geperya Privacy
Policy

01 Introduction & Scope

This Privacy Policy ("Policy") describes how geperya ("Company", "Platform", "we", "us", "our") — the operator of the online gaming platform accessible at geperya.net — collects, uses, stores, shares, and protects the personal data of its registered players and website visitors in the Philippines.

This Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC). It applies to all personal data processed by geperya in connection with the registration, operation, and closure of player accounts, and the delivery of all gaming and support services offered through the platform.

By registering a geperya account or using any feature of the platform, you acknowledge that you have read, understood, and consented to the data processing practices described in this Policy. This Policy forms an integral part of geperya's Terms and Conditions.

02 Personal Data We Collect

geperya collects the following categories of personal data. We collect only what is necessary for the specific purposes described in this Policy:

03 How We Collect Your Data

geperya collects personal data through the following channels:

• Direct submission by you: Information you provide when completing the registration form, submitting KYC documents, contacting customer support, or updating your account profile.
• Automated collection: Technical data collected automatically when you access or use the geperya platform, including through cookies, web beacons, and similar tracking technologies. See Section 7 for our Cookies Policy.
• Third-party service providers: Identity verification and KYC data sourced from accredited verification partners; payment transaction data from payment processors such as GCash and PayMaya; fraud detection data from security and compliance partners.
• Regulatory sources: Information shared by PAGCOR or other Philippine regulatory authorities in connection with their oversight functions, including player exclusion registry data.

geperya does not purchase personal data from data brokers or acquire data from social media platforms without your explicit consent.

04 Purpose of Processing

geperya processes your personal data exclusively for the following specified, explicit, and legitimate purposes:

• Account creation and management: To register your player account, verify your identity, and maintain your account in good standing throughout our relationship.
• Service delivery: To provide access to our gaming catalogue, process deposits and withdrawals in Philippine Peso, award bonuses, and deliver customer support.
• Regulatory compliance: To comply with PAGCOR licensing conditions, the Philippine Anti-Money Laundering Act (AMLA), and Know Your Customer (KYC) obligations, including the filing of covered and suspicious transaction reports where required.
• Fraud prevention and security: To detect, investigate, and prevent fraud, identity theft, unauthorised account access, money laundering, and other prohibited activities on the platform.
• Responsible gaming: To monitor gaming behaviour, administer self-exclusion requests, enforce deposit limits and cooling-off periods, and identify players who may require additional support.
• Platform improvement: To analyse aggregated and anonymised usage data for the purpose of improving the geperya platform, fixing technical issues, and enhancing the player experience.
• Communications: To send account-related notifications, transaction confirmations, security alerts, and — where you have given consent — promotional communications about geperya offers and promotions.

geperya will not process your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or establishing a separate lawful basis for the new processing activity.

05 Legal Basis for Processing

Under the Philippine Data Privacy Act, geperya relies on the following legal bases to process your personal data:

• Contractual necessity: Processing required to enter into and perform the player account agreement with you — including registration, KYC, payment processing, and account management.
• Legal obligation: Processing required to comply with mandatory legal and regulatory requirements, including PAGCOR directives, AMLA reporting obligations, and NPC data privacy regulations.
• Legitimate interests: Processing carried out for fraud detection, platform security, and service improvement, where geperya's legitimate interests are not overridden by your rights and interests.
• Consent: Processing for optional purposes such as sending you marketing and promotional communications about geperya. You may withdraw your consent at any time by updating your communication preferences in your account settings or contacting our support team.

06 Data Sharing & Disclosure

geperya shares personal data only in the following circumstances and only to the extent strictly necessary:

• Payment processors: Financial data is shared with payment partners (including GCash, PayMaya, BPI, BDO, and Metrobank) solely to process your deposit and withdrawal transactions.
• KYC and identity verification providers: Identity documents and related data are shared with accredited third-party verification service providers to complete the KYC process required by PAGCOR and AMLA regulations.
• Fraud prevention and security partners: Technical and gaming data may be shared with fraud detection and cybersecurity service providers for the purpose of protecting the platform and its players.
• Regulatory authorities: geperya is required by law to disclose player data to PAGCOR, the Anti-Money Laundering Council (AMLC), and other competent Philippine authorities upon receipt of a valid legal order, regulatory directive, or as otherwise required by Philippine law.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of geperya's assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. You will be notified of any such transfer in advance.

All third parties who receive personal data from geperya are required to handle that data in accordance with data protection standards consistent with this Policy and applicable Philippine law. geperya does not sell your personal data.

07 Cookies & Tracking Technologies

geperya uses cookies and similar tracking technologies to operate and improve the platform. The following categories of cookies may be placed on your device when you visit geperya.net:

• Strictly necessary cookies: Essential for core platform functions such as maintaining your login session, remembering your language preference, and processing transactions. These cookies cannot be disabled.
• Performance and analytics cookies: Used to collect anonymised data about how players use the geperya platform — such as pages visited and time spent — to help us identify and fix technical issues and optimise the user experience.
• Functional cookies: Used to remember your account preferences and personalise your platform experience, such as your preferred game category or display settings.
• Security cookies: Used to support fraud detection, bot prevention, and account security measures.

