kuyaph Privacy Policy

This Privacy Policy ("Policy") is published by kuyaph ("kuyaph," "Company," "we," "us," or "our") and applies to all personal data collected, processed, and stored by kuyaph in connection with the operation of the kuyaph online gaming platform at kuyaph.org and all associated mobile applications, APIs, and services (collectively, the "Platform").

This Policy applies to all individuals who interact with kuyaph — including registered Account holders, prospective players who browse the Platform without registering, and individuals who contact kuyaph's customer support team. By using the kuyaph Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

This Policy should be read together with kuyaph's Terms & Conditions and any specific supplementary privacy notices that may be provided at the time personal data is collected for a specific purpose.

For the purposes of the Data Privacy Act of 2012, kuyaph is the Personal Information Controller in respect of all personal data collected through the Platform. kuyaph determines the purposes and means by which personal data is processed and bears responsibility for ensuring that all processing is conducted lawfully, fairly, and transparently.

kuyaph has designated a Data Protection Officer (DPO) who is responsible for monitoring compliance with this Policy, the Data Privacy Act, and all related regulations. The DPO's contact details are provided in Section 15 of this Policy. The DPO can be contacted for any questions, concerns, or requests relating to kuyaph's handling of personal data.

Where kuyaph engages third-party service providers to process personal data on its behalf (for example, payment processors, identity verification providers, and cloud infrastructure operators), those providers act as Personal Information Processors and are contractually bound to process data only on kuyaph's documented instructions, to implement appropriate security measures, and to comply with the Data Privacy Act.

kuyaph collects and processes the following categories of personal data, depending on your interaction with the Platform:

kuyaph does not intentionally collect special categories of personal data (such as health data, political opinions, religious beliefs, or biometric data) except where biometric data is collected as part of the KYC verification process on devices that support biometric authentication, in which case such data is processed locally on your device and is not transmitted to or stored on kuyaph's servers.

kuyaph collects personal data through the following mechanisms:

• Direct submission by you: Data you provide when creating an Account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or responding to a promotional survey.
• Automated collection during Platform use: Technical and gaming data collected automatically as you interact with the Platform, including through cookies, server logs, session tracking, and device fingerprinting technologies. See Section 8 for full details on cookies and tracking.
• Third-party identity verification providers: During the KYC process, kuyaph works with PAGCOR-approved identity verification service providers who may cross-reference the documents you submit against government-issued identity databases to verify authenticity.
• Payment processors: kuyaph receives transaction confirmation data from payment processors (such as GCash, Maya, Instapay, and banking partners) to record and reconcile deposits and withdrawals on your Account.
• Fraud and risk detection services: kuyaph may receive risk scoring or flagging data from fraud detection providers to protect against unauthorized Account access and financial crime.

Under the Data Privacy Act of 2012, kuyaph processes your personal data on the following lawful bases:

• Contractual necessity: Processing required to establish and maintain your kuyaph Account, process gaming transactions, deliver the Platform's services to you, and handle your customer support requests.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, Philippine anti-money laundering law (Republic Act No. 9160, as amended), age verification requirements, tax reporting obligations, and other applicable Philippine regulatory requirements.
• Legitimate interests: Processing for fraud detection, Platform security, and responsible gaming monitoring — where such interests are not overridden by your rights and interests.
• Consent: Processing for marketing communications, optional analytics participation, and any other purpose where kuyaph expressly requests your consent. You have the right to withdraw consent at any time, which will not affect the lawfulness of processing conducted prior to withdrawal.

kuyaph uses the personal data we collect for the following purposes:

1. Creating, verifying, maintaining, and administering your kuyaph Account;
2. Processing deposits, withdrawals, and all in-Platform financial transactions in Philippine Peso (₱);
3. Conducting KYC identity and age verification in compliance with PAGCOR requirements;
4. Verifying that you are at least 21 years of age, as required under PAGCOR's regulatory framework for online gaming operators in the Philippines;
5. Detecting, investigating, and preventing fraud, money laundering, and other financial crimes in compliance with Republic Act No. 9160;
6. Monitoring gameplay patterns to identify and respond to responsible gaming concerns, including problem gambling indicators;
7. Providing customer support, resolving disputes, and responding to your inquiries;
8. Sending transactional notifications including deposit confirmations, withdrawal updates, and security alerts — these are sent regardless of marketing preferences as they relate to your Account's operation;
9. Sending promotional communications, bonus offers, and gaming updates — only where you have given your consent or opted in;
10. Complying with mandatory regulatory reporting obligations to PAGCOR and other competent Philippine authorities;
11. Improving the Platform, personalizing the gaming experience, and conducting internal analytics to enhance kuyaph's services.

