gl18 Privacy Policy

1 Introduction

gl18 ("gl18", "We", "Us", "Our") is committed to protecting the privacy and personal data of every player who registers and uses the gl18 online casino and sports betting platform. This Privacy Policy describes our practices regarding the collection, use, storage, disclosure, and protection of personal information in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the data protection guidelines applicable to online gaming operators under the PAGCOR-regulated framework.

This policy applies to all personal data processed by gl18 through the gl18.app website, its mobile browser interface, and all related services, tools, and communications offered under the gl18 brand. It should be read alongside the gl18 Terms and Conditions, which govern your use of the platform as a whole.

If you have any questions about this Privacy Policy or how gl18 handles your personal data, you are encouraged to contact our Data Protection Officer using the details set out in Section 14 of this document.

2 Data Controller

For the purposes of the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, gl18 acts as the Personal Information Controller ("PIC") with respect to all personal data collected through the gl18 platform. This means that gl18 determines the purposes for which, and the means by which, your personal data is processed.

gl18 has appointed a Data Protection Officer ("DPO") who is responsible for overseeing compliance with applicable data privacy laws and for serving as the primary point of contact for data subjects wishing to exercise their rights. Contact details for the DPO are provided in Section 14 of this Policy.

Where gl18 engages third-party service providers to process personal data on its behalf, those parties act as Personal Information Processors ("PIPs") and are bound by data processing agreements that require them to handle your data only in accordance with gl18's instructions and applicable law.

3 Personal Data We Collect

gl18 collects personal data across several categories. The specific data collected depends on how you interact with the platform:

gl18 does not intentionally collect sensitive personal information beyond what is strictly required for identity verification and regulatory compliance. Where sensitive personal information such as government ID numbers is collected, it is handled with heightened security controls and access restrictions.

4 How We Collect Your Data

gl18 collects personal data through the following channels and methods:

• Direct submission: Information you provide when creating your gl18 account, completing KYC verification, making deposits or withdrawals, contacting customer support, or updating your account profile.
• Automated technical collection: Technical and usage data collected automatically when you access the gl18 platform, including through cookies, web beacons, server logs, and similar tracking technologies. See Section 6 for full details on cookies.
• Payment processors: Transaction confirmation data received from payment providers such as GCash, Maya, BPI, BDO, and Metrobank when you initiate a deposit or withdrawal through those channels.
• Identity verification services: Data received from third-party KYC and identity verification service providers engaged by gl18 to confirm the authenticity of identity documents submitted during account verification.
• Fraud and risk systems: Data generated by gl18's internal fraud detection and responsible gaming monitoring systems in the course of assessing account activity for irregular patterns.
• Communications with gl18: Information contained in emails, live chat messages, or other correspondence you send to the gl18 support team.

5 Purposes & Legal Basis for Processing

gl18 processes your personal data only where there is a lawful basis to do so under the Data Privacy Act of 2012. The primary legal bases and corresponding purposes are as follows:

• Performance of a contract: To create and manage your gl18 account, process deposits and withdrawals, credit bonuses, calculate and pay winnings, and provide customer support — all of which are necessary to deliver the services you signed up for.
• Compliance with a legal obligation: To verify your identity and age (21+ requirement), conduct anti-money-laundering checks, submit regulatory reports to PAGCOR, comply with tax obligations, and respond to lawful requests from law enforcement or regulatory authorities.
• Legitimate interests: To detect and prevent fraud, collusion, and bonus abuse; to operate and improve the gl18 platform; to manage platform security; to analyse aggregate gaming patterns for responsible gaming monitoring; and to send service notifications directly related to your account.
• Consent: To send you promotional and marketing communications via email or SMS about gl18 offers, new games, and special events — but only where you have opted in to receive such communications. You may withdraw consent at any time via your account settings or by contacting support.

gl18 will not use your personal data for purposes that are incompatible with those listed above without first obtaining your explicit consent or establishing a new lawful basis for processing.

6 Cookies & Tracking Technologies

gl18 uses cookies and similar technologies on the gl18 platform to provide essential functionality, improve user experience, and gather anonymised analytics data. The types of cookies used are as follows:

• Strictly necessary cookies: These cookies are essential for the platform to function. They enable session management, authentication state, and security features. These cannot be disabled without breaking core platform functionality.
• Functional cookies: These remember your preferences such as language settings, display preferences, and game history to provide a more personalised experience during your sessions.
• Analytics cookies: These collect anonymised data about how players interact with the gl18 platform — such as which pages are visited most frequently and how long sessions last — to help us improve the platform. No personally identifiable information is included in analytics data.
• Security cookies: Used to detect and prevent fraudulent activity, bot traffic, and other security threats to your gl18 account and the platform as a whole.

Most web browsers allow you to manage cookie settings through the browser's privacy or settings menu. Disabling strictly necessary cookies may affect your ability to use certain features of the gl18 platform, including the gl18 Login function. gl18 does not use cookies to serve third-party advertising or to track your activity across other websites.

