phwin2 Privacy Policy

This Privacy Policy ("Policy") is published by phwin2 ("phwin2," "we," "us," or "our") and governs the collection, processing, storage, and use of personal data obtained from users ("you," "Player," or "User") of the phwin2 online gaming platform accessible at phwin2.net, including all associated mobile interfaces, customer support channels, and marketing communications.

phwin2 is committed to the protection of personal data in full compliance with Republic Act No. 10173, known as the Data Privacy Act of 2012 of the Philippines, and the implementing rules and regulations issued thereunder by the National Privacy Commission (NPC). This Policy is designed to give you clear and transparent information about how your personal data is handled at phwin2 at every stage of your relationship with us — from the moment you register a phwin2 account through to the closure of that account and beyond.

This Policy should be read alongside the phwin2 Terms and Conditions, which also form part of your agreement with phwin2. In the event of any conflict between the Terms and Conditions and this Privacy Policy on matters relating to personal data, the Privacy Policy shall prevail.

phwin2 collects and processes the following categories of personal data depending on how you interact with the phwin2 platform:

phwin2 collects personal data through the following channels and mechanisms:

• Direct submission — data you voluntarily provide when registering a phwin2 account, completing KYC verification, submitting a deposit or withdrawal request, contacting phwin2 customer support, or responding to a phwin2 promotion.
• Automated technical collection — data collected automatically when you access the phwin2 platform, including IP address, device identifiers, browser fingerprint, and session activity logs generated by phwin2's platform infrastructure.
• Payment providers — transaction confirmation data received from GCash, Maya, BPI, BDO, Metrobank, and other payment partners when you make a deposit or initiate a withdrawal from your phwin2 account.
• Identity verification partners — identity and document verification data received from phwin2's authorised KYC service providers where automated document checks are conducted.
• Cookies and tracking technologies — session cookies, analytics cookies, and similar technologies operating on the phwin2 platform as described in Section 7 of this Policy.

phwin2 uses the personal data collected from Filipino players and all other phwin2 account holders for the following purposes:

Under the Data Privacy Act of 2012, phwin2 processes your personal data on one or more of the following lawful bases:

• Contractual necessity — processing is necessary to perform the phwin2 Terms and Conditions agreement with you, including delivering gaming services, processing payments, and managing your phwin2 account.
• Legal obligation — processing is required for phwin2 to comply with applicable Philippine laws including the AMLA, PAGCOR regulatory requirements, and NPC data privacy obligations.
• Legitimate interests — processing is necessary for phwin2's legitimate business interests in fraud prevention, platform security, and improving the quality of the phwin2 service, provided these interests are not overridden by your data protection rights.
• Consent — for marketing communications and non-essential cookies, phwin2 relies on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

phwin2 does not sell, rent, or share your personal data with third parties for their own independent commercial purposes. phwin2 may share personal data with the following categories of authorised third parties strictly for the purposes described:

• Payment service providers — GCash, Maya, BPI, BDO, Metrobank, and other payment partners receive transaction data necessary to process your deposits and withdrawals.
• KYC and identity verification providers — authorised partners receive identity document data solely for the purpose of completing age and identity verification in line with phwin2's regulatory KYC obligations.
• Game software providers — game providers operating within the phwin2 platform may receive pseudonymised gameplay data necessary to deliver and maintain game functionality.
• Regulatory and law enforcement authorities — phwin2 is obligated to disclose personal data to PAGCOR, the AMLC, the NPC, or other competent Philippine authorities upon lawful request, court order, or where required by applicable regulation.
• Cloud infrastructure and IT service providers — hosting, security, and analytics service providers operating under binding data processing agreements with phwin2 that mandate compliance with the Data Privacy Act of 2012.

All third parties with whom phwin2 shares personal data are required to handle that data in accordance with applicable Philippine data privacy law and phwin2's data processing standards. phwin2 remains responsible for ensuring that any personal data shared with third parties is adequately protected.

The phwin2 platform uses cookies and similar tracking technologies to ensure the platform operates correctly, to remember your preferences, to keep your session secure, and to analyse how the platform is used so that phwin2 can continue to improve the player experience.

• Strictly necessary cookies — required for the phwin2 platform to function, including session authentication, security tokens, and load balancing. These cannot be disabled.
• Functional cookies — remember your language preferences, display settings, and responsible gaming limits so you do not have to re-enter them on each visit.
• Analytics cookies — collect anonymised and aggregated data about how players navigate the phwin2 platform, which pages are most visited, and where players encounter difficulties. This data is used solely to improve the platform.
• Marketing cookies — used only where you have given consent, to deliver phwin2 promotional messages relevant to your gaming activity and interests.

