Your Privacy at gwinph
gwinph is committed to protecting the personal information of every Filipino player on our platform. This Privacy Policy explains exactly what data we collect, why we collect it, how we use it, and the rights you hold under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).
// LAST UPDATED: JANUARY 2026 | VERSION 2.4Contents
01 Who We Are 02 Data We Collect 03 How We Collect Data 04 Why We Process Your Data 05 Legal Basis 06 Data Sharing 07 International Transfers 08 Data Retention 09 Cookies & Tracking 10 Your Rights (DPA) 11 Security Measures 12 Minors 13 Third-Party Services 14 Policy Changes 15 Contact & DPOSummary: gwinph collects only the data necessary to operate a safe, compliant, and enjoyable online casino for Filipino players. We do not sell your personal information to third parties. We do not use your data for purposes beyond what is described in this policy. Your rights under Republic Act No. 10173 (the Philippine Data Privacy Act) are fully respected and enforceable at any time by contacting our Data Protection Officer.
01 Who We Are
gwinph is an online casino and sports betting platform operated under a PAGCOR (Philippine Amusement and Gaming Corporation) licence, serving Filipino players aged 21 and above. The gwinph platform is accessible at gwinph.app and any associated mobile applications or sub-domains that link to this Privacy Policy.
For the purposes of the Philippine Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations, gwinph acts as the Personal Information Controller (PIC) in respect of the personal data of registered players and website visitors. Where gwinph engages third-party game providers, payment processors, or technology partners to process data on its behalf, those parties act as Personal Information Processors (PIPs) and are bound by appropriate data processing agreements.
Data Protection Officer: gwinph has appointed a Data Protection Officer (DPO) as required by the National Privacy Commission (NPC). You may contact the DPO at any time by writing to [email protected] with the subject line "Data Privacy — DPO Request".
02 Data We Collect
gwinph collects personal data that is necessary, adequate, and not excessive relative to the purposes for which it is processed. The categories of personal data we collect are described in the table below.
| Category | Examples | Mandatory? |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, government-issued ID number (Passport, Driver's Licence, PhilSys National ID, UMID, SSS ID) | Yes — required for KYC |
| Contact Data | Philippine mobile number, email address, residential address | Yes — required for account |
| Financial Data | GCash account reference, PayMaya reference, BPI/BDO/Metrobank account details (partial), cryptocurrency wallet addresses, deposit and withdrawal history | Yes — required for transactions |
| Verification Data | Copies of ID documents, selfie photographs, proof-of-address documents, source-of-funds declarations | Yes — required for KYC |
| Technical Data | IP address, device fingerprint, browser type and version, operating system, session tokens, login timestamps | Automatic — collected on use |
| Usage Data | Game history, bet amounts, wagering patterns, bonus claims, session duration, pages visited | Automatic — collected on use |
| Communication Data | Live chat transcripts, support email correspondence, feedback submissions | Collected when you contact us |
| Responsible Gaming Data | Deposit limits set, loss limits set, self-exclusion elections, reality check preferences, problem gambling indicators | Collected when tools are used |
We do NOT collect: Full payment card numbers, CVV codes, or full bank account numbers. Payment channel integrations (GCash, PayMaya, BPI, BDO, Metrobank) handle sensitive financial credentials on their own secure servers. gwinph receives only a transaction reference or masked identifier.
03 How We Collect Your Data
gwinph collects personal data through the following channels:
3.1 Direct Collection
When you register a gwinph account, complete KYC verification, make a deposit or withdrawal, contact our support team, participate in a promotion, or use any interactive feature of the platform, you provide personal data directly to us.
3.2 Automated Collection
When you visit gwinph.app or use the gwinph platform, our servers and analytics systems automatically record Technical Data and Usage Data. This includes your IP address, browser type, device identifiers, and all game and betting activity conducted within your session. This data is collected through first-party cookies, session logs, and our platform analytics engine.
3.3 Third-Party Sources
In certain circumstances, gwinph may receive personal data about you from third-party sources, including:
- Identity verification partners engaged to assist with KYC screening
- Anti-fraud and anti-money laundering screening providers
- PAGCOR or other regulatory authorities, where required by law
- Payment processors confirming transaction status and payer identity
In all cases, third-party sourcing of personal data is limited to what is strictly necessary for the stated purpose and is conducted in compliance with RA 10173.
