pilwin Privacy Policy

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Information" means any information from which the identity of an individual can be reasonably and directly ascertained, including but not limited to name, address, date of birth, contact details, government identification numbers, financial account details, and IP addresses, as defined under the Philippine Data Privacy Act.
• "Sensitive Personal Information" means personal information about an individual's race, ethnic origin, marital status, age, colour, religious, philosophical or political beliefs, health, education, genetic or sexual life, or information relating to criminal convictions, as defined by the DPA.
• "Processing" means any operation or set of operations performed on personal information, whether or not by automated means, including collection, recording, organisation, storage, updating, retrieval, use, consolidation, blocking, erasure, or destruction.
• "Data Controller" means pilwin, which determines the purposes and means of processing personal information collected through the platform.
• "Data Subject" means the individual player, user, or visitor whose personal information is collected and processed by pilwin.
• "DPA" means the Republic Act No. 10173, the Philippine Data Privacy Act of 2012, and its Implementing Rules and Regulations.
• "NPC" means the National Privacy Commission of the Philippines.
• "PAGCOR" means the Philippine Amusement and Gaming Corporation.

pilwin collects personal information from you in connection with your registration, use of the platform, and any interactions with our customer support team. The categories of data collected are set out below:

pilwin does not knowingly collect sensitive personal information beyond what is strictly necessary for identity verification, age confirmation, and PAGCOR compliance requirements. Where sensitive personal information is collected, it is handled under heightened security and access controls.

pilwin processes your personal information for the following purposes:

• Account Registration and Management: To create, verify, maintain, and manage your pilwin account, including processing your login credentials and account settings.
• Identity Verification and KYC: To verify your identity, confirm you meet the 21+ age requirement, and comply with PAGCOR KYC and anti-money laundering obligations.
• Payment Processing: To process deposits and withdrawals through approved payment channels including GCash, PayMaya, BPI, BDO, Metrobank, and cryptocurrency networks.
• Service Delivery: To provide access to casino games, sports betting, live dealer tables, bingo, and all other pilwin platform features.
• Security and Fraud Prevention: To detect, prevent, and investigate fraudulent activity, cheating, money laundering, and unauthorised account access.
• Responsible Gaming: To monitor gameplay patterns and assist with responsible gaming tools including deposit limits, session timers, cool-off periods, and self-exclusion.
• Regulatory Compliance: To meet obligations under PAGCOR regulations, the DPA, Philippine anti-money laundering law, and any other applicable legislation.
• Customer Support: To respond to your enquiries, complaints, and support requests through live chat, email, and other communication channels.
• Platform Improvement: To analyse usage patterns, conduct internal research, and improve the pilwin platform's features, performance, and user experience.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have not opted out, consistent with Section 12 of this Policy.

Under the Philippine Data Privacy Act, pilwin processes your personal information on the following legal bases:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and pilwin (the Terms and Conditions), including account management, payment processing, and service delivery.
• Legal Obligation: Processing is required to comply with legal obligations under PAGCOR regulations, the Anti-Money Laundering Act, the DPA itself, and other applicable Philippine laws.
• Legitimate Interest: Processing is necessary for pilwin's legitimate interests in preventing fraud, maintaining platform security, improving services, and managing risk, provided that such interests are not overridden by your rights and freedoms.
• Consent: For marketing communications and certain optional data processing activities, pilwin relies on your freely given, informed, and specific consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

Where processing is based on consent, withdrawal of that consent will not affect the processing already carried out, nor will it affect processing carried out under a different legal basis.

pilwin does not sell, rent, or trade your personal information. We may share your data with third parties only in the following circumstances and only to the minimum extent necessary:

• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, and cryptocurrency network providers receive transaction data necessary to process your deposits and withdrawals.
• Game Studio Partners: Certified game providers integrated into the pilwin lobby may receive session and transaction data necessary to deliver games and calculate RTP. All studio partners are contractually bound to data protection standards consistent with this Policy.
• KYC and Identity Verification Services: Third-party identity verification providers may process your KYC documents on our behalf under data processing agreements that prohibit independent use of your data.
• Regulatory Authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council, and other Philippine regulatory and law enforcement agencies may receive data pursuant to mandatory reporting obligations or lawful requests.
• Legal Proceedings: pilwin may disclose personal information where required to comply with a court order, legal process, or to protect the rights, property, or safety of pilwin, its players, or the public.
• Professional Advisors: Legal counsel, auditors, and compliance consultants engaged by pilwin operate under strict confidentiality obligations and may access data only to the extent required for the specific engagement.

pilwin uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small data files stored on your device that help us recognise returning users, maintain session states, measure platform performance, and personalise your experience.