You can manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from accessing certain features of the phwin2 platform, including account login and game access.

phwin2 retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

Upon expiry of the applicable retention period, phwin2 will securely delete or permanently anonymise your personal data so that it can no longer be attributed to you. Where data must be retained beyond these periods due to an ongoing legal dispute, regulatory investigation, or court order, phwin2 will retain that data until the matter is fully resolved.

phwin2 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, disclosure, or alteration. These measures include, but are not limited to:

• AES-256 encryption for all personal data stored in phwin2's databases
• TLS 1.3 encryption for all data transmitted between your device and phwin2's servers
• Multi-factor authentication requirements for phwin2 account login and high-value transactions
• Role-based access controls limiting internal access to personal data to authorised phwin2 personnel only
• Regular vulnerability assessments, penetration testing, and security audits of the phwin2 platform
• 24/7 automated intrusion detection and security incident monitoring
• Documented data breach response procedures in compliance with NPC notification requirements

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, phwin2 will notify the National Privacy Commission and affected individuals within the timeframes required under the Data Privacy Act of 2012 and NPC Circular No. 16-03.

As a data subject under the Data Privacy Act of 2012 of the Philippines, you hold the following rights with respect to your personal data held by phwin2:

• Right to be Informed — You have the right to be told what personal data phwin2 holds about you, how it is used, how long it is retained, and with whom it is shared. This Privacy Policy serves as the primary means by which phwin2 fulfils this obligation.
• Right of Access — You may request a copy of the personal data that phwin2 holds about you at any time. phwin2 will provide this information within 15 business days of receiving a valid, verified data subject access request.
• Right to Rectification — If any personal data that phwin2 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic account information directly through your phwin2 account settings at any time.
• Right to Erasure — You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected and no overriding legal obligation requires its retention. Note that AMLA and PAGCOR regulatory obligations mean that certain financial and identity data must be retained for the periods described in Section 8.
• Right to Object — You have the right to object to phwin2's processing of your personal data for direct marketing purposes at any time. You may also object to processing carried out on the basis of legitimate interests where your particular circumstances warrant it.
• Right to Data Portability — You may request a copy of the personal data you provided to phwin2 in a structured, commonly used, and machine-readable format, where technically feasible.
• Right to File a Complaint — If you believe phwin2 has processed your personal data unlawfully or in breach of the Data Privacy Act of 2012, you have the right to lodge a complaint with the National Privacy Commission (NPC) at privacy.gov.ph.

To exercise any of the above rights, please contact phwin2's Data Protection Officer using the contact details set out in Section 14 of this Policy. phwin2 may request proof of identity before processing a data subject rights request in order to protect your data from unauthorised disclosure.

The phwin2 platform is strictly intended for adults aged 21 years and above in accordance with Philippine gambling regulations. phwin2 does not knowingly collect personal data from individuals under the age of 21.

phwin2 implements age verification controls as part of the account registration process and conducts KYC age verification before any account is approved for real-money gaming. Where phwin2 discovers that personal data has been collected from a person under the age of 21, phwin2 will immediately suspend the account, delete the data, and return any funds deposited, in accordance with applicable regulations.

phwin2 operates primarily within the Philippines and stores the majority of player data on servers located within the region. In limited circumstances, phwin2 may transfer personal data to service providers or technology partners whose infrastructure is located outside the Philippines — for example, cloud hosting providers or game software suppliers operating international data centres.

Where such transfers occur, phwin2 ensures that adequate safeguards are in place to protect your personal data to a standard equivalent to that required under the Data Privacy Act of 2012. These safeguards include binding contractual obligations on recipient organisations, standard contractual clauses approved by the NPC, and assessments of the data protection framework in the recipient country prior to any transfer being made.

phwin2 does not transfer personal data to jurisdictions that do not offer an adequate level of data protection without ensuring that appropriate contractual safeguards are in place.

phwin2 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable Philippine law, NPC guidance, phwin2's data processing practices, or the services offered on the phwin2 platform. The "Last Updated" date at the top of this Policy will be revised each time a material change is made.

Where changes are material — meaning they significantly affect how phwin2 processes your personal data or affect your rights as a data subject — phwin2 will notify registered players via email to the address on file for their phwin2 account, or via a prominent notice on the phwin2 platform, at least 7 days before the changes take effect. Your continued use of the phwin2 platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the revised terms.

phwin2 encourages you to review this Privacy Policy periodically to stay informed about how your personal data is being protected. Archived versions of previous Privacy Policy editions are available upon request by contacting phwin2's Data Protection Officer.

phwin2 has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. If you have any questions, concerns, or requests relating to your personal data or phwin2's data privacy practices, please contact the phwin2 DPO using the following details:

If you are not satisfied with phwin2's response to your data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines. The NPC handles complaints from data subjects regarding potential violations of the Data Privacy Act of 2012. Further information is available at the NPC's official website.