winp Privacy Policy

winp ("we", "us", "our") operates the online gaming platform accessible at https://winp.bio (the "Platform"), serving Filipino players across the Philippines. As part of operating this Platform, winp collects, processes, and stores certain personal information about the individuals who register and use our services.

This Privacy Policy ("Policy") describes how winp handles personal information belonging to registered players, prospective players, and visitors to the winp website. It has been prepared in compliance with Republic Act No. 10173 — the Data Privacy Act of 2012 (DPA) of the Philippines — and the implementing rules and regulations issued by the National Privacy Commission (NPC).

By registering an Account with winp or by continuing to use the Platform, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal information as described herein. If you do not agree with this Policy, please do not register an Account or continue using the Platform.

For the purposes of the Philippine Data Privacy Act of 2012 and all applicable data protection laws, the data controller responsible for the personal information collected through the winp Platform is the operator of https://winp.bio.

If you have any questions, concerns, or requests regarding the processing of your personal information by winp, you may contact our Data Protection Officer (DPO) using the contact details provided in Section 16 of this Policy.

winp has registered with the National Privacy Commission in accordance with its registration obligations under the DPA and its implementing rules and regulations.

winp collects the following categories of personal data from players and Platform visitors:

winp does not collect sensitive personal information — such as racial or ethnic origin, political opinions, religious beliefs, or health information — except where strictly required by applicable law or regulation (for example, in connection with responsible gaming medical assessments, where applicable).

winp collects personal data through the following means:

• Direct registration: When you create a winp Account, you directly provide your name, email address, mobile number, date of birth, and any other details required during the registration process.
• KYC document submission: When you submit identity documents for account verification and withdrawal eligibility, winp receives the data contained in those documents.
• Deposit and withdrawal transactions: When you make a payment via GCash, Maya, BPI, BDO, or any other supported method, winp receives transaction details from the payment processor sufficient to complete and record the transaction.
• Platform usage: winp's systems automatically collect technical and gameplay data as you use the Platform — including session logs, IP addresses, device identifiers, and betting activity.
• Customer support interactions: When you contact winp's support team via live chat or email, your correspondence and the data you provide are retained to resolve your query and for quality assurance.
• Cookies and tracking technologies: winp uses cookies and similar technologies to collect technical data about your browsing and session behaviour on the Platform. See Section 9 for full details.
• Third-party verification services: winp may obtain identity verification data from licensed third-party KYC service providers to assist in confirming the authenticity of documents and the identity of players.

winp processes your personal data for the following specific purposes:

1. Account creation and management: To establish and maintain your winp Account, verify your identity, authenticate your login, and manage your account settings and preferences.
2. Payment processing: To process deposits and withdrawals in Philippine Peso via GCash, Maya, bank transfer, and other supported payment methods. winp requires financial data to execute transactions accurately and securely.
3. Regulatory compliance: To fulfil winp's obligations under PAGCOR's licensing requirements, the Philippine Anti-Money Laundering Act (AMLA), the DPA, and other applicable Philippine laws. This includes mandatory identity verification, transaction monitoring, and regulatory reporting.
4. Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, money laundering, and other illegal or prohibited conduct on the Platform.
5. Responsible gaming: To monitor player activity for indicators of problem gambling behaviour and to apply responsible gaming tools and restrictions where required under our Responsible Gaming Policy or applicable regulations.
6. Customer support: To respond to your queries, complaints, and support requests, and to maintain records of correspondence for dispute resolution purposes.
7. Platform improvement: To analyse aggregated and anonymised usage data to understand how players use the Platform, identify technical issues, and improve the overall user experience.
8. Marketing communications: To send you promotional offers, bonus notifications, and other marketing materials where you have opted in to receiving such communications. You may withdraw consent at any time.
9. Legal claims: To establish, exercise, or defend legal claims where necessary.

