Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how gu777 ("gu777," "we," "us," or "our") collects, uses, stores, discloses, and protects the personal data of individuals ("Data Subjects," "you") who access or use the gu777 online gaming platform at gu777.co and all associated platform services (collectively, the "Platform").

gu777 is committed to protecting the privacy and personal data of all its players, particularly in compliance with the Republic of the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and all relevant issuances of the National Privacy Commission (NPC). We are also required to process certain player data pursuant to our operating obligations under the Philippine Amusement and Gaming Corporation (PAGCOR) regulatory framework and the Anti-Money Laundering Act of 2001 (Republic Act No. 9160, as amended).

By registering an account on gu777 or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, please discontinue use of the Platform and request account closure.

This Policy should be read together with gu777's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

Data Controller Identity

For the purposes of the Data Privacy Act of 2012 and its Implementing Rules and Regulations, gu777 acts as the Personal Information Controller (PIC) with respect to all personal data collected from players and users of the Platform.

gu777 has appointed a Data Protection Officer (DPO) in accordance with Section 21 of the Implementing Rules and Regulations of RA 10173. The DPO is responsible for overseeing gu777's data protection programme, ensuring compliance with applicable data privacy laws, handling Data Subject requests, and serving as the primary point of contact with the National Privacy Commission.

Contact details for the gu777 Data Protection Officer are provided in Section 16 of this Policy.

Personal Data We Collect

gu777 collects the minimum personal data necessary for the purposes described in this Policy. The categories of personal data we process are as follows:

gu777 does not collect sensitive personal information as defined under Section 3(l) of RA 10173 — including racial or ethnic origin, religious beliefs, health information, or sexual orientation — unless specifically required by law or with your explicit consent.

How We Collect Personal Data

gu777 collects personal data through the following channels:

• Direct collection during registration: When you create a gu777 account, you provide identity, contact, and account data directly through the registration form.
• KYC verification submissions: Identity documents and proof of address are submitted directly by you as part of the mandatory KYC process.
• Payment processing: Financial data is collected when you initiate deposits or withdrawals through integrated payment channels including GCash, Maya, and Philippine banking institutions.
• Platform usage: Gaming activity data, device data, and technical data are collected automatically as you use the Platform through server-side logging and analytics systems.
• Customer support interactions: Communication data is collected when you contact gu777 via Live Chat, email, or other support channels.
• Cookies and tracking technologies: Browser cookies, session tokens, and similar technologies are used to maintain your logged-in session and improve Platform performance. See Section 10 for full details.
• Third-party payment providers: Limited financial transaction data may be shared with gu777 by payment processors (e.g., GCash, Maya) for transaction verification and fraud prevention purposes, subject to those providers' own privacy policies.

Purposes of Processing and Legal Basis

gu777 processes your personal data only for specified, explicit, and legitimate purposes. The primary purposes and corresponding legal bases under RA 10173 are as follows:

• Account registration and management — Legal basis: Performance of a contract (your agreement to our Terms & Conditions).
• Identity and age verification (KYC) — Legal basis: Legal obligation under PAGCOR licensing requirements and Philippine AML legislation.
• Payment processing for deposits and withdrawals — Legal basis: Performance of a contract; legal obligation.
• Delivery of gaming services — Legal basis: Performance of a contract.
• Anti-money laundering monitoring and suspicious transaction reporting — Legal basis: Legal obligation under RA 9160 as amended and PAGCOR regulations.
• Fraud prevention and platform security — Legal basis: Legitimate interest of gu777 and its players in maintaining a secure, fair gaming environment.
• Responsible gaming compliance — Legal basis: Legal obligation; legitimate interest in player welfare.
• Customer support and dispute resolution — Legal basis: Performance of a contract; legitimate interest.
• Platform improvement, analytics, and product development — Legal basis: Legitimate interest, using anonymised or aggregated data where possible.
• Direct marketing communications — Legal basis: Your consent, which may be withdrawn at any time.
• Compliance with legal, regulatory, and judicial obligations — Legal basis: Legal obligation.

gu777 will not process your personal data for any purpose incompatible with the purposes listed above without first obtaining your explicit consent or identifying a separate lawful basis for processing under RA 10173.

