grabph Privacy Policy

grabph ("we", "us", "our") operates the online gaming platform accessible at grabph.net (the "Platform"). We are committed to protecting the privacy and personal data of every individual who visits, registers on, or interacts with our Platform. This Privacy Policy explains in clear, honest terms how we handle your personal information.

This Privacy Policy has been prepared in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines, its Implementing Rules and Regulations, and the applicable issuances of the National Privacy Commission (NPC). Where applicable, we also align our practices with PAGCOR's data governance requirements for licensed online gaming operators.

By registering for a grabph account, accessing the Platform, or using any of our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to the terms of this Privacy Policy, please do not use the Platform.

For the purposes of the Data Privacy Act of 2012 and this Privacy Policy, grabph is the Personal Information Controller (PIC) in respect of all personal data collected through the Platform. As the PIC, grabph determines the purposes and means of processing your personal information.

grabph has designated a Data Privacy Officer (DPO) responsible for overseeing compliance with the Data Privacy Act and this Privacy Policy, and for serving as the primary point of contact for data privacy enquiries and complaints from Platform users. The DPO can be reached at:

• Email: [email protected] (mark your message "Data Privacy Officer — Attention DPO")
• Response time: We aim to acknowledge all data privacy enquiries within 5 business days and to provide a substantive response within 30 calendar days of receipt.

Where grabph engages third-party service providers who process personal data on our behalf (for example, payment processors or identity verification providers), those providers act as Personal Information Processors (PIPs) under written contracts that obligate them to process your data only as directed by grabph and in accordance with applicable privacy law.

grabph collects personal information through several channels. Below is a comprehensive breakdown of the categories of data we collect and the circumstances in which we collect them:

3.1 Registration & Account Data

When you create a grabph account, we collect the information you provide during the registration process, which includes:

• Full legal name
• Date of birth (used to verify that you are at least 21 years of age)
• Email address
• Mobile phone number
• Residential address in the Philippines
• Username and password (passwords are stored in hashed, non-reversible form)

3.2 Identity Verification (KYC) Data

As required by PAGCOR regulations and anti-money laundering laws, we collect identity verification documents including:

• Copies of government-issued photo identification (e.g., PhilSys National ID, UMID, Philippine passport, LTO driver's licence)
• Proof of residential address documents (e.g., utility bills, barangay certificates, bank statements)
• Payment method ownership verification documents where applicable
• Facial verification data collected during liveness checks, where required

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, dates, and payment method references
• GCash, PayMaya, or bank account reference details (account names and partial identifiers — not full account credentials)
• Bonus and promotional credit history
• Wagering history and game play records

3.4 Technical & Usage Data

When you access the Platform, we automatically collect certain technical data, including:

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser information
• Pages visited, features used, and session duration on the Platform
• Cookie identifiers and similar tracking technology data (see Section 7)
• Login timestamps and session activity logs

3.5 Communications Data

• Records of live chat, email, and support ticket communications between you and the grabph support team
• Survey responses and feedback submissions
• Any information you voluntarily provide when contacting us

grabph processes your personal information for the following purposes:

grabph will not use your personal data for any purpose that is incompatible with the purposes listed above without first seeking your explicit consent or establishing a separate legal basis for that processing.

Under the Data Privacy Act of 2012, grabph processes your personal information only where a lawful basis exists. The legal bases we rely upon are:

• Contractual Necessity: Processing required to perform our contractual obligations to you as a registered player — including account management, payment processing, and customer support — is carried out on the basis that it is necessary for the performance of the contract between you and grabph.
• Legal Obligation: Processing required to comply with PAGCOR regulations, the Anti-Money Laundering Act, the Data Privacy Act, and other applicable Philippine laws is carried out on the basis of legal obligation.
• Legitimate Interests: Processing for fraud prevention, security monitoring, responsible gaming oversight, and Platform analytics is carried out on the basis of grabph's legitimate interests, provided those interests are not overridden by your rights and interests.
• Consent: Processing for marketing communications and non-essential cookies is carried out only where you have given your explicit, informed, and freely given consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

grabph does not sell or rent your personal information to any third party. We may share your data in the following limited circumstances:

