Gema Zone Privacy Policy – Your Data, Your Rights, Our Commitment

Gema Zone operates the online sports betting, casino, Pusoy, and esports betting platform accessible at gemazone.net. For the purposes of the Philippine Data Privacy Act of 2012 (RA 10173), Gema Zone is the Personal Information Controller — meaning we are responsible for determining the purposes and means of processing your personal data on this platform.

Gema Zone serves registered users in the Philippines and processes all personal data in Philippine Peso-denominated transactions. Our platform is designed exclusively for the Philippine market, and all data handling practices described in this policy apply to Filipino players on gemazone.net.

If you have any questions about this Privacy Policy or how Gema Zone handles your personal data, please contact our Data Protection Officer at the details provided in Section 14 of this policy.

Gema Zone collects the following categories of personal data from registered account holders and visitors to our platform:

Gema Zone does not collect sensitive personal information (as defined under RA 10173 — such as health data, political opinions, or religious beliefs) except where directly relevant to a responsible gaming inquiry and provided voluntarily by the player.

Gema Zone collects personal data through the following means:

• Direct collection: When you register an account, complete the KYC verification process, make a deposit or withdrawal, contact our support team, or update your account settings, you provide data directly to Gema Zone.
• Automated collection: When you use the Gema Zone platform, our servers and analytics tools automatically record technical and session data including your IP address, device identifiers, browser type, pages visited, and session duration. This is standard practice for all online platforms.
• Cookies and tracking technologies: Gema Zone uses cookies and similar technologies on gemazone.net to maintain your session state, remember your preferences, analyse platform usage, and detect fraud. See Section 7 for full cookie details.
• Third-party sources: Our identity verification partner may provide confirmation of ID document authenticity during KYC. Our payment processors (GCash, Maya, banks) may share transaction reference data to confirm payment status. We do not purchase data from third-party data brokers.

Gema Zone uses your personal data for the following specific purposes:

• Account creation and management: To register your account, verify your identity, and maintain your player profile on Gema Zone.
• Processing deposits and withdrawals: To execute GCash, Maya, InstaPay, bank transfer, and card transactions accurately and securely. Your financial data is shared only with the relevant payment processor for this purpose.
• KYC and anti-money laundering compliance: Philippine law and gaming regulations require Gema Zone to verify the identity of account holders before processing withdrawals. We also monitor transaction patterns as required under Anti-Money Laundering Act (AMLA) obligations.
• Providing gaming services: To operate your sports bets, settle markets, run casino game sessions, and maintain Pusoy and esports betting functionality.
• Responsible gaming monitoring: To track gaming patterns that may indicate problem gambling behaviour, apply self-imposed limits, and provide support resources where needed. This is a legal and ethical obligation Gema Zone takes seriously.
• Fraud prevention and platform security: To detect and investigate suspicious login activity, fraudulent transactions, multi-accounting, bonus abuse, and other prohibited conduct described in the Terms and Conditions.
• Customer support: To respond to your queries, resolve disputes, and maintain records of your interactions with the Gema Zone support team.
• Platform improvement and analytics: To understand how players use Gema Zone, identify areas for improvement, and make informed product decisions. This analysis uses aggregated and anonymised data where possible.
• Legal and regulatory compliance: To fulfil obligations to PAGCOR, the National Privacy Commission, BSP, and other applicable Philippine regulatory bodies.
• Communications: To send you account-related notifications (deposits confirmed, withdrawals processed, security alerts) and, with your consent, promotional communications about Gema Zone offers.

Under the Philippine Data Privacy Act (RA 10173), Gema Zone processes personal data under the following legal bases:

• Contractual necessity: Processing required to fulfil the agreement between you and Gema Zone — account management, transactions, bet settlement. Without this processing, Gema Zone cannot provide its services.
• Legal obligation: Processing required to comply with Philippine law — KYC verification under AMLA, transaction reporting to BSP, regulatory reporting to PAGCOR, and cooperation with law enforcement requests issued under proper legal authority.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and aggregated analytics where these interests are not overridden by your rights and freedoms as a data subject.
• Consent: For marketing and promotional communications, Gema Zone relies on your explicit consent. You can withdraw consent for marketing communications at any time via your account notification settings or by contacting support. Withdrawing consent for marketing does not affect your account or the processing required to run it.

Gema Zone shares personal data only in the following circumstances and only with the parties listed below. We do not sell your data to any third party.

• Payment processors: GCash (G-Xchange, Inc.), Maya (PayMaya Philippines, Inc.), GrabPay, Coins.ph, InstaPay/PESONet partner banks (BDO, BPI, UnionBank, and other BSP-regulated institutions), and Visa/Mastercard issuing banks — for the specific purpose of processing your deposits and withdrawals. Data shared is limited to what is required to complete the transaction.
• Identity verification partners: Third-party KYC providers who verify the authenticity of Philippine government IDs submitted during account verification. These providers are contractually bound to handle your ID data confidentially and may not retain or use it beyond the verification purpose.
• Casino and game content providers: Licensed third-party casino game providers integrate with the Gema Zone platform. Session and bet data for casino games is processed by these providers under their own data agreements, which Gema Zone reviews before integration. No registration data is shared with game providers.
• Regulatory bodies: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and BSP may receive data from Gema Zone as required by law or regulation. This sharing is non-discretionary and legally mandated.
• Law enforcement: Gema Zone will cooperate with Philippine law enforcement agencies presenting lawful requests or court orders for personal data. We will notify you of such requests where legally permitted to do so.
• Professional advisers: Legal counsel, auditors, and compliance consultants engaged by Gema Zone may access limited personal data under strict confidentiality obligations where necessary for legal, financial, or regulatory review.

