pilwin Privacy Policy

Introduction

pilwin ("pilwin," "we," "our," or "us") operates the online gaming platform accessible at https://pilwin.club (the "Platform"). We are committed to protecting the personal data of every Filipino player, visitor, and user who interacts with our Platform. This Privacy Policy ("Policy") describes how pilwin collects, uses, stores, shares, and protects your personal data, and explains the rights available to you under applicable Philippine law.

This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations, as administered by the National Privacy Commission of the Philippines. It is also informed by pilwin's obligations under PAGCOR's licensing framework, the Anti-Money Laundering Act (AMLA), and other applicable Philippine legislation.

By accessing the pilwin Platform, creating an account, or providing us with any personal data, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform.

Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information from which you can be identified, directly or indirectly, including your name, mobile number, email address, date of birth, financial account details, and government-issued identification numbers.
• "Processing" means any operation or set of operations performed on personal data — including collection, recording, storage, use, disclosure, or deletion.
• "Data Subject" means the natural person (you, the player) to whom the personal data relates.
• "Personal Information Controller (PIC)" means pilwin, the entity that determines the purposes and means of processing personal data.
• "Personal Information Processor (PIP)" means any third party that processes personal data on behalf of pilwin under a data processing agreement.
• "Data Protection Officer (DPO)" means the individual designated by pilwin to oversee compliance with the DPA and serve as the primary contact point for data subject inquiries.
• "Sensitive Personal Information" has the same meaning as under Section 3(l) of RA 10173 — including government-issued ID numbers, financial information, and health information.
• "NPC" means the National Privacy Commission of the Philippines, the regulatory body responsible for enforcing RA 10173.

Personal Data We Collect

3.1 Data You Provide Directly

pilwin collects personal data that you provide directly when registering for or using the Platform, including:

• Full legal name as it appears on your government-issued identification document;
• Date of birth (for age verification — you must be 21 or older);
• Philippine mobile number and email address;
• Residential address (province, city/municipality);
• Government-issued identification documents submitted for KYC verification (e.g., PhilSys National ID, passport, driver's license, SSS card, UMID);
• Payment account information, including GCash numbers, PayMaya account details, and bank account details (BPI, BDO, Metrobank) used for deposits and withdrawals;
• Source of funds documentation, where required for regulatory compliance;
• Communications you send to pilwin's customer support team.

3.2 Data Generated Automatically

When you use the Platform, pilwin automatically collects certain technical and behavioral data, including:

• IP address and approximate geographic location at the time of access;
• Device type, operating system version, and browser type;
• Session login and logout timestamps;
• Game activity records, including games played, bet amounts, outcomes, and session duration;
• Transaction history, including all deposits, withdrawals, and bonus activity;
• Cookies and similar tracking technology data (see Section 7).

How pilwin Uses Your Personal Data

pilwin processes your personal data for the following purposes:

1. Account Registration and Management: To create and maintain your pilwin account, verify your identity and age, and manage your account settings and preferences.
2. Platform Services: To provide access to all gaming content, process bets and payouts, manage your account balance, and deliver the core functions of the pilwin Platform.
3. Payment Processing: To process your deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, Visa, and Mastercard, and to maintain records of all financial transactions for regulatory compliance.
4. KYC and Identity Verification: To verify your identity, age, and source of funds as required by PAGCOR licensing conditions, the Anti-Money Laundering Act, and related regulations.
5. Regulatory Compliance: To fulfil pilwin's obligations under PAGCOR's licensing framework, RA 10173, the AMLA, and other applicable Philippine law, including mandatory reporting obligations to the Anti-Money Laundering Council (AMLC) and PAGCOR.
6. Responsible Gaming: To monitor gaming activity for patterns that may indicate problematic gambling behavior, to administer deposit limits and self-exclusion requests, and to comply with pilwin's responsible gaming obligations under PAGCOR regulations.
7. Customer Support: To respond to your inquiries, process complaints, and resolve disputes.
8. Security and Fraud Prevention: To detect and prevent unauthorized access, fraud, money laundering, and other prohibited activities on the Platform.
9. Platform Improvement: To analyze aggregate usage patterns and technical performance data to improve the Platform's functionality, stability, and user experience.
10. Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — where you have provided consent or where permitted under applicable law. You may opt out of marketing communications at any time through your Account settings.

