phiwin Privacy Policy

1Introduction

phiwin ("phiwin," "we," "us," or "our") is committed to protecting the privacy and personal data of every Filipino player and visitor who interacts with our platform at phiwin.cam. This Privacy Policy ("Policy") is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations as administered by the National Privacy Commission (NPC) of the Philippines.

This Policy explains: what categories of personal data phiwin collects; the purposes for which that data is processed; the legal bases we rely upon; with whom data may be shared; how long it is retained; the security measures in place; and the rights available to you as a data subject under Philippine law.

By creating a phiwin account, using the phiwin platform, or submitting any personal information through phiwin.cam, you acknowledge that you have read this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, please do not use the phiwin platform.

2Data Controller Identity

For the purposes of the Data Privacy Act of 2012, phiwin is the Personal Information Controller with respect to all personal data collected through phiwin.cam and its associated services. phiwin has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable data protection legislation.

Inquiries, data subject requests, and complaints relating to privacy and personal data processing may be directed to phiwin's DPO using the contact information set out in Section 15 of this Policy.

3Personal Data We Collect

phiwin collects the following categories of personal data from players and platform users:

3.1 Registration and Identity Data

• Full legal name as it appears on government-issued identification
• Date of birth (required for 21+ age verification under PAGCOR regulations)
• Residential address (city, province, postal code — Philippines)
• Philippine mobile number and/or email address
• Username and encrypted password credential

3.2 Know Your Customer (KYC) and Verification Data

• Government-issued photo identification document (PhilSys National ID, Philippine passport, driver's licence, SSS card, or UMID) — image copy
• Selfie photograph submitted at time of KYC
• Proof of payment method ownership where requested
• Source of funds declarations where required by AML obligations

3.3 Financial and Transaction Data

• Deposit and withdrawal amounts, dates, and associated payment method references
• GCash or PayMaya account reference numbers (we do not store full wallet credentials)
• Bank account details submitted for bank transfer withdrawals
• Transaction history and account balance records

3.4 Gaming Activity Data

• Game session records, bet histories, win/loss outcomes, and game duration
• Sports betting wager records including event, market, odds, and stake
• Bonus and promotion participation and wagering progress records
• Responsible gaming tool settings (deposit limits, self-exclusion status)

3.5 Technical and Device Data

• IP address and approximate geographic location at time of login or transaction
• Device type, operating system, browser type and version
• Session timestamps, login history, and session duration
• Cookies and similar tracking technology data (see Section 10)

3.6 Communications Data

• Records of live chat support conversations with phiwin's customer service team
• Email correspondence submitted to [email protected]
• Complaint and dispute records
• Player preferences and marketing communication opt-in/opt-out records

4How We Collect Personal Data

phiwin collects personal data through the following channels and mechanisms:

• Directly from you — when you register, complete KYC, make deposits or withdrawals, contact support, or update your account settings on phiwin.cam
• Automatically through the platform — device data, IP address, session data, and cookies collected when you access phiwin.cam (see Section 10)
• From payment service providers — transaction confirmation data received from GCash, PayMaya, BPI, BDO, and Metrobank when processing your payments
• From identity verification partners — results and confidence scores from KYC verification processes performed by phiwin's accredited third-party identity verification provider
• From PAGCOR and regulatory authorities — where required for compliance with gaming licence conditions or anti-money laundering obligations

5How phiwin Uses Your Personal Data

phiwin processes your personal data for the following specific purposes:

5.1 Account Management and Platform Operation

To create, maintain, and operate your phiwin player account; to authenticate your identity at login; to process deposits and withdrawals; to provide access to all game categories; and to maintain accurate records of your gaming activity.

5.2 Regulatory Compliance

To fulfil phiwin's obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA) and its amendments, the Data Privacy Act of 2012, and other applicable Philippine laws and regulations — including mandatory reporting obligations and record retention requirements.

5.3 Identity Verification and Fraud Prevention

To verify that all players are at least 21 years of age as required by PAGCOR; to verify identity documents submitted during KYC; to detect, investigate, and prevent fraudulent activity, account abuse, money laundering, and other prohibited conduct.

5.4 Customer Support

To respond to your queries, complaints, and requests submitted via live chat or support email; to maintain records of support interactions for quality assurance and regulatory audit purposes.

5.5 Responsible Gaming

To implement and enforce player-configured responsible gaming tools including deposit limits, session reminders, cooling-off periods, and self-exclusion; to identify patterns of potentially problematic gambling behaviour and intervene appropriately in compliance with PAGCOR responsible gaming guidelines.

5.6 Platform Improvement and Analytics

To analyse aggregated and anonymised usage data to improve platform performance, identify technical issues, and develop new features. phiwin does not use individually identifiable data for analytics beyond what is necessary for operational and compliance purposes.

5.7 Marketing Communications (with consent)

To send promotional offers, new game announcements, and bonus notifications to players who have expressly opted in to marketing communications. You may opt out at any time through your phiwin account settings or by contacting support.

6Legal Basis for Processing

Under the Data Privacy Act of 2012, phiwin relies on the following legal bases for processing personal data:

• Contractual Necessity: Processing required to fulfil the player account agreement — account creation, game access, payment processing, and KYC verification
• Legal Obligation: Processing required to comply with PAGCOR licensing conditions, AMLA reporting obligations, tax record retention, and NPC registration requirements
• Legitimate Interest: Fraud detection, platform security, responsible gaming monitoring, and internal analytics — provided these interests are not overridden by your fundamental rights
• Consent: Marketing communications, non-essential cookie placement, and any processing not covered by the above bases — where your freely given, specific, informed, and unambiguous consent has been obtained

7Data Sharing and Disclosure

phiwin does not sell, rent, or trade your personal data to any third party for commercial purposes. phiwin may share personal data with the following categories of recipients only to the extent necessary for the stated purpose:

7.1 Payment Service Providers

Transaction data is shared with GCash, PayMaya, BPI, BDO, and Metrobank to process deposits and withdrawals. These providers receive only the information necessary to execute the specific transaction.

