Privacy Policy —
gc88 Online Gaming Platform

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "gc88", "we", "us", or "our" refers to the company operating the gc88 online gaming platform at gc88.onl.
• "Player", "you", or "your" refers to any individual who has registered an account on gc88.onl or who accesses the Platform without registration.
• "Personal Data" means any information relating to an identified or identifiable natural person, as defined under Section 3(g) of the Data Privacy Act of 2012.
• "Sensitive Personal Information" means personal data about an individual's race, ethnic origin, marital status, age, colour, and religious, philosophical or political affiliations; health, education, genetic or sexual life; proceedings for any offence committed or alleged; and government-issued identifiers, as defined under Section 3(l) of the Data Privacy Act.
• "Processing" means any operation performed on personal data, including collection, recording, organisation, storage, updating, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means gc88 as the entity that determines the purposes and means of processing personal data.
• "Data Processor" means any natural or legal person who processes personal data on behalf of gc88 under a data processing agreement.
• "NPC" means the National Privacy Commission of the Philippines.
• "DPA 2012" means the Data Privacy Act of 2012, Republic Act No. 10173, and its Implementing Rules and Regulations.
• "KYC" means Know Your Customer — the identity, age, and source-of-funds verification process conducted by gc88.

gc88 acts as the Data Controller for the personal data of Players collected through and in connection with the use of gc88.onl. As Data Controller, gc88 determines the purposes for which and the means by which personal data is processed.

gc88 has appointed a Data Protection Officer (DPO) responsible for overseeing data protection compliance. The DPO may be contacted using the details provided in Section 16 of this Policy.

gc88 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

gc88 processes personal data for the following specific purposes:

• Account Management: Creating, managing, and maintaining your gc88 player account, including login authentication, OTP verification, and account security monitoring.
• KYC and Age Verification: Verifying that you meet the minimum age requirement of 21 years and confirming your identity in compliance with PAGCOR and AMLC obligations.
• Payment Processing: Processing deposits from and withdrawals to your registered Philippine payment methods (GCash, Maya, BPI, BDO, and others), including fraud screening on financial transactions.
• Regulatory Compliance: Meeting reporting obligations to PAGCOR, submitting covered and suspicious transaction reports to the AMLC as required by the Anti-Money Laundering Act, and responding to lawful requests from Philippine law enforcement authorities.
• Customer Support: Responding to account queries, dispute resolution, technical support, and responsible gaming assistance.
• Platform Security: Detecting and preventing fraud, multi-accounting, bot access, money laundering, and other prohibited conduct as defined in gc88's Terms and Conditions.
• Responsible Gaming: Monitoring gaming patterns to identify indicators of problem gambling, administering deposit limits and self-exclusion requests, and maintaining records of exclusion status.
• Service Improvement: Aggregated and anonymised analysis of platform usage patterns to improve game performance, page loading speeds, and user experience for Filipino players across all devices and networks.
• Marketing Communications: Sending promotional offers, bonus notifications, and product updates to Players who have consented to receive marketing communications, with an opt-out available at any time.

gc88 processes personal data on the following legal bases as established under the Data Privacy Act of 2012:

• Contract Performance: Processing necessary for the performance of the Player Agreement between gc88 and the Player, including account creation, game access, and payment processing.
• Legal Obligation: Processing required for gc88's compliance with Philippine law, including PAGCOR licensing requirements, AMLC anti-money laundering obligations, BSP payment regulations, and NPC data protection requirements.
• Legitimate Interests: Processing for gc88's legitimate interests in preventing fraud, protecting platform security, managing risk, and improving service quality, where such processing does not override the Player's fundamental rights and freedoms.
• Consent: Processing of data for optional purposes, including marketing communications and non-essential cookies, conducted only where the Player has given freely-given, specific, and informed consent. Consent may be withdrawn at any time without affecting the lawfulness of processing conducted prior to withdrawal.

gc88 may share your personal data with the following categories of recipients, strictly limited to the purposes specified:

• Philippine Regulatory Authorities: PAGCOR (gaming licence compliance), AMLC (covered and suspicious transaction reporting), NPC (data protection compliance), Bureau of Internal Revenue (tax obligations), and other Philippine government agencies where required by law.
• Payment Service Providers: GCash (G-Xchange Inc.), Maya (Voyager Innovations Inc.), and Philippine banking partners (BPI, BDO, Metrobank) for the processing of deposits and withdrawals. These entities process your financial data as independent data controllers under their own privacy policies.
• Game Technology Providers: Licensed game studios such as Pragmatic Play, PG Soft, Jili, and others receive anonymised session tokens for game delivery. These providers do not receive Players' identifiable personal data unless technically necessary for specific game types.
• Identity Verification Services: Third-party KYC and identity verification providers operating under data processing agreements with gc88, subject to the same data protection standards as gc88 itself.
• IT Infrastructure and Cloud Providers: Hosting, database, and cybersecurity service providers operating under data processing agreements with gc88, with data hosting limited to data centres with appropriate security certifications.
• Law Enforcement: Philippine law enforcement agencies (NBI, PNP, NBI-CIDD) where gc88 is legally compelled to disclose data through a valid court order, subpoena, or other legal process.

gc88 does not sell, rent, barter, or otherwise transfer personal data to unaffiliated third parties for their own independent commercial purposes.

