gprya Privacy Policy

01 Introduction

gprya is an online casino and sports betting platform serving Filipino players across the Philippines — from Manila and Makati to Cebu, Davao, and Quezon City. We are committed to protecting the personal information of every individual who interacts with our platform, whether as a registered player, a site visitor, or a user of our customer support services.

This Privacy Policy has been prepared in accordance with the requirements of the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations (IRR), as enforced by the National Privacy Commission (NPC) of the Philippines. It also reflects gprya's obligations under applicable PAGCOR regulations concerning player data handling and anti-money laundering (AML) record-keeping.

This Privacy Policy applies to all personal data collected through:

• The gprya website at gprya.net and all associated subdomains;
• The gprya mobile application (if applicable);
• Customer support interactions via live chat or email;
• KYC and identity verification processes;
• Financial transaction processing through GCash, Maya, BPI, BDO, and other payment partners.

02 Data Controller

For the purposes of the Data Privacy Act of 2012, gprya acts as the Personal Information Controller (PIC) in respect of the personal data of its players and website visitors.

As Personal Information Controller, gprya determines the purposes and means by which your personal data is processed. Where gprya engages third-party service providers (such as payment processors or KYC verification partners) to process data on its behalf, those providers act as Personal Information Processors (PIPs) and are bound by contractual data processing agreements consistent with RA 10173.

03 Personal Data We Collect

gprya collects the following categories of personal data, depending on the nature of your interaction with the platform:

04 How We Collect Your Data

gprya collects personal data through the following methods:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or participate in a promotion;
• Automatically: When you visit gprya.net, our servers and analytics tools automatically collect technical data such as your IP address, browser type, device identifiers, and session activity via cookies and similar technologies;
• From third parties: gprya may receive data from payment processors (e.g., GCash, Maya, BDO) confirming transaction details, or from KYC and identity verification service providers engaged to validate your identity documents;
• From regulatory sources: Where required by PAGCOR or Philippine law enforcement authorities, gprya may receive or be required to verify data from official government databases.

05 Purpose of Processing

gprya processes your personal data for the following specific, legitimate purposes:

• Account management: Creating, maintaining, and administering your gprya player account;
• Identity verification: Conducting KYC checks to confirm your identity and age (21+) as required by PAGCOR regulations;
• Payment processing: Facilitating deposits and withdrawals through GCash, Maya, BPI, BDO, Metrobank, 7-Eleven, USDT, and Coins.ph;
• AML compliance: Monitoring transactions for suspicious activity and fulfilling anti-money laundering reporting obligations under Philippine law;
• Service improvement: Analysing gameplay patterns and platform usage (in aggregated, anonymised form where possible) to improve gprya's products and user experience;
• Responsible gaming: Identifying players who may be exhibiting signs of problem gambling and offering appropriate support tools such as deposit limits and self-exclusion;
• Customer support: Responding to your inquiries, resolving disputes, and processing complaints;
• Fraud prevention: Detecting and investigating bonus abuse, duplicate accounts, and other fraudulent activity;
• Marketing communications: Sending promotional offers and bonus notifications to players who have opted in to receive such communications. You may opt out at any time.

06 Legal Basis for Processing

Under the Data Privacy Act of 2012, gprya processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between gprya and the player — including account creation, payment processing, and gameplay services;
• Legal obligation: Processing required to comply with Philippine laws and PAGCOR regulations, including KYC, AML reporting, and age verification obligations;
• Consent: For optional processing activities such as marketing communications and certain cookie-based analytics, gprya relies on your explicit, freely given consent. You may withdraw consent at any time without affecting the lawfulness of prior processing;
• Legitimate interests: For fraud detection, security monitoring, and platform improvement activities, where gprya's legitimate interests are not overridden by your fundamental rights and freedoms.

07 Data Sharing & Disclosure

gprya does not sell your personal data. We may share your data with the following categories of recipients only as necessary and under appropriate safeguards:

• Payment processors: GCash, Maya, BPI, BDO, Metrobank, and other payment partners receive the transaction data necessary to process your deposits and withdrawals;
• KYC/identity verification providers: Third-party KYC platforms engaged by gprya to verify government-issued Philippine IDs and perform liveness checks;
• Game providers: JILI, Pragmatic Play, and other licensed game studios may receive anonymised session data for game performance monitoring;
• PAGCOR and Philippine regulators: gprya is obligated to provide player data to PAGCOR and other Philippine regulatory authorities upon lawful request;
• Law enforcement: Where required by a valid court order or request from Philippine law enforcement authorities under applicable laws;
• IT and cloud infrastructure providers: Hosting, database, and cybersecurity service providers operating under strict data processing agreements bound by RA 10173 standards.

