phwin6 Privacy Policy — Your Data, Your Rights, Our Responsibility

1. Who We Are (Data Controller)

This Privacy Policy applies to the phwin6 platform, accessible at phwin6.app ("phwin6," "we," "our," "us"). phwin6 acts as the Data Controller for the personal information you provide when using its website and services, including sports betting, casino games, poker, esports, and the VIP Club.

As Data Controller, phwin6 determines the purposes and means of processing your personal data. We are responsible for ensuring that processing is conducted in compliance with the Philippine Data Privacy Act of 2012 (Republic Act 10173) and its Implementing Rules and Regulations. If you have questions about how your data is handled, the contact details at the end of this policy connect you directly with the phwin6 Data Protection team.

2. Personal Data We Collect

phwin6 collects the following categories of personal data. We have organised them to make it easy to see exactly what information is involved.

2.1 Identity & Contact Data

2.2 Financial & Transaction Data

2.3 Account & Activity Data

2.4 Technical Data

3. How We Collect Your Data

phwin6 collects personal data through the following channels:

• Direct collection: Information you provide when registering an account, completing KYC verification, making a deposit, contacting support, or participating in a promotion.
• Automated collection: Technical data collected automatically when you use the phwin6 platform, including IP address, device data, and session activity through cookies and similar technologies (see Section 9).
• Third-party sources: Identity verification data from government ID processing services, fraud detection signals from payment processors, and account status information from responsible gaming registries where legally applicable.

4. Why We Use Your Personal Data

phwin6 uses your personal data for the following purposes. The legal basis for each is identified in Section 5.

5. Legal Basis for Processing

Under the Philippine Data Privacy Act, every instance of personal data processing must have a lawful basis. phwin6 relies on the following legal grounds:

• Contractual necessity: Processing required to operate your phwin6 account and fulfil the Terms and Conditions you agreed to when registering — account management, betting, payments.
• Legal obligation: Processing required to comply with Philippine laws, including anti-money laundering regulations, KYC requirements, and tax record-keeping obligations.
• Legitimate interests: Fraud detection, security monitoring, and platform improvement — where phwin6's interests do not override your fundamental privacy rights.
• Consent: Direct marketing communications (email, SMS) and optional analytics tracking. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Who We Share Your Data With

phwin6 shares personal data only where necessary, with the following categories of recipients:

6.1 Service Providers (Data Processors)

Third-party companies that process data on phwin6's behalf under written data processing agreements, including: payment processors (GCash, Maya, card acquirers), identity verification services, fraud detection providers, cloud hosting and infrastructure providers, and customer support software providers. These parties may only process your data as instructed by phwin6 and may not use it for their own purposes.

6.2 Legal and Regulatory Authorities

Philippine government agencies, law enforcement, regulators, and courts where phwin6 is required or permitted by law to disclose personal data — for example, in response to a lawful subpoena, anti-money laundering investigation, or regulatory inspection.

6.3 Responsible Gaming Registries

Where required by applicable regulations, phwin6 may cross-check self-exclusion requests against national or industry-wide responsible gaming registries. This is done solely to honour your exclusion preferences across the industry, not for any commercial purpose.

6.4 Business Transfers

If phwin6 undergoes a merger, acquisition, or asset sale, your personal data may be transferred to the acquiring entity. You will be notified prior to any such transfer, and the receiving entity will be required to honour this Privacy Policy.

7. How Long We Keep Your Data

phwin6 retains personal data only as long as necessary for the purpose it was collected, subject to legal retention obligations. Key retention periods are as follows:

After the applicable retention period, data is securely deleted from phwin6 systems or anonymised so that it can no longer identify you as an individual.

8. How We Protect Your Data

phwin6 implements technical and organisational security measures appropriate to the nature of the personal data held and the risks involved in its processing. These measures include:

• Encryption in transit: All data transmitted between your device and phwin6 servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Encryption at rest: Sensitive data fields including identity documents and payment references are encrypted in the phwin6 database.
• Access controls: Personal data is accessible only to phwin6 personnel who need it to perform their role, on a least-privilege basis.
• Multi-factor authentication: Available for all player accounts and required for phwin6 staff accessing production systems.
• Intrusion detection: Automated monitoring for unusual access patterns, failed authentication attempts, and data exfiltration indicators.
• Regular security review: phwin6 conducts periodic reviews of security procedures and infrastructure to identify and address vulnerabilities.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, phwin6 will notify the National Privacy Commission within 72 hours of discovery and notify affected individuals promptly thereafter, in accordance with the Data Privacy Act.