Data Sharing and Disclosure

gu777 does not sell, rent, or trade your personal data to any third party for commercial purposes. Personal data is shared only in the following circumstances:

• Payment service providers: GCash (G-Xchange Inc.), Maya (Voyager Innovations Inc.), GrabPay, banking institutions (BPI, BDO, Metrobank), and card networks (Visa, Mastercard) receive transaction data necessary to process your deposits and withdrawals.
• Game content providers: Game providers (including Jili Games, PG Soft, Habanero, CQ9, Spadegaming, and others) may receive your account identifier and game session data necessary to deliver their games within the Platform environment.
• Identity verification service providers: Third-party KYC and identity verification platforms may process your submitted identity documents on gu777's behalf for age and identity verification purposes.
• Regulatory and law enforcement authorities: gu777 is required to disclose player data — including transaction records, identity data, and gaming activity — to PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), the National Privacy Commission (NPC), and other Philippine government authorities pursuant to lawful requests, court orders, or regulatory obligations.
• Professional advisers: Legal counsel, auditors, and compliance consultants engaged by gu777 may access personal data on a confidential, need-to-know basis in the performance of their professional services.
• Corporate transactions: In the event of a business merger, acquisition, or asset sale involving gu777, player data may be transferred as part of the transaction, subject to equivalent data protection obligations being imposed on the recipient.

International Data Transfers

gu777's primary platform infrastructure is maintained in data centres located within or serving the Asia-Pacific region. Some third-party service providers engaged by gu777 — including game content providers, analytics platforms, and cloud infrastructure providers — may process data in servers located outside the Philippines.

Where personal data is transferred to processors or entities located outside the Philippines, gu777 ensures that adequate safeguards are in place to protect your data in accordance with Section 21 of RA 10173, including but not limited to:

• Executing data processing agreements or standard contractual clauses with overseas processors that impose obligations equivalent to those under Philippine data privacy law.
• Selecting processors located in jurisdictions that have been assessed to provide an adequate level of data protection.
• Obtaining your explicit consent where required by the NPC for specific cross-border data transfers.

For information about specific countries or regions where your data may be processed by third-party service providers, you may submit a formal inquiry to our Data Protection Officer at the contact details provided in Section 16.

Data Retention

gu777 retains personal data only for as long as is necessary for the purposes set out in this Policy, or as required by applicable law. The following general retention periods apply:

• Account data and identity records: Retained for the duration of your active account plus a minimum of five (5) years following account closure, in accordance with PAGCOR licensing requirements and applicable AML record-keeping obligations under RA 9160.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of the transaction, in compliance with BIR requirements and AMLC record-keeping rules.
• KYC documents: Retained for the duration of the customer relationship plus five (5) years post-account closure, or such longer period as may be required by applicable Philippine law or PAGCOR regulations.
• Gaming activity logs: Retained for a minimum of three (3) years for regulatory compliance and dispute resolution purposes.
• Customer support communications: Retained for two (2) years from the date of the interaction for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for the period of consent plus three (3) years to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with gu777's data disposal procedures, unless retention is required by a specific legal obligation, ongoing regulatory investigation, or court order.

Security Measures

gu777 implements organisational, technical, and physical security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include, but are not limited to:

• Transport Layer Security (TLS 1.3): All data transmitted between your browser or app and gu777 servers is encrypted in transit using TLS 1.3.
• Password hashing: Account passwords are stored as one-way bcrypt hashes with individual salting. No plain-text passwords are stored at any point in gu777's systems.
• Two-Factor Authentication (2FA): Players are offered SMS-based 2FA to protect account access, with enforcement available as a mandatory control for high-value accounts.
• Data encryption at rest: Sensitive data fields — including identity document references, financial account details, and KYC records — are encrypted at rest using industry-standard symmetric encryption.
• Access controls: Access to personal data is restricted to gu777 staff on a strict need-to-know basis, enforced through role-based access control (RBAC) systems with audit logging.
• Intrusion detection and monitoring: gu777's platform infrastructure is monitored continuously for unauthorised access attempts, anomalous activity, and security incidents.
• Regular security assessments: gu777 conducts periodic security reviews, vulnerability assessments, and penetration testing of its Platform infrastructure.

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. gu777 cannot warrant absolute security of your personal data, but we commit to notifying affected individuals and the NPC promptly in the event of a personal data breach as described in Section 14.

Cookies and Tracking Technologies

gu777 uses cookies and similar tracking technologies on its Platform for the following purposes:

• Strictly necessary cookies: These cookies are essential to the functioning of the Platform. They maintain your logged-in session, remember your authentication state, and enable core security features such as CSRF protection. These cookies cannot be disabled without affecting Platform functionality.
• Functional cookies: These cookies remember your account preferences, language settings, and display preferences to provide a personalised Platform experience across sessions.
• Analytics cookies: Aggregated, anonymised analytics data is collected to understand how players interact with the Platform — including page navigation patterns, feature usage, and performance metrics. This data is used to improve the Platform experience.
• Security cookies: Short-lived session tokens and security identifiers are used to bind your session to your authenticated device and detect suspicious concurrent session activity.

gu777 does not use third-party advertising or tracking cookies that profile your browsing activity across other websites. You may configure your browser to block or delete cookies; however, disabling strictly necessary cookies will prevent you from logging in to your gu777 account.

Direct Marketing Communications

With your consent, gu777 may send you promotional communications about bonuses, new games, platform features, tournaments, and special offers via SMS to your registered Philippine mobile number and/or email to your registered address.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your notification preferences in the Account Settings section of your gu777 dashboard;
• Clicking the unsubscribe link included in any marketing email sent by gu777; or
• Contacting gu777 support via Live Chat or email at [email protected] with the subject line "Marketing Opt-Out."

Withdrawal of marketing consent will not affect the lawfulness of any processing carried out prior to withdrawal, and will not affect gu777's ability to send you transactional and account-related communications (such as deposit confirmations, withdrawal notifications, and security alerts), which are sent pursuant to the performance of your account agreement rather than marketing consent.

Children and Minors

gu777 is strictly intended for individuals who are 21 years of age or older in accordance with Philippine gaming law. gu777 does not knowingly collect personal data from any person under the age of 21.

If gu777 becomes aware that personal data has been submitted by or on behalf of a person under 21 years of age, that account will be immediately suspended, all associated personal data will be deleted to the extent permitted by applicable law, and any deposited funds will be returned through the original payment channel following identity verification.

Parents and guardians who believe that a minor may have registered an account on gu777 or submitted personal data to the Platform should contact our Data Protection Officer immediately at the contact details provided in Section 16.

Exercising Your Data Subject Rights

As a Philippine data subject, you may exercise the rights described in the feature section above (and detailed in Section 16 of RA 10173) by submitting a formal request to gu777's Data Protection Officer. To exercise your rights:

1. Submit your request in writing to [email protected] with the subject line "Data Privacy Request — [Right Being Exercised]."
2. Include your full registered name, registered email address, and a copy of a valid Philippine government-issued photo ID to verify your identity.
3. Clearly describe the specific right you are exercising and provide any relevant details that will assist gu777 in processing your request efficiently.
4. gu777 will acknowledge receipt of your request within three (3) business days and will provide a substantive response within fifteen (15) business days of receiving a complete, verified request. Complex requests may require up to thirty (30) business days, in which case you will be notified of the extended timeline.

gu777 will not charge a fee for processing standard data subject requests. gu777 reserves the right to charge a reasonable administrative fee for manifestly unfounded, excessive, or repetitive requests, in accordance with NPC guidelines.

If you are unsatisfied with gu777's response to your data privacy request, or if you believe gu777 has violated your data privacy rights, you may lodge a complaint with the National Privacy Commission of the Philippines.

Personal Data Breach Notification

In the event of a personal data breach that is likely to give rise to a real risk of harm to affected Data Subjects, gu777 will comply with the breach notification obligations under Section 20(f) of RA 10173 and the NPC's Circular on Personal Data Breach Management.

Specifically, gu777 will:

• Notify the National Privacy Commission within seventy-two (72) hours of becoming aware of a qualifying personal data breach, to the extent feasible;
• Notify affected Data Subjects within a reasonable period when the breach is likely to result in a high risk to their rights and freedoms, including information about the nature of the breach, the data categories affected, the likely consequences, and the remedial measures being taken;
• Maintain an internal breach register documenting all personal data incidents, including those that do not meet the notification threshold, for regulatory review purposes.

If you believe that your gu777 account or personal data has been compromised, please contact gu777 support immediately via Live Chat or at [email protected]. We will investigate all reports of suspected breaches promptly.

Amendments to This Privacy Policy

gu777 reserves the right to update or amend this Privacy Policy at any time in response to changes in applicable law, NPC guidance, PAGCOR requirements, business practices, or Platform features. The effective date at the top of this Policy will be updated to reflect the date of any revision.

Material changes to this Policy — particularly any changes that expand the purposes for which your personal data is processed or changes to data sharing arrangements — will be communicated to registered players via email to the address associated with their gu777 account and/or via a prominent notice on the Platform prior to the changes taking effect.

Your continued use of the gu777 Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised Policy. If you do not agree with the revised Policy, you must cease using the Platform and request account closure prior to the effective date of the amendment.

Contact Details — Data Protection Officer

For all matters relating to this Privacy Policy, including the exercise of your data subject rights, privacy inquiries, or concerns about gu777's data processing practices, please contact our Data Protection Officer through the following channels:

• Data Protection Officer Email: [email protected] — Please use the subject line "Data Privacy — DPO" for privacy-specific correspondence to ensure prompt routing to the correct team.
• General Support Email: [email protected] — For general account and platform support queries.
• Live Chat: Available 24 hours a day, 7 days a week, within your gu777 account dashboard. For immediate account security concerns, Live Chat is the fastest available contact channel.

gu777 will respond to privacy-related correspondence from our Data Protection Officer's team within five (5) Philippine business days of receipt. For urgent data security concerns — such as suspected unauthorised account access — please use Live Chat for the fastest response.