Under the Philippine Data Privacy Act of 2012, winp processes personal data on the following lawful bases:

• Contractual necessity: Processing required to perform our obligations under the player agreement — including account creation, payment processing, and game provision — is necessary to fulfil the contract between winp and you as a registered player.
• Legal obligation: winp is required by Philippine law to process certain personal data, including for PAGCOR regulatory compliance, AMLA-mandated KYC and transaction monitoring, and NPC registration obligations.
• Legitimate interests: winp processes certain data in pursuit of its legitimate business interests, including fraud prevention, Platform security, technical performance monitoring, and responsible gaming compliance — provided these interests are not outweighed by your data protection rights.
• Consent: Where processing is not strictly required for contractual, legal, or legitimate interest purposes — such as sending optional marketing communications — winp will only process your data where you have provided clear and affirmative consent, which you may withdraw at any time.

winp does not sell your personal data to third parties. We may share your personal information with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate confidentiality and data protection obligations:

• Payment service providers: GCash (G-Xchange Inc.), Maya (Voyager Innovations), BancNet, InstaPay-connected banks, and cryptocurrency processors, for the purpose of processing deposits and withdrawals.
• Identity verification and KYC providers: Licensed third-party services engaged by winp to verify identity documents and screen players against regulatory watchlists.
• Game providers: Licensed game studios (e.g., Pragmatic Play, JILI, Evolution) receive technical session identifiers necessary to operate their games. Game providers do not receive your full identity or financial information.
• Regulatory and government authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies, where winp is legally required or compelled by court order to disclose information.
• IT and cloud service providers: Third-party providers of hosting, server infrastructure, and cybersecurity services who process data on winp's behalf under binding data processing agreements.
• Legal and professional advisors: Lawyers, accountants, and compliance consultants engaged by winp, bound by professional confidentiality obligations.

Some of winp's service providers — including certain game providers, cloud hosting services, and technical infrastructure partners — operate outside the Philippines. Where personal data is transferred to a recipient located outside the Philippines, winp ensures that such transfers comply with the requirements of Section 21 of the Philippine Data Privacy Act and NPC regulations, which require that appropriate safeguards are in place.

Appropriate safeguards applied by winp for cross-border data transfers include:

• Binding data processing agreements incorporating the standard contractual clauses prescribed or approved by the NPC.
• Transfers only to recipients located in countries or operating under frameworks determined by the NPC to provide an adequate level of protection.
• Technical and organisational security measures equivalent to those applied within the Philippines.

For more information about the specific safeguards applied to any cross-border transfer, please contact winp's Data Protection Officer using the details in Section 16.

winp uses cookies and similar web technologies (including session tokens, local storage, and pixel tags) on the Platform for the following purposes:

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include your authenticated session token, CSRF protection tokens, and language/currency preference cookies. These cannot be disabled without impairing Platform functionality.
• Performance and Analytics Cookies: Used to understand how players navigate the Platform — such as which pages are visited most frequently, where users encounter errors, and how long sessions last. Data is aggregated and anonymised where possible.
• Security Cookies: Used to detect fraudulent login attempts, identify unusual session behaviour, and support two-factor authentication delivery.
• Responsible Gaming Cookies: Used to enforce session limits, cooling-off periods, and self-exclusion restrictions set by the player or applied by winp's compliance systems.

winp does not use third-party advertising cookies or tracking technologies that enable external advertisers to follow your activity across other websites.

You can control cookie behaviour through your browser settings. Please note that disabling strictly necessary cookies will significantly impair your ability to use the winp Platform, including logging in and making transactions.

winp retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. The following retention guidelines apply:

• Active Account holders: Your personal data is retained for the duration of your Account registration and for a minimum period of five (5) years following Account closure, in compliance with PAGCOR licensing requirements and Philippine anti-money laundering regulations (AMLA).
• KYC and identity documents: Retained for a minimum of five (5) years from the date of verification, in accordance with AMLC regulations applicable to gaming operators.
• Financial transaction records: Retained for a minimum of five (5) years from the transaction date, as required under AMLA and PAGCOR regulations.
• Support correspondence: Retained for three (3) years from the date of the last interaction, to support dispute resolution and service improvement.
• Technical and log data: Retained for up to twelve (12) months for security analysis and fraud detection purposes, after which it is anonymised or deleted.
• Marketing preference records: Retained until you withdraw consent or close your Account, plus a reasonable administrative period thereafter.

