Privacy Policy — plwin

1.1 This Privacy Policy applies to all personal information collected by plwin in connection with your use of the plwin online gaming platform accessible at plwin.club, including all games, the plwin Wallet, customer support interactions, promotional communications, and any other service provided by plwin to registered or prospective users.

1.2 This Policy applies to all Users located in the Philippines and, where applicable, to any User in any other jurisdiction whose personal data is processed by plwin in connection with their use of the Platform. By registering a plwin Account or using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

1.3 This Privacy Policy should be read in conjunction with plwin's Terms and Conditions, Responsible Gaming Policy, and Cookie Policy, each of which is incorporated herein by reference. Where there is a conflict between this Privacy Policy and the Terms and Conditions on a privacy-related matter, this Privacy Policy shall prevail.

2.1 For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, the personal information controller responsible for your personal data is plwin, the operator of the online gaming platform at plwin.club, duly licensed and regulated by the Philippine Amusement and Gaming Corporation (PAGCOR).

2.2 plwin has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the DPA 2012 and this Privacy Policy. The DPO can be contacted at the details provided in Section 14 of this Policy. plwin has registered its data processing activities with the National Privacy Commission (NPC) as required by applicable Philippine regulations.

3.1 plwin collects personal data through multiple channels: directly from you during registration and Account use, automatically through your interaction with the Platform, and from third-party sources such as payment processors and identity verification providers. The categories of personal data we collect include the following:

3.2 plwin does not collect sensitive personal information as defined under Section 3(l) of the DPA 2012 (such as racial or ethnic origin, political opinions, religious beliefs, genetic data, or health data) unless expressly required by PAGCOR regulatory obligations or applicable Philippine law, in which case such collection will be disclosed separately with specific consent obtained.

4.1 plwin processes your personal data for the following specific, explicitly defined, and legitimate purposes:

• Account Registration and Management: To create, verify, maintain, and secure your plwin Account, including identity verification (KYC) and age verification to confirm compliance with the 21+ requirement;
• Platform Operation and Gaming Services: To provide access to all games, live dealer tables, the plwin Wallet, bingo rooms, and all other Platform features; to record gaming activity for audit and dispute resolution purposes;
• Payment Processing: To process GCash, Maya, and other payment method deposits and withdrawals to and from your plwin Wallet; to maintain financial transaction records as required by Philippine AMLA regulations;
• Customer Support: To respond to your inquiries, resolve complaints, investigate disputes, and provide technical assistance;
• Responsible Gaming Compliance: To monitor gaming behaviour for indicators of problem gambling, enforce self-exclusion and deposit limits set by you, and fulfil plwin's obligations under PAGCOR's responsible gaming framework;
• Legal and Regulatory Compliance: To comply with PAGCOR licensing requirements, Anti-Money Laundering Act (AMLA) obligations, National Privacy Commission (NPC) requirements, and any other applicable Philippine law;
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and unauthorized Account access;
• Platform Improvement: To analyse usage patterns and technical performance data for the purpose of improving Platform features, fixing bugs, and enhancing user experience;
• Marketing Communications: To send promotional offers, bonus notifications, and game launch announcements, where you have provided consent or where applicable law permits such communications to existing customers.

4.2 plwin does not use your personal data for automated decision-making that produces legal effects concerning you, except where necessary to enforce these Terms, prevent fraud, or comply with PAGCOR and AMLA requirements, in which case human review is available upon request.

5.1 plwin processes personal data on the following legal bases as recognized under the Philippine Data Privacy Act of 2012:

• Contractual Necessity: Processing necessary for the performance of the plwin Terms and Conditions, including account creation, payment processing, game provision, and customer support;
• Legal Obligation: Processing required to comply with PAGCOR licensing conditions, AMLA reporting obligations, NPC registration requirements, and any court or regulatory order issued in the Philippines;
• Legitimate Interests: Processing for fraud detection, platform security, responsible gaming monitoring, and platform improvement, where plwin's legitimate interests are not overridden by your rights and freedoms;
• Consent: Processing for marketing communications and any processing of sensitive personal information not otherwise covered by the above bases; you may withdraw marketing consent at any time by contacting plwin support.

6.1 plwin does not sell, rent, or trade your personal data to third parties for their own independent commercial or marketing purposes. plwin shares your personal data only in the following limited circumstances:

• Payment Service Providers: GCash (Mynt — Globe Fintech Innovations, Inc.), Maya Philippines, Inc., BancNet for bank transfers, and other payment partners — solely to process your deposits and withdrawals;
• Identity Verification Providers: Third-party KYC and age verification service providers engaged by plwin to verify government-issued IDs for PAGCOR compliance;
• Game Software Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and other licensed game studios — limited to the minimum session data required to operate their games on the Platform;
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and any other Philippine government authority entitled by law to receive your data;
• Cloud Infrastructure Providers: Hosting and server infrastructure providers processing data on plwin's behalf under data processing agreements that bind them to confidentiality and DPA-compliant security standards;
• Professional Advisers: Legal counsel, auditors, and compliance consultants, under strict confidentiality obligations, where required for legal defense or regulatory reporting.