You may manage your cookie preferences through your browser settings. Please note that disabling non-essential cookies may affect certain features of the geperya platform. geperya does not use cookies to serve third-party advertising or to track your activity across unrelated websites.

08 Data Retention

geperya retains personal data for the following periods:

• Active account data: Retained for the duration of your player account relationship with geperya, plus an additional period as required by law following account closure.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of the transaction, as mandated by the Philippine AMLA and PAGCOR regulations. These records may be required as evidence in regulatory investigations or legal proceedings.
• KYC documents: Retained for a minimum of five (5) years following account closure or the conclusion of any related regulatory proceedings, whichever is later.
• Customer support communications: Retained for up to three (3) years from the date of the interaction for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for the duration of your consent, plus one (1) year following withdrawal of consent, to demonstrate compliance with consent requirements.
• Technical and session data: Retained for up to twelve (12) months, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with geperya's data disposal procedures.

09 Data Security

geperya implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption: All data transmitted between your device and geperya's servers is protected by Transport Layer Security (TLS). Sensitive data stored on our servers is encrypted using AES-256 encryption.
• Access controls: Access to personal data within geperya is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and regular data protection training.
• Penetration testing and audits: geperya's platform and infrastructure are subject to regular independent security assessments to identify and remediate vulnerabilities.
• Two-factor authentication: Players are encouraged to enable two-factor authentication (2FA) on their geperya accounts as an additional layer of account protection.
• Incident response: geperya maintains a documented data breach response procedure. In the event of a breach, we will notify the NPC and affected players in accordance with the timeframes set out in the Philippine Data Privacy Act.

While geperya takes all reasonable measures to protect your data, no internet transmission or electronic storage system is completely secure. You are also responsible for maintaining the security of your account credentials and keeping your registered email address up to date.

10 Your Rights Under the Data Privacy Act

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by geperya:

• Right to be informed: The right to be informed of how your personal data is being collected and processed — which is the primary purpose of this Privacy Policy.
• Right of access: The right to request a copy of the personal data geperya holds about you, including information about the purposes of processing and any third parties to whom your data has been disclosed.
• Right to rectification: The right to request correction of any inaccurate or incomplete personal data we hold about you.
• Right to erasure (right to be forgotten): The right to request deletion of your personal data in certain circumstances, subject to geperya's legal and regulatory retention obligations, which may override this right.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes at any time, without charge.
• Right to data portability: The right to request that geperya provide your personal data in a structured, commonly used, machine-readable format.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe geperya has violated your data privacy rights.

To exercise any of the above rights, please contact geperya's Data Protection Officer at [email protected]. We will respond to all rights requests within thirty (30) calendar days of receipt, subject to identity verification requirements.

11 Children's Privacy & Age Restriction

geperya's services are strictly intended for adults aged 21 years and above, in accordance with PAGCOR regulations governing real-money online gaming in the Philippines. geperya does not knowingly collect, process, or retain personal data from any individual under the age of 21.

If geperya discovers or is notified that personal data has been collected from an individual who is under 21 years of age, we will take the following steps without undue delay:

• Immediately suspend the relevant account pending investigation;
• Delete all personal data associated with the underage individual to the extent permitted by law;
• Refund any real-money deposits made by the underage individual, less any applicable regulatory withholding requirements;
• Report the incident to PAGCOR as required under our licensing obligations.

Parents or guardians who believe a minor has registered on geperya should contact us immediately at [email protected].

12 Updates to This Privacy Policy

geperya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or the features and services offered on the platform.

When material changes are made to this Policy, geperya will:

• Update the "Last Updated" date at the top of this Policy;
• Display a prominent notice on the geperya platform for a reasonable period following the update;
• Send a notification to your registered email address where the changes are significant enough to materially affect your rights or the way we process your data.

Your continued use of the geperya platform following notification of an updated Privacy Policy constitutes your acceptance of the revised Policy. If you do not agree with the updated Policy, you must cease using the platform and may request account closure by contacting our customer support team.

13 Contact Us & Complaints

geperya has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and the Philippine Data Privacy Act. If you have any questions, concerns, or complaints about how we handle your personal data, please contact us:

• Data Protection Officer — geperya
• Email: [email protected]
• Subject line: Please include "Privacy Request" or "Data Protection" in your email subject for faster routing
• Response time: We aim to acknowledge all privacy-related inquiries within two (2) Philippine Standard Time business days and to provide a substantive response within thirty (30) calendar days

If you are not satisfied with geperya's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, the independent government body responsible for enforcing the Data Privacy Act.