ctaya Privacy Policy

1 Personal Data We Collect

When you register for and use a ctaya account, we collect the following categories of personal data:

2 How We Collect Your Data

ctaya collects personal data through the following means:

• Directly from you — when you register a ctaya account, complete KYC verification, make a deposit or withdrawal request, contact customer support, respond to a survey, or participate in a ctaya promotion.
• Automatically through your use of the Platform — when you browse ctaya.net or play games on our Platform, we automatically collect technical and usage data through cookies, server logs, and similar tracking technologies. This includes your IP address, device identifiers, browser type, pages visited, and session timing.
• From third-party KYC and identity verification partners — ctaya works with licensed identity verification service providers to confirm the authenticity of the documents you submit during the KYC process. These providers may supply us with verification status results and risk scores.
• From payment processors — when you make a deposit or request a withdrawal via GCash, Maya, BPI, BDO, Metrobank, UnionBank, Coins.ph, or USDT TRC20, the relevant payment service provider shares transaction confirmation data with ctaya.
• From fraud prevention and AML screening services — ctaya uses third-party screening tools to check account activity against known fraud patterns and AML watchlists, as required under Philippine anti-money laundering regulations.

3 How We Use Your Personal Data

ctaya uses the personal data we collect for the following purposes:

• Account creation and management: To register and maintain your ctaya account, verify your identity and age (21+), and manage your account settings and preferences.
• Service delivery: To provide you with access to ctaya's games, sports betting, promotions, and other platform features that you request.
• Payment processing: To process deposits and withdrawals via your chosen payment method, reconcile transactions, and manage your ctaya wallet balance.
• Regulatory compliance: To meet ctaya's obligations under PAGCOR regulations, the Philippine Data Privacy Act, the Anti-Money Laundering Act (AMLA), and other applicable Philippine laws — including KYC verification, AML transaction monitoring, and regulatory reporting.
• Fraud prevention and platform security: To detect and prevent fraudulent activity, account takeovers, bonus abuse, and other security threats to the ctaya Platform and its users.
• Responsible gaming: To monitor gaming patterns and identify potential signs of problem gambling, apply the responsible gaming tools and limits you have set, and in certain circumstances proactively contact you if we identify concerning patterns.
• Customer support: To respond to your queries, complaints, and support requests submitted via live chat or email.
• Marketing communications: Where you have opted in, to send you information about ctaya promotions, bonuses, and new features. You can opt out of marketing communications at any time through your ctaya account settings or by contacting support.
• Platform improvement: To analyse how players use the ctaya Platform in aggregate and improve our products, user interface, game selection, and overall service quality.
• Legal proceedings: To establish, exercise, or defend legal claims involving ctaya or its users.

4 Legal Basis for Processing

ctaya processes your personal data on the following legal grounds under the Philippine Data Privacy Act of 2012:

• Consent: Where you have given your explicit, informed consent to ctaya processing your personal data for a specific purpose — for example, marketing communications or the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Contractual necessity: Processing that is necessary for ctaya to fulfil its obligations under the Terms & Conditions you agreed to when creating a ctaya account — including account management, payment processing, and game access.
• Legal obligation: Processing required to comply with ctaya's obligations under Philippine law, including PAGCOR regulatory requirements, the Anti-Money Laundering Act, and the Data Privacy Act itself — such as KYC verification, AML transaction monitoring, and mandatory record-keeping.
• Legitimate interests: Processing that is necessary for ctaya's legitimate business interests, provided those interests are not overridden by your data protection rights. This includes fraud prevention, platform security, responsible gaming monitoring, and general service improvement analytics.

5 Sharing Your Personal Data

ctaya does not sell your personal data to any third party. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Privacy Policy:

• Payment service providers: GCash, Maya, BPI, BDO, Metrobank, UnionBank, Coins.ph, and USDT TRC20 processors — to facilitate deposits and withdrawals from your ctaya account.
• Identity verification and KYC partners: Licensed third-party verification services that assist ctaya in confirming the identity and age of users in compliance with PAGCOR KYC requirements.
• Game content providers: Third-party game developers and aggregators (such as JILI and other licensed suppliers) whose games are accessible on the ctaya Platform. These providers may receive limited technical data necessary to deliver their games.
• Fraud prevention and AML screening services: Specialist providers that help ctaya detect suspicious activity, prevent fraud, and comply with the Anti-Money Laundering Act.
• IT and infrastructure providers: Cloud hosting, cybersecurity, and technology service providers that support ctaya's platform operations, all of whom are bound by data processing agreements.
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), Philippine law enforcement agencies, and courts — where ctaya is required by law to disclose information, or where disclosure is necessary to protect ctaya's legal rights.
• Professional advisors: Lawyers, auditors, and accountants who provide advisory services to ctaya, subject to professional confidentiality obligations.

6 Data Retention

ctaya retains your personal data for as long as your ctaya account is active and for such additional period as is required by applicable law or regulation. The following general retention principles apply:

• Account data: Retained for the duration of your ctaya account and for a minimum of five (5) years following account closure, as required by PAGCOR regulations and the Anti-Money Laundering Act.
• Transaction records: All financial transaction records are retained for a minimum of five (5) years in compliance with AMLA requirements and PAGCOR record-keeping obligations.
• KYC documents: Identity documents submitted during KYC verification are retained for the duration of your ctaya account and for five (5) years after account closure.
• Customer support communications: Live chat transcripts and email correspondence are retained for a minimum of two (2) years for quality assurance and dispute resolution purposes.
• Gaming activity logs: Retained for a minimum of five (5) years for regulatory compliance, responsible gaming monitoring, and dispute resolution.
• Marketing preferences: Retained until you opt out of marketing communications, at which point your opt-out status is recorded and retained indefinitely to prevent unwanted communications.

