c9taya Privacy Policy

c9taya is an online gaming platform serving Filipino players across the Philippines, including Metro Manila, Cebu, Davao, Quezon City, Makati, and beyond. In the course of providing our services — which include live casino games, slots, bingo, fishing games, and payment processing — we necessarily collect and process certain personal data about our players and website visitors.

This Policy is intended to give you a clear and honest account of our data practices. We have written it in plain English so that every c9taya player can understand exactly what happens to their information. Where legal terminology is unavoidable, we have provided explanations alongside it.

c9taya is committed to complying with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines and its Implementing Rules and Regulations. We are also guided by internationally recognized data protection principles, including purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

This Policy applies to all personal data collected through the c9taya website, mobile platform, customer support channels, and any other touchpoint through which you interact with c9taya. It does not apply to third-party websites or services that may be linked from our platform — those are governed by their own privacy policies.

c9taya collects personal data through several channels: directly from you when you register or interact with the platform, automatically through your use of the platform, and from third-party service providers such as payment processors and KYC verification partners. The categories of data we collect are described below.

Registration & Account Data

When you create a c9taya account, we collect:

• Full legal name;
• Date of birth (to verify the 21+ age requirement);
• Residential address (including city and province);
• Email address;
• Mobile phone number;
• Username and encrypted password.

Identity Verification (KYC) Data

To comply with anti-money laundering obligations and verify your identity before processing withdrawals, we may collect:

• Government-issued photo ID (e.g., Philippine passport, SSS ID, UMID, driver's license, PhilSys national ID);
• Proof of address documents (e.g., utility bill, bank statement);
• Selfie or liveness check images for identity matching;
• Proof of payment method ownership.

Financial & Transaction Data

When you make deposits or withdrawals via GCash, Maya, BPI, BDO, Metrobank, or other supported payment methods, we collect:

• Payment method type and account reference (e.g., GCash mobile number, bank account last four digits);
• Transaction amounts in Philippine Peso (₱);
• Transaction timestamps and reference numbers;
• Deposit and withdrawal history.

Gaming Activity Data

• Game session logs, bet amounts, game outcomes, and win/loss records;
• Bonus and promotion usage history;
• Responsible gaming tool settings (deposit limits, session limits, self-exclusion status).

Technical & Usage Data

• IP address and approximate geolocation;
• Device type, operating system, and browser information;
• Pages visited, features used, and time spent on the platform;
• Login timestamps and session duration;
• Cookie and tracking data (see Section 6).

Communications Data

• Records of your communications with c9taya support, including live chat transcripts, emails, and support ticket content;
• Survey responses and feedback you voluntarily provide.

c9taya uses your personal data only for the purposes described in this Policy. We do not use your data for purposes that are incompatible with those for which it was originally collected. The primary purposes for which we process your data are set out in the table below.

Where c9taya uses your data for marketing purposes — such as sending you information about new games, promotions, or bonuses — we will only do so where you have provided your consent, or where we have a legitimate interest in doing so and that interest is not overridden by your data protection rights. You may withdraw your consent to marketing communications at any time by contacting c9taya support or using the unsubscribe mechanism in any marketing email.

c9taya processes your personal data on one or more of the following legal bases, as applicable to each processing activity:

• Contractual necessity: Processing is necessary to perform our contract with you — i.e., to operate your c9taya account, process your deposits and withdrawals, and deliver gaming services.
• Legal obligation: Processing is necessary to comply with applicable Philippine law, including anti-money laundering regulations, KYC requirements, and data retention obligations.
• Legitimate interests: Processing is necessary for c9taya's legitimate business interests, such as fraud prevention, platform security, responsible gaming monitoring, and improving our services — provided those interests are not overridden by your rights.
• Consent: Where we rely on your consent — for example, for marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

If you have questions about the specific legal basis on which c9taya relies for any particular processing activity, please contact our Data Protection Officer using the details in Section 12.

c9taya may share your personal data with the following categories of third parties:

• Payment processors: GCash, Maya, BPI, BDO, Metrobank, and other payment service providers, to process your deposits and withdrawals. These providers receive only the data necessary to complete your transaction.
• KYC and identity verification providers: Third-party identity verification services that assist us in verifying your identity and age in compliance with our legal obligations.
• Fraud prevention and security services: Providers that help us detect and prevent fraudulent activity, money laundering, and unauthorized account access.
• Game content providers: Third-party game studios and live casino operators whose games are available on the c9taya platform. These providers may receive limited session data necessary to deliver their games.
• IT and hosting providers: Cloud infrastructure and hosting providers that store and process data on our behalf under strict data processing agreements.
• Regulatory and law enforcement authorities: Where required by applicable Philippine law, court order, or regulatory instruction, c9taya may disclose your data to government agencies, law enforcement bodies, or regulatory authorities.
• Professional advisors: Lawyers, auditors, and accountants, where necessary in connection with legal proceedings, compliance reviews, or corporate transactions.

