winphp Privacy Policy

This Privacy Policy ("Policy") describes how winphp ("we", "us", "our") collects, uses, stores, discloses, and otherwise processes personal data in connection with your use of the winphp online gaming platform accessible at https://winphp.biz and any associated mobile-optimised interfaces (collectively, the "Platform").

winphp operates under the licensing authority of the Philippine Amusement and Gaming Corporation (PAGCOR) and is subject to the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines. All personal data processing activities described in this Policy are conducted in compliance with these frameworks.

By accessing or using the winphp Platform, you acknowledge that you have read and understood this Policy. If you do not agree to the collection and processing of your personal data as described herein, you must not access or use the Platform.

1 About This Policy

1.1  This Policy applies to all personal data processed by winphp in relation to: registered Player Accounts; visitors who browse the Platform without registering; individuals who contact winphp via support channels; and any other individuals whose personal data winphp receives in connection with its gaming operations.

1.2  This Policy is to be read together with the winphp Terms & Conditions and the Responsible Gaming Policy, each of which forms part of the overall framework governing your relationship with winphp.

1.3  This Policy does not apply to third-party websites, payment processors, or services that may be linked from the Platform. winphp is not responsible for the privacy practices of any third-party service provider beyond what is expressly addressed in Section 6 of this Policy.

2 Data Controller

2.1  winphp is the personal information controller (as defined under RA 10173) in respect of personal data processed through the Platform. For the avoidance of doubt, winphp determines the purposes for which, and the manner in which, your personal data is processed.

2.2  winphp has appointed a Data Protection Officer (DPO) as required under the Data Privacy Act. The DPO may be contacted at the address set out in Section 15 of this Policy.

3 Personal Data We Collect

3.1  Registration & Identity Data. When you create a Player Account on winphp, we collect: full legal name; date of birth; residential address (barangay, city/municipality, province); Philippine mobile number; email address; username; and password (stored in hashed, non-reversible form).

3.2  KYC & Identity Verification Data. To comply with PAGCOR licensing requirements and Anti-Money Laundering (AML) obligations under RA 9160 as amended, winphp collects: government-issued ID type, number, and expiry; ID document images (front and back); and where required, a selfie or liveness check image for biometric matching.

3.3  Financial & Transaction Data. winphp processes: deposit and withdrawal transaction records; linked payment method identifiers (GCash mobile number, Maya account reference, bank account name and last digits — winphp does not store full card numbers or complete bank account numbers); and transaction history associated with a Player Account.

3.4  Gaming & Behavioural Data. winphp logs: game session records (game title, stakes, outcomes, timestamps); sports betting selections and outcomes; login and logout timestamps; session duration; and responsible gaming tool settings and activations (deposit limits, self-exclusion requests).

3.5  Technical & Device Data. winphp automatically collects: IP address; device type and operating system; browser type and version; screen resolution; referring URL; and pages viewed within the Platform.

3.6  Communications Data. winphp retains records of support interactions (live chat transcripts, email correspondence) and any complaints or responsible gaming disclosures submitted by Players.

4 How We Collect Your Data

winphp collects personal data through the following channels:

• Directly from you — via the registration form, KYC submission, cashier interactions, support contact, and responsible gaming tool activations on the Platform
• Automatically — through cookies, web beacons, and server log files when you access or interact with the Platform (see Section 9)
• From payment processors — GCash, Maya, BPI, BDO, Metrobank, and other Philippine payment channels transmit transaction confirmation data to winphp upon deposit and withdrawal processing
• From identity verification services — winphp may use third-party KYC and AML screening providers to verify government-issued IDs and screen against sanctions and PEP (politically exposed person) lists as required by PAGCOR and AML Law
• From regulatory authorities — PAGCOR and relevant Philippine government agencies may provide or request data sharing in connection with licensing compliance, AML reporting, or investigations

5 Purposes & Legal Bases for Processing

5.1  Performance of Contract. winphp processes Registration Data, Financial Data, and Gaming Data to administer your Player Account, process deposits and withdrawals, and provide access to the games and services you have contracted for. This processing is necessary for the performance of the agreement between you and winphp.

