winph2 Privacy Policy

Introduction & Controller Identity

This Privacy Policy is issued by winph2, the legal entity operating the online gaming platform accessible at winph2.win (the "Platform"). winph2 is a PAGCOR-licensed operator serving Filipino players across the Philippines, including Metro Manila, Cebu, Davao, Quezon City, Makati, and all other regions where eligible residents may lawfully access online gaming services.

winph2 acts as the Personal Information Controller (PIC) as defined under Republic Act 10173, the Data Privacy Act of 2012 of the Philippines. As PIC, winph2 determines the purposes and means by which your personal data is collected and processed in connection with the operation of the Platform and the provision of gaming services to Filipino players.

This Privacy Policy applies to all personal data collected from players and prospective players who access, register on, or use any part of the winph2 Platform. It also applies to personal data collected through winph2 customer support channels and any other direct communications between winph2 and its players.

Personal Data We Collect

winph2 collects personal data from players in the following categories. We collect only what is necessary for the specified purpose and do not collect excessive data beyond those requirements.

2.1 Registration Data

When you create a winph2 account, we collect: legal full name, date of birth, residential address in the Philippines, email address, Philippine mobile phone number, and a self-selected username and encrypted password. This information is required to create and maintain your account and to comply with PAGCOR licensing obligations regarding player identification.

2.2 Identity Verification (KYC) Data

To comply with PAGCOR regulations and the Anti-Money Laundering Act, winph2 requires identity verification before processing withdrawals. KYC data includes: copies of government-issued Philippine identification documents (e.g., PhilSys ID, passport, driver's licence, UMID), proof of residential address (e.g., utility bills, bank statements), and selfie images used to match against identity documents. KYC data is handled with elevated security measures given its sensitive nature.

2.3 Financial Transaction Data

winph2 records all financial transactions associated with your account, including: deposit amounts, dates, and payment method references (GCash transaction references, bank transfer confirmations, PayMaya references); withdrawal requests, amounts, and processing outcomes; and bonus credit issuances and wagering activity. Full payment card or bank account numbers are not stored by winph2 — financial institutions and payment processors handle this data under their own privacy obligations.

2.4 Gaming Activity Data

winph2 logs all gaming activity conducted through your account, including: games played, bet amounts, outcomes, session start and end times, and any real-time chat or interaction data within live dealer game environments. This data is used for dispute resolution, RTP verification, responsible gaming monitoring, and regulatory reporting.

2.5 Device and Technical Data

When you access the winph2 Platform, we automatically collect certain technical data including: IP address, browser type and version, operating system, device type (mobile/desktop/tablet), screen resolution, and general geographic location derived from IP address. This data is used for fraud detection, security monitoring, and platform optimisation for Philippine network conditions.

2.6 Communications Data

We retain records of all communications between you and winph2, including live chat transcripts, support email correspondence, and any feedback or complaints submitted. These records are maintained for quality assurance, dispute resolution, and regulatory compliance purposes.

Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, winph2 processes your personal data on one or more of the following lawful bases:

• Performance of a Contract: Processing your registration data, managing your winph2 account, facilitating deposits and withdrawals, and delivering gaming services are all necessary for the performance of the contract between you and winph2, constituted when you register an account and accept the Terms & Conditions.
• Legal Obligation: winph2 is required by PAGCOR regulations, the Anti-Money Laundering Act (RA 9160 as amended), and other applicable Philippine laws to collect, retain, and in some cases disclose specific player data. Processing for these purposes is mandatory and cannot be refused without forfeiting access to the Platform.
• Legitimate Interests: winph2 processes certain data (such as technical and device data) where there is a legitimate interest in doing so — specifically, fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided that this interest is not overridden by your fundamental rights and freedoms.
• Consent: Where winph2 uses your personal data for purposes not covered by the above bases — primarily direct marketing communications — we will seek your explicit consent before doing so. You may withdraw consent at any time through your winph2 account notification settings or by contacting support.

How winph2 Uses Your Personal Data

winph2 uses the personal data collected from Filipino players for the following specific purposes:

• Creating, maintaining, and managing your winph2 player account throughout its lifecycle.
• Processing deposits and withdrawals through GCash, PayMaya, BPI, BDO, Metrobank, and USDT channels.
• Verifying your identity and age (21+) in compliance with PAGCOR player verification requirements.
• Conducting AML checks and monitoring transaction patterns for suspicious activity as required under RA 9160.
• Operating responsible gaming tools including deposit limit enforcement, session timer monitoring, and self-exclusion records.
• Resolving disputes, including reviewing game logs, transaction histories, and communication records.
• Detecting, preventing, and investigating fraud, cheating, collusion, and platform abuse.
• Sending transactional communications including deposit confirmations, withdrawal notifications, and account security alerts.
• Sending promotional communications and bonus offers to players who have opted in to receive them — opt-out available at any time.
• Improving the winph2 platform experience, including mobile performance optimisation for Philippine network conditions.
• Complying with PAGCOR regulatory reporting requirements, court orders, and instructions from Philippine government authorities.