04 Why We Process Your Data
gwinph processes personal data only for specific, legitimate, and clearly defined purposes. We do not process data in a manner that is incompatible with these stated purposes.
| Purpose | Data Categories Used |
|---|---|
| Account registration and management | Identity Data, Contact Data |
| KYC / age verification (21+ enforcement) | Identity Data, Verification Data |
| Processing deposits and withdrawals | Identity Data, Financial Data, Technical Data |
| Anti-money laundering (AMLA) compliance | Identity Data, Financial Data, Verification Data |
| Fraud detection and prevention | Technical Data, Usage Data, Financial Data |
| Responsible gaming monitoring | Usage Data, Responsible Gaming Data |
| Customer support | Identity Data, Contact Data, Communication Data |
| Platform improvement and analytics | Usage Data, Technical Data (anonymised where possible) |
| Promotional and bonus administration | Identity Data, Usage Data, Financial Data |
| Legal and regulatory compliance | All categories as required by applicable law |
gwinph does not use your personal data for automated decision-making that produces legal or similarly significant effects, except where required by PAGCOR AML directives or fraud prevention obligations — and in those cases, you have the right to request human review of any automated decision.
05 Legal Basis for Processing
Every instance of personal data processing at gwinph is grounded in at least one of the following lawful bases as defined under RA 10173 and its Implementing Rules and Regulations:
- Consent: You have given clear, informed consent to the processing of your personal data for a specific purpose (e.g., receiving promotional communications). Consent may be withdrawn at any time by contacting our DPO, though withdrawal will not affect the lawfulness of processing prior to withdrawal.
- Contractual Necessity: Processing is necessary to fulfil the contract between you and gwinph — principally, the Terms & Conditions governing your player account. This includes account creation, game play, and payment processing.
- Legal Obligation: Processing is required to comply with Philippine law, including the Anti-Money Laundering Act (RA 9160 as amended), PAGCOR regulatory directives, the Data Privacy Act itself, and other applicable statutes.
- Legitimate Interest: Processing is necessary for the legitimate interests of gwinph, provided those interests are not overridden by your fundamental rights and freedoms. Examples include fraud prevention, platform security, and service analytics.
- Protection of Vital Interests: In rare circumstances, processing may be necessary to protect your vital interests or those of another natural person — for example, where responsible gaming monitoring indicates an imminent risk of serious harm.
06 Data Sharing & Disclosure
gwinph does not sell, rent, or trade your personal data to any third party for commercial purposes. Data is shared with third parties only to the extent necessary and under the following circumstances:
6.1 Service Providers (Personal Information Processors)
gwinph engages trusted third-party processors to assist with specific operational functions. These include KYC and identity verification providers, payment gateway operators (GCash, PayMaya, BPI, BDO, Metrobank, and cryptocurrency payment processors), game content providers (JILI, Pragmatic Play, PG Soft, CQ9, Habanero, Evolution Gaming), IT infrastructure and hosting providers, and fraud analytics services. All processors are bound by written data processing agreements requiring them to process data solely on gwinph's instructions and to maintain appropriate security standards.
6.2 Regulatory and Law Enforcement Authorities
gwinph is obligated to disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities when required by law, court order, or regulatory directive. gwinph will not notify you of such disclosures where prohibited from doing so by applicable law.
6.3 Business Transfers
In the event of a merger, acquisition, reorganisation, or sale of all or a portion of gwinph's business, personal data held on player accounts may be transferred to the acquiring entity. You will be notified of any such transfer and of any material change to the applicable privacy terms in advance, where practically possible.
No data brokering: gwinph has never sold player data to data brokers, advertisers, or marketing aggregators, and has no intention of doing so. Your gwinph data stays within the gwinph ecosystem and its regulated service providers.
07 International Data Transfers
Some of gwinph's third-party processors — particularly game content providers and cloud infrastructure partners — may operate servers located outside the Philippines. Where personal data is transferred to a country that the National Privacy Commission has not deemed to provide an adequate level of data protection, gwinph ensures appropriate safeguards are in place, including:
- Contractual clauses that impose data protection obligations substantially equivalent to those under RA 10173
- Binding corporate rules where the recipient is part of the same corporate group
- Processing only data that is strictly necessary for the service function being outsourced
By registering on gwinph, you acknowledge that your personal data may be processed in jurisdictions outside the Philippines where data protection laws may differ. In all cases, the safeguards described above apply to protect your information.
08 Data Retention
gwinph retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by Philippine law. The following retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & KYC Data | Duration of account + 5 years after closure | PAGCOR regulations, AMLA |
| Financial Transaction Records | 10 years from transaction date | Anti-Money Laundering Act (RA 9160) |
| Communication & Support Records | 3 years from date of correspondence | Dispute resolution / legal claims |
| Technical & Usage Data (logs) | 12 months on live systems; up to 3 years in secure archive | Fraud investigation, security |
| Responsible Gaming Records | Duration of self-exclusion period + 5 years | PAGCOR responsible gaming mandate |
| Marketing Preferences | Until consent is withdrawn | Consent |
Once the applicable retention period has expired and no legal hold is in force, gwinph will securely delete or irreversibly anonymise the relevant personal data.
