Privacy Policy — gl29

1. Overview

gl29 ("gl29," "we," "us," or "our") operates the online gaming platform accessible at gl29.vip (the "Platform"). We are committed to handling your personal data responsibly and in full compliance with the Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA) of the Philippines, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

This Privacy Policy applies to all personal data collected from users ("you," "your") who access or register on the gl29 Platform, including through any mobile-optimised version of gl29.vip. By using the Platform, you acknowledge that you have read, understood, and consent to the data practices described in this Policy.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming page, which together govern your relationship with gl29.

2. Personal Data We Collect

gl29 collects the following categories of personal data, depending on how you interact with the Platform:

2.1 Identity & Contact Data

• Full legal name as it appears on a government-issued ID
• Date of birth (used to verify the 21+ age requirement)
• Nationality and country of residence
• Registered email address
• Mobile phone number (used for OTP verification and account security)
• Residential address

2.2 Identity Verification (KYC) Data

• Copies of government-issued photo identification (e.g., Philippine passport, driver's licence, SSS ID, PhilSys national ID, UMID)
• Proof of address documents (e.g., utility bill, bank statement)
• Selfie or liveness-check image for biometric matching where required

2.3 Financial Data

• GCash or Maya account reference (masked)
• Bank account details for withdrawal processing (masked)
• Debit card details (masked; full card numbers are never stored by gl29)
• Transaction history: deposits, withdrawals, and bonus credits

2.4 Gaming & Behavioural Data

• Game history, bet amounts, win/loss records, and session durations
• Responsible gaming tool usage (deposit limits, self-exclusion activations)
• Bonus and promotion participation records

2.5 Technical & Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Cookie identifiers and session tokens
• Platform access logs and timestamps

2.6 Communications Data

• Records of live chat, email, and support ticket interactions with gl29 staff
• Responses to surveys or feedback forms (where voluntarily submitted)

3. How We Collect Your Data

gl29 collects personal data through the following means:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, or contacting our support team.
• Automated collection: Technical and device data collected automatically when you access the Platform, including through cookies, web beacons, and server logs.
• Third-party sources: Identity verification data from KYC service providers; fraud-screening data from anti-money laundering (AML) compliance partners; payment confirmation data from GCash, Maya, and banking partners.

4. Purpose & Legal Basis for Processing

gl29 processes your personal data only for specified, legitimate purposes. The table below summarises the primary purposes and the corresponding legal basis under the DPA:

5. Sharing Your Personal Data

gl29 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• KYC and identity verification providers: To verify your identity and age in compliance with regulatory requirements.
• Payment processors: GCash, Maya, and banking partners require transaction reference data to process deposits and withdrawals.
• AML and fraud screening services: To detect and prevent money laundering, fraud, and other financial crimes.
• Game software providers: Game providers may receive anonymised session data necessary to operate their games on the Platform.
• Regulatory authorities: PAGCOR and other competent Philippine authorities may require disclosure of player data in the exercise of their regulatory functions. gl29 will comply with lawful requests.
• Law enforcement: Where required by a valid court order, subpoena, or other lawful process.
• IT and hosting providers: Cloud infrastructure and platform hosting partners who process data on gl29's behalf under strict data processing agreements.

6. Data Retention

gl29 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and KYC data: Retained for a minimum of five (5) years from the date of account closure, in accordance with AML record-keeping obligations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Gaming history: Retained for three (3) years from the date of each gaming session, unless a longer period is required for dispute resolution or regulatory compliance.
• Support communications: Retained for two (2) years from the date of the last interaction.
• Marketing consent records: Retained until consent is withdrawn, plus one (1) year thereafter as evidence of the consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with gl29's data disposal procedures.

7. Data Security

gl29 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and gl29.vip.
• Encryption of sensitive data fields (including payment references and KYC documents) at rest.
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis.
• Regular security assessments and penetration testing of the Platform infrastructure.
• Multi-factor authentication requirements for administrative access to data systems.
• Incident response procedures for detecting, reporting, and managing personal data breaches in accordance with NPC notification requirements.

While gl29 takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your gl29 account credentials. If you suspect your account has been compromised, contact gl29 support immediately via live chat at gl29.vip.

8. Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by gl29:

• Right to be informed: You have the right to know what personal data gl29 holds about you and how it is processed.
• Right of access: You may request a copy of the personal data gl29 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to gl29's legal retention obligations.
• Right to object: You may object to the processing of your personal data for direct marketing purposes at any time.
• Right to data portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe gl29 has processed your personal data in violation of the DPA.

To exercise any of the above rights, please contact the gl29 Data Protection Officer (DPO) via the contact details in Section 12. gl29 will respond to verified data subject requests within fifteen (15) business days of receipt.

9. Cookies & Tracking Technologies

gl29 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens and security cookies. They cannot be disabled.
• Functional cookies: Remember your preferences (e.g., language, display settings) to personalise your experience.
• Analytics cookies: Collect anonymised data about how users interact with the Platform to help gl29 improve performance and usability.
• Marketing cookies: Used to deliver relevant promotional content to you on the Platform. These are only activated with your consent.

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform.