cataya is committed to protecting your personal information. This Privacy Policy explains what data cataya collects, how it is used, who it may be shared with, and what rights you have as a cataya player.
1.1 cataya is an online casino and gaming platform operating at cataya.asia and serving players across the Philippines, including Metro Manila, Cebu, Davao, and Quezon City. As part of providing a regulated, secure gaming environment, cataya collects and processes personal data in accordance with the Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), and its implementing rules and regulations.
1.2 This Privacy Policy applies to all personal data collected by cataya through the cataya website, mobile-optimized pages, live chat support interactions, email correspondence, and any other communication channel operated under the cataya brand.
1.3 This Privacy Policy should be read in conjunction with the cataya Terms & Conditions, which govern the overall use of the cataya platform.
1.4 cataya is committed to ensuring that all personal data processing activities are lawful, proportionate, transparent, and conducted with appropriate security safeguards. Your trust matters to us — we do not sell your personal data to third parties for their own commercial marketing purposes.
2.1 For the purposes of the Data Privacy Act of 2012 and this Privacy Policy, the data controller responsible for your personal data is:
2.2 cataya has designated a Data Protection Officer ("DPO") responsible for overseeing compliance with the DPA and this Privacy Policy. Queries relating specifically to data privacy matters may be addressed to the DPO through the contact details provided in Section 15.
3.1 cataya collects the following categories of personal data in connection with account registration, gameplay, payments, and platform usage:
3.2 cataya does not collect full credit or debit card numbers. Where card payments are processed, they are handled by PCI-DSS compliant payment processors, and cataya receives only tokenized payment references.
3.3 cataya does not collect special categories of sensitive personal data (such as health, race, religion, or biometric data) except where required by Philippine law or PAGCOR regulations in specific circumstances.
4.1 cataya collects personal data through the following means:
5.1 cataya processes your personal data for the following purposes, each supported by the specified legal basis under the Data Privacy Act of 2012:
6.1 cataya may share your personal data with the following categories of recipients:
6.2 All third parties with whom cataya shares personal data are contractually bound to process that data solely in accordance with cataya's instructions and applicable data protection law.
7.1 cataya retains your personal data for as long as your cataya account remains active and for such further periods as are required by applicable law or legitimate business purposes, including:
7.2 Upon expiry of applicable retention periods, cataya will securely delete or anonymize your personal data in accordance with its data destruction procedures, unless further retention is required by a specific legal obligation.
8.1 cataya implements industry-standard technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. These measures include:
8.2 In the event of a personal data breach affecting your cataya account that poses a real risk of serious harm, cataya will notify the National Privacy Commission and affected players in accordance with the timelines prescribed by NPC Circular No. 16-03 and its amendments.
8.3 While cataya takes all reasonable precautions, no digital platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your cataya login credentials and for reporting suspected unauthorized access to your account immediately via the cataya live chat.
9.1 cataya uses cookies and similar tracking technologies on the cataya website for the following purposes:
9.2 You may manage non-essential cookie preferences through your browser settings. Blocking strictly necessary cookies may impair your ability to use the cataya platform. Blocking functional or analytics cookies will not prevent you from accessing games or making transactions.
9.3 cataya does not use tracking technologies to build advertising profiles for sale to third-party advertisers.
10.1 Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by cataya:
10.2 To exercise any of the above rights, please contact cataya's Data Protection Officer using the contact details in Section 15. cataya will respond to data subject requests within fifteen (15) working days of receipt, or within such extended period as permitted under the DPA where the request is complex or numerous.
10.3 cataya may need to verify your identity before processing a data subject request. Identity verification for data access requests does not constitute unlawful processing.
11.1 cataya enforces age verification at registration through ID document requirements and third-party KYC checks. Any player who provides a false date of birth or identity document to circumvent the age restriction is in material breach of the cataya Terms & Conditions.
11.2 If you believe that a minor has registered a cataya account using false identity information, please report this to cataya support immediately via live chat.
12.1 The cataya platform integrates services from third-party game content providers, payment processors, and infrastructure partners. While cataya exercises due diligence in selecting these partners, cataya is not responsible for the privacy practices of third-party services accessed through the cataya platform.