09 Cookies & Tracking Technologies
gwinph uses cookies and similar tracking technologies on the gwinph.app website and platform. The following categories of cookies are used:
- Strictly Necessary Cookies: Required for the platform to function — including session authentication, security tokens, and load-balancing. These cannot be disabled without breaking core functionality.
- Functional Cookies: Remember your preferences such as language settings, responsible gaming limit reminders, and UI display options.
- Analytics Cookies: Collect anonymised data about how players navigate the platform to help gwinph identify areas for improvement. No personally identifiable information is associated with analytics cookies.
- Security Cookies: Used for fraud detection, bot prevention, and device fingerprinting to protect your account from unauthorised access.
gwinph does not use advertising or retargeting cookies. No third-party advertising network has access to your browsing behaviour on gwinph.app. You may manage cookie preferences through your browser settings at any time; however, disabling strictly necessary cookies will impair platform functionality.
10 Your Rights Under the Data Privacy Act
As a data subject under Republic Act No. 10173 and its Implementing Rules and Regulations, you are entitled to exercise the following rights in respect of your personal data held by gwinph. All requests should be submitted to our Data Protection Officer at [email protected] with the subject line "Data Privacy — Rights Request". gwinph will respond within 15 business days.
// Republic Act No. 10173
Your Data Rights as a gwinph Player
The Philippine Data Privacy Act grants you specific, enforceable rights over your personal information. gwinph is committed to honouring every one of them — no bureaucratic runaround, no unexplained delays.
You have the right to know whether gwinph holds personal data about you, the specific categories of data held, and how that data is being processed. This Privacy Policy is part of how gwinph fulfils this obligation proactively.
You may request a copy of the personal data gwinph holds about you, including a summary of the processing activities applied to it. Requests are fulfilled within 15 business days. One free copy is provided per calendar year; subsequent requests within the same year may incur a reasonable administrative fee.
If any personal data gwinph holds about you is inaccurate, incomplete, or outdated, you have the right to request its correction. For most contact and account data, you can update information directly in your account settings. KYC data corrections require resubmission of supporting documents.
You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is otherwise unlawful. Note that gwinph cannot erase data that is subject to a mandatory legal retention obligation under the AMLA, PAGCOR regulations, or other Philippine statutes.
You have the right to object to the processing of your personal data for purposes based on legitimate interest, including profiling for marketing purposes. Where you object, gwinph will cease the relevant processing unless gwinph can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that gwinph provide your personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV) so that you can transmit it to another controller.
If you believe gwinph has violated your rights under RA 10173, you may file a complaint directly with the National Privacy Commission (NPC) of the Philippines. gwinph encourages you to contact our DPO first to allow us to resolve the matter swiftly, but this does not restrict your right to approach the NPC at any time.
11 Security Measures
gwinph implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:
- Encryption in Transit: All data transmitted between your browser or app and the gwinph platform is encrypted using TLS 1.3 or higher. HTTPS is enforced across all gwinph.app domains without exception.
- Encryption at Rest: Sensitive personal data — including KYC documents, identity records, and financial data — is encrypted at rest using AES-256 encryption on secure, access-controlled servers.
- Access Controls: Access to personal data within the gwinph organisation is restricted on a strict need-to-know basis using role-based access control (RBAC). All internal access to player data is logged and auditable.
- Two-Factor Authentication: All gwinph staff with access to player data systems are required to use 2FA. Players are strongly encouraged to enable 2FA on their own accounts.
- Regular Security Audits: gwinph undergoes periodic penetration testing and security audits conducted by independent third-party security firms.
- Incident Response: gwinph maintains a documented data breach incident response plan. In the event of a personal data breach that poses a risk to data subjects, gwinph will notify the National Privacy Commission within 72 hours of becoming aware of the breach and will notify affected players without undue delay.
Your responsibility: While gwinph takes robust steps to protect your data, account security also depends on the strength and confidentiality of your login credentials. Never share your gwinph username, password, or 2FA codes with anyone — including anyone claiming to be gwinph support staff. gwinph staff will never ask for your password.
12 Protection of Minors
The gwinph platform is strictly intended for persons aged 21 years and above in the Philippines. gwinph does not knowingly collect, process, or retain personal data relating to persons under the age of 21.