Legal Basis for Processing

Under Republic Act No. 10173, pilwin processes your personal data on the following lawful bases:

• Consent: Where you have given clear, specific consent to processing for a particular purpose (e.g., marketing communications).
• Contractual Necessity: Where processing is necessary to perform the contract between pilwin and you (i.e., to provide the Platform services you have registered for).
• Legal Obligation: Where processing is required to comply with a legal obligation applicable to pilwin — including PAGCOR licensing conditions, the AMLA, and other Philippine law.
• Legitimate Interests: Where processing is necessary for pilwin's legitimate interests — such as fraud prevention, platform security, and responsible gaming monitoring — provided those interests are not overridden by your rights and interests as a data subject.

Sharing Your Personal Data

6.1 Third-Party Service Providers

pilwin shares personal data with third-party service providers who process data on our behalf under binding data processing agreements. These providers include payment processors (GCash / GXI, Maya Philippines, Inc., Bancnet, card networks), identity verification services, game content providers, IT infrastructure and hosting providers, and customer support platform operators. All third-party processors are contractually bound to process personal data only in accordance with pilwin's instructions and to implement appropriate security measures.

6.2 Regulatory and Legal Authorities

pilwin is legally required to share personal data with the following authorities upon lawful request or as required by applicable regulation:

• Philippine Amusement and Gaming Corporation (PAGCOR) — for licensing compliance, audit, and player protection purposes;
• Anti-Money Laundering Council (AMLC) — for suspicious transaction reporting and compliance with the AMLA;
• National Privacy Commission (NPC) — in connection with data breach notifications and compliance inquiries;
• Any Philippine court, tribunal, or law enforcement authority pursuant to a lawful order or subpoena.

6.3 No Sale of Personal Data

pilwin does not sell, rent, trade, or otherwise transfer your personal data to third parties for their independent marketing or commercial purposes. Any disclosure of personal data to third parties is limited to the purposes described in this Policy and is subject to appropriate contractual safeguards.

Cookies & Tracking Technologies

7.1 Types of Cookies Used

pilwin uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly Necessary Cookies: Required for the Platform to function — including session management, login authentication, and security. These cannot be disabled without disrupting Platform functionality.
• Functional Cookies: Used to remember your preferences (such as game settings and language), improving your experience during subsequent sessions.
• Analytics Cookies: Used to collect aggregated, anonymized data about how players use the Platform — helping pilwin identify technical issues and prioritize improvements. pilwin uses analytics tools whose data remains within the Platform's control and is not shared with third-party advertisers.

7.2 Cookie Consent and Control

Upon your first visit to the pilwin Platform, you will be presented with a cookie consent notice. By accepting, you agree to the use of non-essential cookies as described above. You may withdraw consent for non-essential cookies at any time through the cookie settings accessible in the Platform's account preferences. Note that disabling certain cookies may affect the functionality of some Platform features.

You may also manage cookie settings through your browser — most modern browsers allow you to block or delete cookies. Strictly necessary cookies cannot be blocked without preventing core Platform functions from operating.

Data Security

pilwin implements a combination of technical and organizational security measures designed to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and pilwin's servers;
• Encryption of sensitive personal data and financial information at rest in pilwin's systems;
• Role-based access controls limiting employee access to personal data on a need-to-know basis;
• Multi-factor authentication for administrative access to systems containing personal data;
• Regular security assessments and penetration testing of Platform infrastructure;
• Incident response procedures for detecting and responding to data security events.

Despite these measures, no online platform can guarantee absolute security. In the event of a personal data breach that poses a risk to your rights and freedoms, pilwin will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected data subjects within the period prescribed by the NPC's breach notification guidelines.

You are responsible for maintaining the security of your account login credentials. pilwin strongly recommends using a strong, unique password for your pilwin account and enabling SMS two-factor authentication. Do not share your password or OTP with anyone, including individuals claiming to represent pilwin.

