phwins Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how phwins ("phwins," "we," "us," or "our") collects, uses, stores, discloses, and otherwise processes personal data relating to individuals ("you," "Member," or "User") who access or use the phwins online casino platform, including all associated games, features, and services (collectively, the "Platform").

phwins operates in the Philippines and is committed to full compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). This Policy is designed to be transparent, straightforward, and genuinely useful — not just a legal formality.

By registering on phwins or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. This Policy should be read alongside the phwins Terms & Conditions and Responsible Gaming Policy.

2 Data Controller

phwins acts as the personal information controller (PIC) in respect of the personal data it collects from members and visitors to the Platform. As PIC, phwins determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data protection laws.

phwins has appointed a Data Protection Officer (DPO) who is responsible for overseeing data protection compliance within the organisation. Contact details for the DPO are provided in Section 14 of this Policy.

3 Personal Data We Collect

phwins collects the following categories of personal data, depending on how you interact with the Platform:

phwins does not collect sensitive personal information (as defined under the Data Privacy Act) unless strictly required for regulatory compliance, in which case such collection will be clearly disclosed to you at the point of collection.

4 How We Collect Your Data

phwins collects personal data through the following means:

• Direct Collection: Data you provide when registering a phwins account, completing KYC verification, making deposits or withdrawal requests, contacting customer support, or participating in promotions.
• Automated Collection: Technical data collected automatically when you access the Platform, including IP address, device identifiers, browser information, and session activity logs, via cookies and similar tracking technologies (see Section 9).
• Third-Party Sources: Identity and address verification data received from KYC service providers; fraud and anti-money laundering screening data from compliance partners; payment confirmation data from GCash, Maya, and banking partners.
• Publicly Available Sources: In limited circumstances, phwins may verify information against publicly available records or databases maintained by Philippine government agencies for compliance purposes.

5 Purpose & Legal Basis for Processing

phwins processes your personal data only where a lawful basis exists under the Data Privacy Act of 2012. The primary purposes for which phwins processes personal data, and the corresponding legal bases, are as follows:

• Account Registration & Management: Processing is necessary for the performance of the contract between you and phwins (i.e., your membership agreement and the Terms & Conditions).
• Identity Verification (KYC): Processing is required for compliance with legal obligations under PAGCOR regulations and the Anti-Money Laundering Act (Republic Act No. 9160, as amended).
• Payment Processing: Processing is necessary for the performance of the contract and for compliance with financial regulatory obligations.
• Responsible Gaming Monitoring: Processing is necessary for compliance with PAGCOR responsible gaming requirements and to protect the vital interests of members who may be at risk of gambling-related harm.
• Fraud Prevention & Security: Processing is necessary for the legitimate interests of phwins in maintaining the integrity and security of the Platform, provided such interests are not overridden by your rights and freedoms.
• Customer Support: Processing is necessary for the performance of the contract and for the legitimate interests of phwins in providing effective member support.
• Marketing Communications: Processing is based on your freely given, specific, and informed consent. You may withdraw consent at any time by updating your communication preferences within your phwins account settings.
• Legal Compliance & Regulatory Reporting: Processing is required to comply with applicable laws, including reporting obligations to PAGCOR, the Anti-Money Laundering Council (AMLC), and the National Privacy Commission (NPC).

6 Sharing Your Personal Data

phwins does not sell, rent, or trade your personal data to third parties for their own marketing purposes. phwins may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• KYC & Identity Verification Providers: Third-party service providers engaged to verify your identity and age in compliance with PAGCOR and AML requirements.
• Payment Service Providers: GCash, Maya, and banking partners involved in processing your deposits and withdrawals. These providers receive only the data necessary to complete the relevant transaction.
• Fraud Prevention & Compliance Partners: Specialist providers engaged to screen transactions and member activity for fraud, money laundering, and other prohibited conduct.
• IT Infrastructure & Cloud Service Providers: Providers of hosting, data storage, and platform infrastructure services who process data on behalf of phwins under strict data processing agreements.
• Customer Support Platforms: Third-party tools used to manage live chat and support ticket communications.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities, where disclosure is required by law or regulatory direction.
• Law Enforcement: Philippine law enforcement agencies, where disclosure is required pursuant to a valid legal order or to prevent or detect crime.