All new registrations are subject to mandatory KYC age verification before Real Money Play is permitted. If gwinph discovers that a player who has registered is under 21 years of age, the following actions will be taken immediately:
- The account will be permanently closed.
- All deposited funds will be returned to the source payment method, net of any real-money wagers already placed.
- All personal data collected in connection with the underage account will be securely deleted, except where retention is required for PAGCOR compliance or legal proceedings.
- The matter will be reported to PAGCOR as required under applicable regulations.
Parents and guardians: If you believe a minor has registered on gwinph using false age information, please contact us immediately at [email protected]. We take this matter extremely seriously and will act without delay.
13 Third-Party Services & Game Providers
The gwinph platform integrates games and services from licensed third-party providers including JILI, Pragmatic Play, PG Soft, CQ9, Habanero, and Evolution Gaming. When you launch and play a game provided by a third party, certain technical and gameplay data — such as your session token, bet amounts, and game results — are transmitted to that provider's systems to enable the game to function.
Each game provider operates under its own privacy practices and is independently responsible for the data processed on its own systems. gwinph selects providers that meet high standards of data security and regulatory compliance. However, gwinph is not responsible for the privacy practices of third-party providers beyond the data processing obligations set out in its provider agreements.
gwinph's platform does not embed third-party advertising scripts, social media pixels, or external tracking tools that would share your browsing behaviour with parties outside the gwinph ecosystem.
14 Changes to This Privacy Policy
gwinph reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or National Privacy Commission guidance. The "Last Updated" date at the top of this page will be revised whenever a material change is made.
Where changes are material — meaning they significantly affect your rights or how your data is used — gwinph will notify registered players via email and/or a prominent in-platform notification at least 14 days before the changes take effect. For non-material updates (such as formatting corrections or clarifications that do not alter substance), gwinph will update the policy without advance notice.
Your continued use of the gwinph platform after the effective date of any revised Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any changes, you should stop using the platform and may request account closure by contacting our support team.
15 Contact & Data Protection Officer
For all data privacy inquiries, rights requests, complaints, or concerns relating to this Privacy Policy or gwinph's data processing activities, please contact our Data Protection Officer using the details below. All communications are treated confidentially and responded to within 15 business days.
Data Protection Officer — gwinph
Email: [email protected]
Subject line: Data Privacy — DPO Request
Response time: within 15 business days of receipt
If you are not satisfied with gwinph's response to your data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines at privacy.gov.ph. The NPC is the independent authority responsible for administering and enforcing RA 10173 in the Philippines.
// Why Your Privacy Is Safe at gwinph
Built-in Privacy Protections
Privacy at gwinph isn't an afterthought — it's woven into every layer of the platform. Here's what that looks like in practice for every Filipino player on our platform.
AES-256 Encryption
All your KYC documents and financial records are encrypted at rest with military-grade AES-256 standards. Nobody can read them without the correct decryption keys — not even gwinph staff without proper authorisation.
Zero Data Selling
gwinph has a firm policy against selling, renting, or brokering player data to any third party for commercial gain. Your information exists on our platform to serve you — not to generate ad revenue for someone else.
DPA-Compliant KYC
Our Know Your Customer process fully complies with RA 10173. ID documents are verified, then stored under strict access controls. Only authorised compliance personnel can view raw KYC documents.
No Spam Guarantee
Marketing communications from gwinph are consent-based only. You can opt out of all promotional emails and SMS messages at any time via your account settings or by contacting support — and we honour that immediately.
Breach Notification
In the unlikely event of a data breach affecting your personal information, gwinph is committed to notifying the National Privacy Commission within 72 hours and informing affected players without undue delay — no cover-ups, full transparency.
Clear Retention Limits
We don't hold onto your data indefinitely. Each data category has a defined retention period based on legal requirements. Once that period lapses and no hold applies, your data is securely deleted or irreversibly anonymised.
Minimal Data Collection
gwinph collects only what is necessary. We do not collect full payment card numbers, CVV codes, or full bank account numbers. Payment credentials are handled entirely by regulated payment providers on their own secure infrastructure.
PAGCOR Regulated
Operating under a PAGCOR licence means gwinph is subject to regular regulatory oversight, including data handling standards. Our compliance obligations provide an additional layer of accountability beyond our own internal policies.
// Secure. Licensed. Filipino-Built.
Play with Confidence at gwinph
Your personal data is protected by Philippine law, PAGCOR oversight, and gwinph's own privacy-first infrastructure. Over 1,200 games, GCash and crypto deposits, 24/7 Filipino support — and the peace of mind that your privacy is taken seriously. For players aged 21 and above only.