7 Third-Party Sharing & Disclosure

gl18 does not sell, rent, or trade your personal data to third parties for their own commercial or marketing purposes. Personal data may be disclosed to third parties only in the following circumstances:

• Service providers and processors: Third-party vendors who provide services on gl18's behalf, including payment processing (GCash, Maya, BPI, BDO, Metrobank), identity verification, IT infrastructure, customer support tools, and fraud prevention systems. These parties process your data only under contract and in accordance with gl18's instructions.
• Regulatory and government authorities: PAGCOR, the National Privacy Commission ("NPC"), the Anti-Money Laundering Council ("AMLC"), the Bureau of Internal Revenue ("BIR"), and law enforcement agencies — where disclosure is required by law, court order, or regulatory direction.
• Responsible gaming organisations: Anonymised or aggregated data may be shared with PAGCOR's responsible gaming programme to support player protection initiatives. Individually identifiable data is shared only where required by regulation or where you have consented.
• Business transfers: In the event of a merger, acquisition, or sale of assets involving gl18, personal data held about players may be transferred to the acquiring entity, subject to the same data protection obligations set out in this Policy. Affected players will be notified of any such transfer in advance.
• With your explicit consent: In any other circumstance not listed above, gl18 will seek your prior consent before sharing your personal data with any third party.

All third-party processors engaged by gl18 are evaluated for their data protection practices prior to engagement and are required to maintain security standards consistent with or exceeding those applied by gl18 itself.

8 Data Retention

gl18 retains personal data only for as long as it is necessary for the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulatory obligations. The general retention schedule is as follows:

• Active account data: Retained for the full duration of your account's active status and for a period of five (5) years following permanent account closure, in compliance with PAGCOR record-keeping requirements and anti-money-laundering obligations under Philippine law.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act (Republic Act No. 9160, as amended) and AMLC regulations.
• KYC and identity documents: Retained for five (5) years following the end of the business relationship or the date of the last transaction, whichever is later.
• Customer support records: Retained for two (2) years from the date of the interaction, or longer if the record is relevant to an ongoing dispute or legal proceeding.
• Marketing data: Retained until you withdraw consent for marketing communications, after which your contact details are removed from active marketing lists without undue delay.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual. Anonymised aggregate data may be retained indefinitely for statistical and platform improvement purposes.

9 Data Security

gl18 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the gl18 platform
• Encryption of sensitive data fields at rest in gl18's database infrastructure
• Role-based access controls ensuring that only personnel with a legitimate need can access personal data
• Multi-factor authentication requirements for all internal staff systems that handle personal data
• Regular security assessments and vulnerability testing of the gl18 platform and supporting infrastructure
• Incident response procedures in place to detect, contain, and report personal data breaches in accordance with the NPC notification requirements under the Data Privacy Act

While gl18 takes all reasonable precautions to protect your personal data, no online platform can guarantee absolute security. You also play an important role in keeping your data safe — never share your gl18 password with anyone, and use the platform's two-factor authentication feature to add an extra layer of protection to your account. Report any suspicious activity on your account to gl18 support immediately.

10 Your Rights as a Data Subject

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by gl18. These rights may be exercised by contacting the gl18 Data Protection Officer using the details in Section 14:

gl18 will respond to valid data subject requests within thirty (30) days of receipt. In complex cases, this period may be extended by a further thirty (30) days, with prior notification to the requesting data subject. gl18 reserves the right to decline requests that are manifestly unfounded, excessive, or that conflict with legal retention obligations.

11 Children & Minors

The gl18 platform is strictly intended for individuals who are 21 years of age or older, in compliance with Philippine gambling law and PAGCOR regulations. gl18 does not knowingly collect, process, or retain personal data from individuals below the age of 21.

All account registration attempts are subject to age verification checks. Where gl18 discovers that personal data has been collected from an individual who does not meet the minimum age requirement, that account will be immediately suspended, all personal data associated with the account will be deleted, and any funds in the account will be handled in accordance with applicable regulatory requirements.

If you are a parent or guardian and believe that a minor under your care has registered on the gl18 platform, please contact the gl18 Data Protection Officer immediately using the contact details in Section 14 so that the matter can be addressed without delay.

12 International Data Transfers

gl18 primarily processes and stores personal data within infrastructure located in the Philippines or in jurisdictions that maintain data protection standards recognised as adequate under Philippine law. Where personal data is transferred outside the Philippines — for example, in connection with cloud infrastructure services or internationally-based service providers — gl18 ensures that such transfers are carried out with appropriate safeguards in place.

These safeguards may include contractual clauses that require the receiving party to protect personal data to standards equivalent to those mandated by the Data Privacy Act of 2012, or other mechanisms approved by the National Privacy Commission. gl18 does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate safeguards and, where required, obtaining NPC approval.

13 Changes to This Privacy Policy

gl18 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this page will be revised whenever a change is made.

Where changes are material — meaning they significantly affect how your personal data is collected, used, or shared — gl18 will provide advance notice to registered players via the email address associated with their account and through a prominent notice on the gl18 platform, at least seven (7) days before the changes take effect.

Your continued use of the gl18 platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with the updated Policy, you should discontinue use of the platform and may request account closure in accordance with the gl18 Terms and Conditions.

14 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way gl18 handles your personal data, please contact our Data Protection Officer:

Data Protection Officer — gl18
Email: [email protected]

Please include your registered account username, a brief description of your query or request, and — for data subject rights requests — a copy of a valid government-issued Philippine ID to allow us to verify your identity before processing the request.

gl18 will acknowledge receipt of your privacy-related enquiry within five (5) business days and aims to resolve all matters within thirty (30) days. For formal complaints that cannot be resolved directly with gl18, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines through their official channels.