2. WHEN DO WE COLLECT PERSONAL DATA?

We collect your personal data when:

• You register an Account and verify your phone number by OTP;
• You sign in, change your password or change your phone number;
• You top up GCent or request an invoice;
• You submit a support request, complaint or feedback;
• You take part in events, promotions or surveys;
• Automatically when you visit the website or a game (technical data, system logs).

3. WHAT PERSONAL DATA DO WE COLLECT?

We collect only what is needed for the purposes in section 6.

4. OTHER DATA WE COLLECT

Besides what you provide, the system automatically records:

• IP address, device identifier, browser type, operating system;
• Sign-in logs: time, device, outcome;
• In-game action logs used for fraud prevention and complaint handling;
• Play time — required to enforce limits for players under 18.

5. COOKIES

We use cookies to keep you signed in, remember your language choice and measure performance.

• Essential cookies: required for the system to work (session, CSRF protection). These cannot be turned off.
• Analytics and advertising cookies: loaded ONLY after you consent. The default is to DECLINE.
• You can change your choice at any time via the cookie settings bar or your browser settings.

6. HOW DO WE USE YOUR PERSONAL DATA?

• Creating, verifying and managing your Account;
• Processing GCent top-ups, reconciling with gateways and issuing electronic invoices;
• Applying age rules and play-time limits for players under 18;
• Detecting and preventing fraud, account takeover and other breaches;
• Customer support, complaint and dispute handling;
• Improving service quality using aggregated, anonymised data;
• Sending promotional information — ONLY with your separate consent, revocable at any time;
• Meeting legal obligations and lawful requests from State authorities.

7. HOW DO WE PROTECT AND STORE YOUR DATA?

• Passwords are one-way hashed with argon2id and never stored in readable form;
• Citizen ID numbers and other sensitive fields are encrypted at rest;
• Data is transmitted over TLS;
• Internal access follows least privilege; every administrator action is written to an immutable log;
• Encrypted backups are taken regularly, with quarterly restore drills;
• Data is held on infrastructure located in Vietnam as required by law.

8. DO WE DISCLOSE YOUR PERSONAL DATA?

We do NOT sell personal data. It is shared only as far as necessary with:

• Payment gateways (VNPAY, MoMo, banks) — to complete and reconcile transactions;
• SMS and email providers — to deliver OTP codes and transaction notices;
• Electronic invoice providers — to issue invoices you request;
• Infrastructure and cloud storage providers under binding confidentiality agreements;
• Competent State authorities upon a lawful written request.

9. CHILDREN’S PERSONAL DATA

We do not knowingly collect data from children under 16. Under section 3.1 of the Terms of Use, accounts for under-16s must be registered by a parent or legal guardian using their own details.

If we find we have collected a child’s data without guardian consent, we delete it as soon as possible. Guardians may request access, correction or deletion via the Support Centre.

10. PERSONAL DATA COLLECTED BY THIRD PARTIES

When you pay through a gateway, that gateway collects and processes payment information under its own policy. GameHub does NOT store your card number, CVV or payment password.

When you sign in with a social account, that provider processes data under its own policy. We recommend reading those policies carefully.

11. LIMITATION OF LIABILITY FOR THIRD-PARTY SITES AND APPS

The website and games may link to third-party sites or apps. This Policy does not apply to them, and we are not responsible for how they handle your data.

12. YOUR RIGHTS AND HOW TO EXERCISE THEM

Under the Personal Data Protection Law you have the right to:

• Be informed about the processing of your personal data;
• Consent or refuse consent to processing;
• Access, view and correct your data;
• Withdraw consent;
• Have your data deleted;
• Restrict processing;
• Obtain a copy of your data;
• Object to processing;
• Complain, denounce or bring legal proceedings;
• Claim compensation for damage;
• Protect yourself.

13. HOW LONG WE KEEP DATA

• Account data: for as long as the Account is active;
• After a deletion request: soft-deleted and anonymised within 30 days;
• Sign-in and anti-fraud logs: up to 24 months;
• Financial transaction records and invoices: retained under accounting and tax obligations even after account deletion. This is a legally required exception.

14. WHERE DATA IS STORED AND CROSS-BORDER TRANSFERS

Personal data of Vietnamese players is stored on infrastructure located in Vietnam.

Where data must be transferred abroad (for example when using international infrastructure services), we complete the cross-border transfer impact assessment and file it with the competent authority as required.

15. DATA PROTECTION CONTACT

For any question, request or complaint about personal data, contact the Support Centre or the email published in the footer. We have a team responsible for personal data protection.

In the event of a data breach we notify the competent authority and affected players within 72 hours of discovery, describing the incident and the remedial steps taken.