12.2 When you interact with payment providers such as GCash or PayMaya to fund your cataya wallet, you are also subject to those providers' own privacy policies. cataya recommends reviewing the privacy documentation of all payment providers you use in connection with your cataya account.
13.1 cataya's primary data processing infrastructure is located within or is directed at the Philippines. However, some of cataya's service providers and game content partners may process data outside the Philippines in the course of providing their services.
13.2 Where personal data is transferred outside the Philippines, cataya ensures that appropriate safeguards are in place in accordance with the Data Privacy Act of 2012 and NPC guidelines, including contractual data transfer agreements requiring the recipient to maintain standards equivalent to Philippine data protection law.
13.3 cataya will not transfer your personal data to any country or territory that does not provide an adequate level of protection for personal data unless appropriate safeguards are in place.
14.1 cataya may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, or cataya's data processing practices. Any material changes will be communicated to registered cataya players via the contact details on their account and will be published on the cataya website with a revised effective date.
14.2 Your continued use of the cataya platform following publication of an updated Privacy Policy constitutes your acknowledgment of the revised terms. If you do not accept a revised Privacy Policy, you should cease using the cataya platform and may request account closure as provided in the cataya Terms & Conditions.
15.1 For any queries, data subject requests, or concerns relating to this Privacy Policy or cataya's data processing activities, please contact cataya's Data Protection Officer through the following channels:
15.2 If you are not satisfied with cataya's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). Information about the NPC's complaint process is available through official Philippine government channels.
15.3 cataya endeavours to acknowledge all privacy-related enquiries within forty-eight (48) hours and to provide a substantive response within fifteen (15) working days.
The Data Privacy Act of 2012 gives every Filipino player meaningful rights over their personal data. Here's a plain-language summary of what cataya is required to honour.
cataya must tell you — clearly and upfront — what personal data it collects and why. This Privacy Policy is that disclosure. No hidden data collection, no undisclosed processing purposes.
You can request a full copy of the personal data cataya holds about you. Contact cataya support with your request and we will respond within 15 working days with a data subject access report.
If cataya holds personal data about you that is inaccurate, incomplete, or outdated, you have the right to have it corrected. Update your basic details via your cataya account settings or contact support for KYC data corrections.
You may request deletion of your cataya account data. Note that regulatory retention requirements (see Section 7) mean certain records — such as AML-required transaction logs — must be kept for prescribed minimum periods regardless of erasure requests.
Where cataya processes your data based on legitimate interests — such as fraud prevention analytics — you have the right to object. Objections will be reviewed on a case-by-case basis against cataya's legitimate grounds for processing.
In certain circumstances you may request your personal data in a structured, commonly used, machine-readable format. This right typically applies to data you provided directly to cataya and which is processed by automated means on a consent or contract basis.
Beyond legal compliance, here are the practical commitments cataya makes to every player about how your personal data is handled day to day.
cataya will never sell your personal data to third-party advertisers, data brokers, or any commercial entity for their own marketing purposes. Data sharing is strictly limited to what's needed to operate the cataya platform and comply with Philippine law.
Every connection to cataya.asia — login, game play, deposit, withdrawal, support chat — is encrypted end-to-end using SSL/TLS. Your personal and financial data is never transmitted in plain text between your device and the cataya server.
Internal cataya staff access to player personal data is role-based and strictly limited on a need-to-know principle. Support agents handling your queries do not have access to financial account data beyond what is needed to resolve your specific issue.
cataya only keeps your personal data for as long as is legally necessary. Once retention periods expire, data is securely deleted or anonymized. cataya does not accumulate player data indefinitely for speculative future uses.
Marketing communications from cataya are consent-based. You can withdraw consent and opt out of promotional emails or SMS at any time through your cataya account settings or by contacting cataya support. Withdrawal of marketing consent does not affect your cataya account.
cataya operates in full compliance with the Data Privacy Act of 2012 and National Privacy Commission circulars and guidelines. cataya's DPO monitors regulatory developments and updates cataya's data protection practices accordingly to maintain current compliance.