pwin Privacy Policy

pwin operates the online gaming platform accessible at pwin.vu (the "Platform"). In this Privacy Policy, references to "pwin," "we," "us," or "our" mean the entity operating the pwin Platform and responsible for the processing of your personal information in connection with your use of our services.

pwin operates under the PAGCOR (Philippine Amusement and Gaming Corporation) regulatory framework and is subject to the data protection obligations applicable to regulated gaming operators in the Philippines, including the requirements of Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its implementing rules and regulations.

This Privacy Policy applies to all personal information collected, processed, stored, or shared by pwin in connection with your use of the Platform, including but not limited to account registration, identity verification (KYC), deposits and withdrawals, gameplay activity, bonus participation, customer support interactions, and marketing communications.

This Policy applies to all users of the Platform, including registered Account holders, visitors browsing pwin.vu without an account, and any person contacting pwin's support team. It does not apply to third-party websites, services, or platforms that may be linked from the pwin Platform; you should review the privacy policies of those third parties independently.

By registering an Account or using the Platform, you acknowledge that you have read, understood, and consent to the collection and use of your personal information as described in this Policy. If you do not agree with any part of this Policy, you should not create an Account or continue to use the Platform.

pwin collects the following categories of personal information from and about you:

• Full legal name as it appears on your government-issued identification;
• Date of birth (to verify you are at least 21 years of age as required by PAGCOR regulations);
• Philippine mobile number or email address used for registration and communications;
• Residential address (required for KYC verification and regulatory compliance);
• Copies of government-issued photo identification (e.g., SSS card, PhilHealth ID, passport, driver's licence, UMID) submitted during the KYC process;
• Selfie photographs submitted for biometric comparison during identity verification.

• Payment method details (e.g., GCash registered mobile number, Maya account reference, BPI/BDO/Metrobank account details for bank transfer verification — noting that pwin does not store full card or bank account numbers directly);
• Transaction records including deposits, withdrawals, and wager history;
• Account Balance information;
• Records of any disputes, chargebacks, or financial investigations.

• Game session logs including game type, wager amounts, results, and timestamps;
• Bonus and promotion participation records;
• Responsible gaming tool usage (e.g., deposit limit settings, self-exclusion requests);
• Customer support interaction logs and communications history.

• IP address and approximate geolocation derived therefrom;
• Device type, operating system, and browser type and version;
• Session identifiers and authentication tokens;
• Platform access logs including login times, durations, and page navigation data.

pwin collects your personal information through the following methods:

• Directly from you: When you register an Account, complete the KYC process, make a deposit or withdrawal, contact customer support, participate in promotions, or update your account settings;
• Automatically during your use of the Platform: Through server logs, cookies, session tracking technologies, and analytics tools that record your interactions with pwin.vu;
• From payment service providers: Transaction confirmation data and payment verification responses from GCash, Maya, BPI, BDO, Metrobank, and other integrated payment processors;
• From identity verification services: Results of document authentication and biometric verification performed by pwin's KYC service partners;
• From fraud prevention and AML services: Risk flags, politically exposed person (PEP) screening results, and sanction list checks performed in connection with your account and transactions.

pwin uses your personal information for the following purposes:

• Account management: To create, maintain, verify, and administer your pwin Account;
• Identity verification and KYC compliance: To verify your age (21+ requirement), identity, and eligibility in accordance with PAGCOR regulatory requirements and the Data Privacy Act of 2012;
• Payment processing: To process deposits and withdrawals via GCash, Maya, bank transfer, and other accepted payment methods;
• Gaming services: To provide and record game sessions, calculate outcomes, apply bonus wagering progress, and manage your Account Balance;
• Customer support: To respond to enquiries, resolve disputes, and provide assistance via live chat, email, Viber, and Messenger channels;
• Legal and regulatory compliance: To comply with PAGCOR obligations, anti-money laundering (AML) requirements, and applicable Philippine law, including record-keeping mandates;
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, unauthorized account access, cheating, and other prohibited conduct;
• Responsible gaming: To monitor gaming behaviour for indicators of problem gambling, enforce self-exclusion requests, and apply player-set account limits;
• Marketing and communications: Where you have provided consent, to send promotional offers, bonus notifications, and platform updates via your registered contact details;
• Platform improvement: To analyse aggregate usage data, improve platform performance, and develop new features and game categories based on player behaviour trends.

pwin processes your personal information on the following legal bases as provided under the Data Privacy Act of 2012 and its implementing rules:

• Consent: Where you have provided explicit, informed consent to the processing of your personal information for a specific purpose, such as receiving marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing;
• Performance of a contract: Where processing is necessary to perform our obligations under the pwin Terms & Conditions, including account management, game provision, and payment processing;
• Compliance with a legal obligation: Where processing is necessary to comply with applicable Philippine laws, PAGCOR regulatory requirements, AML obligations, and tax or financial reporting requirements;
• Legitimate interests: Where processing is necessary for pwin's legitimate interests, including fraud detection, platform security, responsible gaming monitoring, and service improvement — provided those interests are not overridden by your privacy rights and interests.

pwin does not sell your personal information to third parties. We share your personal information only in the following limited circumstances:

pwin engages trusted third-party service providers to perform functions on our behalf, including payment processing (GCash, Maya, banking partners), identity verification and KYC services, fraud detection and AML screening, IT infrastructure and hosting, and customer support software. These providers are contractually bound to process your data only on pwin's instructions and in accordance with applicable privacy obligations.

Where required for the provision of specific games — particularly live dealer and networked jackpot games — limited game session data may be shared with the relevant game provider for the purpose of game operation, dispute resolution, and jackpot administration.

pwin is required by law to share certain information with PAGCOR and other competent Philippine government authorities upon lawful request, including for regulatory audits, investigations, AML reporting, and court orders. pwin will comply with such requirements and, where legally permissible, will notify you of disclosures made.