Cookies & Tracking Technologies

5.1 What Are Cookies

Cookies are small text files stored in your browser when you visit the winph2 Platform. They help the Platform function correctly, remember your preferences, and provide winph2 with information about how players interact with the site. Similar technologies such as web beacons, pixels, and local storage may also be used for comparable purposes.

5.2 Types of Cookies Used by winph2

• Strictly Necessary Cookies: Required for the Platform to function — including session authentication (keeping you logged in to your winph2 account), security tokens, and load balancing. These cannot be disabled without breaking the Platform's core functionality.
• Functional Cookies: Remember your preferences such as language settings, game lobby display options, and responsible gaming tool configurations so you don't have to reset them on every visit.
• Analytics Cookies: Collect anonymised data about how Filipino players navigate the winph2 Platform — pages visited, time spent, and device types used. This helps us improve the mobile experience and identify platform performance issues on Philippine mobile networks.
• Security Cookies: Used for fraud detection, login anomaly monitoring, and identifying potentially compromised sessions. These work alongside the Platform's 256-bit SSL protection.

5.3 Cookie Management

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to your winph2 account and using core Platform features. Analytics and functional cookies may be disabled without loss of core functionality, though some preference-saving features will not work.

Data Sharing & Third-Party Disclosure

6.1 Parties Who May Receive Your Data

winph2 does not sell your personal data. We may share your personal data with the following categories of recipients, strictly as necessary for the stated purposes:

• PAGCOR: winph2 is required to submit player-related reports to PAGCOR as part of its licensing obligations. This may include transaction data, player verification records, and responsible gaming reports.
• Anti-Money Laundering Council (AMLC): winph2 is a covered person under the AMLA and is required to submit covered transaction reports and suspicious transaction reports to the AMLC as mandated by law. This is a non-negotiable legal disclosure.
• Payment Processors: GCash (G-Xchange Inc.), PayMaya, BPI, BDO, Metrobank, and other payment service providers receive the minimum transaction data necessary to process deposits and withdrawals on your behalf. These parties operate under their own privacy policies and applicable Philippine financial regulations.
• Game Providers: Certified third-party game suppliers (such as Pragmatic Play and similar providers) may receive anonymised game session identifiers to support game delivery, RTP auditing, and jackpot verification. Game providers do not receive your full personal profile.
• KYC Verification Partners: Identity verification may be processed through a contracted third-party KYC provider operating under a data processing agreement and bound by the same data protection standards as winph2.
• Legal and Regulatory Authorities: In response to a valid court order, lawful government instruction, or PAGCOR directive, winph2 may be required to disclose player data to Philippine law enforcement, judicial bodies, or regulatory agencies.

6.2 Data Processing Agreements

All third parties engaged by winph2 as Personal Information Processors (PIPs) are required to enter into Data Processing Agreements (DPAs) that obligate them to process your data only as directed by winph2, to implement appropriate security measures, and to comply with the Philippine Data Privacy Act and NPC regulations.

Data Security

winph2 implements technical and organisational security measures appropriate to the risk level of the personal data we process. These measures include, but are not limited to:

• Encryption in Transit: All data exchanged between your browser or mobile device and the winph2 Platform is encrypted using TLS 1.2 or higher with 256-bit encryption. This applies to login, deposit, withdrawal, and all other Platform interactions.
• Encryption at Rest: Sensitive stored data, including KYC documents and financial records, is encrypted at rest using AES-256 standard encryption on winph2's secure servers.
• Password Security: Player account passwords are stored using a one-way cryptographic hash function. winph2 cannot retrieve your password — only reset it. This means that even in an internal security incident, password values are not exposed in plaintext.
• Access Controls: Access to winph2 player data is restricted to authorised personnel on a strict need-to-know basis. All internal data access is logged and subject to audit review.
• Two-Factor Authentication: winph2 offers two-factor authentication (2FA) to all account holders. Players are strongly encouraged to enable 2FA from their account security settings to provide an additional layer of protection against unauthorised access.
• Penetration Testing: winph2 conducts regular security assessments and penetration testing of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Staff Training: All winph2 personnel with access to personal data receive regular training on data privacy obligations under RA 10173 and winph2's internal data handling procedures.

While winph2 takes all reasonable and proportionate measures to protect your personal data, no electronic transmission or storage system is completely immune to interception or breach. Players are encouraged to use strong, unique passwords for their winph2 accounts and to enable 2FA as an additional protective measure.