The categories of cookies used by pilwin are as follows:

• Strictly Necessary Cookies: Essential for the platform to function correctly. These include session authentication cookies that keep you logged in to your pilwin account. You cannot opt out of these without ceasing to use the platform.
• Performance and Analytics Cookies: Used to collect anonymised data about how players use the platform — pages visited, features interacted with, error events — to help us improve performance and fix issues.
• Functionality Cookies: Remember your preferences such as language settings, display preferences, and last-visited game categories to provide a more personalised experience.
• Security Cookies: Used to detect and prevent fraud, including session hijacking and account takeover attempts.

You may control cookie settings through your browser preferences. Note that disabling certain categories of cookies may impair pilwin platform functionality. pilwin does not use third-party advertising cookies or cross-site behavioural tracking cookies.

pilwin retains personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law, regulation, or PAGCOR compliance requirements. Specific retention periods are guided by the following principles:

• Active Account Data: Retained for the duration of your active account and for a minimum of five (5) years following account closure, in accordance with Philippine anti-money laundering record-keeping requirements.
• KYC Documents: Retained for at least five (5) years following the end of the business relationship, consistent with AMLC and PAGCOR requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years following the date of each transaction, as required under Philippine financial regulatory obligations.
• Customer Support Records: Retained for three (3) years following the resolution of the relevant enquiry or complaint, to allow for escalation and regulatory review where required.
• Marketing Consent Records: Retained until consent is withdrawn and for one (1) year thereafter as proof of consent.
• Technical and Usage Data: Retained in anonymised or aggregated form after account closure for platform analytics and security purposes.

Upon expiry of applicable retention periods, personal information is securely deleted or anonymised in a manner consistent with NPC data disposal guidelines and international best practices for data destruction.

pilwin implements appropriate technical and organisational security measures designed to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and pilwin servers is protected by 256-bit TLS/SSL encryption. The presence of a valid security certificate can be verified via your browser's security indicator.
• Encryption at Rest: Personal information and KYC documents stored on pilwin servers are encrypted at rest using industry-standard encryption protocols.
• Access Controls: Access to personal data is strictly limited to authorised personnel who require it for specific, documented operational purposes. Access rights are reviewed periodically.
• Two-Factor Authentication: Account access is protected by optional two-factor authentication via SMS verification for new device logins.
• Penetration Testing: pilwin's systems and infrastructure undergo regular security assessments by qualified security professionals to identify and remediate vulnerabilities.
• Staff Training: All pilwin personnel with access to personal data receive data privacy and security training consistent with NPC guidelines.

While pilwin maintains robust security measures, no system is entirely immune to security incidents. In the event of a data breach that poses a risk to your rights and freedoms, pilwin will notify the NPC and affected individuals in accordance with the requirements set out in Section 14 of this Policy and as mandated by the DPA.

As a data subject under the Philippine Data Privacy Act, you are entitled to the following rights with respect to your personal information held by pilwin. These rights may be exercised by contacting pilwin's Data Protection Officer using the details provided in Section 16.

In certain circumstances, personal information collected by pilwin may be transferred to, stored, or processed in countries outside the Republic of the Philippines — for example, where game studio partners or infrastructure providers operate servers in other jurisdictions.

Where such international transfers occur, pilwin ensures that appropriate safeguards are in place consistent with the requirements of the DPA and NPC guidelines on cross-border data transfers. These safeguards may include:

• Contractual data protection clauses that bind the recipient to standards equivalent to Philippine DPA requirements;
• Transfers to jurisdictions recognised by the NPC as providing an adequate level of data protection; or
• Your explicit informed consent to the transfer where required.

In all cases, pilwin retains Data Controller responsibility for personal information transferred to third-party processors and monitors ongoing compliance with applicable data protection standards.

The pilwin platform is strictly intended for individuals who are at least 21 years of age — the minimum legal gambling age established by PAGCOR for online casino and gaming activities in the Philippines. pilwin does not knowingly collect personal information from individuals below the age of 21.

