phiwin Privacy Policy

This Privacy Policy ("Policy") governs the collection, use, storage, disclosure, and protection of personal data by phiwin ("phiwin," "we," "us," or "the Company"), the operator of the online gaming platform at phiwin.org. phiwin operates as the data controller with respect to personal data collected from users of the phiwin platform.

phiwin processes personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the relevant issuances of the National Privacy Commission ("NPC"). phiwin also processes certain data in fulfillment of obligations arising under its PAGCOR operating license, the Anti-Money Laundering Act (as amended), and applicable PAGCOR circulars and memoranda.

By registering an account on phiwin, accessing the phiwin platform, or otherwise providing personal data to phiwin, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

phiwin collects the following categories of personal data from players and platform users:

2.1 Identity and Contact Data:

• Full legal name as it appears on a valid Philippine government-issued identification document.
• Date of birth (to verify compliance with the 21+ age requirement under PAGCOR regulations).
• Philippine mobile number (in +63 format).
• Email address used for account registration and communications.
• Residential address within the Philippines.
• Government-issued ID number and copies of identity documents submitted during KYC verification.
• Selfie photographs submitted for biometric identity verification purposes.

2.2 Financial Data:

• GCash mobile number or Maya account details linked for deposit and withdrawal purposes.
• Bank account details (BPI, BDO, Metrobank, or other Philippine banks) where provided for withdrawals.
• Cryptocurrency wallet addresses (USDT TRC20) where used for transactions.
• Transaction history including deposit amounts, withdrawal requests, and timestamps.

2.3 Gaming and Platform Activity Data:

• Game session records including game titles played, wager amounts, outcomes, and timestamps.
• Betting history on sports markets.
• Bonus and promotional offer redemption records.
• Account login history including timestamps and IP addresses.
• Responsible gaming tool settings including deposit limits, loss limits, and self-exclusion status.

2.4 Technical Data:

• IP address and geolocation data at time of account access.
• Device type, operating system, and browser information.
• Session duration and platform navigation data collected through cookies and analytics tools.

2.5 Communications Data:

• Records of communications between you and phiwin's customer support team, including live chat transcripts and email correspondence.
• Feedback, complaints, and dispute correspondence.

phiwin collects personal data through the following channels and methods:

• Direct submission: Personal data you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or participating in a promotion.
• Automated collection: Technical data, session data, and device data collected automatically through cookies, server logs, and analytics tools when you access or use the phiwin platform.
• Third-party payment providers: Transaction confirmation data received from payment processors (GCash, Maya, BPI, BDO, Metrobank, etc.) in the course of processing deposits and withdrawals.
• Identity verification providers: Results of identity verification checks conducted through phiwin's KYC service providers, which process government ID data and biometric selfie data on phiwin's behalf.
• Regulatory and compliance sources: Data received from PAGCOR, the Anti-Money Laundering Council ("AMLC"), or other government bodies as part of regulatory compliance obligations.

Under the Philippine Data Privacy Act, phiwin processes your personal data on the following lawful grounds:

• Contractual necessity: Processing of identity, contact, financial, and gaming data is necessary to open and operate your phiwin account, process transactions, and deliver gaming services under the contract you enter into with phiwin upon registration.
• Legal obligation: Processing of KYC, identity, and financial transaction data is required to comply with phiwin's obligations under its PAGCOR license, the Anti-Money Laundering Act, the Data Privacy Act itself, and other applicable Philippine law.
• Legitimate interests: Processing of technical, session, and platform activity data for fraud prevention, platform security, responsible gaming monitoring, and service improvement, provided such interests do not override your fundamental rights and freedoms.
• Consent: Processing of your data for direct marketing communications, where you have provided specific, informed, and freely given consent. You may withdraw this consent at any time.

phiwin uses the personal data collected for the following specific purposes:

• To create, maintain, and administer your phiwin player account.
• To verify your identity and age (21+ requirement) through KYC processes as required by PAGCOR.
• To process deposit and withdrawal transactions through your chosen Philippine payment methods.
• To operate and deliver gaming services including live casino, slots, bingo, and sports betting.
• To detect, investigate, and prevent fraud, money laundering, bonus abuse, and other prohibited activities.
• To comply with anti-money laundering reporting obligations under the AMLA and report suspicious transactions to the AMLC where required.
• To administer promotional offers, bonuses, and loyalty programs.
• To provide customer support services in Tagalog and English.
• To enforce responsible gaming tools including deposit limits, loss limits, and self-exclusion, and to monitor for problem gambling indicators as required under PAGCOR regulations.
• To send transactional communications including deposit confirmations, withdrawal notifications, and account security alerts.
• To send promotional communications where you have provided consent and not subsequently opted out.
• To improve the phiwin platform through analysis of aggregated, anonymised usage data.

phiwin does not sell, rent, or trade your personal data. phiwin may share your personal data only in the following limited circumstances:

• Service providers and data processors: phiwin engages third-party service providers to assist with KYC verification, payment processing, fraud detection, IT infrastructure, and customer support. These providers process data strictly on phiwin's instructions under written data processing agreements and are not permitted to use player data for their own purposes.
• PAGCOR: phiwin is required to submit player data and gaming activity reports to PAGCOR as a condition of its operating license. Disclosures to PAGCOR are made in accordance with the relevant regulatory frameworks.
• Anti-Money Laundering Council (AMLC): Where phiwin identifies or has reasonable grounds to suspect a transaction that may constitute money laundering or other financial crime under Philippine law, phiwin is legally obligated to file a Covered Transaction Report or Suspicious Transaction Report with the AMLC.
• Law enforcement and courts: phiwin will disclose personal data to Philippine law enforcement agencies, courts, or other government authorities where required by valid legal process, court order, or applicable law.
• Corporate transactions: In the event of a merger, acquisition, or sale of phiwin's business or assets, player data may be transferred to the acquiring entity, subject to the same privacy protections as described in this Policy.

phiwin uses cookies and similar tracking technologies on its platform to deliver a functional, secure, and personalised user experience. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the operation of the platform, including maintaining login sessions, preventing cross-site request forgery, and enabling core platform functionality. These cookies cannot be disabled without impairing basic platform functions.
• Performance and analytics cookies: Used to collect anonymised information about how players interact with the phiwin platform — which pages are visited most often, session duration, and error messages encountered. This data helps phiwin improve the platform experience.
• Functional cookies: Enable phiwin to remember your preferences such as language settings, preferred games lobby view, and responsible gaming tool configurations.
• Security cookies: Used to detect and prevent fraudulent access attempts, identify unusual login patterns, and protect against automated bot access.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent certain platform features from functioning correctly. phiwin does not use advertising or third-party marketing cookies.

phiwin retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods arising from regulatory obligations:

• KYC and identity verification records: Retained for a minimum of 5 years following account closure, as required under the Anti-Money Laundering Act.
• Financial transaction records: Retained for a minimum of 5 years following the date of each transaction, as required by AMLC regulations.
• Gaming activity records: Retained for a minimum of 3 years as required under phiwin's PAGCOR license conditions.
• Customer support correspondence: Retained for 2 years following the closure of each support interaction, or longer where the correspondence relates to an unresolved dispute or regulatory investigation.
• Self-exclusion records: Retained for the duration of the self-exclusion period and for 5 years thereafter to prevent re-registration during an exclusion period.
• Marketing consent records: Retained for as long as you remain a registered phiwin player, and for 3 years following account closure, to evidence the lawful basis for any marketing communications sent.

Upon expiry of the applicable retention period, phiwin will securely delete or anonymise your personal data. Anonymised, aggregated data that cannot be linked back to any individual may be retained indefinitely for statistical and analytical purposes.

phiwin implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These include:

• 256-bit SSL/TLS encryption on all data transmission between your device and phiwin's servers.
• Password hashing using industry-standard algorithms — phiwin stores salted hashes of passwords, not plain text.
• Multi-factor authentication (2FA) available to all players for account login security.
• Role-based access controls limiting phiwin staff access to personal data strictly to those with a legitimate operational need.
• Firewalls, intrusion detection systems, and regular penetration testing of the phiwin platform.
• Segregation of player funds from operational accounts to protect financial data integrity.
• Regular security training for all phiwin staff with access to personal data.
• A documented data breach response procedure, including NPC notification within the timeframes required by the Data Privacy Act where a breach poses a risk to player rights and freedoms.

Under Republic Act No. 10173 (Data Privacy Act of 2012), as a Filipino data subject you have the following rights with respect to your personal data held by phiwin:

To exercise any of the above rights, contact phiwin's Data Protection Officer at [email protected] with the subject line "Data Privacy — Rights Request." phiwin will respond within 15 working days. If you are unsatisfied with phiwin's response, you may lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

phiwin does not knowingly collect personal data from individuals below the age of 21 years. Access to phiwin is restricted to individuals aged 21 and above in compliance with PAGCOR's minimum age requirements for online gambling in the Philippines. All registration attempts undergo age verification as part of the KYC process.

If phiwin becomes aware that personal data has been collected from an individual under 21 years of age, phiwin will immediately close the account, delete the associated personal data (subject to any regulatory retention requirements), and void any transactions processed through that account. Parents or guardians who believe a minor may have registered on phiwin should contact support immediately at [email protected].

phiwin reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, NPC guidance, PAGCOR regulatory requirements, or phiwin's data processing practices. Material changes will be communicated to registered players via email or an in-platform notification prior to the changes taking effect, except where an immediate update is required to comply with a legal obligation.

The "Last Updated" date at the top of this page indicates when the most recent revision was made. We encourage you to review this Policy periodically. Continued use of the phiwin platform following any amendments constitutes acceptance of the revised Policy.

For all data privacy inquiries, requests to exercise your rights under the Data Privacy Act, or concerns about phiwin's data processing practices, please contact phiwin's Data Protection Officer using the following channels:

• Email: [email protected] — Subject line: "Data Privacy — [Type of Request]"
• Live Chat: Available 24/7 on the phiwin website. For data privacy requests requiring formal documentation, email is preferred.

phiwin's support team is available in Tagalog and English, serving players across the Philippines from Metro Manila, Cebu, Davao, and beyond. Formal data subject requests will receive a written response within 15 working days. Where additional time is required due to the complexity of a request, phiwin will notify you within the initial 15-day period with an estimated completion date.

If you believe phiwin has violated your data privacy rights and phiwin's internal process has not resolved the matter to your satisfaction, you have the right to file a complaint with the National Privacy Commission of the Philippines.