gopaldo Privacy Policy

gopaldo operates the online gaming platform accessible at gopaldo.org and is the data controller responsible for the personal data of its registered users. As data controller, gopaldo determines the purposes and means by which personal data is processed in connection with the platform's services.

All data protection enquiries, subject access requests, and requests to exercise data subject rights should be directed to gopaldo's Data Protection Officer using the contact details set out in Section 14 of this Policy.

This Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the applicable guidelines issued by the National Privacy Commission (NPC). Where gopaldo processes data subject to additional regulatory requirements, including those arising from PAGCOR licensing conditions and Anti-Money Laundering Act (AMLA) obligations, those requirements are reflected in this Policy.

gopaldo collects personal data from you directly, automatically through your use of the platform, and in some cases from third-party sources including payment processors and identity verification services. The categories of personal data we collect include:

gopaldo processes your personal data for the following clearly defined purposes:

• Account Registration and Management: To create, maintain, and administer your gopaldo account, including processing login credentials, managing your balance, applying bonuses, and recording transaction history.
• Identity Verification (KYC): To verify your identity and age (21+ requirement) in compliance with PAGCOR regulatory guidelines and anti-money laundering obligations under Philippine law.
• Payment Processing: To process deposits via GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, and other accepted payment methods, and to facilitate withdrawal of winnings to your verified payment account.
• Regulatory Compliance: To fulfil gopaldo's obligations under PAGCOR gaming regulations, the Anti-Money Laundering Act (RA 9160 as amended), the Philippine Data Privacy Act (RA 10173), and other applicable laws.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, account takeover attempts, bonus abuse, and other prohibited activities on the platform.
• Customer Support: To respond to your enquiries, process complaints, and provide assistance via live chat and email support channels.
• Responsible Gaming: To monitor gameplay patterns for indicators of problem gambling, administer self-exclusion requests, and manage voluntary deposit and session limits set by users.
• Platform Improvement: To analyse usage patterns, identify technical issues, and improve the performance, security, and user experience of the gopaldo platform.
• Marketing Communications: To send promotional emails, SMS notifications, and platform alerts about bonuses, new games, and relevant offers — subject to your marketing preferences and applicable opt-in requirements under Philippine law.

Under the Philippine Data Privacy Act of 2012, gopaldo processes your personal data on the following legal bases:

• Performance of a Contract: Processing necessary to provide the gaming services you have registered for and agreed to through the gopaldo Terms and Conditions, including account management, payment processing, and gameplay facilitation.
• Compliance with a Legal Obligation: Processing required to fulfil gopaldo's obligations under PAGCOR regulations, AML laws, tax requirements, and other applicable Philippine legislation.
• Legitimate Interests: Processing for fraud prevention, platform security, and internal analytics, where such processing is proportionate and does not override your data protection rights.
• Consent: Processing for direct marketing communications and the use of non-essential cookies, where your explicit consent has been obtained and can be withdrawn at any time.

5.1 Third-Party Service Providers. gopaldo shares personal data with carefully selected third-party service providers who assist in the operation of the platform. These include payment processors (GCash, PayMaya, banking partners), identity verification service providers, game content providers, cloud infrastructure providers, and customer support technology providers. All third-party providers are contractually bound to process data only for the purposes specified by gopaldo and to maintain appropriate security standards.

5.2 Regulatory Authorities. gopaldo may share personal data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, or other government bodies where required by applicable law, lawful regulatory request, or court order. gopaldo will, where legally permitted, notify affected users of such disclosures.

5.3 No Sale of Personal Data. gopaldo does not sell, rent, licence, or otherwise commercially transfer your personal data to any third party for their independent marketing purposes. Any data shared with third parties is solely for the purpose of providing services to gopaldo and its users.

5.4 Business Transfers. In the event of a merger, acquisition, sale of assets, or other corporate restructuring involving gopaldo, personal data held on the platform may be transferred to the successor entity as part of the transaction. Users will be notified of any material change to the identity of the data controller as a result of such a transaction.

6.1 What Are Cookies. Cookies are small text files stored on your device by a website you visit. gopaldo uses cookies and similar tracking technologies to operate the platform correctly, remember your preferences, maintain your login session, and analyse usage patterns.

6.2 Types of Cookies Used. gopaldo uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the platform to function. These include session management cookies that maintain your login state and security cookies that help detect fraudulent activity. These cannot be disabled.
• Functional Cookies: Store your preferences such as language settings, display preferences, and responsible gaming settings you have configured on your account.
• Analytics Cookies: Collect anonymised or pseudonymised data about how users navigate the platform, which pages are most visited, and where technical errors occur. Used to improve the gopaldo user experience.
• Marketing Cookies: Used, with your consent, to identify you across sessions for the purpose of delivering relevant promotional content about gopaldo's games and offers.

6.3 Managing Cookies. You can control and delete non-essential cookies through your browser settings. Disabling strictly necessary cookies may prevent the gopaldo platform from functioning correctly. Withdrawing consent for marketing cookies will not affect the delivery of platform services.

7.1 Retention Principles. gopaldo retains personal data for no longer than is necessary for the purpose for which it was collected, or as required by applicable law. The primary driver for extended retention is regulatory and legal obligation, including AML record-keeping requirements and PAGCOR gaming record retention mandates.