9. Cookies & Tracking Technologies

phwin6 uses cookies and similar technologies on its website. Here is a plain-language breakdown of the types used:

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect platform functionality. phwin6 does not use third-party advertising network cookies.

10. Payment Data & Financial Privacy

phwin6 takes particular care with financial data. Here is how payment information is handled at each stage:

Deposits via GCash and Maya: When you initiate a GCash or Maya deposit, phwin6 generates a payment session token and redirects you to the relevant e-wallet's own secure interface. Your GCash or Maya credentials are entered directly into that interface — phwin6 does not see or receive your e-wallet password or PIN. phwin6 receives only a transaction confirmation and a masked identifier (e.g., the last four digits of the registered mobile number).

Card payments: Visa and Mastercard transactions are processed by a PCI-DSS Level 1 certified payment processor. phwin6 does not store full card numbers or CVV codes. The processor returns only a payment token and masked card reference to phwin6's systems.

Transaction records: phwin6 maintains records of deposit and withdrawal amounts, timestamps, and payment method references for 5 years as required by Philippine AML regulations. These records are not shared with third parties except as required by law or in the course of a formal dispute resolution process.

11. Protection of Minors

phwin6 is strictly a 21+ platform. phwin6 does not knowingly collect personal data from individuals under 21 years of age. Age verification is conducted during the KYC process, and accounts found to belong to underage individuals are immediately suspended.

If you believe phwin6 has inadvertently collected personal data from a person under 21 years old, please contact support@phwin6.app immediately. phwin6 will investigate and delete any such data promptly upon verification of the report.

12. International Data Transfers

Some of phwin6's service providers operate infrastructure outside the Philippines. Where personal data is transferred internationally, phwin6 ensures that appropriate safeguards are in place — including contractual clauses that require receiving parties to protect data to a standard equivalent to the Philippine Data Privacy Act.

phwin6 does not transfer data to jurisdictions that do not provide adequate data protection without first implementing appropriate contractual, technical, and organisational safeguards. If you have questions about specific international transfers, contact support@phwin6.app.

13. How to Exercise Your Privacy Rights

To exercise any of the rights described in this Privacy Policy — access, rectification, erasure, objection, portability, restriction of processing, or withdrawal of marketing consent — follow these steps:

1. Send an email to support@phwin6.app with the subject line: "Data Privacy Request — [Your Request Type]"
2. Include your registered name, account username, and a brief description of your request.
3. phwin6 may request additional identity verification before processing a data rights request to protect against fraudulent requests by third parties.
4. phwin6 will acknowledge your request within 3 business days and provide a full response within 15 business days. Complex requests may take up to 30 days — we will notify you if an extension is needed.
5. Responses to data rights requests are free of charge for reasonable requests. For manifestly excessive or repetitive requests, phwin6 may charge a reasonable administrative fee.

14. Complaints & the National Privacy Commission

If you are not satisfied with how phwin6 has handled your personal data or responded to a data rights request, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines.

Before escalating to the NPC, phwin6 encourages you to contact us first — the majority of privacy concerns can be resolved quickly through direct communication. The phwin6 Data Protection team will give your complaint full consideration and respond in writing within 15 business days.

If you choose to file a complaint directly with the NPC, information on the complaint process is available through the NPC's official channels. phwin6 cooperates fully with NPC investigations.

15. Changes to This Privacy Policy

phwin6 may update this Privacy Policy from time to time to reflect changes in our data practices, technology, legal obligations, or business operations. The "Last Updated" date at the top of this page indicates when the most recent revision was made.

For material changes — those that significantly affect your rights or how your data is used — phwin6 will notify registered players via the email address on file at least 14 days before the changes take effect. For minor or clarifying changes, the updated policy will be published without prior individual notification.

Continued use of phwin6 after the effective date of an updated Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with the updated policy, you may close your account as described in our Terms and Conditions.

16. Contact & Data Protection Team

For any questions, requests, or concerns relating to this Privacy Policy or the processing of your personal data at phwin6, contact us at:

phwin6 is committed to handling all privacy enquiries professionally and in good faith. Your trust matters to us — and data privacy is one of the areas where that trust has to be earned through consistent, transparent action, not just policy language.