gilis Privacy Policy

Introduction

gilis ("we", "us", "our") is committed to protecting the privacy and personal data of every individual who visits or registers on the gilis Platform at gilis.app. This Privacy Policy describes how gilis collects, uses, stores, shares, and protects your personal information, and explains the rights available to you as a data subject under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its implementing rules and regulations.

This Privacy Policy applies to all personal data processed by gilis in connection with your use of the Platform, including data collected through the website, mobile interface, customer support communications, and any other channel through which you interact with gilis.

By registering an account on the gilis Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Privacy Policy, you must not register an account or use the gilis Platform.

Data Controller

For the purposes of the Philippine Data Privacy Act of 2012, gilis acts as the personal information controller in respect of all personal data collected through the Platform. gilis determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out in accordance with applicable law.

All queries, requests, and complaints relating to the processing of your personal data by gilis should be directed to our designated Data Protection Officer (DPO) using the contact details set out in Section 15 of this Privacy Policy. gilis has appointed a Data Protection Officer in accordance with the requirements of the DPA and its implementing rules.

Personal Data We Collect

gilis collects the following categories of personal data from players and Platform visitors. The specific data collected in each category may vary depending on the nature of your interaction with the gilis Platform:

gilis does not intentionally collect sensitive personal information as defined under the DPA (such as religious beliefs, political affiliations, or medical records) unless expressly required for responsible gaming assessments or as otherwise required by applicable law.

How We Collect Your Data

gilis collects personal data through the following channels and methods:

• Direct registration: Information you provide when creating your gilis account, completing KYC verification, or updating your account profile.
• Transactional activity: Data generated when you make deposits or withdrawal requests via GCash, PayMaya, BPI, BDO, Metrobank, Visa, or Mastercard on the Platform.
• Platform interactions: Data automatically collected when you use the gilis website or mobile interface, including pages visited, games launched, and session activity logs.
• Cookies and tracking technologies: Data collected via cookies, web beacons, and similar technologies as described in Section 8 of this Privacy Policy.
• Customer support: Information you provide when contacting gilis through live chat, email, or any other support channel.
• Third-party sources: Data received from identity verification providers, fraud prevention services, and payment processors in connection with KYC and transaction monitoring processes.

Legal Basis for Processing

gilis processes your personal data on the basis of one or more of the following legal grounds, as applicable to each specific processing activity:

1. Contractual necessity: Processing is necessary for the performance of the contract between you and gilis, including operating your account, processing transactions, and providing gaming services.
2. Legal obligation: Processing is required for gilis to comply with applicable Philippine laws and regulations, including anti-money laundering laws (Republic Act No. 9160, as amended), the DPA, and any applicable gaming regulatory requirements.
3. Legitimate interests: Processing is necessary for the legitimate interests of gilis, including fraud prevention, platform security, responsible gaming monitoring, and business analytics, provided such interests are not overridden by your rights and interests.
4. Consent: Where required by law, gilis will seek your express consent before processing your personal data for a specific purpose, such as for direct marketing communications. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

How We Use Your Personal Data

gilis uses the personal data it collects for the following purposes:

• Creating and managing your gilis account and verifying your identity and eligibility to use the Platform, including age verification to confirm you are 21 years of age or older.
• Processing PHP-denominated deposits and withdrawals via supported payment methods and maintaining accurate transaction records.
• Conducting Know Your Customer (KYC) checks and ongoing customer due diligence in compliance with Philippine anti-money laundering laws.
• Detecting, investigating, and preventing fraudulent activity, cheating, money laundering, and other prohibited conduct on the Platform.
• Administering bonuses, promotions, and loyalty programmes in accordance with the applicable promotion terms.
• Monitoring your gaming activity to identify indicators of problem gambling and enabling gilis to apply responsible gaming interventions where necessary.
• Responding to your customer support queries, resolving disputes, and maintaining records of communications for quality and compliance purposes.
• Sending you account-related notifications, security alerts, and, where you have opted in, promotional communications about gilis products and services.
• Improving the gilis Platform by analysing aggregated usage data and understanding how players interact with games and features.
• Complying with any court orders, regulatory requests, or other legal obligations imposed on gilis under applicable Philippine or international law.

Sharing Your Personal Data

gilis does not sell, rent, or trade your personal data to any third party for commercial purposes. gilis may share your personal data with the following categories of recipients where necessary and on a strictly need-to-know basis:

• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, Visa, Mastercard, and other payment service providers, solely for the purpose of processing your financial transactions on the Platform.
• Identity verification providers: Third-party KYC and document verification services engaged by gilis to verify the identity and eligibility of registered players.
• Fraud and security providers: Specialist anti-fraud and cybersecurity service providers who assist gilis in detecting and preventing fraudulent or unauthorised activity on the Platform.
• Technology and hosting providers: Cloud hosting, data storage, and platform infrastructure providers who process data on behalf of gilis under strict data processing agreements.
• Gaming software providers: Licensed game content providers whose games are integrated into the gilis Platform, to the extent technically necessary for game delivery and integrity.
• Legal and regulatory authorities: Government agencies, regulatory bodies, law enforcement authorities, and courts in the Philippines where gilis is legally required or permitted to disclose your data.
• Professional advisers: Lawyers, auditors, accountants, and other professional advisers acting under confidentiality obligations in connection with the operation of gilis's business.

All third-party service providers who receive personal data from gilis are required to process such data strictly in accordance with gilis's instructions and applicable data protection law, and are prohibited from using it for their own independent purposes.