Data Retention

winph2 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to longer retention periods required by applicable Philippine law. The following general retention principles apply:

• Account and Registration Data: Retained for the duration of your active winph2 account, and for a further period of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and applicable limitation periods under Philippine law.
• KYC and Identity Data: Retained for a minimum of five (5) years from the date of the last transaction on the account, as required by the AMLA and PAGCOR regulations. KYC documents are stored in encrypted form and access is restricted to compliance-authorised personnel only.
• Financial Transaction Records: Retained for a minimum of five (5) years from the transaction date, as required under PAGCOR licence conditions and the AMLA.
• Gaming Activity Logs: Retained for a rolling period of ninety (90) days for dispute resolution purposes, and in aggregated anonymised form for longer-term RTP auditing and regulatory reporting.
• Technical and Device Data: Retained for a maximum of thirteen (13) months for security and fraud analytics purposes, after which it is deleted or anonymised.
• Marketing Preferences and Consent Records: Retained for as long as you hold an active winph2 account or until you withdraw consent, whichever is earlier. Consent withdrawal records are retained for three (3) years as evidence of compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of individual records.

Your Rights as a Data Subject

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules, you have the following rights with respect to your personal data held by winph2. These rights are free to exercise and winph2 will respond to valid requests within thirty (30) calendar days.

Children & Minors

The winph2 Platform is strictly prohibited for use by any individual under twenty-one (21) years of age, consistent with PAGCOR regulations governing commercial gaming in the Philippines. winph2 does not knowingly collect personal data from individuals under 21 years old. All account registrations are subject to age verification, and any account found to belong to a person under 21 will be immediately suspended and all associated data handled in accordance with PAGCOR reporting obligations.

If you believe that winph2 has inadvertently collected personal data from a person under 21, please contact our Data Protection Officer immediately at the email address in Section 13. winph2 will investigate and take prompt corrective action, including deletion of any data unlawfully collected from a minor and notification to PAGCOR as required.

Cross-Border Data Transfers

winph2's primary data processing infrastructure is located within jurisdictions that maintain adequate data protection standards. In cases where it is necessary to transfer your personal data outside the Philippines — for example, to a game content provider whose servers are located abroad — winph2 will ensure that adequate safeguards are in place to protect your data during the transfer, as required by the NPC's rules on cross-border data flow under the Data Privacy Act.

Adequate safeguards may include data processing agreements incorporating NPC-approved standard contractual clauses, or transfers to recipients in countries recognised by the NPC as providing an adequate level of data protection. winph2 will not transfer your personal data to jurisdictions without adequate protections in place without your informed consent.

Changes to This Privacy Policy

winph2 reserves the right to update or amend this Privacy Policy at any time to reflect changes in Philippine law, NPC guidelines, PAGCOR regulatory requirements, or winph2's data processing practices. Where changes are material — meaning they significantly affect your rights or how your data is used — winph2 will notify registered players via email to the address associated with their winph2 account at least fourteen (14) days before the changes take effect.

The "Last Updated" date at the top of this policy indicates when the most recent revision was made. We recommend reviewing this Privacy Policy periodically. Continued use of the winph2 Platform after the effective date of any amended Privacy Policy constitutes your acceptance of the revised terms, to the extent permitted by applicable Philippine law.

Data Protection Officer

winph2 has appointed a Data Protection Officer (DPO) in compliance with the requirements of the Data Privacy Act of 2012 and NPC Circular 17-01. The DPO is responsible for overseeing winph2's compliance with RA 10173, liaising with the National Privacy Commission, and serving as the primary point of contact for data subjects exercising their rights.

You may contact the winph2 Data Protection Officer for any privacy-related inquiries, data subject rights requests, or complaints through the following channel:

• Email (DPO): [email protected] — please use subject line "Privacy / DPO Inquiry"
• Live Chat: Available 24/7 through the winph2 Platform — request transfer to data privacy support

winph2 will acknowledge DPO inquiries within three (3) business days and provide a substantive response within the timeframes prescribed by the Data Privacy Act and applicable NPC guidelines.

How to Complain

If you believe that winph2 has processed your personal data in a manner that violates your rights under the Philippine Data Privacy Act, or that winph2 has failed to comply with any of its obligations under this Privacy Policy, you may raise a complaint through the following escalation path:

1. Contact winph2 First: Submit a written complaint to the winph2 Data Protection Officer at [email protected]. winph2 will acknowledge your complaint within three (3) business days and provide a substantive response within thirty (30) calendar days. Most privacy concerns are resolved at this stage.
2. Escalate to PAGCOR: If your complaint relates to winph2's conduct as a licensed gaming operator and cannot be resolved through direct communication, you may escalate through PAGCOR's official complaints process.
3. File with the National Privacy Commission (NPC): If you are not satisfied with winph2's response to your data privacy complaint, you have the right to file a formal complaint with the National Privacy Commission of the Philippines, the independent body established under RA 10173 to enforce the Data Privacy Act. The NPC provides an accessible complaints process for Filipino data subjects.