winphp Privacy Policy

1. Introduction & Scope

winphp ("winphp," "we," "us," "our") operates the online gaming platform at winphp.co, a PAGCOR-licensed gaming destination serving Filipino players across the Philippines. This Privacy Policy ("Policy") governs our collection, use, storage, disclosure, and protection of personal data in connection with:

• Registration and maintenance of player accounts on the winphp Platform;
• Deposits, withdrawals, and all financial transactions processed through the Platform;
• KYC identity and age verification conducted pursuant to PAGCOR and AMLA requirements;
• Gameplay activity, including game history, bet records, and session data;
• Customer support communications and dispute resolution;
• Responsible gaming tools, self-exclusion requests, and related services;
• Marketing and promotional communications, where consent has been provided;
• General browsing and navigation of the winphp website.

This Policy applies to all individuals whose personal data is processed by winphp, including registered Players, prospective Players who begin but do not complete registration, and visitors who browse winphp.co without registering.

This Policy should be read together with winphp's Terms & Conditions, which incorporate this Policy by reference. In the event of any conflict between this Policy and the Terms & Conditions regarding the handling of personal data, this Policy shall prevail.

---

2. Data Controller

2.1 For the purposes of the Philippine Data Privacy Act of 2012 (RA 10173) and its implementing rules and regulations, winphp acts as the Personal Information Controller (PIC) in respect of the personal data it collects and processes on the winphp Platform.

2.2 winphp has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and with RA 10173. The DPO's contact details are set out in Section 14 of this Policy.

2.3 Where winphp engages third-party service providers to process personal data on its behalf — such as payment processors, game software providers, cloud hosting services, and customer support platforms — those parties act as Personal Information Processors (PIP) and are contractually bound to process data only on winphp's documented instructions and in accordance with applicable Philippine data protection law.

---

3. Data We Collect

winphp collects the following categories of personal data in connection with the Platform:

3.1 Identity & Contact Data

• Full legal name as it appears on your government-issued Philippine ID;
• Date of birth;
• Philippine mobile number;
• Email address (if provided);
• Residential address;
• Nationality.

3.2 Identity Verification (KYC) Data

• Copy of government-issued Philippine identification documents (PSA National ID, UMID, passport, driver's license, PRC ID, or equivalent);
• Facial photograph or selfie submitted for liveness verification;
• Source-of-funds documentation where required by PAGCOR or AMLA compliance thresholds.

3.3 Financial & Transaction Data

• GCash or Maya account mobile number;
• Bank account details (where bank transfer is used for deposits or withdrawals);
• Transaction history: deposit amounts, withdrawal amounts, dates, and reference numbers;
• Account balance at any given time;
• Cryptocurrency wallet addresses (where USDT is used).

3.4 Gameplay & Account Activity Data

• Game session records: games played, stakes placed, outcomes, and timestamps;
• Sports betting records: events wagered on, odds accepted, and settlement outcomes;
• Bonus and promotional activity: bonuses claimed, wagering progress, and expiry;
• Responsible gaming settings: deposit limits set, self-exclusion periods, and cooling-off history.

3.5 Technical & Device Data

• IP address at time of login and during active sessions;
• Device type, operating system, and browser version;
• Session duration and navigation patterns on the Platform;
• Cookie identifiers and similar tracking data (see Section 7).

3.6 Communications Data

• Records of customer support interactions (chat transcripts, email correspondence);
• Feedback and survey responses where submitted voluntarily;
• Any personal data contained in communications you send to winphp.

---

4. How We Collect Data

winphp collects personal data through the following mechanisms:

• Direct submission by you: Registration forms, KYC document uploads, deposit and withdrawal requests, customer support contacts, and responsible gaming tool activations;
• Automated technical collection: Cookies, session tokens, server logs, and analytics tools that record your interactions with the Platform (see Section 7);
• Payment processors: GCash, Maya, BPI, BDO, Metrobank, and other payment partners transmit transaction-related data to winphp to facilitate cashier operations;
• Identity verification providers: Third-party KYC and document verification services that process ID images and biometric data on winphp's behalf;
• Regulatory sources: PAGCOR, the Anti-Money Laundering Council (AMLC), and other Philippine regulatory bodies may share data with winphp pursuant to legal obligations;
• Fraud and risk intelligence services: winphp may receive risk signals from third-party fraud prevention platforms in connection with account security monitoring.

---

5. Purpose & Legal Basis for Processing

The following table sets out the primary purposes for which winphp processes personal data and the applicable legal basis under RA 10173 and related regulations:

---

6. Data Sharing & Disclosure

winphp does not sell, rent, or trade your personal data to third parties for marketing or commercial purposes. winphp may share your personal data with the following categories of recipients where necessary for the purposes described in Section 5:

• PAGCOR: As the licensing and regulatory authority for winphp, PAGCOR has the right to access player data as part of its regulatory oversight functions. This is a mandatory legal obligation;
• Anti-Money Laundering Council (AMLC): winphp is required under the Anti-Money Laundering Act (RA 9160) and its amendments to file covered transaction reports and suspicious transaction reports with the AMLC where applicable thresholds are triggered;
• Payment processors: GCash, Maya, BPI, BDO, Metrobank, and other financial institutions receive the minimum personal data necessary to process deposits and withdrawals on your behalf;
• Game software providers: Licensed game studios and live dealer platform operators receive player session identifiers and bet data for game delivery and settlement purposes. They do not receive full identity data;
• Identity verification (KYC) providers: Third-party document verification services process ID images and facial data solely for the purpose of completing KYC and age verification on winphp's behalf;
• Cloud infrastructure and hosting providers: winphp's Platform infrastructure is hosted on secure cloud platforms. Hosting providers may have incidental access to data in the course of providing infrastructure services but are contractually prohibited from using it for any other purpose;
• Legal and law enforcement authorities: winphp may disclose personal data to Philippine courts, law enforcement agencies, or other government authorities where required by applicable law, court order, or legal process.