All third parties who handle personal data on Gema Zone's behalf are bound by data processing agreements that require them to maintain confidentiality, process data only for the stated purpose, and implement appropriate security measures.

Gema Zone uses cookies — small data files stored on your device — and similar tracking technologies on gemazone.net. Here's a breakdown of the cookies we use:

You can manage cookie preferences through your browser settings. Note that disabling essential cookies will prevent you from logging in to or using Gema Zone. Gema Zone does not use advertising or targeting cookies that track you across third-party websites.

Gema Zone retains personal data only for as long as necessary for the purposes stated in this policy or as required by Philippine law. Our general retention schedule is as follows:

• Account and identity data: Retained for the duration of your active account plus five (5) years after account closure, in compliance with AMLA record-keeping requirements applicable to gaming platforms.
• Transaction and financial data: Retained for five (5) years from the date of each transaction, as required by BSP and AMLA regulations.
• Gaming activity data (bet history): Retained for three (3) years from each session, used for dispute resolution, responsible gaming monitoring, and regulatory audit purposes.
• KYC documents (government ID scans): Retained for five (5) years after account closure. Stored in encrypted form with access restricted to verification and compliance personnel only.
• Support communications: Retained for two (2) years from each interaction, used for quality assurance, dispute reference, and training.
• Technical and session logs: Retained for twelve (12) months for security monitoring and fraud investigation purposes, after which they are anonymised or deleted.
• Marketing consent records: Retained for the duration of your account, or until you withdraw consent, whichever is earlier.

When retention periods expire, personal data is securely deleted or anonymised using industry-standard processes. Anonymised data — which cannot be linked back to any individual — may be retained indefinitely for aggregate analysis.

As a data subject under the Philippine Data Privacy Act, you have the following rights in relation to your personal data held by Gema Zone:

To exercise any of your rights, contact the Gema Zone Data Protection Officer via the support channels in Section 14, referencing "Data Privacy Rights Request" in your message. We will verify your identity before processing any data rights request and respond within the timeframes required by RA 10173.

Gema Zone implements a layered data security approach that includes:

• Encryption in transit: All data transmitted between your device and Gema Zone is encrypted using TLS 1.2 or higher with 256-bit AES encryption. This applies to login, account activity, and all financial transactions.
• Encryption at rest: Sensitive personal data stored on Gema Zone servers — including identity documents, financial data, and password hashes — is encrypted using industry-standard algorithms.
• Access controls: Personal data is accessible only to Gema Zone personnel who need it to perform their job function. Access is role-based and logged. Access credentials for sensitive data systems require multi-factor authentication.
• Two-factor authentication for players: All Gema Zone accounts support two-factor authentication (2FA) via OTP sent to your registered mobile number. We strongly recommend enabling this in your account security settings.
• Penetration testing and security audits: Gema Zone's platform undergoes regular third-party security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response plan: Gema Zone maintains a documented data breach response plan. In the event of a security incident, our team is trained to contain, assess, and notify affected parties and the NPC within the timeframes required by law.

Despite these measures, no online platform can guarantee absolute security. We encourage all Gema Zone users to use a strong unique password, enable 2FA, and never share their login credentials or OTP codes with anyone.

Some of Gema Zone's service providers — particularly casino game content providers and certain technical infrastructure components — may be located outside the Philippines. Where personal data is transferred to parties in other countries, Gema Zone ensures that appropriate safeguards are in place in accordance with RA 10173, including:

• Contractual data processing agreements requiring the receiving party to maintain data protection standards equivalent to those required under Philippine law.
• Restricting the data transferred to the minimum necessary for the specific service being provided by the third party.
• Ensuring that game providers who receive gaming session data do not receive Philippine government ID data or financial account details.

The majority of Gema Zone's data processing — particularly financial and identity data — is handled by Philippine-regulated entities (GCash, Maya, Philippine banks) and remains within Philippine jurisdiction.

Gema Zone may update this Privacy Policy to reflect changes in our data practices, new services, legal requirements, or regulatory guidance. When material changes are made, we will notify registered users via email or an in-platform notification before the changes take effect. The updated policy will be published on this page with a revised effective date.

Your continued use of Gema Zone after the effective date of any revision constitutes your acknowledgement of the updated policy. If you disagree with a revised policy, you may close your account and request deletion of your personal data as described in Section 9, subject to applicable legal retention requirements.

We recommend reviewing this page periodically. The "Last Updated" date at the top of this policy shows when the most recent revision was made.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data rights, please contact Gema Zone's Data Protection Officer:

• Email: support@gemazone.net (subject line: "Data Privacy Enquiry")
• Live Chat: Available 24/7 on gemazone.net — reference "Data Privacy" at the start of your chat.
• Response time: General privacy questions within 48 hours; formal data rights requests within 30 days as required by RA 10173.

If you are not satisfied with Gema Zone's response to your data privacy request, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which has jurisdiction over data privacy complaints under RA 10173. Information about filing an NPC complaint is available through Philippine government channels.