Upon expiry of the applicable retention period, ctaya will securely delete or anonymise your personal data in accordance with the National Privacy Commission's guidelines on data disposal.

7 Data Security

ctaya takes the security of your personal data seriously and implements a range of technical and organizational measures to protect your information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and ctaya's servers is encrypted using TLS 1.2 or higher. Connections to ctaya.net are enforced over HTTPS.
• Encryption at rest: Sensitive personal data stored in ctaya's databases is encrypted using AES-256 encryption.
• Access controls: Access to personal data within ctaya is restricted to authorized personnel on a strict need-to-know basis. All access is authenticated, role-based, and logged for audit purposes.
• Firewall and intrusion detection: ctaya's infrastructure is protected by enterprise-grade firewalls and continuous intrusion detection and prevention systems.
• Regular security assessments: ctaya conducts periodic vulnerability assessments and penetration testing of its systems to identify and remediate security weaknesses.
• Staff training: All ctaya staff with access to personal data receive regular data protection and security awareness training.
• Incident response: ctaya maintains a documented data breach response plan. In the event of a personal data breach, ctaya will notify affected users and the National Privacy Commission in accordance with the Data Privacy Act's breach notification requirements.

8 Cookies & Tracking Technologies

ctaya uses cookies and similar tracking technologies (such as web beacons and local storage) to operate, secure, and improve the ctaya Platform. The following types of cookies are used:

ctaya does not use third-party advertising cookies or retargeting pixels. You can manage your cookie preferences at any time through your browser settings. Please note that disabling strictly necessary cookies will affect the functionality of the ctaya Platform.

9 Your Data Protection Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by ctaya:

• Right to be informed: You have the right to be informed of the existence of any processing of your personal data by ctaya, the purposes for which it is processed, and the recipients of your data. This Privacy Policy fulfils ctaya's obligation to inform you.
• Right to access: You have the right to request a copy of the personal data that ctaya holds about you, and to receive information about how that data is being processed.
• Right to correction: You have the right to request that ctaya correct any inaccurate or incomplete personal data that we hold about you. For certain information such as your registered name and date of birth, you will be required to provide supporting documentation for corrections.
• Right to erasure or blocking: You have the right to request that ctaya delete or block your personal data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and there is no other legal basis for processing. Note that certain data must be retained by ctaya for legal and regulatory compliance purposes and cannot be deleted on request.
• Right to object: You have the right to object to the processing of your personal data by ctaya based on legitimate interests, including profiling. You also have an unconditional right to object to direct marketing communications at any time.
• Right to data portability: Where technically feasible, you have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format.
• Right to damages: If you have suffered damage as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data by ctaya, you have the right to claim compensation.
• Right to file a complaint: If you believe that ctaya has violated your data privacy rights, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any of the above rights, please contact ctaya's Data Protection Officer via live chat on ctaya.net or email [email protected] with the subject line "Data Privacy Request." ctaya will respond to all verified requests within 30 days.

10 Minors & Age Restriction

The ctaya Platform is strictly intended for individuals who are 21 years of age or older, in compliance with PAGCOR regulations governing online casino gaming in the Philippines. ctaya does not knowingly collect, process, or store personal data from any person under the age of 21.

ctaya employs robust age verification procedures during the account registration and KYC process to prevent underage individuals from accessing the Platform. These procedures include verification of government-issued identification and cross-referencing with third-party identity verification services.

If ctaya discovers or is notified that personal data has been collected from a person under 21 years of age:

• The relevant ctaya account will be immediately suspended and subsequently closed.
• Any funds held in the account will be returned to the originating payment method after standard AML verification, less any bonuses claimed.
• All personal data associated with the underage account will be securely deleted, except where retention is required for regulatory or legal purposes.
• The incident will be reported to PAGCOR as required by ctaya's regulatory obligations.

11 International Data Transfers

ctaya primarily operates and stores data within infrastructure located in the Asia-Pacific region. However, certain third-party service providers engaged by ctaya — including KYC verification partners, cybersecurity providers, and cloud infrastructure providers — may process data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, ctaya ensures that adequate safeguards are in place to protect your information, including:

• Contractual data processing agreements requiring the recipient to apply data protection standards equivalent to those required under the Philippine Data Privacy Act.
• Transfer only to countries or organizations that the National Privacy Commission has determined provide an adequate level of protection for personal data.
• Application of additional technical safeguards such as encryption during transfer where the destination jurisdiction does not provide equivalent statutory protections.

ctaya will not transfer your personal data to any jurisdiction or recipient that does not provide adequate data protection guarantees. If you have questions about the specific safeguards applied to any international transfer of your data, contact ctaya's Data Protection Officer at [email protected].

12 Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or ctaya's handling of your personal data, you may reach ctaya's Data Protection Officer through the following channels:

• Email: [email protected] (use subject line: "Data Privacy Request")
• Live Chat: Available 24/7 on ctaya.net — our support team can route your inquiry to the Data Protection Officer.

ctaya will acknowledge receipt of your request within 3 business days and provide a substantive response within 30 calendar days. For complex requests, ctaya may extend this period by a further 30 days and will notify you of the extension in advance.

If you are not satisfied with ctaya's response to your data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines:

ctaya is committed to working with you and the NPC to resolve any data privacy concerns promptly and in good faith.