5.2  Legal Obligation. KYC and AML-related processing is required by PAGCOR licensing conditions and by RA 9160. winphp has no discretion to avoid this processing — it is a mandatory regulatory obligation. Responsible gaming data (deposit limits, self-exclusion records) is retained in compliance with PAGCOR's responsible gaming framework.

5.3  Legitimate Interests. winphp processes Technical Data and Gaming Behavioural Data for fraud detection, platform security, and problem gambling risk monitoring. These purposes are proportionate to winphp's legitimate interests in maintaining a safe, secure, and fair gaming environment and do not override Players' fundamental rights.

5.4  Consent. winphp processes Communications Data for direct marketing (promotions, bonus offers, news) only with your explicit consent obtained at registration or opt-in. You may withdraw marketing consent at any time via your Account Settings or by contacting winphp support.

6 Disclosure to Third Parties

6.1  winphp does not sell or rent your personal data to third parties for their own marketing purposes. Personal data is disclosed to third parties only in the following circumstances:

• Payment Processors — GCash, Maya, BPI, BDO, Metrobank, InstaPay, and other payment service providers receive the minimum data required to process your transactions
• KYC & AML Service Providers — identity verification and sanctions screening providers process KYC data under data processing agreements that bind them to equivalent data protection standards
• Game Software Providers — RNG and live dealer game providers may receive pseudonymised session data (player ID, stake, outcome) for game integrity auditing purposes
• PAGCOR and Philippine Government Authorities — winphp is obligated to provide data to PAGCOR, the AMLC (Anti-Money Laundering Council), and other competent authorities upon lawful request or as part of mandatory reporting obligations
• Professional Advisors — auditors, legal counsel, and compliance consultants who are bound by professional confidentiality obligations

6.2  All third-party processors engaged by winphp are required to process personal data solely on winphp's documented instructions and to implement appropriate technical and organisational security measures.

7 International Data Transfers

7.1  winphp's primary data infrastructure is located in the Philippines. Where personal data is transferred to service providers operating in other jurisdictions (for example, KYC providers with processing infrastructure outside the Philippines), winphp ensures that appropriate safeguards are in place, including: contractual clauses approved by the NPC; adequacy assessments demonstrating the receiving jurisdiction provides substantially equivalent data protection; or the explicit informed consent of the data subject.

7.2  Players may request information about specific cross-border data transfers by contacting the winphp DPO at the address in Section 15.

8 Data Retention

8.1  winphp retains personal data for the periods necessary to fulfil the purposes described in this Policy, subject to longer retention periods required by law:

• KYC and AML Records — retained for a minimum of five (5) years following the closure of a Player Account, as required by RA 9160
• Transaction Records — retained for a minimum of five (5) years from the date of the transaction for AML and PAGCOR audit purposes
• Gaming Session Logs — retained for three (3) years from the date of the session for dispute resolution and regulatory audit purposes
• Self-Exclusion Records — retained for the duration of the exclusion plus five (5) years to prevent a Player from circumventing exclusion by creating a new account
• Marketing Consent Records — retained for three (3) years following withdrawal of consent to evidence consent history

8.2  Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with winphp's data destruction procedures.

9 Cookies & Tracking Technologies

9.1  winphp uses cookies and similar tracking technologies to operate the Platform, remember your session preferences, detect fraud, and understand how Players interact with different parts of the Platform.

9.2  Strictly Necessary Cookies are required for the Platform to function and cannot be disabled. They include session authentication tokens and security cookies that prevent cross-site request forgery.

9.3  Functional Cookies remember your language preferences, display settings, and responsible gaming configurations across sessions.

9.4  Analytics Cookies collect pseudonymised data about page visits, session duration, and navigation paths to help winphp improve the Platform's performance and usability. Analytics data is not linked to your identity.

9.5  You may manage non-essential cookie preferences via your browser settings. Disabling strictly necessary cookies will impair your ability to log in and use the Platform.