kuyaph will not use your personal data for purposes incompatible with those listed above without first providing notice and, where required, obtaining your consent.

kuyaph does not sell, rent, or trade your personal data to third parties for their own independent commercial purposes. We share personal data only in the following circumstances and only to the extent necessary for the stated purpose:

• Payment processors: GCash, Maya, BPI, BDO, Metrobank, and other payment partners receive the minimum data necessary to process your deposit and withdrawal transactions.
• KYC and identity verification providers: PAGCOR-approved providers who verify the authenticity of the identity documents you submit during Account registration.
• Fraud detection and AML compliance services: Third-party providers who assist kuyaph in identifying and preventing financial crime on the Platform.
• Cloud infrastructure and hosting providers: kuyaph's Platform is hosted on secure cloud infrastructure. Hosting providers operate as Personal Information Processors and are contractually bound to process data only on kuyaph's instructions.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), and other competent Philippine government authorities, where disclosure is required by law or regulatory mandate.
• Law enforcement: Philippine law enforcement agencies where kuyaph is legally required or authorized to disclose data in connection with a criminal investigation or legal proceeding.
• Business transfers: In the event of a merger, acquisition, or sale of kuyaph's business or assets, your data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

kuyaph uses cookies and similar tracking technologies on the Platform to ensure proper functionality, enhance security, and analyze Platform usage. The following types of cookies are used:

• Strictly necessary cookies: Required for the Platform to function correctly — these include session authentication tokens, security cookies, and load balancing cookies. These cookies cannot be disabled without disrupting core Platform functionality.
• Functional cookies: Store your preferences such as language settings, game display settings, and whether you have accepted cookie notices. These cookies improve your experience but are not strictly required.
• Analytics cookies: Used to collect aggregate, anonymized data about how players navigate and interact with the Platform, enabling kuyaph to identify and fix usability issues and improve the gaming experience. Where analytics cookies involve processing personal data, they are set only with your consent.
• Security and fraud detection cookies: Used to identify and block suspicious activity, unauthorized login attempts, and automated bot access. These are classified as strictly necessary for Platform security purposes.

You may manage non-essential cookie settings through your browser's cookie management tools. Disabling all cookies may affect the functionality of certain features of the kuyaph Platform. kuyaph does not use cookies to serve third-party advertising or to track your activity across third-party websites.

kuyaph implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction. These measures include:

• HTTPS/TLS 1.3 encryption for all data transmission between your device and kuyaph's servers;
• Encryption at rest for all personal and financial data stored on kuyaph's infrastructure;
• Role-based access controls ensuring that only authorized kuyaph personnel may access personal data, and only to the extent required for their specific job function;
• Multi-factor authentication requirements for all kuyaph staff accessing production systems containing personal data;
• Regular security audits, penetration testing, and vulnerability assessments conducted by qualified security professionals;
• Incident response procedures enabling kuyaph to detect, contain, and notify affected individuals of data security incidents within the timeframes required by the Data Privacy Act;
• Employee training on data privacy and security obligations under Philippine law.

kuyaph will notify the National Privacy Commission and affected Players of any personal data breach that is reasonably likely to result in serious harm, in accordance with the notification requirements of the Data Privacy Act of 2012 and NPC Circular No. 16-03.

kuyaph retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following retention periods apply as a general guideline:

• Account data and KYC documentation: Retained for the duration of the active Account relationship and for a minimum of five (5) years following Account closure, in accordance with the Republic Act No. 9160 (Anti-Money Laundering Act) record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years following the date of the transaction, consistent with AML record-keeping obligations and BIR requirements.
• Gaming activity records: Retained for the duration of the Account relationship plus two (2) years, or longer where required for dispute resolution or PAGCOR regulatory reporting.
• Customer support communications: Retained for two (2) years from the date of the communication, unless a longer period is required for ongoing dispute or legal proceedings.
• Marketing preference records: Retained for the duration of the Account relationship and for one (1) year following Account closure, as evidence of consent or opt-out status.