Cookies & Tracking Technologies

The gilis Platform uses cookies and similar tracking technologies to enhance your browsing experience, maintain your session, and collect analytical data about Platform usage. A "cookie" is a small text file placed on your device by the gilis website.

gilis uses the following categories of cookies:

• Strictly necessary cookies: Essential for the operation of the Platform, including maintaining your login session, storing your preferences, and ensuring Platform security. These cookies cannot be disabled without affecting core Platform functionality.
• Analytics cookies: Used to collect aggregated, anonymised data about how players navigate and use the Platform, enabling gilis to identify areas for improvement. No individually identifiable data is retained through analytics cookies.
• Functional cookies: Enable the Platform to remember your preferences, such as language settings and responsible gaming limits you have applied to your account.
• Security cookies: Used to detect and prevent fraudulent activity, including recognising your device across sessions and flagging unusual access patterns.

You may control cookie settings through your browser preferences. Please note that disabling certain cookies may affect the functionality of the gilis Platform and your ability to access account features. For detailed cookie management instructions, please refer to your browser's help documentation.

Data Security

gilis implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include, but are not limited to:

• Encryption of data in transit using Transport Layer Security (TLS) protocols and encryption of sensitive data at rest using industry-standard encryption algorithms.
• Strict role-based access controls limiting access to your personal data to authorised gilis personnel who have a genuine operational need to process it.
• Regular security audits, vulnerability assessments, and penetration testing of the gilis Platform infrastructure.
• Multi-factor authentication requirements for administrative access to systems that process personal data.
• Incident response procedures to ensure that any personal data breach is contained, assessed, and — where required by the DPA — notified to the National Privacy Commission and affected data subjects within the prescribed timeframes.

Notwithstanding the above measures, no method of transmission over the internet or electronic storage is completely secure. While gilis takes all reasonable steps to protect your data, we cannot guarantee absolute security. You are advised to keep your gilis login credentials confidential and to notify us immediately at [email protected] if you suspect any unauthorised access to your account.

Data Retention

gilis retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, and for a minimum retention period of five (5) years following the closure of your account, as required by Philippine anti-money laundering regulations and applicable financial record-keeping laws.

The following retention periods apply to specific categories of data:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years after account closure.
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction, in accordance with Anti-Money Laundering Act requirements.
• Customer support communications: Retained for three (3) years from the date of the communication for dispute resolution and quality assurance purposes.
• Technical and usage data: Retained for up to twenty-four (24) months for analytical and security purposes, after which it is anonymised or deleted.

At the end of the applicable retention period, gilis will securely delete or anonymise your personal data in accordance with its data destruction procedures, unless retention for a longer period is required or permitted by applicable law.

Your Privacy Rights

Under the Philippine Data Privacy Act of 2012 and its implementing rules, you have the following rights in relation to your personal data held by gilis. To exercise any of these rights, please contact us using the details in Section 15.

gilis will respond to all valid data subject requests within thirty (30) days of receipt. In complex cases, this period may be extended by a further thirty (30) days, in which case gilis will notify you of the extension and the reason for it. gilis will not charge a fee for handling data subject requests unless the request is manifestly unfounded or excessive.

Children's Privacy

The gilis Platform is strictly intended for individuals who are 21 years of age or older. gilis does not knowingly collect personal data from any individual under the age of 21. Age verification is conducted as part of the account registration and KYC process to enforce this restriction.

If gilis becomes aware that it has inadvertently collected personal data from a person under the age of 21, it will take immediate steps to delete that data and close the associated account. If you believe that gilis may have collected data from a minor, please notify us immediately at [email protected] so that appropriate action can be taken.

Cross-Border Data Transfers

In the course of providing gaming services, gilis may transfer your personal data to service providers or infrastructure partners located outside the Philippines, including in jurisdictions that may not provide the same level of data protection as Philippine law. Such transfers may occur in connection with cloud hosting, identity verification, payment processing, and fraud prevention services.

Where personal data is transferred outside the Philippines, gilis ensures that adequate safeguards are in place to protect your data, including the use of standard contractual clauses approved by the National Privacy Commission, or transfers to jurisdictions recognised as providing an adequate level of data protection. gilis will not transfer your personal data to a foreign country or international organisation that does not provide an adequate level of protection for your rights as a data subject, unless the transfer is otherwise authorised under the DPA.

Amendments to This Privacy Policy

gilis reserves the right to update or amend this Privacy Policy at any time to reflect changes in its data processing practices, applicable law, or the gilis Platform. The date of the most recent update is displayed at the top of this page.

Where amendments are material — meaning they significantly affect how your personal data is collected, used, or shared — gilis will notify registered players via the email address associated with their account or by displaying a prominent notice on the Platform prior to the changes taking effect. For non-material amendments, such as typographical corrections or clarifications that do not alter the substance of the policy, gilis may update this page without advance notice.

Your continued use of the gilis Platform after the effective date of any amendment constitutes your acknowledgement of the updated Privacy Policy. If you do not accept the amended Privacy Policy, you must cease using the Platform and may request closure of your account by contacting our support team.

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have a complaint about how gilis has handled your personal data, please contact our Data Protection Officer using the details below:

• Email: [email protected]
• Subject line: Privacy / Data Request
• Support Hours: 8:00 AM – 12:00 AM PHT (GMT+8), daily
• Language: English

gilis is committed to resolving all privacy complaints promptly and fairly. If you are not satisfied with our response to your complaint, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act of 2012. Information about how to file a complaint with the NPC is available on the official NPC website.