gotaya Privacy Policy

gotaya is a Philippines-focused online casino and sports betting platform operating at gotaya.org. gotaya is licensed and regulated by the Philippine Amusement and Gaming Corporation (PAGCOR) to offer online gaming services to eligible players in the Philippines.

For all privacy-related enquiries, requests, or concerns, you may contact our Data Protection Officer (DPO) through the following channel:

gotaya is committed to handling all personal data in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its implementing rules and regulations overseen by the National Privacy Commission (NPC) of the Philippines.

gotaya collects personal information from you in the following categories, depending on your level of interaction with the platform:

2.1 Identity and Contact Information

• Full legal name as it appears on your government-issued identification
• Date of birth (to verify you are at least 21 years of age, as required by PAGCOR regulations)
• Residential address, including barangay, city or municipality, province, and postal code
• Email address and mobile number registered to your gotaya Account
• Nationality and, where applicable, Tax Identification Number (TIN)

2.2 Identity Verification Documents

• Copies of government-issued photo identification (Philippine national ID, passport, UMID, SSS card, or driver's licence)
• Proof of address documents ( utility bill, bank statement, or official government correspondence dated within 90 days)
• Selfie or live photo for identity verification where required
• Source of funds documentation for high-value transactions as required under AMLA compliance

2.3 Financial and Payment Information

• GCash or PayMaya mobile number and account name
• BPI, BDO, or Metrobank account name (not full account numbers, which are not stored by gotaya)
• Deposit and withdrawal transaction history, including amounts and timestamps
• Account balance and bonus wallet information

2.4 Gaming and Behavioural Data

• Game history, bet records, wager amounts, and win/loss outcomes
• Session duration, login times, and frequency of platform use
• Responsible gaming preferences, including deposit limits and self-exclusion status
• Bonus claims, promotional participation records, and wagering activity

2.5 Technical and Device Information

• IP address and approximate geolocation derived from IP
• Device type, operating system, browser type and version
• Cookies and similar tracking technologies (see Section 8 for full cookie details)
• Pages visited on gotaya.org, click paths, and time spent on specific sections

2.6 Communications Data

• Records of support chat conversations, email exchanges, and complaint submissions
• Feedback, survey responses, and voluntary communications sent to gotaya
• Marketing communication preferences and opt-in or opt-out records

gotaya only collects and processes personal information where we have a valid legal basis to do so under the Data Privacy Act of 2012. The following table summarises our primary processing purposes and the legal basis for each:

Where gotaya relies on your consent as a legal basis — such as for marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

gotaya does not sell your personal information to third parties. We share personal data only in the following limited and controlled circumstances:

4.1 Game Providers and Technology Partners

To deliver live dealer games, slots, and sportsbook markets, gotaya shares limited technical identifiers (such as anonymised player IDs and session tokens) with its licensed game providers. These providers are contractually bound to process such data only for the purpose of delivering gaming services and are prohibited from using it for any other purpose.

4.2 Payment Processors

To process deposits and withdrawals, gotaya shares necessary payment-related information with GCash, PayMaya, and participating bank partners (BPI, BDO, Metrobank). These institutions operate under their own privacy policies and are regulated by the Bangko Sentral ng Pilipinas (BSP) and applicable Philippine financial laws.

4.3 Regulatory and Law Enforcement Authorities

gotaya is legally required to disclose personal information to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities when required by law, court order, or legitimate regulatory investigation. gotaya will only disclose the minimum information necessary to satisfy such requirements.

4.4 Service Providers and Infrastructure Partners

gotaya engages trusted third-party service providers for IT infrastructure, data hosting, cybersecurity, and analytics. All such providers are required under contract to maintain confidentiality, implement appropriate security measures, and process personal data only under gotaya's documented instructions.

4.5 Business Transfers

In the event of a merger, acquisition, or transfer of gotaya's business operations, personal data held by gotaya may be transferred to the acquiring entity. Affected Members will be notified of any such transfer and the privacy protections applicable to their data prior to the transfer being completed.

gotaya takes data security seriously and implements multiple layers of technical and organisational safeguards to protect your personal information against unauthorised access, loss, misuse, alteration, or disclosure.