7.2 Identity Verification and KYC Partners

Identity document images and selfie photographs are transmitted to phiwin's accredited KYC verification provider for identity and age verification purposes. KYC partners are contractually bound to process this data only for the specified verification purpose and not to retain it beyond the period required for audit compliance.

7.3 PAGCOR and Regulatory Authorities

phiwin is required by its PAGCOR licence and by Philippine law to share certain player records and transaction data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other relevant government authorities upon lawful request or as mandated by reporting obligations.

7.4 Technology and Infrastructure Providers

phiwin's platform infrastructure, cloud hosting, and technical service providers may process personal data in the course of providing services to phiwin. All such providers are subject to contractual data processing agreements that prohibit use of personal data for any purpose other than providing services to phiwin.

7.5 Professional Advisors

Legal counsel, accountants, auditors, and other professional advisors may have access to personal data where strictly necessary and subject to professional confidentiality obligations.

8Data Retention

phiwin retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Account and identity data: Retained for the duration of the active account and for five (5) years following account closure, in compliance with PAGCOR record-keeping requirements
• KYC documents: Retained for five (5) years from the date of verification, or longer if required by AMLC or PAGCOR directives
• Financial and transaction records: Retained for five (5) years from the date of each transaction, consistent with AML and tax record obligations
• Gaming activity records: Retained for three (3) years from the date of each session
• Support communications: Retained for two (2) years from the date of the final communication in each case
• Marketing preferences and consent records: Retained until withdrawal of consent plus three (3) years for dispute resolution purposes
• Cookie and technical data: Retention varies by cookie type — see Section 10

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

9Data Security

phiwin implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include:

• SSL/TLS Encryption: All data transmitted between your device and phiwin.cam is encrypted via SSL/TLS, the same standard used by Philippine banking institutions
• Encryption at Rest: Sensitive personal data stored in phiwin's databases is encrypted using industry-standard algorithms
• Access Controls: Access to personal data is restricted to authorised phiwin employees and contractors who require it to perform their specific functions, and is governed by role-based access control policies
• OTP Authentication: Login from unrecognised devices triggers mandatory one-time password (OTP) verification via your registered mobile number
• Penetration Testing: phiwin's platform undergoes periodic security assessments by qualified third-party security professionals
• Incident Response: phiwin maintains a documented data breach response procedure in compliance with NPC Circular 16-03, including mandatory breach notification timelines

Notwithstanding the above, no method of electronic transmission or storage is completely secure. phiwin cannot guarantee absolute security but commits to promptly notifying affected users and the NPC in the event of a personal data breach that is likely to result in harm, as required by Philippine law.

10Cookies and Similar Technologies

phiwin uses cookies and similar technologies to operate and improve the platform, maintain your session, and provide a personalised experience. A cookie is a small text file placed on your device by a website server. phiwin uses the following categories of cookies:

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair platform functionality, including the ability to log in to your phiwin account. phiwin does not use third-party advertising cookies or share cookie data with ad networks.

11Your Data Subject Rights

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights with respect to your personal data held by phiwin. To exercise any of these rights, please contact phiwin's Data Protection Officer using the details in Section 15.

phiwin will respond to all data subject rights requests within fifteen (15) business days of receipt, as required by the DPA. In complex cases, this may be extended by a further thirty (30) days with notification. If you are unsatisfied with phiwin's response, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

12Minors and Age Restrictions

13Cross-Border Data Transfers

phiwin is a Philippines-based platform and stores the majority of player personal data on servers located within the Philippines. Where the use of specific technology service providers or KYC verification partners involves the transfer of personal data to jurisdictions outside the Philippines, phiwin will ensure that such transfers are conducted in accordance with the Data Privacy Act of 2012 and any relevant NPC guidelines on cross-border data transfers.

Specifically, personal data will only be transferred outside the Philippines to: countries or territories with an adequate level of data protection as determined by the NPC; or third-party recipients subject to contractual data transfer agreements incorporating NPC-approved data transfer mechanisms, including standard contractual clauses or binding corporate rules where applicable.

14Changes to This Privacy Policy

phiwin may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or platform features. Where changes are material — such as changes to the categories of data collected, the purposes for which data is used, or the rights available to you — phiwin will provide advance notice via the platform or to your registered email address not less than seven (7) days before the amended Policy takes effect.

For minor updates (clarifications, corrections of typographical errors, or non-substantive formatting changes), phiwin will update this Policy without advance notice and will update the "Last Updated" date accordingly. We encourage you to review this Policy periodically to stay informed of how phiwin protects your personal data.

Your continued use of the phiwin platform after a notified Policy change constitutes your acceptance of the updated Privacy Policy.

15Contact — Data Protection Officer

For all privacy-related enquiries, data subject rights requests, or complaints regarding phiwin's handling of your personal data, please contact phiwin's Data Protection Officer through the following channel:

• Live Chat: Available 24/7 via the chat widget on phiwin.cam — mark your message as "Privacy/DPO Request"
• Support Email: [email protected] — include "Privacy Policy" or "Data Subject Request" in your subject line

Please include in your request: your full name, your registered phiwin account mobile number or email, the nature of your request, and any relevant details. phiwin may request additional verification information to confirm your identity before processing a data subject request, to protect against unauthorised disclosure of personal data.