gwin Privacy Policy

01 Who We Are

This Privacy Policy is issued by the operator of the gwin platform, accessible at gwin.asia ("gwin," "we," "us," "our"). gwin is a PAGCOR-regulated online gaming platform serving Filipino players. We are the data controller responsible for the personal information you provide when using the gwin platform.

gwin has appointed a Data Protection Officer (DPO) in accordance with the requirements of the Philippine Data Privacy Act of 2012 and the National Privacy Commission's guidelines. The DPO is responsible for overseeing gwin's data protection practices and can be contacted as described in Section 14 of this Policy.

02 Personal Data We Collect

gwin collects the following categories of personal information from players and prospective players:

gwin does not collect sensitive personal information beyond what is required for identity verification and responsible gaming compliance. We do not collect biometric data, health information, or political opinions.

03 How We Collect Your Data

gwin collects personal information through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated collection: Technical data collected automatically when you access the gwin platform, including through cookies, web beacons, and server logs. See Section 7 for details on cookies.
• Third-party sources: Identity verification data from PAGCOR-approved KYC service providers; fraud and AML screening data from compliance service providers; payment data from GCash, PayMaya, and banking partners as part of transaction processing.

gwin will always inform you at the point of collection what data is being collected and why. Mandatory fields during registration are marked as required; optional fields are clearly indicated.

04 How We Use Your Personal Data

gwin uses your personal information for the following purposes:

1. Account management: Creating and maintaining your gwin account, verifying your identity and age (21+), and managing your account settings and preferences.
2. Service delivery: Processing your deposits and withdrawals in Philippine Peso, operating game sessions, crediting bonuses, and providing customer support.
3. Legal and regulatory compliance: Meeting gwin's obligations under PAGCOR regulations, the Philippine Anti-Money Laundering Act (AMLA), the Data Privacy Act of 2012, and other applicable Philippine laws. This includes filing mandatory reports with the Anti-Money Laundering Council (AMLC) where required.
4. Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behaviour, enforcing deposit limits and self-exclusion requests, and complying with PAGCOR's responsible gaming framework.
5. Security and fraud prevention: Detecting and preventing unauthorized account access, fraudulent transactions, bonus abuse, and other prohibited conduct.
6. Platform improvement: Analysing aggregated, anonymised usage data to improve the gwin platform, game selection, and user experience.
7. Marketing communications: Sending you information about gwin promotions, new games, and special offers — but only where you have consented to receive such communications or where gwin has a legitimate interest in doing so. You may opt out at any time.

05 Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, gwin processes your personal information on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and gwin — including account creation, game operation, and payment processing.
• Legal obligation: Processing required to comply with PAGCOR regulations, AMLA reporting requirements, tax obligations, and other applicable Philippine laws.
• Legitimate interests: Processing for fraud prevention, security monitoring, platform improvement, and direct marketing to existing players, where these interests are not overridden by your privacy rights.
• Consent: Processing for optional purposes such as marketing communications to prospective players, where gwin has obtained your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

06 Data Sharing and Disclosure

gwin does not sell, rent, or trade your personal information. We share your data only in the following circumstances and only to the extent necessary:

• Service providers: Third-party companies that provide services to gwin under strict data processing agreements, including KYC verification providers, payment processors (GCash, PayMaya, banking partners), cloud infrastructure providers, and customer support platform operators. These providers are contractually prohibited from using your data for any purpose other than providing services to gwin.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities where disclosure is required by law or regulation.
• Law enforcement: Philippine law enforcement agencies where gwin is legally required to disclose information in connection with a criminal investigation or court order.
• Business transfers: In the event of a merger, acquisition, or sale of gwin's business, your personal information may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

07 Cookies and Tracking Technologies

gwin uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small text files stored on your device that help gwin recognise you, remember your preferences, and analyse how the platform is used.

gwin uses the following categories of cookies:

You can manage your cookie preferences through the cookie settings panel accessible from the footer of the gwin platform. You may also control cookies through your browser settings; however, disabling strictly necessary cookies will prevent you from logging in and using the platform.

gwin does not use cookies to serve third-party advertising or to track your activity on other websites.

08 Data Retention

gwin retains your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and regulation. The following retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, as required by PAGCOR regulations and the Philippine Anti-Money Laundering Act.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLA and PAGCOR record-keeping requirements.
• Gaming history: Retained for a minimum of three (3) years to support dispute resolution and responsible gaming monitoring.
• Support communications: Retained for two (2) years from the date of the last communication, unless a longer period is required for an ongoing dispute or legal matter.
• Marketing consent records: Retained for the duration of your account and for one (1) year following account closure, to demonstrate compliance with consent requirements.
• Technical and log data: Retained for twelve (12) months for security and fraud prevention purposes.

When personal information is no longer required, gwin securely deletes or anonymises it in accordance with industry-standard data destruction procedures. Anonymised, aggregated data may be retained indefinitely for statistical and platform improvement purposes.

