phwim Privacy Policy

1. Who We Are (Data Controller)

phwim ("phwim", "we", "us", "our") operates the online gaming platform accessible at phwim.win and its subdomains ("Platform"). phwim acts as the data controller in respect of the personal data of its registered users and visitors, meaning phwim determines the purposes for which and the means by which personal data is processed.

phwim operates under PAGCOR (Philippine Amusement and Gaming Corporation) regulatory oversight and is subject to the Republic Act No. 10173, also known as the Data Privacy Act of 2012 of the Philippines ("DPA") and its implementing rules and regulations. This Privacy Policy is issued in accordance with the DPA and PAGCOR's data handling requirements.

By creating an account on phwim or by using any feature of the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein.

2. Personal Data We Collect

phwim collects the following categories of personal data in connection with your use of the Platform:

phwim applies the principle of data minimisation — we collect only the data that is necessary for the stated purposes and do not collect data beyond what is reasonably required for the operation of a licensed online casino.

3. How We Collect Your Data

phwim collects personal data through the following means:

• Direct submission: Data you provide when registering an account, completing KYC, making a deposit or withdrawal request, contacting customer support, or completing a survey or feedback form;
• Automatic collection: Technical data collected automatically as you use the Platform, including via cookies, web beacons, and server logs (see Section 10);
• Third-party providers: Identity verification data from KYC partners; payment confirmation data from GCash, Maya, BPI, BDO, UnionBank, Metrobank, and other payment processors; game play data from third-party game providers integrated into the phwim Platform;
• Regulatory sources: Data received from PAGCOR or other regulatory bodies in connection with compliance obligations, including AML screening results.

4. How We Use Your Personal Data

phwim uses your personal data for the following purposes:

• To create, verify, and manage your phwim account;
• To process deposits and withdrawals via your chosen payment method (GCash, Maya, bank transfer, etc.);
• To comply with PAGCOR licensing requirements, including player identity verification, age verification (21+), and AML/CFT obligations;
• To detect, investigate, and prevent fraudulent activity, multiple account creation, bonus abuse, and other prohibited conduct;
• To provide customer support and respond to queries and complaints;
• To send you transactional communications — account notifications, password reset links, deposit/withdrawal confirmations, and 2FA codes via SMS;
• To send you promotional communications about phwim bonuses and offers, where you have consented to receive marketing communications (consent may be withdrawn at any time);
• To monitor gaming activity for responsible gaming purposes, including applying deposit limits, session reminders, and self-exclusion requests;
• To improve the phwim Platform based on aggregated, anonymised usage data;
• To enforce phwim's Terms & Conditions and resolve disputes.

5. Legal Basis for Processing

Under the Data Privacy Act of 2012 and its implementing rules, phwim relies on the following legal bases for processing your personal data:

• Contract performance: Processing necessary to create and operate your phwim account and deliver the gaming services you have requested;
• Legal obligation: Processing required for compliance with PAGCOR licensing conditions, AML/CFT laws (Republic Act No. 9160 as amended), tax reporting, and other applicable Philippine laws;
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where such interests are not overridden by your privacy rights;
• Consent: Processing for marketing communications and certain cookie categories, where your explicit consent has been obtained. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing & Disclosure

phwim does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. phwim shares personal data only in the following circumstances:

6.1 Service Providers

phwim engages third-party processors to support platform operations, including KYC/identity verification providers, payment processors (GCash, Maya, BPI, BDO, and other Philippine payment partners), game software providers, cloud hosting providers, fraud detection services, and customer support platform providers. These processors act under contractual obligations to process data only on phwim's instructions and in accordance with applicable data protection requirements.

6.2 Regulatory Authorities

phwim discloses personal data to PAGCOR and other Philippine government authorities (including the AMLC — Anti-Money Laundering Council) where required by law, regulation, or regulatory order. Such disclosures are made only to the extent required and in the form required.

