getaya Privacy Policy

1. Introduction

getaya ("we", "us", "our") is committed to protecting the privacy and personal data of every individual who uses our platform at getaya.bet. This Privacy Policy describes the types of personal information we collect from players and visitors, the purposes for which we process that information, the circumstances in which we may share it with third parties, and the rights available to you as a data subject under Philippine law.

This Privacy Policy applies to all services offered through the getaya website and any associated mobile applications, and covers data collected both online and offline in connection with your relationship with getaya. It should be read alongside our Terms & Conditions, which govern your use of the platform.

getaya is regulated by the Philippine Amusement and Gaming Corporation (PAGCOR) and operates in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as overseen by the National Privacy Commission (NPC) of the Philippines.

2. Data Controller

For the purposes of the Data Privacy Act of 2012, getaya is the personal information controller responsible for your data. Our designated Data Protection Officer (DPO) oversees all matters relating to data privacy within getaya and can be reached using the contact details provided in Section 14 of this Policy.

If you are located outside the Philippines, please be aware that your data may be transferred to and processed in the Philippines, where data protection laws may differ from those in your country of residence. By using the getaya platform, you consent to such transfer and processing.

3. Personal Data We Collect

getaya collects personal data that is necessary to provide you with a safe, compliant, and enjoyable gaming experience. The categories of personal data we collect include the following:

3.1 Identity & Contact Data

• Full legal name as it appears on a government-issued ID;
• Date of birth (to verify the 21+ age requirement);
• Nationality and country of residence;
• Valid email address;
• Philippine mobile number;
• Residential address including barangay, city or municipality, and province.

3.2 Identity Verification (KYC) Data

• Copies of government-issued photo identification (e.g., Philippine passport, driver's licence, UMID, SSS ID, or PhilSys national ID);
• Proof of address documents (e.g., utility bills, bank statements dated within 90 days);
• Selfie or live photo for liveness verification where required by our KYC process.

3.3 Financial Data

• Deposit and withdrawal transaction records including amount, date, and payment method used;
• GCash or PayMaya account reference numbers;
• Bank account details where bank transfer is used (BPI, BDO, Metrobank);
• Cryptocurrency wallet addresses where applicable;
• Transaction history and account balance records.

3.4 Gaming & Behavioural Data

• Game session data including games played, bet amounts, winnings, and session duration;
• Promotion and bonus usage history;
• Responsible gaming tool settings and self-exclusion records;
• Customer support interaction history including chat transcripts and email correspondence.

3.5 Technical & Device Data

• IP address and geolocation data;
• Device type, operating system, and browser information;
• Login timestamps and session identifiers;
• Cookies and similar tracking technologies as described in Section 10.

4. How We Collect Your Data

getaya collects personal data through the following means:

• Directly from you — when you register an Account, complete KYC verification, make deposits or withdrawals, contact customer support, participate in promotions, or update your Account profile;
• Automatically — through cookies, web beacons, server logs, and similar technologies when you visit or interact with the getaya platform;
• From third parties — including identity verification service providers, payment processors, fraud prevention agencies, and PAGCOR regulatory systems where disclosure is required or permitted by law.

5. Purposes of Processing

getaya processes your personal data for the following purposes:

6. Legal Basis for Processing

Under the Data Privacy Act of 2012, getaya relies on the following legal bases when processing your personal data:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms and Conditions you agreed to at registration, including operating your Account and processing payments;
• Legal Obligation: Processing required to comply with applicable Philippine laws, including PAGCOR licensing conditions, AMLA obligations, and tax reporting requirements;
• Legitimate Interests: Processing necessary for fraud detection, platform security, and responsible gaming monitoring, where those interests are not overridden by your rights and freedoms;
• Consent: Processing for marketing communications, where you have given us a clear, freely given, specific, and informed consent that can be withdrawn at any time.

7. Sharing Your Personal Data

getaya may share your personal data with the following categories of third parties:

7.1 Payment Service Providers

Transaction data is shared with our payment processors — including GCash, PayMaya, BPI, BDO, Metrobank, and cryptocurrency network providers — solely to process your deposits and withdrawals. These providers operate under their own privacy policies and are independently regulated.