All third-party service providers engaged by phwins are required to process personal data only in accordance with phwins's instructions and applicable data protection laws. phwins does not permit its service providers to use member data for their own independent purposes.

7 Data Retention

phwins retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the duration of your membership with phwins and for a period of five (5) years following account closure, in accordance with PAGCOR record-keeping requirements.
• KYC & Identity Verification Records: Retained for a minimum of five (5) years following the end of the business relationship, as required under the Anti-Money Laundering Act.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction.
• Customer Support Communications: Retained for two (2) years from the date of the last interaction, unless a longer period is required for dispute resolution or legal proceedings.
• Marketing Preferences: Retained until you withdraw consent or request deletion, subject to any overriding legal retention obligations.

Upon expiry of the applicable retention period, phwins will securely delete or anonymise your personal data in accordance with its data disposal procedures.

8 Security Measures

phwins implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phwins Platform.
• Encryption of sensitive data fields (including passwords and financial account details) at rest using industry-standard encryption algorithms.
• Role-based access controls ensuring that phwins personnel can only access personal data necessary for their specific job functions.
• Regular security assessments, penetration testing, and vulnerability scanning of the Platform infrastructure.
• Multi-factor authentication requirements for administrative access to systems containing personal data.
• Comprehensive audit logging of access to and processing of personal data.
• Staff training on data protection obligations and secure data handling practices.

9 Cookies & Tracking Technologies

phwins uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit the Platform. The following categories of cookies are used by phwins:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session authentication cookies and security tokens. These cookies cannot be disabled without affecting Platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings and responsible gaming limits, to provide a more personalised experience.
• Analytics Cookies: Used to collect aggregated, anonymised data about how members use the Platform, helping phwins identify areas for improvement. No personally identifiable information is shared with analytics providers.
• Security Cookies: Used to detect and prevent fraudulent activity, including bot traffic and account takeover attempts.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the phwins Platform. phwins does not use cookies to serve third-party advertising.

10 Your Data Privacy Rights

As a data subject under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phwins. You may exercise any of these rights by contacting the phwins Data Protection Officer (see Section 14):

phwins will respond to all data subject requests within thirty (30) days of receipt. In complex cases, this period may be extended by a further thirty (30) days, with prior notice to you. phwins will not charge a fee for handling data subject requests unless they are manifestly unfounded or excessive.

If you are not satisfied with phwins's response to your request, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

11 Minors

The phwins Platform is strictly intended for individuals aged twenty-one (21) years and above. phwins does not knowingly collect personal data from individuals under the age of 21. If phwins becomes aware that personal data has been collected from a person under 21, it will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that a minor has registered on phwins or provided personal data to phwins without your consent, please contact the phwins Data Protection Officer immediately using the contact details in Section 14.

12 Cross-Border Data Transfers

In certain circumstances, phwins may transfer personal data to service providers or partners located outside the Philippines — for example, cloud infrastructure providers or specialist compliance platforms. Where such transfers occur, phwins ensures that appropriate safeguards are in place to protect your personal data, in accordance with Section 21 of the Data Privacy Act of 2012 and NPC guidelines on cross-border data transfers.

Safeguards employed by phwins for cross-border transfers include contractual clauses requiring recipient organisations to maintain data protection standards equivalent to those required under Philippine law, and transfer impact assessments where required by the NPC.

13 Updates to This Policy

phwins reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or phwins's data processing practices. When material changes are made, phwins will notify registered members via email or through a prominent notice on the Platform prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this page. Your continued use of the phwins Platform following the effective date of any amendment constitutes your acknowledgment of the updated Policy. We encourage you to review this Policy periodically to stay informed about how phwins protects your personal data.

14 Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by phwins, please contact our Data Protection Officer through the following channel:

For complaints that remain unresolved after contacting phwins, you may escalate your concern to the National Privacy Commission of the Philippines through their official complaints process.