7.2 Retention Periods. The following general retention periods apply:

• Account and Transaction Records: Retained for a minimum of five (5) years from the date of the last transaction or account closure, in compliance with AMLA record-keeping requirements.
• KYC Identity Documents: Retained for five (5) years from account closure or the last transaction date, as required by applicable AML regulations.
• Gaming History: Retained for two (2) years from the date of the relevant gaming session, or longer if required for the resolution of a dispute or regulatory inquiry.
• Customer Support Records: Retained for two (2) years from the date of the support interaction.
• Marketing Data: Retained until you withdraw consent or for one (1) year of inactivity, whichever occurs first.
• System and Security Logs: Retained for ninety (90) days, or longer where a specific security investigation requires preservation of evidence.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.

8.1 Technical Measures. gopaldo implements industry-standard technical security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include 256-bit SSL/TLS encryption for all data in transit, encryption for sensitive data at rest, firewalls and intrusion detection systems, and access controls limiting data access to authorised personnel only.

8.2 Organisational Measures. gopaldo's internal data protection measures include staff training on data handling obligations, role-based access controls, periodic security audits, and data processing agreements with all third-party service providers who handle personal data on gopaldo's behalf.

8.3 User Responsibility. While gopaldo takes all reasonable steps to protect your personal data, you are also responsible for the security of your account. You must maintain a strong and unique password for your gopaldo account, enable two-factor authentication where available, and ensure you log out of shared devices. gopaldo will never ask for your password via live chat, email, or any other support channel.

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights with respect to your personal data held by gopaldo:

To exercise any of the above rights, please submit a written request to the gopaldo Data Protection Officer at [email protected] with the subject line "Data Subject Request." gopaldo will acknowledge your request within five (5) business days and provide a substantive response within fifteen (15) business days, subject to identity verification.

Note that certain rights are subject to limitations where gopaldo has overriding legal obligations, such as AML record-keeping requirements that may prevent immediate erasure of transaction records. gopaldo will explain any applicable limitation when responding to your request.

10.1 Minimum Age Policy. The gopaldo platform is strictly restricted to individuals who are at least twenty-one (21) years of age. gopaldo does not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process.

10.2 Discovery of Underage Use. If gopaldo discovers or has reason to believe that an Account has been registered by or is being used by an individual under the age of 21, the Account will be immediately suspended. All personal data collected in connection with such an Account will be identified and either deleted or handled in accordance with the specific obligations applicable to data relating to minors under RA 10173.

10.3 Parental Notification. Where an Account is found to belong to a minor, gopaldo may notify the parent or legal guardian and will cooperate with any request to delete the relevant data, subject to legal retention obligations.

11.1 Primary Processing in the Philippines. gopaldo prioritises the processing and storage of personal data within the Philippines. Where data is processed within the country, it is subject to the full protection of RA 10173 and the NPC's implementing regulations.

11.2 Transfers Outside the Philippines. Certain game providers, payment processors, and cloud infrastructure providers used by gopaldo may process data outside of the Philippines. Where such transfers occur, gopaldo ensures that the recipient jurisdiction provides an adequate level of data protection or that contractual safeguards are in place equivalent to the standards required by RA 10173 and NPC guidelines.

11.3 Your Consent. By using the gopaldo platform and creating an Account, you consent to the transfer of your personal data to third-party service providers outside of the Philippines where necessary for the delivery of platform services, subject to the safeguards described in this section.

12.1 Internal Response. In the event of a personal data breach affecting gopaldo users, gopaldo will activate its incident response procedures immediately upon discovery. The scope and nature of the breach will be assessed to determine the risk to affected data subjects.

12.2 Notification to NPC. Where a personal data breach is assessed to likely result in a real risk of serious harm to affected data subjects, gopaldo will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, as required by Section 20(f) of RA 10173 and NPC Circular No. 16-03.

12.3 Notification to Affected Users. Where a breach is likely to result in a high risk to the rights and freedoms of specific data subjects, gopaldo will notify those individuals directly via their registered contact details (email or Philippine mobile number) without undue delay. The notification will describe the nature of the breach, what data was affected, what steps gopaldo is taking, and what actions the user should take to protect themselves.

13.1 Right to Update. gopaldo reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, NPC guidelines, PAGCOR requirements, or the platform's data processing activities. The current version and effective date of the Policy are displayed at the top of this document.

13.2 Notice of Material Changes. Material changes to this Policy that affect how your personal data is collected, used, or shared will be communicated to you via your registered email address or a notification upon login, no less than seven (7) days before the changes take effect.

13.3 Continued Use. Your continued use of the gopaldo platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of and agreement to the revised terms. If you do not agree with the changes, you should discontinue use of the platform and request account closure in accordance with the gopaldo Terms and Conditions.

gopaldo has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with RA 10173 and this Privacy Policy. The DPO is the primary point of contact for all data protection enquiries, subject access requests, and complaints relating to gopaldo's handling of personal data.

To contact the gopaldo Data Protection Officer:

• Email: [email protected] (subject line: "Data Protection Enquiry" or "Data Subject Request")
• Live Chat: Available 24/7 on the gopaldo platform — request to be connected to the data protection team
• Response Time: Acknowledgement within 5 business days; substantive response within 15 business days

If you are not satisfied with gopaldo's response to your data protection enquiry, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines.