phwin 25 Privacy Policy — How We Protect Your Personal Data

This Privacy Policy applies to phwin 25 ("phwin 25", "we", "us", "our"), the online gaming platform accessible at https://phwin25.asia. phwin 25 is the data controller responsible for the personal information collected through this platform.

phwin 25 is a licensed online gaming operator serving players in the Philippines. Our operations are subject to applicable Philippine gaming regulations and to the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, which govern how we handle the personal data of Filipino players.

If you have any questions about this Privacy Policy, how phwin 25 handles your personal information, or if you want to exercise any of your rights as a data subject, you can contact our Data Protection Officer (DPO) through the phwin 25 support team. We will respond to all privacy-related enquiries within 15 business days.

phwin 25 collects only the personal data that is necessary to operate the platform, comply with our legal and regulatory obligations, and provide you with a secure and functional gaming experience. We do not collect personal data beyond what is needed for these purposes.

Registration and Account Data: When you create a phwin 25 account, we collect the information you provide during registration.

Identity Verification (KYC) Data: Before processing your first withdrawal, phwin 25 is required by Philippine regulations to verify your identity. This requires you to submit a copy of a government-issued Philippine ID. We may also request a selfie photograph for liveness verification purposes.

Financial Data: When you deposit or withdraw on phwin 25, we collect the minimum financial information needed to process the transaction.

Activity and Gaming Data: phwin 25 automatically records your activity on the platform as part of normal platform operation.

Technical Data: When you access phwin 25, our servers automatically collect certain technical information about your device and connection.

phwin 25 collects personal data through three main channels:

• Directly from you: When you register on phwin 25, complete your KYC verification, make a deposit or withdrawal, contact our support team, or respond to a survey or promotion, you provide data to us directly. This is the primary source of personal data on phwin 25.
• Automatically through platform use: When you access phwin 25, our servers and analytics tools automatically collect technical data such as IP addresses, device identifiers, session data, and browsing patterns within the platform. This data is collected through server logs and cookies (see Section 8 for full details on cookies).
• From third-party service providers: Where necessary to verify your identity or process payments, phwin 25 may receive data from authorised third-party services such as KYC verification providers, payment processors (GCash, Maya, banks), and fraud detection services. Data received from these sources is used solely for the purpose for which it was obtained and is handled with the same level of protection as data collected directly.

phwin 25 does not purchase personal data from data brokers or any other third-party data trading services.

phwin 25 uses the personal data we collect only for specific, declared purposes. Here is a clear breakdown of what we use each type of data for:

phwin 25 does not use your personal data for purposes beyond those listed above without first obtaining your explicit consent or having a clear legal basis to do so under RA 10173.

Under the Data Privacy Act of 2012, phwin 25 must have a valid legal basis for every type of personal data processing we carry out. We process your personal data on the following legal grounds:

• Contractual necessity: Processing your registration data, financial data, and gaming activity records is necessary to perform the contract between you and phwin 25 — that is, to provide you with the platform and services you signed up for. Without this processing, phwin 25 cannot operate your account.
• Legal obligation: Philippine gaming regulations, the Anti-Money Laundering Act (AMLA), and tax laws require phwin 25 to collect, retain, and in some cases disclose certain player data. KYC verification and transaction monitoring fall under this basis.
• Legitimate interests: phwin 25 processes some technical and activity data on the basis of its legitimate interest in maintaining platform security, preventing fraud, and improving service quality. We only rely on this basis where our interests do not override your fundamental privacy rights.
• Consent: For optional processing — such as sending you promotional emails or SMS about phwin 25 offers — we rely on your explicit consent. You can withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

phwin 25 does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. Full stop. We share your personal data only in the following limited and specific circumstances:

• Payment processors: To process your deposits and withdrawals, phwin 25 shares the minimum necessary financial data with your chosen payment provider (GCash, Maya, BDO, BPI, UnionBank, and others). These providers process your data under their own privacy policies and applicable Philippine financial regulations.
• KYC and identity verification providers: phwin 25 uses licensed third-party KYC services to verify player identity. Your ID documents and personal details are shared with these providers solely for verification purposes and are not retained by them beyond the verification process.
• Regulatory authorities: phwin 25 is required by law to report certain transactions and provide player data to the relevant Philippine gaming regulator, the Anti-Money Laundering Council (AMLC), and other authorities where legally obligated.
• Law enforcement: Where phwin 25 receives a valid legal order or request from Philippine law enforcement, we will provide the requested data in accordance with that order.
• Fraud prevention networks: phwin 25 may participate in licensed fraud prevention services and may share limited data (such as flagged account identifiers) with other licensed operators through such networks to protect all players from fraud and abuse.

All third parties with whom phwin 25 shares personal data are required to handle that data in accordance with the Data Privacy Act of 2012 and are subject to contractual obligations limiting their use of your data to the specific purpose for which it was shared.

phwin 25 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable Philippine law.

• Active account data is retained for the full duration of your account relationship with phwin 25.
• Transaction and gaming records are retained for a minimum of 5 years from the date of each transaction, in compliance with AMLA and gaming regulatory requirements.
• KYC documents are retained for a minimum of 5 years from account closure, as required by Philippine AML regulations.
• Customer support records including chat transcripts and complaint files are retained for 3 years from the date of the last interaction.
• Technical logs (IP logs, session data) are typically retained for 12 months and then deleted or anonymised.
• Marketing consent records are retained for as long as your consent remains active, plus 1 year following withdrawal of consent for record-keeping purposes.

When data is no longer required, phwin 25 securely destroys it using methods appropriate to the data type and storage medium (electronic deletion, cryptographic erasure, or physical destruction of printed records).

phwin 25 uses cookies and similar tracking technologies to keep the platform functional, improve your experience, and support security and analytics functions. A cookie is a small text file stored on your device when you visit a website.

phwin 25 uses the following types of cookies:

• Strictly necessary cookies: These are required for the phwin 25 platform to function. They manage your login session, keep your account secure, and remember your in-session preferences. You cannot opt out of these cookies while using phwin 25.
• Functional cookies: These remember your choices — such as your language preference and display settings — to make your phwin 25 experience more convenient. They do not track you across other websites.
• Analytics cookies: phwin 25 uses anonymised analytics data to understand how players use the platform, which pages are most visited, and where technical issues occur. This data is aggregated and does not identify you personally.
• Security cookies: These help phwin 25 detect and prevent fraudulent activity, including account takeover attempts and automated bot activity.

phwin 25 does not use advertising or third-party tracking cookies. We do not allow any third-party advertising networks to place cookies on the phwin 25 platform.

phwin 25 implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure.

• Encryption in transit: All data transmitted between your device and phwin 25 servers is protected by 256-bit SSL/TLS encryption. The padlock icon in your browser's address bar confirms this protection is active during your phwin 25 session.
• Encryption at rest: Sensitive data stored in phwin 25 databases — including KYC documents and financial records — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within phwin 25 is restricted on a strict need-to-know basis. Team members can access only the data necessary for their specific role. All data access is logged and monitored.
• Regular security audits: phwin 25 undergoes regular internal and third-party security assessments to identify and address potential vulnerabilities in our systems.
• Breach response: phwin 25 maintains a data breach response procedure. In the event of a breach that is likely to affect your rights, we will notify you and the National Privacy Commission (NPC) within 72 hours of discovering the breach, as required by RA 10173.

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights as a data subject with respect to the personal information phwin 25 holds about you. These rights can be exercised at any time by contacting the phwin 25 support team and referencing "Data Subject Rights Request".