• Payment Processors: We share transaction data with GCash, PayMaya, BPI, BDO, Metrobank, and other payment providers to process your deposits and withdrawals. These providers receive only the information necessary to complete the transaction.
• Identity Verification Providers: Where we use third-party KYC verification services, your identity documents and verification data are shared with those providers under strict contractual data processing agreements.
• Game Providers: We may share anonymised session identifiers with third-party game software providers to enable gameplay. These providers do not receive your personal identification details unless required for regulatory purposes.
• Regulatory Authorities: grabph is required to share certain player data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other competent Philippine authorities upon lawful request or as required by applicable regulations.
• Law Enforcement: We may disclose personal information to law enforcement agencies in the Philippines where required by a lawful court order, subpoena, or other compulsory legal process.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of grabph's business assets, your personal data may be transferred to the successor entity. We will notify you of any such transfer and the applicable privacy terms of the successor entity prior to your data being transferred.

grabph uses cookies and similar tracking technologies (collectively, "cookies") on the Platform. A cookie is a small text file stored on your device that helps the Platform recognise you and remember your preferences across sessions.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. These cookies manage your login session, maintain your authenticated state while browsing, and enable core security features. They cannot be disabled without breaking the Platform's functionality.
• Functional Cookies: Remember your preferences such as language settings, preferred currency display, and responsible gaming notification settings. Disabling these cookies will not prevent you from using the Platform but may reduce convenience.
• Analytics Cookies: Collect aggregated, anonymised data about how players navigate and interact with the Platform. This information helps us identify areas for improvement and optimise performance. These cookies do not identify you as an individual.
• Marketing Cookies: Used only where you have given explicit consent to receive personalised promotional content. These cookies help us present relevant bonus offers and promotions based on your gameplay interests. You may withdraw consent for marketing cookies at any time through your cookie preferences.

You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging into or using the Platform. For all other cookie categories, you can adjust your preferences without losing access to your account.

grabph retains your personal data for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal and regulatory obligations. The following retention periods apply:

• Active Account Data: Retained for the full duration of your account's existence on the Platform, plus a period of 5 years following permanent account closure, as required by PAGCOR's record-keeping obligations and AMLA requirements.
• KYC Documents: Retained for a minimum of 5 years from the date of the last transaction or account closure, whichever is later, in compliance with Anti-Money Laundering Act requirements.
• Transaction Records: Retained for a minimum of 5 years following the date of each transaction, as required by Philippine financial record-keeping regulations.
• Customer Support Records: Retained for 3 years following the closure of each support interaction, for quality assurance and dispute resolution purposes.
• Marketing Consent Records: Retained for the duration of your account plus 3 years, as evidence of your consent preferences.
• Technical & Log Data: Typically retained for 12 months before being anonymised or deleted, unless a longer retention period is required for a specific security investigation.

At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with your identity. Where complete deletion is not immediately possible due to system backup cycles, data is isolated from active processing until it can be permanently deleted.

grabph implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security framework includes:

• Encryption in Transit: All data transmitted between your device and the grabph Platform is protected using TLS (Transport Layer Security) encryption, ensuring that your information cannot be intercepted during transmission.
• Encryption at Rest: Sensitive personal data stored in our systems — including KYC documents and financial records — is encrypted using AES-256 or equivalent encryption standards.
• Access Controls: Access to personal data is restricted to grabph personnel who require that access to perform their job functions. All such access is logged and subject to regular audit.
• Password Security: Account passwords are stored as one-way cryptographic hashes. Even grabph staff cannot see your password in plain text.
• Two-Factor Authentication: grabph offers two-factor authentication (2FA) for account logins. We strongly encourage all players to enable 2FA to provide an additional layer of protection for their accounts.
• Penetration Testing & Security Audits: The Platform undergoes periodic security testing and vulnerability assessments conducted by qualified information security professionals.
• Data Breach Response: In the event of a personal data breach that is likely to result in a risk to your rights and interests, grabph will notify the National Privacy Commission and affected individuals in accordance with the timeframes prescribed by the Data Privacy Act and NPC guidelines.

As an online gaming platform, grabph may engage third-party service providers — such as cloud hosting providers, game software suppliers, and identity verification services — whose infrastructure or operations are located outside the Philippines. Where this results in your personal data being transferred to or accessed from a country outside the Philippines, grabph takes the following steps to ensure your data remains protected:

• We only transfer personal data to third parties in countries that the National Privacy Commission has determined provide an adequate level of personal data protection, or where we have put in place appropriate safeguards such as contractual clauses that require the recipient to protect your data to the same standards as required under Philippine law.
• All third-party processors who may access Philippine player data from outside the Philippines are contractually bound by data processing agreements that reflect the requirements of the Data Privacy Act of 2012.
• Where technically and commercially feasible, grabph prefers to use data hosting and processing infrastructure located within the Philippines or the ASEAN region.

If you would like further information about the specific safeguards in place for a particular international transfer, please contact our Data Privacy Officer.