All third-party data processors engaged by winphp are subject to data processing agreements that require them to implement appropriate technical and organizational security measures and to process personal data only on winphp's documented instructions.

---

7. Cookies & Tracking Technologies

7.1 What Are Cookies? Cookies are small text files placed on your device by websites you visit. winphp uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyze usage patterns.

7.2 Types of Cookies Used by winphp:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without breaking core Platform functionality;
• Functional Cookies: Remember your preferences such as language settings, lobby display options, and last-visited game categories;
• Analytics Cookies: Collect aggregated, anonymized data about how Players navigate the Platform — which pages are visited, where Players encounter errors, and how long sessions last. This data helps winphp improve the Platform experience;
• Security Cookies: Support fraud detection and account security monitoring by tracking login patterns and flagging anomalous session behavior.

7.3 Cookie Control. You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not affect your ability to access the core winphp Platform, but may affect the availability of certain convenience features.

---

8. Retention Periods

winphp retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to the following minimum retention obligations:

• Account and identity data: Retained for the duration of the active account relationship, plus a minimum of five (5) years following account closure, in accordance with PAGCOR record-keeping requirements;
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, as required by PAGCOR regulations and the Anti-Money Laundering Act;
• KYC documents: Retained for a minimum of five (5) years following account closure or the completion of the business relationship, per AMLA implementing rules;
• Customer support records: Retained for three (3) years from the date of the interaction, or longer where the matter relates to an unresolved dispute;
• Marketing consent records: Retained from the time consent is given until it is withdrawn, plus an additional twelve (12) months as evidence of consent.

Following the applicable retention period, personal data is securely deleted or anonymized using industry-standard methods. Anonymized data (which cannot identify you) may be retained indefinitely for platform analytics and regulatory reporting purposes.

---

9. Security Measures

winphp implements a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, or destruction:

• Encryption in transit: All data transmitted between your device and winphp's servers is encrypted using TLS 1.2 or higher (256-bit SSL);
• Encryption at rest: Sensitive personal data — including KYC documents, financial records, and password hashes — is encrypted at rest using AES-256 encryption;
• Access controls: Access to production systems containing personal data is restricted to authorized winphp personnel on a need-to-know basis. Multi-factor authentication is required for all privileged access;
• Penetration testing: winphp's Platform and infrastructure undergo regular third-party penetration testing and vulnerability assessments;
• Incident response: winphp maintains a documented data breach response plan. In the event of a personal data breach that creates a real risk to data subjects, winphp will notify the National Privacy Commission (NPC) within 72 hours of discovery, as required by NPC Circular 16-03;
• Staff training: All winphp staff who handle personal data receive mandatory training on data privacy obligations and security best practices.

---

10. Your Data Rights

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by winphp. These rights may be exercised by contacting winphp's Data Protection Officer at the details set out in Section 14:

winphp will acknowledge all data rights requests within five (5) business days and aim to fulfil them within thirty (30) calendar days. Where a request is complex or numerous, this period may be extended by a further thirty (30) days, with notice to you.

---

11. Children & Minors

The winphp Platform is strictly for individuals aged twenty-one (21) years and above, as required by PAGCOR regulations applicable to casino-style online gaming in the Philippines. winphp does not knowingly collect personal data from individuals under the age of 21.

All accounts are subject to age verification during KYC. Where winphp discovers that an account has been registered by an individual below the age of 21 — or by a parent or guardian on behalf of a minor — the account will be immediately closed, any remaining balance returned to the verified payment source (after deduction of fraudulently obtained promotional credits), and the matter reported to PAGCOR as required.

---

12. Cross-Border Data Transfers

12.1 winphp's primary data processing operations are based in the Philippines. However, some of winphp's third-party service providers — including cloud infrastructure providers, game content studios, and fraud prevention services — may be located outside the Philippines and may process your personal data in their home jurisdictions.

12.2 Where personal data is transferred outside the Philippines, winphp ensures that such transfers are subject to appropriate safeguards as required by RA 10173 and NPC regulations, including the use of data processing agreements that incorporate adequate data protection requirements equivalent to those applicable in the Philippines.

12.3 winphp does not transfer your KYC documents or government-issued ID copies to entities outside the Philippines except where expressly required by law or by a PAGCOR directive.

---

13. Changes to This Privacy Policy

winphp reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or Platform features. The "Last Updated" date at the top of this Policy will be revised accordingly.

Material changes to this Policy — particularly changes that affect your data rights or the purposes for which we process your data — will be communicated to you via the mobile number or email address registered to your winphp Account, and/or through a prominent notice on the Platform. Your continued use of the winphp Platform after the effective date of any revised Policy constitutes your acceptance of the changes.

If you disagree with any material change to this Policy, you have the right to close your winphp Account and request deletion of your personal data, subject to our regulatory retention obligations described in Section 8.

---

14. Contact the Data Protection Officer

For any questions, requests, or concerns related to this Privacy Policy, or to exercise any of your data rights under RA 10173, please contact winphp's designated Data Protection Officer:

If you are not satisfied with winphp's response to your data rights request or complaint, you have the right to escalate your concern to the National Privacy Commission (NPC) of the Philippines, the supervisory authority for data protection in the Philippines.