Where winp is required to retain data for regulatory purposes, those obligations take precedence over any request for earlier deletion.

winp implements appropriate technical and organisational security measures designed to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:

• AES-256 SSL/TLS encryption for all data transmitted between your device and winp's servers.
• Hashed storage of passwords using bcrypt — winp cannot recover or view your plain-text password.
• Two-factor authentication (2FA) via SMS OTP, available to all registered winp players and mandatory for certain sensitive account actions.
• Role-based access controls ensuring that personal data is accessible only to winp personnel who require it for their specific job functions.
• Regular penetration testing and vulnerability assessments of the Platform and supporting infrastructure.
• Dedicated fraud detection and monitoring systems that flag anomalous transaction and login patterns in real time.
• Contractual data protection obligations binding all third-party processors that handle winp player data.

Despite these measures, no method of electronic transmission or storage is 100% secure. winp cannot guarantee absolute security of your personal data. In the event of a personal data breach that is likely to result in a risk to your rights, winp will notify the NPC and affected individuals in accordance with its obligations under the DPA.

Under the Philippine Data Privacy Act of 2012 and NPC regulations, you have the following rights in respect of your personal data held by winp. These rights may be subject to certain conditions and limitations under applicable law:

The winp Platform is strictly intended for individuals who are twenty-one (21) years of age or above, in accordance with PAGCOR's minimum age requirements for online gaming in the Philippines. winp does not knowingly collect, process, or retain personal data belonging to individuals under the age of 21.

winp applies age verification measures during the Account registration process and as part of its KYC procedures to identify and prevent underage registration. If winp discovers or is notified that it has inadvertently collected personal data from an individual under the age of 21, that Account will be suspended immediately, the personal data will be deleted to the extent permissible under applicable law, and any balance held in the Account will be handled in accordance with winp's Account Termination procedures.

The winp Platform may contain references or links to third-party services — including licensed game providers operating their own platforms within the winp interface. winp is not responsible for the privacy practices of any third party whose services are accessible through the Platform.

When you interact with a third-party game provider's content within the winp Platform, that provider may process technical session data necessary to operate their games in accordance with their own privacy policies. winp contractually limits what data third-party providers may collect and requires them to maintain data security standards consistent with applicable law.

Where you follow a link from the winp Platform to a genuinely external website, winp's Privacy Policy no longer applies. winp encourages you to review the privacy policy of any external website you visit.

winp reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. Material changes to this Policy will be communicated to registered players via email to their registered address and/or through a notification displayed upon login to the winp Platform.

The updated Policy will be published at https://winp.bio/privacy-policy with the revised effective date clearly stated at the top of the document. Your continued use of the Platform following the effective date of an amended Policy constitutes your acceptance of the changes.

If you have any questions, concerns, or requests regarding this Privacy Policy or winp's processing of your personal data — including requests to exercise your data subject rights — please contact winp's Data Protection Officer through the following channels:

• Data Protection Officer Email: [email protected] (plain text — not a clickable link). Please include "Privacy / DPO Request" in the subject line of your message.
• General Support (Live Chat): Available 24 hours a day, 7 days a week via the winp Platform after logging in to your Account. For data rights requests, please request to be escalated to the DPO team.
• Written Correspondence: Formal written requests may also be submitted via email to the DPO address above. Please include your full name, registered Account username, and a clear description of your request. Identity verification will be required before sensitive data requests are processed.

winp commits to acknowledging receipt of all data rights requests within three (3) business days and providing a substantive response within fifteen (15) calendar days.

If you believe winp has failed to comply with its data protection obligations under the Philippine Data Privacy Act, you have the right to file a complaint directly with the National Privacy Commission (NPC) of the Philippines. Information on filing a complaint with the NPC is available on the NPC's official website.