Data Retention

pilwin retains your personal data for as long as is necessary to fulfill the purposes for which it was collected, subject to the minimum retention periods required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with pilwin's data disposal procedures. Where deletion is not technically immediately feasible (for example, in backup systems), data is isolated and protected until deletion is possible.

Your Rights as a Data Subject

Under Republic Act No. 10173, you have the following rights with respect to your personal data held by pilwin. To exercise any of these rights, please submit a written request to pilwin's Data Protection Officer using the contact details in Section 14.

• Right to Be Informed: You have the right to be informed of what personal data pilwin is processing about you and the purposes for which it is being processed. This Policy fulfills that obligation.
• Right to Access: You have the right to request a copy of the personal data pilwin holds about you, including information about the categories of data processed and the purposes of processing.
• Right to Correction / Rectification: You have the right to request correction of inaccurate or incomplete personal data held by pilwin. Certain corrections may require submission of supporting documentation.
• Right to Erasure or Blocking: You have the right to request deletion or blocking of your personal data where processing is unlawful, the data is no longer necessary for the purposes for which it was collected, or you withdraw your consent and there is no other lawful basis for processing. This right is subject to pilwin's legal obligations to retain data under PAGCOR, AMLA, and other regulations.
• Right to Data Portability: You have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to request that it be transmitted to another platform, where technically feasible.
• Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, pilwin will cease processing your data for that purpose without requiring justification.
• Right to Damages: You have the right to claim compensation for damages sustained as a result of pilwin's non-compliance with RA 10173, subject to the provisions of the law.
• Right to File a Complaint: You have the right to file a complaint with the National Privacy Commission if you believe pilwin has violated your data privacy rights.

pilwin will respond to data subject rights requests within fifteen (15) business days of receipt. Requests may be subject to identity verification to prevent unauthorized access to personal data by third parties.

Children's and Minors' Privacy

The pilwin Platform is strictly for adults aged 21 years or older in compliance with PAGCOR regulations applicable to online gaming in the Philippines. pilwin does not knowingly collect, process, or retain personal data from individuals below the age of 21. The Platform implements age verification procedures during registration to enforce this restriction.

If pilwin discovers that personal data has been collected from a person below 21 years of age without proper parental or guardian consent, pilwin will promptly suspend the relevant account, delete the associated personal data, and decline to process any financial transactions connected to that account. If you believe that a minor has registered on the Platform, please notify pilwin's Data Protection Officer immediately using the contact details in Section 14.

International Data Transfers

pilwin primarily processes personal data of Filipino players within the Philippines or through service providers operating in jurisdictions that provide an adequate level of data protection. Where personal data is transferred outside the Philippines — for example, to international payment network processors or game software providers with processing infrastructure in other jurisdictions — pilwin ensures that appropriate safeguards are in place, including binding contractual clauses that require recipient organizations to protect personal data to a standard at least equivalent to that required under RA 10173.

pilwin does not transfer personal data to jurisdictions that do not provide adequate privacy protections without first implementing appropriate contractual and technical safeguards, and where required, obtaining approval from the National Privacy Commission.

Changes to This Privacy Policy

pilwin reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our processing activities, legal obligations, or platform operations. Material changes to this Policy will be communicated to registered players via the email address associated with their pilwin account, with a minimum of fourteen (14) days' notice before the revised Policy takes effect.

The effective date at the top of this Policy will be updated to reflect the date of any revision. Continued use of the pilwin Platform following the effective date of a revised Policy constitutes acceptance of the updated terms. If you do not agree with any revisions, you should cease using the Platform before the revised Policy takes effect.

Contact & Data Protection Officer

If you have any questions, concerns, or requests related to this Privacy Policy or pilwin's processing of your personal data, please contact pilwin's designated Data Protection Officer:

This Privacy Policy was last revised on 1 January 2026. Pilwin reserves the right to update this document in accordance with Section 13. All previous versions of this Policy are superseded by this current version upon its effective date.