gma777 Privacy Policy

gma777 operates the online gaming platform accessible at gma777.org (the "Platform"), which is designed and operated for the Philippine market. For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations, gma777 is the Personal Information Controller in respect of personal data collected from Platform users.

gma777 is committed to safeguarding the privacy of all persons whose personal data is processed in connection with the Platform. This Privacy Policy has been prepared in accordance with:

• Republic Act No. 10173 — Data Privacy Act of 2012 (Philippines);
• The Implementing Rules and Regulations of RA 10173, as issued by the National Privacy Commission (NPC);
• PAGCOR's applicable data protection and player information requirements;
• Republic Act No. 9160 — Anti-Money Laundering Act, as amended, insofar as it relates to the collection and reporting of personal data.

If you have questions about this Privacy Policy or how gma777 handles your personal data, please contact our Data Protection Officer (DPO) at [email protected].

gma777 collects personal data from you in the following categories and through the following means:

gma777 uses your personal data for the following purposes:

• Account management: Creating, verifying, maintaining, and where necessary suspending or closing your gma777 account;
• Identity verification (KYC): Confirming your identity and age (21+) in accordance with PAGCOR requirements and Philippine AML obligations;
• Payment processing: Facilitating PHP deposits and withdrawals via GCash, Maya, QR Ph, and Philippine bank transfers;
• Regulatory compliance: Meeting gma777's obligations to PAGCOR, the AMLC, the NPC, and other applicable Philippine regulatory bodies, including mandatory transaction reporting and suspicious activity reporting;
• Fraud prevention and security: Detecting, preventing, and investigating fraudulent activity, money laundering, underage gambling, and any breach of the gma777 Terms & Conditions;
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behaviour; administering deposit limits, loss limits, session reminders, and self-exclusion tools at the player's request; and fulfilling gma777's duty of care obligations;
• Customer support: Responding to your queries, resolving disputes, and improving the quality of support provided to gma777 players;
• Platform improvement: Analysing aggregated, anonymised usage data to improve game offerings, interface design, payment processing speed, and overall platform performance;
• Marketing communications: Sending promotional offers, bonus notifications, and event announcements — subject always to your communication preferences and the opt-out rights described in this Policy;
• Legal proceedings: Exercising or defending gma777's legal rights in any dispute or regulatory proceeding.

Under the Philippine Data Privacy Act of 2012, gma777 processes your personal data on the following legal bases, depending on the specific purpose:

• Performance of a contract: Processing necessary to create and manage your gma777 account, process deposits and withdrawals, and deliver the gaming services you have registered to receive;
• Legal obligation: Processing required to comply with PAGCOR's licensing conditions, AMLA reporting requirements, NPC directives, and any other applicable Philippine law;
• Legitimate interests: Processing conducted for fraud prevention, platform security, responsible gaming monitoring, and service improvement — where such processing does not unreasonably override your fundamental rights and freedoms;
• Consent: Processing for marketing communications and non-essential cookies, where your prior consent has been obtained. You may withdraw consent for marketing communications at any time by updating your Account notification preferences or contacting [email protected].

gma777 does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial purposes. We may share your personal data with the following categories of recipients, strictly for the purposes described in this Policy:

• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and any other competent Philippine authority, where disclosure is required by law or regulatory mandate;
• Payment processors: GCash (Globe Fintech Innovations), Maya Philippines, BPI, BDO, Metrobank, and other Philippine payment service providers, solely as necessary to process your deposits and withdrawals;
• KYC/AML partners: Licensed identity verification and document authentication service providers contracted by gma777 to conduct KYC checks and monitor for AML red flags, bound by strict data processing agreements;
• Platform technology providers: Game content providers, platform infrastructure providers, and security monitoring services used to operate the gma777 Platform, each bound by contractual data protection obligations no less stringent than those in this Policy;
• Legal and professional advisers: Lawyers, auditors, and compliance consultants instructed by gma777, bound by professional confidentiality obligations;
• Law enforcement: Philippine law enforcement agencies, where gma777 is required by a valid court order, subpoena, or legal process to disclose personal data.

gma777 uses cookies and similar tracking technologies to operate and improve the Platform. A "cookie" is a small data file stored on your device by your browser. The following categories of cookies are used on gma777.org:

gma777 retains personal data for the periods set out below, after which data is securely deleted or irreversibly anonymised:

• Account and identity data: Retained for the duration of your active gma777 account, plus five (5) years following permanent account closure, in accordance with PAGCOR record-keeping requirements and the AMLA's minimum retention period for customer due diligence records;
• Transaction and financial data: Retained for five (5) years from the date of each transaction, as required by the AMLA and PAGCOR regulations;
• KYC documentation: Retained for five (5) years from the date of account closure or the date the KYC documents were last reviewed, whichever is later;
• Gaming activity data: Retained for three (3) years from the date of each gaming session, or longer if required for the resolution of an active dispute or regulatory inquiry;
• Support communications: Retained for two (2) years from the date of each communication, unless the content relates to an unresolved dispute;
• Marketing consent records: Retained for the duration of your account plus one (1) year following account closure, to evidence the basis on which marketing communications were sent.

Where retention beyond these periods is required by Philippine law, court order, or active regulatory proceeding, gma777 will retain the relevant data until that obligation ceases.

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by gma777:

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request — [your account username]". gma777 will respond to all data rights requests within fifteen (15) Business Days of receipt. Identity verification will be required before any request is actioned to protect against unauthorised disclosure.

gma777 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, and disclosure. Key measures include:

• Encryption at rest: All databases and file stores containing personal data are encrypted using AES-256;
• Encryption in transit: All communications between your device and gma777's servers are secured via TLS 1.3;
• Password hashing: Account passwords are hashed using a one-way cryptographic algorithm; gma777 employees cannot view your plaintext password at any time;
• Access controls: Personal data is accessible only to gma777 staff and contractors who require it for a legitimate business purpose, and is subject to role-based access controls and detailed audit logging;
• Two-factor authentication: Two-factor authentication (2FA) via OTP is available to all gma777 players and is strongly recommended to protect account access;
• Penetration testing: gma777's platform infrastructure undergoes regular third-party penetration testing and vulnerability assessments;
• Incident response: gma777 maintains a documented data breach response plan in accordance with NPC requirements, including the 72-hour notification obligation for reportable breaches.

All gma777 account registrations are subject to mandatory KYC identity verification that includes date of birth confirmation against a valid Philippine government-issued ID. Accounts created by or on behalf of persons under twenty-one (21) constitute a material breach of the gma777 Terms & Conditions and applicable Philippine law, and will be permanently closed upon discovery.

gma777 operates primarily within the Philippines. However, some of our technology service providers — including platform infrastructure providers, game content suppliers, and security services — may be located in or process data in countries outside the Philippines. Where personal data is transferred outside the Philippines, gma777 ensures that such transfers are conducted only:

• Where the recipient country has been assessed to provide an adequate level of data protection comparable to Philippine standards under RA 10173;
• Subject to contractual data processing agreements that impose data protection obligations on the recipient no less stringent than those applicable to gma777 under Philippine law; or
• Where the transfer is required for the performance of your gma777 account contract or is required by Philippine law.

gma777 does not transfer personal data of Philippine players to any jurisdiction for purposes that are incompatible with the principles of RA 10173 or PAGCOR's data protection requirements.

gma777 may update this Privacy Policy from time to time to reflect changes in our data processing practices, the services we offer, or applicable Philippine law. When material changes are made, gma777 will notify registered players via email to the address registered on their Account, and/or via a prominent notice on the Platform, no less than seven (7) days prior to the updated Policy taking effect — unless changes are required to comply with applicable law on a shorter timeframe.

The "Last updated" date at the top of this page will always reflect the date of the most recent revision. Your continued use of gma777 following the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not agree with any change, you must stop using the Platform and may request account closure in accordance with the Terms & Conditions.

gma777 recommends that you review this Privacy Policy periodically to remain informed of how we protect your personal data.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or wish to raise a concern about how gma777 has handled your personal data, please contact our Data Protection Officer:

If you are not satisfied with gma777's response to a data privacy complaint, you have the right to lodge a complaint directly with the Philippine National Privacy Commission (NPC), which is the supervisory authority responsible for enforcing RA 10173. The NPC's contact details and complaints procedure are available on its official website.

This Privacy Policy was last updated on January 1, 2026. This version supersedes all prior versions of the gma777 Privacy Policy. Registered gma777 players who created their accounts prior to this date are bound by this updated Policy from its effective date.