As part of the account registration and KYC process, pilwin collects date of birth information and requires submission of a valid Philippine government-issued ID to confirm age eligibility. This age verification data is treated as KYC information under the heightened security and retention protocols described in this Policy.

If pilwin becomes aware that personal information has been collected from an individual who is under 21 years of age, we will take immediate steps to:

• Suspend and close the relevant account;
• Securely delete the personal information collected to the extent permitted by law and PAGCOR requirements;
• Report the matter to PAGCOR where required under applicable regulations.

If you have reason to believe that a person under 21 has registered or accessed a pilwin account, please contact our Data Protection Officer immediately using the contact details in Section 16.

Where you have not opted out, pilwin may use your contact information to send you communications about platform updates, bonus offers, game releases, and other promotional content relevant to your pilwin account.

pilwin sends marketing communications only through the following channels: email to your registered address, SMS to your registered mobile number, and in-platform notifications when you are logged in to your account.

Withdrawing Consent: You may opt out of marketing communications at any time through any of the following means:

• Using the unsubscribe link included in every pilwin marketing email;
• Updating your notification preferences in your pilwin account settings panel;
• Contacting the pilwin support team via live chat or email with a specific opt-out request.

Opt-out requests will be processed within one (1) business day for account settings changes and within five (5) business days for manually submitted requests. Withdrawal of marketing consent does not affect the delivery of transactional and operational communications essential to your account, such as deposit confirmations, withdrawal notifications, and security alerts.

The pilwin platform integrates third-party services necessary for its operation, including payment gateways, game engines, identity verification services, and analytics tools. Each of these services is engaged under a data processing or data sharing agreement that requires compliance with applicable data protection standards.

pilwin is not responsible for the privacy practices of game studios, payment processors, or other third parties whose services are accessed through the platform. Players interacting with these third-party integrations should review the relevant privacy policies of those providers independently.

pilwin does not permit third-party services integrated into the platform to use player personal information for any purpose other than providing the specific service to pilwin for which they are engaged.

In the event of a personal data breach that is likely to pose a risk to the rights and freedoms of affected individuals, pilwin will comply with mandatory breach notification requirements under the Philippine Data Privacy Act and relevant NPC guidelines:

• NPC Notification: pilwin will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of a qualifying breach, as required under NPC Circular No. 16-03 and related issuances.
• Affected Player Notification: Where a breach is likely to result in a high risk to individual rights and freedoms, pilwin will notify affected players without undue delay, providing a description of the breach, the categories of data affected, and the steps being taken to mitigate harm.
• Breach Response: pilwin maintains an internal data breach response procedure that includes immediate containment measures, forensic investigation, risk assessment, and remediation steps to prevent recurrence.

pilwin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, new regulatory requirements, or platform developments. The current version of this Policy is always identified by the "Last Updated" date displayed at the top of this page.

When material changes are made to this Policy, pilwin will provide notice through one or more of the following methods: email notification to your registered address, an in-account notification upon next login, or a prominent notice on the platform. Material changes will take effect no sooner than fourteen (14) days following notice, except where a shorter period is required by law or PAGCOR regulation.

Continued use of the pilwin platform after the effective date of any amendment constitutes your acknowledgement of the revised Policy. If you do not agree with the amended Policy, you should discontinue use of the platform and may request account closure.

pilwin has designated a Data Protection Officer ("DPO") in accordance with the requirements of the Philippine Data Privacy Act. The DPO is responsible for overseeing pilwin's compliance with the DPA, handling data rights requests, and serving as the primary point of contact for the National Privacy Commission.

To exercise your data rights under Section 9, raise a privacy concern, or make a complaint related to the handling of your personal information by pilwin, you may contact:

• Channel: On-site live chat — available 24/7 from the pilwin platform. State that your inquiry is a DPA / privacy matter so it is routed to the correct team.
• Email: [email protected] — mark the subject line "Privacy / Data Rights Request" for priority routing to the DPO. Target response time: within 24 hours for acknowledgement, within 30 days for substantive response.

All DPA-related requests and complaints are handled with strict confidentiality and in accordance with NPC procedural guidelines. Where a complaint cannot be resolved to your satisfaction through pilwin's internal process, you retain the right to escalate the matter to the National Privacy Commission.

This Privacy Policy is governed by the laws of the Republic of the Philippines. Any disputes relating to this Policy are subject to the jurisdiction of the appropriate Philippine courts and, where applicable, the complaints resolution process of the National Privacy Commission.