Privacy Policy

www.phwin (hereinafter "www.phwin," "the Platform," "we," "us," or "our") is an online gaming platform operating in the Philippines and accessible at https://wwwphwin.org. www.phwin acts as the personal information controller (PIC) within the meaning of Republic Act No. 10173 (the "Data Privacy Act" or "DPA") with respect to all personal data collected from users of the Platform.

www.phwin offers online casino games, sports betting, live sabong, bingo, and related gaming services to eligible Filipino players aged 21 and above, operating under the oversight of the Philippine Amusement and Gaming Corporation (PAGCOR).

This Privacy Policy applies to all personal data collected from:

• Visitors to the www.phwin website and all associated pages
• Registered account holders of the www.phwin platform
• Players who interact with any www.phwin game, service, or customer support channel
• Recipients of www.phwin promotional communications who have consented to receive them

www.phwin collects only the personal data necessary for the legitimate purposes described in this Policy. The categories of data we collect include:

www.phwin does not collect sensitive personal information such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data beyond what is strictly required for identity verification purposes under PAGCOR KYC requirements.

www.phwin collects personal data through the following channels and methods:

• Account registration: Information you provide directly when creating a www.phwin account, including your name, mobile number, email, date of birth, and government ID during the KYC verification process.
• Platform use: Data generated automatically as you interact with www.phwin — including gameplay records, session data, deposit and withdrawal transactions, and bonus activity.
• Customer support interactions: Data you provide when contacting www.phwin support via live chat, email, or any other support channel.
• Payment processors: Transactional confirmation data received from payment service providers including GCash, Maya, and Philippine banking partners when you make deposits or receive withdrawals.
• Cookies and tracking technologies: Automatically collected technical data as described in Section 7 of this Policy.
• Third-party identity verification services: Data received from accredited KYC verification service providers used to authenticate Philippine government IDs in compliance with PAGCOR requirements.

www.phwin uses the personal data we collect for the following specific and legitimate purposes:

• Account creation and management: To register, maintain, and administer your www.phwin player account, including processing your login credentials and account settings.
• Age and identity verification: To comply with the mandatory 21+ age requirement under PAGCOR regulations and to verify your identity in accordance with KYC obligations applicable to licensed Philippine gaming operators.
• Payment processing: To process your GCash deposits, Maya top-ups, bank transfers, and all withdrawals; to verify payment method ownership; and to maintain transaction records for regulatory and accounting purposes.
• Anti-money laundering (AML) compliance: To meet our obligations under the Anti-Money Laundering Act of the Philippines (AMLA) and AMLC regulations, including transaction monitoring and reporting of unusual transactions where required.
• Responsible gaming: To monitor for signs of problem gambling, to administer self-exclusion and account limit requests, and to fulfil our obligations under PAGCOR's responsible gaming framework.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent activity, unauthorised account access, bonus abuse, and other prohibited conduct on the www.phwin platform.
• Customer support: To respond to your enquiries, resolve disputes, and improve our support services.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates — only where you have given explicit consent and only until that consent is withdrawn.
• Platform improvement: To analyse usage patterns, optimise game performance, and improve the overall www.phwin player experience using aggregated and anonymised analytics data.
• Legal and regulatory compliance: To comply with all applicable Philippine laws, PAGCOR regulations, court orders, and lawful requests from government authorities.

Under the Data Privacy Act of 2012 (RA 10173), www.phwin processes your personal data on the following lawful bases:

• Contractual necessity: Processing required to perform the contract between you and www.phwin — specifically your account registration, gameplay, and financial transactions.
• Legal obligation: Processing necessary to comply with Philippine law, including PAGCOR licensing requirements, the AMLA, the DPA itself, and PAGCOR's responsible gaming regulations. This basis covers identity verification, AML monitoring, and regulatory reporting.
• Legitimate interests: Processing necessary for the legitimate interests of www.phwin, including fraud prevention, platform security, account integrity protection, and service improvement — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing carried out on the basis of your freely given, specific, informed, and unambiguous consent — particularly for marketing communications. You may withdraw this consent at any time by updating your communication preferences in your www.phwin account settings or by contacting our support team.

www.phwin does not sell your personal data to third parties. We share personal data only in the following circumstances and only to the extent necessary:

• PAGCOR and regulatory authorities: We are required by Philippine law to report certain player information and gaming activities to PAGCOR and, where applicable, to the AMLC. Compliance with these reporting obligations is mandatory and not subject to your consent.
• Payment service providers: We share relevant transaction and identity data with GCash, Maya, BPI, BDO, Metrobank, and other payment processors solely for the purpose of processing your deposits and withdrawals. These providers are contractually bound to handle your data securely and in accordance with applicable Philippine law.
• KYC and identity verification providers: Your government ID data is shared with accredited third-party KYC providers to validate your identity and age at registration. These providers are bound by data processing agreements consistent with RA 10173.
• Game studios and software providers: Limited technical session data is shared with our licensed game studio partners solely for the purposes of game operation, RNG auditing, and technical support. Game providers do not receive personally identifiable financial information.
• Legal and law enforcement: We may disclose personal data when required to do so by a valid court order, subpoena, or lawful directive from a Philippine government authority or law enforcement agency.

