following the effective date of any amendment to this Privacy Policy constitutes your acknowledgment of the updated Policy. If you do not agree with an amendment, you should discontinue use of the goldph Platform and may request Account closure in accordance with the goldph Terms & Conditions.

15.1 For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by goldph — including requests to exercise your rights under the Data Privacy Act of 2012 — please contact the goldph Data Protection Officer using the following details:

• Data Protection Officer: goldph DPO
• Email (plain text — not clickable): [email protected] — please mark the subject line "Data Privacy Request" for fastest routing to the DPO team
• Correspondence: goldph, Philippines
• Live Chat: Available 24/7 through the goldph Platform after logging in to your Account

15.2 goldph will acknowledge your data privacy request within 5 business days and will endeavour to resolve it within 30 calendar days of receipt. Complex requests may require additional time, in which case goldph will notify you of the extended timeline.

15.3 If you are not satisfied with goldph's response to your data privacy concern, you have the right to file a complaint with the National Privacy Commission of the Philippines (NPC) through the official NPC complaint mechanisms. goldph supports your right to seek independent regulatory review of any data privacy concern.