6.3 Legal & Safety Disclosures

phwim may disclose personal data where necessary to protect the rights, property, or safety of phwim, its players, or the public; to investigate potential violations of these Terms or applicable law; or in connection with a legal proceeding, court order, or governmental investigation.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or a substantial portion of phwim's assets, personal data held by phwim may be transferred to the acquiring entity, subject to the acquiring entity assuming equivalent data protection obligations. Users will be notified of any such transfer that materially affects their rights.

7. International Data Transfers

Some of phwim's third-party service providers — including cloud infrastructure providers and game software partners — may process data outside the Republic of the Philippines. Where such transfers occur, phwim ensures that appropriate safeguards are in place, including contractual data processing agreements that impose data protection standards equivalent to those required under the DPA. phwim does not transfer data to jurisdictions with inadequate data protection frameworks without appropriate safeguards.

8. Data Retention

phwim retains personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. The following general retention periods apply:

• Account data and KYC documents: Retained for a minimum of five (5) years following account closure, in accordance with PAGCOR and AML regulatory requirements;
• Transaction records: Retained for a minimum of five (5) years for AML compliance and tax reporting purposes;
• Gaming history: Retained for three (3) years for responsible gaming monitoring and dispute resolution;
• Customer support records: Retained for two (2) years following resolution of the relevant query or complaint;
• Technical/log data: Retained for twelve (12) months for security and fraud detection purposes.

Upon expiry of applicable retention periods, data is securely deleted or anonymised in a manner that prevents re-identification.

9. Security Measures

phwim implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Security measures in place at phwim include:

• SSL/TLS encryption for all data in transit between your browser and the phwim Platform;
• Encryption of sensitive data fields (including payment data and ID document copies) at rest;
• Role-based access controls limiting internal access to personal data on a need-to-know basis;
• Multi-factor authentication for internal systems access;
• Regular security assessments and penetration testing of the Platform;
• Incident response procedures for identifying, containing, and notifying data breaches in accordance with DPA requirements.

10. Cookies & Tracking Technologies

phwim uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function — including session management, authentication state, and security tokens. These cookies cannot be disabled without affecting Platform functionality.
• Performance cookies: Collect anonymised data about how visitors use the Platform — pages visited, time on site, error messages — to help phwim improve performance. No personally identifiable information is collected by these cookies.
• Functional cookies: Remember your preferences — language settings, preferred game categories — to personalise your experience on phwim.

You can control non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the phwim Platform. phwim does not use third-party advertising cookies or sell cookie-derived data to advertising networks.

11. Your Rights Under the DPA

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights in respect of your personal data held by phwim:

• Right to be informed — to know whether phwim holds personal data about you and to receive a description of the data held;
• Right of access — to obtain a copy of your personal data in a reasonably portable format;
• Right to rectification — to have inaccurate or incomplete personal data corrected;
• Right to erasure — to request deletion of personal data where processing is no longer necessary, subject to retention obligations under PAGCOR and AML regulations;
• Right to object — to object to processing of your data for direct marketing purposes at any time;
• Right to data portability — to receive your data in a structured, machine-readable format where technically feasible;
• Right to withdraw consent — where processing is based on consent, to withdraw consent at any time without affecting prior processing;
• Right to complain — to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data protection rights have been violated.

To exercise any of the above rights, contact phwim's Data Protection Officer at the address in Section 14. phwim will respond to verified requests within thirty (30) days.

12. Children & Minors

If you are a parent or guardian and believe that a minor has registered on phwim, please contact our support team immediately at [email protected] so the matter can be investigated and the account closed without delay.

13. Changes to This Privacy Policy

phwim may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or Platform features. Material changes will be communicated to registered users via email notification or a prominent notice on the phwim Platform prior to the changes taking effect. The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. Your continued use of the phwim Platform following the effective date of any revision constitutes your acceptance of the updated Privacy Policy.

14. Contact & Data Protection Officer

For any privacy-related queries, data subject rights requests, or data breach notifications, please contact phwim's Data Protection Officer:

You also have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC) if you believe phwim has violated your data protection rights under the DPA. Information about the NPC's complaint process is available on the NPC's official website.