ggfap Privacy Policy

1 Who We Are

This Privacy Policy is published by ggfap ("ggfap," "we," "us," or "our"), the operator of the online gaming platform accessible at https://ggfap.app (the "Platform"). ggfap is a Philippine-focused gaming operator offering slots, live casino, sports betting, sabong, bingo, and specialty games to registered players across the Philippines.

ggfap acts as the Personal Information Controller (PIC) in respect of the personal data it collects from players, visitors, and any other individuals who interact with the Platform — as defined under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

This Policy should be read alongside ggfap's Terms & Conditions and Responsible Gaming Policy, which together form the complete framework governing your relationship with ggfap.

2 Data We Collect

ggfap collects personal data in several ways: directly from you when you register or use the Platform, automatically through your device and browser, and from trusted third-party verification providers. The categories of data we collect are outlined in the table below.

ggfap does not knowingly collect personal data from individuals under the age of 21 years. If we discover that data has been collected from an underage individual, we will delete it immediately and close the associated account. Please refer to Section 10 for our full Children's Privacy policy.

3 How We Use Your Data

ggfap uses personal data collected from players strictly for the purposes listed below. We do not use your data for any purpose incompatible with the reasons for which it was originally collected without first obtaining your explicit consent.

• Account Creation & Management: To register your player account, maintain your account profile, and authenticate your identity when you log in to the Platform.
• KYC & Age Verification: To verify that you meet the mandatory 21+ age requirement and to comply with PAGCOR regulations and Philippine anti-money-laundering (AML) requirements under RA 9160 (AMLA) as amended.
• Payment Processing: To process GCash, Maya, BPI, BDO, Metrobank, and other payment transactions, including deposits and the 1–2 hour withdrawal processing that is a core feature of the ggfap Platform.
• Platform Operation: To deliver gaming services, calculate game outcomes, maintain bet records, and resolve any disputes related to your gaming activity.
• Customer Support: To respond to your support inquiries, investigate complaints, and resolve disputes in a timely manner.
• Bonus & Promotions Administration: To manage your eligibility for bonuses, track wagering progress, and communicate promotional offers where you have opted in to receive such communications.
• Responsible Gaming: To monitor gaming behavior patterns that may indicate problem gambling, enforce self-exclusion requests, and administer deposit limit and cooling-off tools you activate on your account.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, bonus abuse, and any other conduct that violates our Terms & Conditions.
• Legal & Regulatory Compliance: To meet our obligations under Philippine law, including reporting obligations to PAGCOR, the Anti-Money Laundering Council (AMLC), and the National Privacy Commission (NPC).
• Platform Analytics & Improvement: To analyze aggregated, anonymized usage data to understand how players interact with the Platform and to improve our games, features, and user experience.

4 Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, ggfap processes your personal data on the following legal bases:

• Contractual Necessity: Processing your identity, contact, financial, and gaming activity data is necessary to perform the contract between you and ggfap — namely, to operate your account, accept your bets, and pay out your winnings. Without this processing, ggfap cannot provide its services to you.
• Legal Obligation: Processing your KYC documentation, transaction records, and AML-related data is required by Philippine law — specifically the Data Privacy Act, the Anti-Money Laundering Act, and PAGCOR's licensing requirements.
• Legitimate Interests: ggfap processes technical data, communications data, and gaming behavior data based on its legitimate interest in preventing fraud, securing the Platform, and detecting problem gambling behaviors, provided these interests are not overridden by your privacy rights.
• Consent: Where ggfap processes your data for optional purposes — such as sending marketing communications or using non-essential cookies — we rely on your freely given, specific, and informed consent. You may withdraw consent at any time.

5 Data Sharing & Disclosure

ggfap does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share personal data only in the limited circumstances described below, and only to the extent necessary for each purpose:

• Payment Processors: GCash (GXI), Maya (Voyager Innovations), BPI, BDO, Metrobank, and other payment service providers receive the financial data necessary to process your deposits and withdrawals. These providers are bound by their own privacy policies and applicable Philippine financial regulations.
• KYC & Identity Verification Providers: Third-party KYC platforms that assist ggfap in verifying government-issued IDs and performing liveness checks. These providers act as Personal Information Processors (PIPs) under RA 10173 and are bound by data processing agreements with ggfap.
• Game Content Providers: Third-party game studios and aggregators that supply casino games, slots, and live dealer content on the Platform may receive anonymized session identifiers necessary to deliver game content. They do not receive your name, contact details, or financial information.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities, where ggfap is legally required to disclose information in response to a lawful order, regulation, or law enforcement request.
• Legal & Professional Advisors: ggfap's lawyers, auditors, and compliance consultants may access personal data where strictly necessary to provide professional advice, subject to professional confidentiality obligations.
• Business Transfers: In the event that ggfap undergoes a merger, acquisition, or sale of business assets, your personal data may be transferred to the acquiring entity, subject to the same or equivalent data protection standards set out in this Policy. You will be notified of any such transfer.

6 Cookies & Tracking Technologies

ggfap uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyze how players use our services. The types of cookies we use are as follows:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They enable core functionality such as account login sessions, security token management, and load balancing. These cookies cannot be disabled.
• Functional Cookies: These remember your preferences — such as your preferred language, lobby layout, and game settings — so you do not have to reconfigure them on each visit.
• Analytics Cookies: ggfap uses anonymized analytics data to understand which games are most popular, how players navigate the Platform, and where technical issues occur. This data is aggregated and does not identify individual players.
• Security Cookies: Used to detect and prevent fraudulent account activity, including session hijacking attempts and credential stuffing attacks.

