Privacy Policy

1 Introduction

c9taya ("c9taya," "we," "us," or "our") operates the online casino platform accessible at c9taya.asia ("Platform"). We understand that your personal data is important to you, and we take our obligations as a personal information controller seriously.

This Privacy Policy ("Policy") describes how c9taya collects, uses, stores, shares, and protects personal data relating to registered players, prospective players, and visitors to the Platform ("you" or "Data Subject"). It applies to all personal data processed by c9taya in connection with the Platform and any related services.

This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), and the issuances of the National Privacy Commission ("NPC") of the Philippines. It should be read together with our Terms & Conditions, which govern your use of the Platform.

2 Data Controller Information

The personal information controller responsible for your data in connection with the c9taya Platform is:

c9taya has designated a Data Protection Officer ("DPO") responsible for overseeing compliance with the DPA and this Policy. You may contact the DPO directly for any privacy-related concerns using the contact details provided in Section 15 of this Policy.

3 Personal Data We Collect

c9taya collects the following categories of personal data in connection with the operation of the Platform:

3.1 Identity & Contact Data

• Full legal name as it appears on your government-issued identification;
• Date of birth and age verification information;
• Residential address (including barangay, city/municipality, province, and postal code);
• Email address and mobile phone number;
• Nationality and country of residence.

3.2 Verification & KYC Data

• Copies of government-issued photo identification (e.g., Philippine passport, driver's license, SSS ID, UMID, PhilSys National ID, PRC ID);
• Proof of address documents (e.g., utility bills, bank statements, barangay certificates);
• Selfie or liveness verification images where required for identity confirmation;
• Source of funds declarations where required by anti-money laundering regulations.

3.3 Financial & Transaction Data

• GCash or PayMaya account details (mobile number and account name);
• Bank account details for bank transfer transactions (account name, account number, bank name);
• Debit card details (card number masked, expiry date, cardholder name);
• Deposit and withdrawal transaction history, amounts, dates, and payment method used;
• Account balance and bonus balance information.

3.4 Gaming & Activity Data

• Game play history, including games played, wager amounts, outcomes, and session durations;
• Bonus and promotion usage history;
• Responsible gaming tool settings (deposit limits, session limits, self-exclusion status);
• Customer support interaction records, including chat transcripts and email correspondence.

3.5 Technical & Device Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser type and version;
• Unique device identifiers;
• Platform access logs, including login timestamps and session activity;
• Cookie and tracking technology data as described in Section 10.

4 How We Collect Your Data

c9taya collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions;
• Automated collection: Technical and device data collected automatically when you access and use the Platform, including through cookies and similar tracking technologies;
• Third-party sources: Identity verification data from KYC service providers; fraud detection data from anti-fraud service providers; payment verification data from payment processors such as GCash and PayMaya; and regulatory data from PAGCOR and other competent authorities where required by law.

5 Purposes of Processing

c9taya processes your personal data for the following specific, legitimate purposes:

• Account registration and management: To create, maintain, and administer your c9taya account;
• Identity verification and KYC compliance: To verify your identity and age (21+) as required by PAGCOR regulations and Philippine law;
• Transaction processing: To process deposits, withdrawals, and bonus transactions in Philippine Peso;
• Anti-money laundering (AML) compliance: To monitor transactions and detect suspicious activity as required under Republic Act No. 9160 (Anti-Money Laundering Act) and its amendments;
• Fraud prevention and platform security: To detect, investigate, and prevent fraudulent activity, cheating, and unauthorized account access;
• Responsible gaming: To monitor gaming patterns and enforce responsible gaming tools, including deposit limits, session limits, and self-exclusion;
• Customer support: To respond to your enquiries, complaints, and support requests;
• Marketing and promotions: To send you relevant promotional offers and updates, subject to your marketing preferences and applicable law;
• Platform improvement: To analyze usage patterns and improve the functionality, performance, and user experience of the Platform;
• Legal and regulatory compliance: To comply with applicable Philippine laws, PAGCOR directives, court orders, and other legal obligations.