Under the Data Privacy Act of 2012 and its Implementing Rules, you have the following rights in relation to your personal data held by grabph:

• Right to be Informed: You have the right to be informed about how grabph collects, uses, and processes your personal data. This Privacy Policy fulfils that obligation.
• Right of Access: You have the right to request a copy of the personal data grabph holds about you, along with information about the purposes for which it is processed and with whom it has been shared.
• Right to Rectification: If any personal data grabph holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update many details directly through your account dashboard.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the data has been unlawfully processed — subject to any overriding legal obligation to retain the data (such as PAGCOR's 5-year record-keeping requirement).
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests, though grabph may be able to demonstrate compelling legitimate grounds that override your interests.
• Right to Data Portability: Where technically feasible, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another controller.
• Right to Lodge a Complaint: If you believe that grabph has processed your personal data in violation of the Data Privacy Act of 2012, you have the right to lodge a complaint with the National Privacy Commission (NPC) through their official channels.

To exercise any of the above rights, please contact our Data Privacy Officer at [email protected] with the subject line "Data Privacy Rights Request." We will verify your identity before processing any request and will respond within 30 calendar days. Complex requests may require additional time, in which case we will notify you of the extended timeline.

grabph does not knowingly collect personal information from individuals under the age of 21. Age verification is a mandatory step in the account registration process, and all accounts are subject to KYC checks that confirm the account holder meets the minimum age requirement.

If we become aware that personal data has been collected from a person under the age of 21 — whether through a circumvented age check, falsified documentation, or any other means — we will:

• Immediately suspend the account in question.
• Void any wagers placed and forfeit any associated winnings.
• Delete the personal data of the underage individual from our active systems as promptly as technically feasible, subject to any retention obligations under applicable law.
• Return any Real Money Balance deposits to the source payment method, minus any amounts legally required to be withheld.

If you believe a person under the age of 21 has registered a grabph account, please notify us immediately at [email protected].

With your consent, grabph may send you promotional communications about bonuses, new games, special events, and other offers available on the Platform. We may use the following channels for marketing communications:

• Email to the address registered with your account
• SMS to your registered Philippine mobile number
• Push notifications through the Platform (where enabled on your device)
• In-platform notifications displayed within your account dashboard

You can manage your marketing communication preferences at any time through the Notifications section of your account settings. You may also opt out of email marketing by clicking the "Unsubscribe" link included at the bottom of any marketing email. Opting out of SMS marketing can be done through your account settings or by contacting our support team.

Please note that even if you opt out of all marketing communications, grabph will continue to send you essential transactional and service communications — such as deposit confirmations, withdrawal notifications, account security alerts, and mandatory regulatory communications. These are not marketing communications and cannot be disabled while your account is active.

The grabph Platform does not contain outbound links to third-party websites for general brows ing purposes. However, certain game providers or payment processing flows may redirect you to a third-party interface or widget to complete a transaction or load game content.

grabph is not responsible for the privacy practices or content of any third-party interfaces accessed during payment processing or gameplay. We encourage you to review the privacy policies of any third-party service providers whose interfaces you interact with during your use of the Platform. grabph's Privacy Policy applies only to data collected directly by and through the grabph Platform at grabph.net.

grabph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or business operations. When we make material changes to this Privacy Policy, we will notify you through one or more of the following means:

• A prominent notice displayed on the Platform upon your next login
• An email notification sent to your registered email address
• An in-platform notification in your account dashboard

The "Last Updated" date at the top of this Privacy Policy reflects the date on which the current version came into effect. We encourage you to review this Privacy Policy periodically to stay informed about how grabph protects your personal data. Your continued use of the Platform following the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes.

Where a proposed change to this Privacy Policy would materially reduce your privacy rights or significantly alter how we use your personal data, we will provide at least 30 days' advance notice and, where required by law, seek your renewed consent before the change takes effect.

The most current version of this Privacy Policy will always be available at grabph.net/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way grabph handles your personal data, please contact us through any of the following channels:

• Data Privacy Officer Email: [email protected] — please use the subject line "Data Privacy — [Your Query Type]" to ensure your message is routed to the correct team.
• Live Chat Support: Available 24/7 through the Platform after logging into your account. Our support agents can answer general privacy questions and escalate data rights requests to the DPO on your behalf.
• Response Time: We acknowledge all data privacy enquiries within 5 business days and aim to provide a full response within 30 calendar days.

grabph takes all data privacy complaints seriously and is committed to resolving them promptly, fairly, and in accordance with the Data Privacy Act of 2012 and NPC guidelines. We view every complaint as an opportunity to improve our privacy practices and better serve our players.