Some of gc88's technology infrastructure providers and game software partners operate data centres or processing systems outside the Philippines. Where personal data is transferred to a country that the NPC has not recognised as providing equivalent data protection standards, gc88 ensures that appropriate safeguards are in place, including:

• Standard contractual clauses approved by the NPC or equivalent data protection authority
• Binding corporate rules where applicable within corporate group entities
• Explicit contractual data processing agreements requiring the recipient to apply data protection standards equivalent to those required under the DPA 2012

Players may request information about the specific safeguards in place for cross-border transfers of their personal data by contacting the gc88 Data Protection Officer using the details in Section 16.

gc88 implements technical and organisational security measures appropriate to the risk level of the personal data held, including:

• Encryption: 256-bit TLS/SSL for all data in transit between Player devices and gc88 servers; AES-256 encryption for sensitive data at rest, including KYC documents and financial data.
• Access Controls: Role-based access control (RBAC) ensuring that gc88 staff access personal data only on a strict need-to-know basis. Access to KYC and financial data is logged, monitored, and audited.
• Two-Factor Authentication: All gc88 staff with access to Player personal data are required to use multi-factor authentication on internal systems.
• Penetration Testing: gc88's platform undergoes periodic third-party penetration testing to identify and remediate security vulnerabilities.
• Incident Response: gc88 maintains a documented data breach incident response plan tested annually, with NPC notification procedures meeting the 72-hour reporting requirement where applicable.

gc88 uses cookies and similar tracking technologies on gc88.onl for the following purposes:

• Essential Cookies: Required for the Platform to function, including session management, authentication tokens, and security cookies. These cannot be disabled without rendering core Platform functions unusable.
• Functional Cookies: Remembering Player preferences such as language settings, lobby view, and last-played game category. These are activated on first login and may be disabled through browser settings.
• Analytics Cookies: Aggregated, anonymised data about how Players navigate gc88.onl, which pages are most visited, and where technical errors occur. gc88 uses first-party analytics. No third-party advertising analytics networks are embedded in gc88.onl.

Players may manage cookie preferences through their browser settings. Note that disabling essential cookies will affect Platform functionality, including the ability to remain logged in between pages.

gc88 retains personal data for the periods specified below, after which data is securely deleted or irreversibly anonymised unless a longer retention period is required by Philippine law:

Under the Data Privacy Act of 2012, Filipino players whose personal data gc88 holds have the following rights:

gc88 does not knowingly collect personal data from individuals under 21 years of age. The gc88 platform is strictly restricted to verified adults aged 21 and above, in accordance with Philippine gaming law and PAGCOR regulations.

If gc88 becomes aware that personal data has been collected from a person under 21 years of age — including through misrepresentation during registration — gc88 will:

• Immediately suspend the account pending investigation
• Close the account permanently upon confirmation of underage access
• Return any real-money deposits to the originating payment method
• Delete the associated personal data except to the extent required for regulatory reporting purposes
• Report the incident to PAGCOR as required by applicable regulations

Parents or guardians who believe that a person under their care has registered on gc88 should contact gc88 support immediately using the contact details in Section 16.

gc88 may send Players promotional notifications about bonuses, new game launches, and special offers through SMS (to your registered Philippine mobile number) and email, but only where the Player has opted in to receive such communications.

Marketing consent is requested separately at the time of account registration and is independent of the consent to the Privacy Policy. Declining marketing communications does not affect access to gc88's gaming services.

Players may opt out of marketing communications at any time by:

• Updating notification preferences in the gc88 account settings panel
• Replying "STOP" to any SMS message from gc88
• Contacting gc88 live support and requesting removal from all marketing lists

Opt-out requests are processed within five (5) business days. Transactional communications — such as OTP codes, deposit confirmations, withdrawal notifications, and account security alerts — are not marketing communications and will continue to be sent to Players regardless of marketing opt-out status, as they are necessary for account operation.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of Filipino players, gc88 will:

• Notify the National Privacy Commission of the Philippines within seventy-two (72) hours of becoming aware of the breach, as required under NPC Circular 16-03
• Notify affected Players without undue delay where the breach is likely to result in a high risk to those individuals, including information about the nature of the breach, the categories of data involved, likely consequences, and measures taken or proposed to address the breach
• Document all breaches in gc88's breach register, regardless of whether NPC notification is required

Breach notifications to Players will be sent to the registered email address and/or mobile number on the Player's gc88 account. It is therefore important that Players keep their contact details accurate and up to date.

gc88 may update this Privacy Policy from time to time to reflect changes in our data processing practices, new regulatory requirements, or updates to Philippine data protection law. The most recent version of this Policy is always available at gc88.onl/privacy-policy.

Where updates to this Policy constitute a material change to how gc88 processes personal data, gc88 will notify registered Players by email or SMS to their registered contact details at least fourteen (14) days before the updated Policy takes effect. Continued use of gc88 after the effective date of any material changes constitutes acceptance of the updated Policy.

The version number and "Last Updated" date at the top of this document indicate the current revision in force. Players who do not accept material changes to this Policy may request account closure before the effective date without penalty, and any uninvested real-money balance will be returned in full.

For all matters relating to this Privacy Policy, including exercising your data subject rights, reporting a privacy concern, or requesting information about data processing, contact gc88's Data Protection Officer through the following channels:

• Data Protection Officer: gc88 Data Protection Office
• Platform: gc88.onl (use the live chat function for immediate response)
• Support Email: [email protected] — subject line: "DATA PRIVACY REQUEST" (plain text address — not a link)
• Response Commitment: Privacy-related queries are acknowledged within 2 business days and fully resolved within 30 calendar days of the verified request
• Language: Requests may be submitted in English or Filipino (Tagalog)

For complaints about gc88's data protection practices that have not been resolved through gc88's internal process, Players may contact the National Privacy Commission of the Philippines through the NPC's official channels.