You can manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect your ability to log in and use the Platform. ggfap does not use third-party advertising cookies or behavioral tracking cookies that share data with external advertising networks.

7 Data Security

ggfap implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, loss, destruction, alteration, or disclosure. Our security infrastructure includes:

• Encryption in Transit: All data transmitted between your browser and the ggfap Platform is encrypted using TLS 1.2 or higher. Payment data transmitted to GCash and Maya is additionally protected by their respective end-to-end encryption standards.
• Encryption at Rest: Sensitive personal information stored on ggfap servers — including government ID copies, financial records, and KYC documentation — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All ggfap staff with access to player data are subject to background checks, confidentiality agreements, and role-based access controls.
• Regular Security Audits: ggfap conducts periodic penetration testing, vulnerability assessments, and internal security audits to identify and remediate potential weaknesses before they can be exploited.
• Incident Response: ggfap maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify the National Privacy Commission (NPC) within 72 hours and affected players as soon as reasonably practicable.

8 Data Retention

ggfap retains your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by Philippine law and regulatory guidelines. Our standard retention periods are:

• Active Account Data: Retained for the duration of your active player account relationship with ggfap, plus a minimum of five (5) years after account closure, as required by PAGCOR licensing conditions and Philippine AML regulations.
• Transaction & Financial Records: Retained for a minimum of ten (10) years from the date of each transaction, in compliance with AMLC record-keeping requirements under RA 9160 as amended.
• KYC Documentation: Retained for the duration of your account relationship plus five (5) years after account closure. Government ID copies are stored in encrypted form with access limited to authorized compliance personnel.
• Support Communications: Retained for three (3) years from the date of the communication, or longer where the communication relates to an open dispute or legal claim.
• Technical & Log Data: Retained for twelve (12) months for routine server logs, and up to three (3) years for security-related logs where fraud investigation may be required.
• Marketing Consent Records: Retained until you withdraw consent, plus one (1) year thereafter as proof of your consent decision.

Once the applicable retention period expires, ggfap will securely delete or anonymize your personal data in accordance with our internal data destruction procedures. Anonymized data — which cannot be linked back to you — may be retained indefinitely for aggregate analytics purposes.

9 Your Privacy Rights

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights in respect of your personal data held by ggfap. To exercise any of these rights, contact our Data Protection Officer (DPO) using the details in Section 14.

If you are not satisfied with ggfap's response to a data rights request, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

10 Children's Privacy

The ggfap Platform is strictly intended for adults aged 21 years and older, in compliance with PAGCOR regulations governing real-money gaming in the Philippines. ggfap does not knowingly collect, process, or retain personal data belonging to individuals under the age of 21.

All new registrations are subject to mandatory age verification. Players must confirm that they are 21 or older during registration and submit valid Philippine government-issued identification before their first withdrawal is processed. Any account found to belong to an individual under 21 will be immediately suspended and all data permanently deleted.

11 International Data Transfers

ggfap primarily stores and processes player data on servers located within the Philippines. Where data must be transferred to or processed by service providers located outside the Philippines — for example, international KYC technology providers or cloud infrastructure partners — ggfap ensures that appropriate safeguards are in place to protect your data in accordance with the Philippine Data Privacy Act of 2012.

These safeguards include:

• Data processing agreements that require overseas processors to apply data protection standards equivalent to those required under RA 10173.
• Transfer to jurisdictions recognized by the NPC as providing an adequate level of data protection.
• Standard contractual clauses approved by the National Privacy Commission where necessary.

ggfap will not transfer your data to any overseas processor that cannot demonstrate compliance with internationally recognized data protection standards. You may request details of specific overseas processors by contacting our Data Protection Officer.

12 Third-Party Links

The ggfap Platform may contain references to third-party services such as GCash and Maya for payment processing. While ggfap takes care to work only with reputable partners, we are not responsible for the privacy practices of any third-party services that operate independently of the ggfap Platform.

When you interact with GCash, Maya, or any bank's payment interface in connection with an ggfap transaction, you are subject to that provider's own privacy policy and terms of service. ggfap encourages you to review the privacy policies of any third-party service you use in connection with your ggfap account.

13 Policy Updates

ggfap reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, technological developments, or updates to Philippine data privacy law and NPC guidelines.

When material changes are made, ggfap will:

• Update the "Last Updated" date displayed at the top of this page.
• Display a prominent notice on the Platform informing registered players of the change.
• Where the change materially affects how your data is processed, send an email notification to your registered email address summarizing the key changes at least 14 days before they take effect.

Your continued use of the ggfap Platform after the revised Privacy Policy takes effect constitutes your acceptance of the updated terms. If you do not agree with any material change, you may request account closure and data erasure as described in Sections 9 and 14 before the changes take effect.

ggfap recommends bookmarking this page and reviewing it periodically to stay up to date with how your personal data is being managed.

14 Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or ggfap's data processing practices, you may contact us through the following channels:

You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated. The NPC can be reached through their official government website and offices in Manila.

ggfap is committed to resolving all data privacy concerns fairly and promptly. We encourage players to contact our DPO first, as most concerns can be resolved quickly without the need for a formal NPC complaint.