6.2 All third-party service providers with whom plwin shares personal data are contractually required to process that data only for the purposes specified by plwin, to maintain appropriate security measures, and to comply with the Philippine Data Privacy Act of 2012 to the extent applicable.

7.1 plwin retains personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with applicable legal obligations, and to resolve disputes. The following retention guidelines apply:

• Account and Identity Data: Retained for the duration of your active plwin Account and for a minimum of five (5) years following Account closure, as required by PAGCOR and AMLA regulations applicable to online gaming operators in the Philippines;
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, consistent with AMLA record-keeping requirements and PAGCOR audit obligations;
• Gaming Activity Logs: Retained for three (3) years from the date of each gaming session for dispute resolution and regulatory audit purposes;
• Customer Support Records: Retained for two (2) years from the date of the last interaction, or longer if the subject matter relates to an unresolved dispute or regulatory investigation;
• Marketing Consent Records: Retained for the duration of your consent and for one (1) year after withdrawal of consent, to demonstrate compliance with the consent requirement.

7.2 Upon expiry of the applicable retention period, plwin will securely delete or anonymize personal data in accordance with procedures approved by the plwin Data Protection Officer.

8.1 plwin implements technical and organizational security measures appropriate to the risks presented by the processing of personal data, including:

• 256-bit SSL/TLS encryption for all data transmitted between your device and plwin's servers;
• Encryption at rest for all databases storing personal and financial data;
• Multi-factor authentication (OTP via SMS) for Account login and sensitive Account changes;
• Role-based access controls limiting internal access to personal data to authorized personnel only;
• Regular security audits and penetration testing of Platform infrastructure;
• Automated anomaly detection systems monitoring for unauthorized access patterns;
• Data breach response procedures, including notification to the NPC and affected data subjects within 72 hours of discovery of a breach, as required by NPC Circular 16-03.

8.2 While plwin employs industry-standard security measures, no internet-based system is completely immune from security risks. You are responsible for maintaining the security of your Account credentials and for notifying plwin immediately if you suspect unauthorized access to your Account.

9.1 plwin uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential Cookies: Required for the Platform to function, including maintaining your login session, remembering your language preference, and enabling the plwin Wallet. These cannot be disabled without impairing Platform functionality;
• Analytics Cookies: Used to collect aggregated, anonymized data about how users interact with the Platform — which pages are visited most frequently, average session duration, and navigation paths — to improve Platform performance and user experience;
• Security Cookies: Used to detect and prevent fraud, bot activity, and multi-account creation attempts. These process device fingerprint data for security purposes.

9.2 plwin does not use third-party advertising cookies or tracking pixels for cross-site behavioural advertising. Cookies set by plwin are first-party and scoped to the plwin.club domain. You can manage cookie preferences through your browser settings; disabling essential cookies will impair your ability to use the Platform.

10.1 Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by plwin. To exercise any of these rights, contact the plwin Data Protection Officer at the details provided in Section 14.

10.2 plwin will respond to all verified data subject requests within thirty (30) days of receipt. Complex requests may require up to sixty (60) days, in which case plwin will notify you of the extension and the reason for it.

11.1 plwin implements age verification controls during registration and identity verification. If you believe that a person under the age of 21 has registered or is using a plwin Account, please notify plwin's Data Protection Officer immediately at the contact details in Section 14.

12.1 The plwin Platform serves Filipino players in the Philippines. Where plwin engages third-party game software providers (such as those headquartered in Malta, Isle of Man, or other gaming jurisdictions) or cloud infrastructure providers operating data centres outside the Philippines, limited personal data — typically session identifiers and game activity — may be processed on servers located outside the Philippines.

12.2 Any cross-border transfer of personal data is subject to data transfer agreements that impose obligations on recipient entities equivalent to those required by the Philippine DPA 2012 and NPC regulations on cross-border data flows. plwin will only transfer personal data to jurisdictions that provide adequate levels of data protection or under contractual safeguards approved by the NPC.

13.1 plwin may update this Privacy Policy from time to time to reflect changes in applicable Philippine law, NPC guidance, PAGCOR regulatory requirements, or plwin's data processing practices. Material changes will be communicated to registered Users via the mobile number or email address on file at least seven (7) days before the amended Policy takes effect.

13.2 The "Last updated" date at the top of this page indicates when the most recent revision was published. We encourage Users to review this Policy periodically. Continued use of the plwin Platform following the effective date of any amendment constitutes acceptance of the revised Privacy Policy.

14.1 For all privacy-related inquiries, data subject rights requests, complaints, or concerns about this Privacy Policy or plwin's data processing practices, please contact the plwin Data Protection Officer through any of the following channels:

14.2 plwin commits to acknowledging all privacy-related requests within forty-eight (48) hours and to providing a substantive response within thirty (30) days of receipt.