7.2 Identity Verification Providers

KYC and identity data is shared with licensed third-party identity verification services to confirm your identity and age in compliance with PAGCOR requirements and Philippine law.

7.3 Regulatory and Law Enforcement Authorities

getaya is required by law to disclose certain personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other competent authorities when required by applicable legislation, court order, or legitimate regulatory request.

7.4 Technology and Infrastructure Partners

Technical data may be shared with cloud hosting providers, software vendors, and cybersecurity partners who support the operation of the getaya platform. All such partners are bound by contractual confidentiality obligations and are prohibited from using your data for any purpose other than providing services to getaya.

7.5 Game Content Providers

Aggregated, anonymised gameplay statistics may be shared with game providers to support technical operations and game certification. No personally identifiable information is shared with game providers for marketing purposes.

8. Data Retention

getaya retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Account and KYC records: Retained for a minimum of five (5) years from the date of Account closure, in compliance with PAGCOR requirements and AMLA obligations;
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction;
• Customer support records: Retained for three (3) years from the date of the last interaction;
• Marketing consent records: Retained for the duration of your Account and for one (1) year following Account closure or withdrawal of consent, whichever is later;
• Technical and log data: Typically retained for twelve (12) months, unless required for longer periods in connection with an active investigation or legal proceeding.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual.

9. Security Measures

getaya implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security programme includes the following safeguards:

• 256-bit SSL/TLS encryption for all data in transit between your device and getaya's servers;
• AES-256 encryption for sensitive data stored at rest, including identity documents and financial records;
• Multi-factor authentication options for player Accounts;
• Regular penetration testing and vulnerability assessments conducted by independent security experts;
• Role-based access controls ensuring that only authorised personnel with a legitimate need can access personal data;
• 24/7 security monitoring and automated intrusion detection systems;
• Mandatory data privacy training for all staff who handle personal information.

In the event of a personal data breach that poses a real risk of harm to affected individuals, getaya will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will promptly inform affected players as required by law.

10. Cookies and Tracking Technologies

getaya uses cookies and similar technologies (including web beacons and local storage) to operate and improve the platform. The categories of cookies we use are as follows:

You can control and manage cookies through your browser settings. Please note that disabling strictly necessary cookies may affect the functionality of the getaya platform and your ability to log in or complete transactions. Detailed guidance on managing cookies is available in your browser's help documentation.

11. Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by getaya. To exercise any of these rights, please contact our Data Protection Officer using the details in Section 14.

getaya will respond to all verified data subject requests within thirty (30) calendar days of receipt. In complex cases, we may extend this period by a further thirty (30) days, in which case we will notify you of the extension and the reason for it. We reserve the right to verify your identity before processing any data subject request.

If you are not satisfied with our response to a data subject request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

12. Minors and Age Restriction

getaya does not knowingly collect, use, or store personal data from any person under the age of 21. Age verification is a mandatory step in our registration and KYC process, and we require all players to provide a government-issued ID confirming that they meet the minimum age requirement.

If getaya becomes aware that personal data has been collected from an individual who is below the minimum age requirement, we will immediately close the associated Account, void all transactions, and delete the personal data in question in accordance with applicable law. If you believe a minor has registered an Account on getaya, please contact our Data Protection Officer immediately.

13. Changes to This Privacy Policy

getaya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. When we make material changes to this Policy, we will notify registered players via email to the address associated with their Account and by posting a prominent notice on the getaya platform at least fourteen (14) days before the changes take effect.

The "Last updated" date at the top of this Policy reflects the date of the most recent revision. We encourage you to review this page periodically to stay informed about how getaya protects your personal data. Continued use of the platform following the effective date of any revised Policy constitutes your acceptance of the updated terms.

14. Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the way getaya processes your personal data, please contact our Data Protection Officer. All enquiries will be handled confidentially and in accordance with the Data Privacy Act of 2012.

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines if you believe that getaya has not handled your personal data in accordance with applicable law. Details on how to file a complaint are available on the NPC's official website.