All third parties with whom c9taya shares personal data are required to handle that data in accordance with applicable data protection law and c9taya's data processing standards. c9taya does not permit third-party service providers to use your data for their own marketing or commercial purposes.

c9taya uses cookies and similar tracking technologies to operate the platform, remember your preferences, analyze usage patterns, and support fraud prevention. A cookie is a small text file placed on your device when you visit the c9taya website.

Types of Cookies We Use

• Strictly necessary cookies: Essential for the platform to function. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled.
• Functional cookies: Remember your preferences, such as language settings and responsible gaming tool configurations, to provide a more personalized experience.
• Analytics cookies: Help us understand how players use the c9taya platform — which pages are visited most, where players encounter issues, and how we can improve the overall experience. Data collected is aggregated and anonymized where possible.
• Security and fraud prevention cookies: Used to detect and prevent fraudulent activity, including account takeover attempts and bot activity.

Managing Cookies

You can control non-essential cookies through your browser settings. Most browsers allow you to block or delete cookies. However, disabling strictly necessary cookies will impair the functionality of the c9taya platform and may prevent you from logging in or completing transactions. For instructions on managing cookies in your specific browser, refer to your browser's help documentation.

c9taya retains your personal data for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and registration data: Retained for the duration of your account and for a minimum of five years following account closure, in accordance with anti-money laundering record-keeping requirements.
• KYC and identity verification data: Retained for a minimum of five years following the completion of the verification process or account closure, whichever is later.
• Transaction and financial records: Retained for a minimum of five years following the date of the transaction, as required by Philippine financial regulations.
• Gaming activity logs: Retained for a minimum of two years following the date of the activity, or longer where required for dispute resolution or regulatory purposes.
• Customer support communications: Retained for two years following the resolution of the relevant support interaction.
• Marketing consent records: Retained for the duration of your consent and for a reasonable period thereafter as evidence of consent.

Where personal data is no longer required for any legitimate purpose, c9taya will securely delete or anonymize it. Anonymized data — which can no longer be linked to any individual — may be retained indefinitely for analytical and statistical purposes.

c9taya implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and c9taya's servers;
• Encryption at rest for sensitive data stored on c9taya's servers, including KYC documents and financial records;
• Role-based access controls ensuring that only authorized personnel with a legitimate operational need can access player data;
• Multi-factor authentication for internal systems access by c9taya staff;
• Regular security audits and penetration testing conducted by independent security professionals;
• Intrusion detection and monitoring systems that alert our security team to suspicious activity in real time;
• Secure data disposal procedures for the destruction of physical and digital records that are no longer required.

While c9taya takes all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, c9taya will notify you and the relevant Philippine regulatory authorities in accordance with applicable law.

Under the Data Privacy Act of 2012 and applicable data protection principles, you have the following rights in relation to your personal data held by c9taya:

• Right to be informed: You have the right to be informed about how c9taya collects and uses your personal data. This Policy fulfills that obligation.
• Right of access: You have the right to request a copy of the personal data c9taya holds about you, along with information about how it is being used.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data c9taya holds about you. You can update basic account information directly through your account settings.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to c9taya's legal retention obligations.
• Right to object: You have the right to object to the processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests, though c9taya may be entitled to continue processing if it can demonstrate compelling legitimate grounds.
• Right to data portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact c9taya's Data Protection Officer using the details provided in Section 12. c9taya will respond to all data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it.

c9taya will not charge a fee for handling data rights requests unless the request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

c9taya does not knowingly collect, process, or retain personal data from individuals under the age of 21. Age verification is a mandatory step in the c9taya registration and KYC process. If c9taya discovers or is notified that personal data has been collected from an individual under the age of 21, we will immediately suspend the associated account, delete the data, and return any deposited funds to the payment method used, subject to verification.

If you are a parent or guardian and believe that your child has registered on c9taya, please contact our support team immediately. We take underage gambling extremely seriously and will act promptly on any such report.

c9taya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes to this Policy, we will notify registered players via the email address on file and/or by displaying a prominent notice on the c9taya platform.

The updated Policy will take effect on the date indicated at the top of this page. Your continued use of the c9taya platform after the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with the changes, you should stop using the platform and contact support to close your account.

We encourage you to review this Policy periodically to stay informed about how c9taya protects your personal data. The most current version will always be available at this URL.

If you have any questions, concerns, or requests relating to this Privacy Policy or c9taya's data practices, please contact our Data Protection Officer. We are committed to resolving all privacy-related inquiries promptly and transparently.

If you are not satisfied with c9taya's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the regulatory authority responsible for enforcing the Data Privacy Act of 2012. Information about how to file a complaint with the NPC is available through official Philippine government channels.

c9taya takes all privacy complaints seriously. We will acknowledge your complaint within two business days and aim to provide a substantive response within 15 business days. For complex matters, we may require additional time, in which case we will keep you informed of progress.