When personal data is no longer required for any applicable retention purpose, kuyaph will securely delete or irreversibly anonymize it. Anonymized data — where all identifying information has been removed such that re-identification is not reasonably possible — may be retained indefinitely for aggregate analytics and reporting purposes.

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by kuyaph. To exercise any of these rights, contact kuyaph via the support channel described in Section 15.

21+ The kuyaph Platform is strictly for persons aged 21 years and above. kuyaph does not knowingly collect, process, or retain personal data from individuals under 21 years of age. This is both a PAGCOR regulatory requirement and kuyaph's firm policy commitment.

All Account registrations are subject to government ID-based age verification. Where kuyaph determines or has reasonable cause to believe that an Account has been registered by or is being used by a person under 21 years of age, kuyaph will immediately suspend the Account, delete all personal data associated with the Account to the extent permitted by applicable law, and report the incident to PAGCOR in accordance with regulatory obligations.

If you are a parent or guardian and believe a person under 21 years of age has registered an Account on kuyaph, please contact kuyaph's customer support immediately via live chat. kuyaph will investigate and act promptly on all such reports.

kuyaph's primary data processing infrastructure is located within the Philippines. In certain circumstances, personal data may be transferred to or accessed by kuyaph's service providers located outside the Philippines — for example, cloud infrastructure providers, fraud detection services, or game software licensors operating from other jurisdictions.

Where such cross-border transfers occur, kuyaph ensures that an adequate level of data protection is in place, consistent with the requirements of Section 21 of the Data Privacy Act of 2012. Safeguards implemented for cross-border transfers include contractual data processing agreements with standard data protection clauses, and transfer only to countries or organizations recognized by the NPC as providing an adequate level of protection.

kuyaph does not transfer personal data to jurisdictions identified by the Financial Action Task Force (FATF) as high-risk or non-cooperative territories for anti-money laundering purposes, except where required by Philippine law or mandatory regulatory process.

kuyaph reserves the right to update or revise this Privacy Policy at any time. Changes may be made to reflect updates to Philippine privacy law, PAGCOR regulatory requirements, changes to kuyaph's data processing practices, or corrections to existing provisions.

Where a material change is made to this Policy — meaning a change that meaningfully affects how your personal data is processed in a way that was not contemplated by this Policy — kuyaph will notify registered Account holders via the email address on their Account and will publish the updated Policy on the Platform with a revised effective date at least fourteen (14) days before the change takes effect.

For changes required immediately by law or regulatory directive, the updated Policy may take effect without prior notice. In such cases, kuyaph will notify Account holders as soon as practicable after the change takes effect.

Your continued use of the kuyaph Platform after the effective date of any Policy update constitutes your acceptance of the revised terms. If you disagree with any update, you may request Account closure by contacting kuyaph support before the effective date of the change.

For any question, concern, or request relating to this Privacy Policy or kuyaph's processing of your personal data — including requests to exercise your data rights under Section 11 — please contact kuyaph through the following channels:

• Live Chat Support: Available 24/7 within your kuyaph Account dashboard. This is the fastest method for all account-related privacy requests. Identify your inquiry as a "Privacy Request" or "Data Rights Request" when initiating the chat so it can be directed to the appropriate team.
• Email (plain text — not a clickable link): [email protected] — Use the subject line "Privacy Policy Inquiry" or "Data Rights Request" for faster routing to kuyaph's privacy team.

kuyaph's Data Protection Officer will acknowledge all privacy-related inquiries within five (5) business days. Complex requests — such as full data access requests, erasure requests, or formal complaints — may take up to fifteen (15) business days to fully resolve, consistent with the response periods set out in the NPC's implementing rules.

If kuyaph's response to your privacy inquiry is unsatisfactory, you have the right to escalate the matter to the National Privacy Commission of the Philippines. Information about the NPC's complaint process is available on the NPC's official government website.