www.phwin uses cookies and similar tracking technologies to operate the Platform, improve your experience, and maintain security. The following types of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in to your www.phwin account and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without impacting Platform functionality.
• Functional cookies: Used to remember your preferences such as language settings, game lobby layout, and notification preferences on the www.phwin platform.
• Analytics cookies: Used to collect aggregated, anonymised data about how Filipino players interact with the www.phwin website — such as pages visited, time spent, and navigation paths. This helps us improve the platform experience without identifying individual users.
• Security cookies: Used to detect and prevent fraudulent activity, bot activity, and multiple account registrations from the same device.

You may manage non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies. Note that disabling certain cookies may affect the functionality of the www.phwin Platform, including your ability to stay logged in.

www.phwin does not use third-party advertising cookies or behavioural advertising tracking technologies that share your data with ad networks.

www.phwin retains personal data only for as long as is necessary for the purposes described in this Policy, or as required by Philippine law and PAGCOR regulations. The following general retention periods apply:

• Active account data: Retained for the duration of your registration with www.phwin and for a minimum of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and AMLA obligations.
• Transaction and financial records: Retained for a minimum of ten (10) years in accordance with AMLC reporting requirements and Philippine tax record-keeping rules.
• KYC and identity documents: Retained for the duration of your account relationship and for five (5) years post-closure, consistent with PAGCOR licensing conditions.
• Support communications: Retained for three (3) years from the date of last interaction for quality assurance and dispute resolution purposes.
• Marketing data: Retained until you withdraw consent or request deletion, subject to legal retention requirements.

Following the expiry of applicable retention periods, www.phwin securely destroys or anonymises personal data so that it can no longer be associated with any individual.

www.phwin implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the www.phwin servers
• Encryption at rest for sensitive data including payment details and government ID information stored in www.phwin databases
• Role-based access controls ensuring that www.phwin staff can only access personal data to the extent required for their specific operational role
• Two-factor authentication available to all www.phwin player accounts and required for staff accessing administrative systems
• Regular security audits and penetration testing conducted by independent security firms
• Fraud detection systems that monitor for unusual login activity, multiple account creation, and suspicious transaction patterns in real time
• Incident response procedures consistent with the NPC's guidelines on personal data breach management under RA 10173

As a Philippine data subject, you have the following rights under the Data Privacy Act of 2012 (RA 10173) with respect to your personal data held by www.phwin:

To exercise any of these rights, contact the www.phwin Data Protection Officer as described in Section 14. We will respond to all verified data rights requests within fifteen (15) business days in accordance with NPC guidelines.

The www.phwin Platform is strictly restricted to individuals who are 21 years of age or older under Philippine law. www.phwin does not knowingly collect personal data from persons under the age of 21.

Age verification using a Philippine government-issued ID is mandatory at account registration for all www.phwin accounts. If www.phwin discovers that personal data has been collected from a person under 21 years of age, the account will be immediately closed, all data will be deleted to the extent not required to be retained for legal or regulatory purposes, and the matter may be referred to the relevant Philippine authorities.

Some of the third-party service providers engaged by www.phwin — including certain game studios, technology infrastructure providers, and KYC verification services — may process personal data outside of the Philippines.

Where personal data is transferred outside the Philippines, www.phwin ensures that such transfers are governed by appropriate safeguards, including:

• Data processing agreements incorporating the standard contractual clauses approved by the National Privacy Commission
• Transfers only to jurisdictions or entities that provide an adequate level of data protection comparable to that required under RA 10173
• Technical and organisational measures ensuring the security of transferred data during transit and at rest

www.phwin does not transfer personal data to recipients in jurisdictions known to have inadequate data protection standards without appropriate supplementary safeguards in place.

www.phwin reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or NPC issuances.

When material changes are made, www.phwin will:

• Update the "Last Updated" date displayed at the top of this page
• Notify registered www.phwin account holders via email or in-platform notification at least fourteen (14) days before the revised policy takes effect
• Where required by the DPA or NPC guidelines, seek fresh consent for any new processing activities

We encourage you to review this Privacy Policy periodically to stay informed about how www.phwin handles your personal data. Your continued use of the Platform following the effective date of any update constitutes your acknowledgment of the revised Policy.

www.phwin has designated a Data Protection Officer (DPO) in accordance with Section 21 of the Data Privacy Act of 2012 and NPC Advisory No. 2017-01. The DPO is responsible for overseeing www.phwin's compliance with RA 10173 and handling data subject rights requests.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact:

www.phwin will acknowledge all data rights requests within three (3) business days and provide a full response within fifteen (15) business days, consistent with NPC guidelines. If your request requires additional time to process, we will notify you of the expected timeline.