09 Data Security

gwin implements a comprehensive set of technical and organisational security measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and gwin's servers is protected using TLS 1.3 encryption. The gwin platform enforces HTTPS across all pages and connections.
• Encryption at rest: Sensitive personal data stored on gwin's servers — including identity documents, financial details, and authentication credentials — is encrypted using AES-256.
• Access controls: Access to personal data is restricted to gwin staff and service providers who have a legitimate need to access it. All access is logged and subject to regular review. Staff with access to personal data are subject to confidentiality obligations.
• Two-factor authentication: gwin offers and recommends two-factor authentication (2FA) for all player accounts. Certain high-value account actions require 2FA regardless of player preference.
• Penetration testing and security audits: gwin's platform undergoes regular independent security assessments to identify and remediate vulnerabilities.
• Incident response: gwin maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights, gwin will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected players without undue delay.

While gwin takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the security of your gwin Login credentials and for notifying gwin immediately if you suspect unauthorised access to your account.

10 Your Data Privacy Rights

Under the Philippine Data Privacy Act of 2012 (Republic Act 10173), you have the following rights with respect to your personal information held by gwin:

• Right to be informed: The right to know what personal information gwin collects about you, how it is used, and with whom it is shared. This Privacy Policy fulfils gwin's obligation to inform you.
• Right of access: The right to request a copy of the personal information gwin holds about you. gwin will respond to access requests within 15 business days.
• Right to rectification: The right to request correction of inaccurate or incomplete personal information. You can update most account details directly through your gwin account settings.
• Right to erasure: The right to request deletion of your personal information where it is no longer necessary for the purposes for which it was collected, subject to gwin's legal retention obligations under PAGCOR regulations and AMLA.
• Right to object: The right to object to the processing of your personal information for direct marketing purposes. You may exercise this right at any time through your account notification settings or by contacting gwin support.
• Right to data portability: The right to receive a copy of your personal information in a structured, commonly used, machine-readable format, where technically feasible.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe gwin has violated your data privacy rights. The NPC can be reached through its official channels.

To exercise any of these rights, contact gwin's Data Protection Officer as described in Section 14. gwin will verify your identity before processing any data rights request to protect against unauthorised access to your information.

11 Children's Privacy and Age Restriction

The gwin platform is strictly intended for adults aged 21 years and above, in accordance with Philippine gaming regulations enforced by PAGCOR. gwin does not knowingly collect personal information from individuals under the age of 21.

During registration, gwin requires all applicants to confirm that they are at least 21 years of age and to provide a valid Philippine government-issued identification document for age verification. Accounts found to belong to individuals under 21 will be immediately closed and any balance returned to the registered payment method.

If you believe that gwin has inadvertently collected personal information from a person under the age of 21, please contact gwin's Data Protection Officer immediately using the contact details in Section 14. gwin will promptly investigate and, where confirmed, delete the relevant information and close the associated account.

12 Cross-Border Data Transfers

gwin's primary data processing infrastructure is located within the Philippines. In certain circumstances, personal data may be transferred to or processed by service providers located outside the Philippines — for example, cloud infrastructure providers or KYC verification services with international operations.

Where such transfers occur, gwin ensures that appropriate safeguards are in place to protect your personal information in accordance with the requirements of the Philippine Data Privacy Act of 2012 and the National Privacy Commission's guidelines on cross-border data transfers. These safeguards include:

• Contractual clauses requiring overseas recipients to apply data protection standards equivalent to those required under Philippine law.
• Selecting service providers that operate in jurisdictions with data protection laws recognised as providing an adequate level of protection.
• Conducting due diligence on the data protection practices of all overseas service providers before engaging them.

gwin does not transfer personal data to overseas recipients for marketing or commercial purposes unrelated to the operation of the gwin platform.

13 Changes to This Privacy Policy

gwin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. When material changes are made, gwin will notify registered players via email or in-platform notification at least 7 days before the changes take effect, where practicable.

The most current version of this Privacy Policy will always be available at gwin.asia/privacy-policy. The "Last Updated" date at the top of this page indicates when the Policy was most recently revised. We encourage you to review this Policy periodically.

Your continued use of the gwin platform after the effective date of any amendment constitutes your acknowledgment of the revised Privacy Policy. If you do not agree with the changes, you may close your account in accordance with the gwin Terms and Conditions.

14 Contact and Data Protection Officer

If you have questions about this Privacy Policy, wish to exercise your data privacy rights, or need to report a privacy concern, please contact gwin's Data Protection Officer through the following channels:

• Live Chat: Available 24/7 through the gwin platform. For privacy-related matters, select "Privacy & Data" from the support topic menu.
• Email (DPO): privacy at gwin.asia — please include "Data Privacy Request" in your subject line along with your registered account username.

gwin will acknowledge all privacy-related enquiries within 3 business days and will provide a substantive response within 15 business days. For complex requests, gwin may request an extension of up to an additional 15 business days, in which case you will be notified of the extension and the reason for it.

If you are not satisfied with gwin's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, the independent authority responsible for enforcing the Data Privacy Act of 2012.