6 Legal Basis for Processing

Under the Data Privacy Act of 2012, c9taya processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you (the Terms & Conditions), including account management, transaction processing, and customer support;
• Legal obligation: Processing required to comply with applicable Philippine laws and PAGCOR regulations, including KYC, AML monitoring, and age verification;
• Legitimate interests: Processing necessary for c9taya's legitimate interests in fraud prevention, platform security, and service improvement, where such interests are not overridden by your rights and interests;
• Consent: Processing for marketing communications and non-essential cookies, where your prior consent has been obtained. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Disclosure

c9taya does not sell your personal data to third parties. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment processors: GCash, PayMaya, and partner banks, for the purpose of processing your deposits and withdrawals;
• KYC and identity verification providers: Third-party service providers engaged to assist with identity verification and document authentication;
• Fraud prevention and AML service providers: Third-party providers engaged to assist with fraud detection and anti-money laundering monitoring;
• Game content providers: Game software providers whose games are available on the Platform, to the extent necessary for game operation and dispute resolution;
• Regulatory authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other competent Philippine government authorities, where disclosure is required by law or regulatory directive;
• Professional advisers: Legal counsel, auditors, and other professional advisers engaged by c9taya, subject to professional confidentiality obligations;
• IT and infrastructure providers: Cloud hosting, data storage, and platform infrastructure providers engaged by c9taya to operate the Platform, subject to contractual data processing agreements.

All third-party service providers engaged by c9taya are required to process your personal data only in accordance with c9taya's instructions and applicable data protection law. c9taya does not permit third-party service providers to use your personal data for their own independent purposes.

8 Data Retention

c9taya retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and PAGCOR regulations. The following general retention periods apply:

Upon expiry of the applicable retention period, c9taya will securely delete or anonymize your personal data in accordance with its data disposal procedures. Where data is anonymized, it may be retained indefinitely for statistical and analytical purposes as it no longer constitutes personal data.

9 Data Security

c9taya implements appropriate technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption in transit: All data transmitted between your device and the c9taya Platform is encrypted using Transport Layer Security (TLS/SSL) technology;
• Encryption at rest: Sensitive personal data stored on c9taya's systems is encrypted at rest using industry-standard encryption algorithms;
• Access controls: Access to personal data is restricted to authorized c9taya personnel and service providers on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication;
• Pseudonymization: Where feasible, personal data is pseudonymized to reduce the risk of re-identification in the event of unauthorized access;
• Regular security assessments: c9taya conducts regular vulnerability assessments and penetration testing of its Platform and infrastructure;
• Incident response: c9taya maintains a data breach response plan and will notify affected Data Subjects and the National Privacy Commission within seventy-two (72) hours of becoming aware of a personal data breach that poses a real risk of serious harm, as required by the DPA.

While c9taya takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying c9taya immediately at [email protected] if you suspect any unauthorized access to your account.

10 Cookies & Tracking Technologies

c9taya uses cookies and similar tracking technologies on the Platform to enhance your user experience, maintain session security, and analyze Platform usage. The following categories of cookies are used:

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may impair the functionality of the Platform. For functional, analytics, and marketing cookies, you may withdraw your consent at any time by adjusting your cookie preferences in your account settings or browser.

11 Your Data Subject Rights

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights with respect to your personal data held by c9taya:

To exercise any of the above rights, please submit a written request to c9taya's Data Protection Officer at [email protected]. c9taya will respond to your request within thirty (30) days of receipt. We may require you to verify your identity before processing your request.

12 Minors & Age Restriction

The c9taya Platform is strictly intended for persons aged 21 years and above, in accordance with Philippine law and PAGCOR regulations governing online gambling. c9taya does not knowingly collect personal data from persons under 21 years of age.

If c9taya becomes aware that personal data has been collected from a person under 21 years of age, it will take immediate steps to delete such data and close the associated account. Any winnings accrued by an underage player will be forfeited.

If you are a parent or guardian and believe that your child under 21 has registered on the c9taya Platform, please contact us immediately at [email protected] so that we can take appropriate action.

13 Cross-Border Data Transfers

In the course of operating the Platform, c9taya may transfer your personal data to service providers or infrastructure providers located outside the Republic of the Philippines. Where such transfers occur, c9taya ensures that appropriate safeguards are in place to protect your personal data, including:

• Transferring data only to countries or organizations that provide an adequate level of data protection as recognized by the NPC;
• Implementing contractual data processing agreements with overseas recipients that impose data protection obligations equivalent to those under the DPA;
• Obtaining your explicit consent for transfers where required by applicable law.

c9taya will not transfer your personal data to overseas recipients unless the transfer is necessary for the performance of our contract with you, required by law, or subject to appropriate safeguards as described above.

14 Amendments to This Policy

c9taya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. When material changes are made, c9taya will notify registered players via email or through a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this page reflects the effective date of the most recent version of this Policy. We encourage you to review this Policy periodically. Your continued use of the c9taya Platform after the effective date of any amendment constitutes your acknowledgment of the updated Policy.

15 Contact Us & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by c9taya, please contact our Data Protection Officer through the following channels:

If you are not satisfied with c9taya's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act of 2012.