5.1 Technical Safeguards

• 256-bit SSL/TLS encryption on all data transmitted between your browser and gotaya's servers
• Encrypted storage for all sensitive personal data and KYC documents at rest
• Access controls limiting employee access to personal data on a strict need-to-know basis
• Firewall and intrusion detection systems monitoring for unauthorised access attempts in real time
• Regular security audits and penetration testing conducted by independent cybersecurity specialists

5.2 Organisational Safeguards

• All gotaya employees and contractors who handle personal data are bound by confidentiality agreements
• gotaya maintains a documented Data Protection Policy and Privacy Impact Assessment process
• A designated Data Protection Officer (DPO) oversees compliance with the DPA and coordinates with the NPC
• gotaya maintains an internal breach response procedure with defined notification timelines

gotaya retains personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal obligations. The following retention periods apply:

After the applicable retention period expires, personal data is securely deleted or anonymised so that it can no longer be linked to you as an individual. Anonymised or aggregated data may be retained for longer periods for statistical and analytical purposes.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal information held by gotaya. You may exercise any of these rights by contacting our Data Protection Officer at [email protected].

gotaya will respond to all data rights requests within 15 business days. Where a request is particularly complex or voluminous, gotaya may extend this period by a further 15 business days, with prior written notice to you explaining the reason for the extension.

gotaya uses cookies and similar tracking technologies on gotaya.org to ensure the platform functions correctly, to secure your session, and to understand how Members and visitors interact with our content. This section explains the types of cookies we use and how you can manage your preferences.

8.1 Types of Cookies Used

8.2 Managing Your Cookie Preferences

You can manage your cookie preferences at any time through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when a new cookie is set. Please note that disabling strictly necessary cookies will impair your ability to log in to your gotaya Account and use core platform features.

Marketing and analytics cookies can be disabled without affecting your ability to access your Account or place bets. Your cookie preferences are saved and respected on subsequent visits to gotaya.org.

gotaya does not knowingly collect, store, or process personal information from any individual under the age of 21. Age verification is a mandatory step in the gotaya Account registration and KYC process. Where gotaya becomes aware that personal data has been collected from a person under the required minimum age, all such data will be deleted immediately and the associated Account will be permanently closed.

If you are a parent or guardian and believe that a minor in your care may have registered on gotaya or provided personal data to gotaya, please contact our Data Protection Officer immediately at [email protected] so that we can take prompt corrective action.

gotaya may send you promotional emails, SMS notifications, or in-platform messages about bonuses, new games, seasonal promotions, and platform updates. We will only send you marketing communications where you have provided your consent to receive them during registration or at a later point through your Account settings.

10.1 Opting Out

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the unsubscribe link included in any gotaya marketing email
• Updating your notification preferences in your gotaya Account settings
• Contacting gotaya support at [email protected] with your opt-out request

Opting out of marketing communications will not affect essential account-related communications such as transaction confirmations, security alerts, KYC verification requests, or responsible gaming notifications — these are sent as part of our contractual and legal obligations to you and cannot be opted out of while your Account is active.

10.2 Personalised Offers

gotaya may use your gaming activity and platform behaviour to personalise the bonus offers and promotions shown to you. This personalisation is based on your account history and responsible gaming profile. You may request that gotaya cease personalisation of offers at any time by contacting support, in which case you may still receive generic, non-personalised promotional communications if you remain opted in to marketing.

gotaya is a Philippines-based platform and primarily processes personal data within the Philippines. However, some of gotaya's technology partners and game providers operate data infrastructure in other countries. Where personal data is transferred outside the Philippines, gotaya ensures that such transfers comply with the requirements of the Data Privacy Act of 2012, specifically by ensuring that the recipient country or organisation provides an adequate level of protection for personal data, or by implementing appropriate contractual safeguards such as data processing agreements.

gotaya does not transfer your financial data, full KYC documents, or sensitive personal information to entities in countries that do not meet the adequacy standard recognised under Philippine data protection law without appropriate contractual protections in place.

gotaya reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or the services we offer. When material changes are made, gotaya will notify registered Members via email and/or through a prominent notice on the platform at least seven days before the updated policy takes effect.

The "Last Updated" date at the top of this page reflects the most recent revision. Your continued use of the gotaya platform after the effective date of any revised Privacy Policy constitutes your acknowledgement and acceptance of the updated terms. If you do not agree with the changes, you should discontinue use of the platform and may request Account closure in accordance with our Terms and Conditions.

We encourage you to review this Privacy Policy periodically to stay informed about how gotaya protects your personal data. Older versions of this Privacy Policy may be requested from our Data Protection Officer for reference.