08 Data Retention

gprya retains your personal data for as long as is necessary to fulfil the purposes outlined in this Privacy Policy, or as required by applicable Philippine laws and regulations. The following general retention periods apply:

• Active account data: Retained for the duration of your active gprya account plus a minimum of five (5) years following account closure, as required by PAGCOR AML regulations;
• KYC documents: Retained for a minimum of five (5) years from the date of the player's last transaction, in line with Philippine AML record-keeping requirements;
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction;
• Customer support records: Retained for two (2) years from the date of the last support interaction;
• Technical and cookies data: Session data is deleted after your browsing session. Analytics data is retained in aggregated form for up to twelve (12) months.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual player.

09 Security Measures

gprya implements a comprehensive set of technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction:

• TLS/SSL encryption: All data in transit between your browser and gprya's servers is encrypted using TLS 1.2 or higher;
• AES-256 encryption at rest: Stored personal data, including KYC documents and payment details, is encrypted using AES-256;
• Access controls: Access to personal data within gprya's systems is restricted on a strict need-to-know basis. Staff with data access undergo regular security training;
• Two-factor authentication (2FA): gprya strongly encourages players to enable 2FA on their accounts for an additional layer of protection;
• Regular security audits: gprya conducts periodic vulnerability assessments and penetration testing of its platform infrastructure;
• Incident response plan: In the event of a personal data breach, gprya has a documented incident response procedure. Where required, we will notify affected players and the National Privacy Commission within 72 hours of discovering a breach.

10 Cookies & Tracking Technologies

gprya uses cookies and similar tracking technologies on our website to provide and improve our services. The following types of cookies are used:

• Strictly necessary cookies: Essential for the operation of the gprya platform, including session management and security token validation. These cookies cannot be disabled without affecting site functionality;
• Performance cookies: Used to collect anonymised information about how players interact with the gprya website, such as which pages are visited most frequently and how long players spend on each page. This helps us improve the platform experience;
• Functional cookies: Allow gprya to remember your preferences such as language, region, and preferred payment method to personalise your experience;
• Analytics cookies: gprya may use privacy-compliant analytics tools to understand aggregate site traffic patterns. Individual players are not identified in analytics reports.

You may manage your cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using gprya's core gaming and payment services, but may affect certain personalisation features.

11 Your Data Rights Under Philippine Law

As a data subject under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by gprya:

12 Minors & 21+ Policy

gprya's services are strictly intended for individuals who are 21 years of age or older, in compliance with Philippine law governing real-money gambling and casino-style gaming activities. gprya does not knowingly collect personal data from individuals under the age of 21.

As part of our registration and KYC process, gprya verifies the age of all players. Any account found to have been created by a person under 21 years of age will be immediately suspended, all pending transactions cancelled, and the personal data of the minor handled in accordance with NPC guidelines for data collected without valid consent.

13 Cross-Border Data Transfers

gprya's primary data processing operations are conducted within the Philippines. However, some of our third-party service providers — including cloud infrastructure providers and certain game studios — may process data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, gprya ensures that such transfers are subject to appropriate safeguards in accordance with Section 21 of RA 10173, including:

• Contractual data processing agreements incorporating the standard data protection clauses recognised by the NPC;
• Transfer to jurisdictions recognised by the NPC as providing an adequate level of data protection equivalent to Philippine standards;
• Your explicit consent to the transfer, where required.

gprya will not transfer your personal data to jurisdictions that do not provide adequate data protection safeguards without your prior informed consent.

14 Changes to This Privacy Policy

gprya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable Philippine laws, or PAGCOR regulatory requirements. The "Last Updated" date at the top of this page will reflect the date of the most recent revision.

Where changes are material — such as a new category of data being collected or a new purpose of processing — gprya will notify registered players via email or an in-platform notification prior to the changes taking effect. For minor or clarificatory changes, the updated policy will be published on this page without separate notification.

Continued use of the gprya platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with the updated terms, you should discontinue use of the platform and may request account closure by contacting support.

15 Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by gprya, please contact our Data Protection Officer through any of the following channels:

• Email: [email protected] — Subject line: "Privacy Inquiry" or "Data Subject Request";
• Live Chat: Available 24/7 on gprya.net — average response time under 10 minutes;
• Support Hours: 24 hours a day, 7 days a week, including Philippine public holidays.

If you are not satisfied with gprya's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC) at privacy.gov.ph (please visit the NPC website directly for current contact information).