10 Security Measures

10.1  winphp implements technical and organisational security measures proportionate to the sensitivity of the personal data processed. These measures include:

• TLS 1.2/1.3 encryption for all data in transit between your device and winphp servers
• AES-256 encryption for sensitive data at rest, including KYC document storage
• Bcrypt hashing for all stored password credentials — winphp staff cannot access your plaintext password under any circumstances
• Role-based access controls limiting staff access to personal data on a need-to-know basis
• Intrusion detection and DDoS mitigation systems monitoring Platform infrastructure in real time
• Annual penetration testing and security audits by independent third-party security firms

10.2  Despite these measures, no internet-connected system is immune to all risks. winphp strongly recommends that Players enable two-factor authentication on their Player Account and use a unique, strong password not reused across other services.

10.3  In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, winphp will notify you and the NPC within the timeframes required by RA 10173 and NPC Circular 16-03.

11 Your Data Subject Rights

11.1  Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by winphp:

• Right to be Informed — the right to know what data winphp collects and how it is used, as set out in this Policy
• Right of Access — the right to request a copy of the personal data winphp holds about you
• Right to Rectification — the right to have inaccurate personal data corrected; you may update most of your account information directly via Account Settings
• Right to Erasure — the right to request deletion of personal data where there is no lawful basis for continued processing; this right is subject to winphp's legal retention obligations under AML Law and PAGCOR requirements
• Right to Data Portability — the right to receive your personal data in a structured, commonly used, and machine-readable format where technically feasible
• Right to Object — the right to object to processing based on legitimate interests, including direct marketing; marketing opt-out takes effect immediately upon request
• Right to Lodge a Complaint — the right to lodge a complaint with the National Privacy Commission of the Philippines if you believe your data rights have been violated

11.2  To exercise any of the above rights, contact the winphp DPO as described in Section 15. winphp will respond to verified data subject requests within fifteen (15) business days of receipt.

12 Marketing Communications

12.1  With your consent, winphp may send you promotional communications regarding bonuses, new game launches, sports betting events (including PBA season promotions, UFC fight night offers, and sabong specials), and loyalty programme updates via SMS to your registered Philippine mobile number and/or email.

12.2  You may withdraw consent to marketing communications at any time by: updating your communication preferences in Account Settings; replying STOP to any promotional SMS; or contacting winphp support. Withdrawal of marketing consent does not affect the lawfulness of processing that occurred prior to withdrawal and does not restrict winphp from sending service-essential communications (transaction confirmations, account security alerts, responsible gaming notifications).

12.3  winphp will never send marketing communications to any Player who is subject to an active self-exclusion order or who has identified themselves to winphp as experiencing a problem with gambling.

13 Children & Minors

13.1  The winphp Platform is strictly limited to individuals who are twenty-one (21) years of age or older under PAGCOR's licensing conditions and Philippine gambling law. winphp does not knowingly collect or process personal data from individuals below the age of 21.

13.2  If winphp becomes aware that personal data has been collected from an individual below the minimum age, the relevant Player Account will be immediately suspended, data will be deleted to the extent permitted by legal obligations, and the matter will be referred to PAGCOR.

14 Changes to This Policy

14.1  winphp may update this Privacy Policy from time to time to reflect changes in its data processing activities, applicable law, or NPC guidance. The current version is always accessible at https://winphp.biz/privacy-policy and displays the effective and last-updated dates at the top of the document.

14.2  Material changes — such as new categories of data collection or new third-party disclosures — will be communicated to registered Players via their registered mobile number or email address at least seven (7) days before taking effect. Continued use of the Platform after notice of a material change constitutes acceptance of the updated Policy.

15 Contact & Data Protection Officer

For any questions about this Privacy Policy, to exercise your data subject rights, or to contact the winphp Data Protection Officer, please use the following contact details. Note: The email address below is provided as plain text only and is not a clickable link.

winphp Data Protection Officer
Email: [email protected]
Subject Line: "Privacy – [Your Request Type]"
Response Target: Within 15 business days of verified receipt

You also have the right to lodge a complaint with the National Privacy Commission of the Philippines if you believe your data protection rights have been infringed. Information about how to submit a complaint to the NPC is publicly available on the NPC's official government website.