In the event of a merger, acquisition, restructuring, or sale of all or a material part of pwin's business assets, your personal information may be transferred to the acquiring entity, subject to equivalent privacy protections. You will be notified of any such transfer where required by applicable law.

pwin retains your personal information for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and PAGCOR regulatory obligations. Specific retention periods are as follows:

• Account and KYC records: Retained for a minimum of five (5) years following Account closure, as required by PAGCOR and applicable AML regulations;
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, for regulatory, financial, and dispute-resolution purposes;
• Game session logs: Retained for a minimum of three (3) years for dispute resolution and responsible gaming monitoring;
• Customer support communications: Retained for a minimum of two (2) years following closure of the relevant case;
• Marketing preference records: Retained until you withdraw consent or close your Account, whichever is earlier.

After the applicable retention period, personal information is securely deleted or anonymised in accordance with pwin's data management procedures. Where anonymisation is applied, the resulting data is no longer personal information and may be retained indefinitely for analytical purposes.

pwin uses cookies and similar tracking technologies on the Platform to provide a functional, secure, and personalised experience. Cookies are small data files stored on your device by your browser when you access pwin.vu.

• Essential cookies: Required for core Platform functionality including login session management, security tokens, and load balancing. These cannot be disabled without impairing Platform operation;
• Functional cookies: Used to remember your preferences such as preferred language and interface settings;
• Analytics cookies: Used to collect aggregate data about Platform usage, including pages visited, session duration, and navigation paths, to help pwin improve the Platform experience;
• Security cookies: Used to detect and prevent fraudulent login attempts and other security threats.

You may control cookie settings through your browser preferences. Disabling non-essential cookies will not prevent you from accessing the Platform but may affect the functionality of certain features. Disabling essential cookies may prevent you from logging in or using core Platform services.

pwin implements a range of technical and organisational security measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL (Secure Sockets Layer) encryption for all data transmitted between your browser and pwin's servers;
• Encryption of sensitive stored data, including KYC documents and financial records, using industry-standard encryption protocols;
• Role-based access controls limiting internal access to personal information to authorised personnel on a need-to-know basis;
• Regular security audits and penetration testing of the Platform and its underlying infrastructure;
• Two-factor authentication (2FA) available to users for enhanced account security;
• Automated anomaly detection systems that flag and respond to suspicious login activity or unusual transaction patterns in real time.

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal information held by pwin:

• Right to be Informed: The right to be notified of how your personal information is being collected and processed;
• Right of Access: The right to request a copy of the personal information pwin holds about you;
• Right to Rectification: The right to have inaccurate or incomplete personal information corrected;
• Right to Erasure: The right to request deletion of your personal information, subject to pwin's legal retention obligations;
• Right to Object: The right to object to processing of your personal information for direct marketing purposes or on the basis of legitimate interests;
• Right to Data Portability: The right to receive your personal information in a structured, commonly used, and machine-readable format;
• Right to Withdraw Consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal;
• Right to File a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

To exercise any of the above rights, please contact pwin's Data Privacy Officer via the contact details in Section 16. pwin will respond to verified data requests within thirty (30) days of receipt, or within the period permitted by applicable law where a longer period is required.

The pwin Platform is strictly for adults aged 21 years and above, consistent with PAGCOR's minimum age requirements for casino-style gaming in the Philippines. pwin does not knowingly collect personal information from individuals under the age of 21.

If pwin discovers or is informed that it has inadvertently collected personal information from a person under the age of 21, pwin will take immediate steps to delete that information and close the associated Account. Any funds deposited by a person under 21 will be returned to the payment source after identity verification, less any applicable regulatory reporting obligations.

The pwin Platform integrates services provided by third parties, including payment processors (GCash, Maya, BPI, BDO, Metrobank), game software providers, and customer communication platforms. These third parties may process your personal information subject to their own privacy policies.

pwin has agreements in place with all significant third-party service providers requiring them to process your data securely and only for the purposes specified by pwin. However, pwin is not responsible for the privacy practices of third-party websites or services that you may access independently through links on the Platform. You should review the applicable privacy policies of those services directly.

In the course of providing services to you, pwin may transfer your personal information to service providers, game studios, or infrastructure partners located outside of the Philippines. Where such international data transfers occur, pwin takes steps to ensure that appropriate safeguards are in place in accordance with the Data Privacy Act of 2012 and its implementing rules, including contractual data processing agreements that impose equivalent data protection standards on the recipient.

pwin will not transfer your personal information to jurisdictions that do not provide an adequate level of data protection without your explicit consent or without implementing appropriate contractual safeguards.

pwin reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or regulatory requirements. Where changes are material, pwin will notify you by email to your registered address or by displaying a prominent notice on the Platform prior to the changes taking effect.

The current version of this Privacy Policy will always be accessible at pwin.vu/privacy-policy. The "Last Updated" date at the top of this document reflects the date of the most recent revision. Your continued use of the Platform following any update constitutes your acceptance of the revised Policy.

If you have any questions about this Privacy Policy, wish to exercise any of your rights under the Data Privacy Act of 2012, or wish to submit a data access, correction, or erasure request, you may contact pwin through the following channels:

• Data Privacy Officer: support at pwin.vu (plain text — not a clickable link), marked "Attention: Data Privacy Officer";
• Live Chat: Available on all pages of the Platform, 24 hours a day, 7 days a week — Tagalog and English support agents available;
• Viber & Messenger: Available via the official pwin page.

pwin will acknowledge all data privacy requests within five (5) business days and aim to resolve requests within thirty (30) calendar days. Where additional time is required, we will inform you of the extended timeline and the reason for the delay.