ph2win Privacy Policy

This Privacy Policy ("Policy") is issued by ph2win ("ph2win," "we," "us," "our"), the operator of the online gaming platform accessible at ph2win.cam. This Policy applies to all personal data collected, processed, stored, or disclosed by ph2win in connection with your use of our website, platform services, games, customer support channels, and any related communications.

ph2win operates as a Personal Information Controller (PIC) under Republic Act No. 10173, also known as the Data Privacy Act of 2012 of the Philippines (the "DPA"), and its Implementing Rules and Regulations. ph2win is registered with the National Privacy Commission (NPC) as required under the DPA and its implementing regulations.

This Policy is incorporated by reference into our Terms & Conditions. By accessing or using the ph2win platform, you acknowledge that you have read, understood, and consent to the data processing practices described in this Policy. If you do not agree to this Policy, you must discontinue use of the ph2win platform.

ph2win collects personal data that is necessary for the proper operation of the platform, compliance with applicable Philippine law, and the provision of a safe and fair gaming environment. We do not collect personal data beyond what is reasonably required for these purposes.

ph2win may collect sensitive personal information as defined under the DPA, including government-issued identification numbers submitted during KYC verification. Such information is handled with heightened care, stored with additional security controls, and accessed only by authorized personnel on a strict need-to-know basis.

ph2win may receive personal data about you from third-party sources, including payment processors (GCash, Maya, BPI, BDO, Metrobank), identity verification service providers, fraud prevention and AML screening services, and PAGCOR's exclusion register. Data received from such third parties is used only for the purposes described in Section 3 and is handled in accordance with this Policy.

ph2win uses your personal data only for specific, legitimate purposes. The following table describes the primary purposes for which your data is processed:

• Account Management: Creating, maintaining, securing, and closing your ph2win account; verifying your identity and age; processing login authentication including two-factor verification.
• Payment Processing: Processing deposits via GCash, Maya, and Philippine bank transfers; verifying withdrawal requests; conducting AML checks on financial transactions as required under RA 9160 and related PAGCOR directives.
• Platform Operation and Game Delivery: Delivering live casino, slot, bingo, and sports betting services; maintaining accurate game records; managing bonuses, free credits, and loyalty program rewards.
• Legal and Regulatory Compliance: Fulfilling ph2win's obligations under PAGCOR regulatory requirements, the Anti-Money Laundering Act (RA 9160, as amended), the Data Privacy Act (RA 10173), and other applicable Philippine statutes and regulations.
• Responsible Gaming: Monitoring account activity for signs of disordered gambling; enforcing deposit limits and self-exclusion requests; complying with PAGCOR responsible gaming requirements.
• Security and Fraud Prevention: Detecting, preventing, and investigating fraud, cheating, unauthorized account access, bonus abuse, and other prohibited conduct as defined in the Terms & Conditions.
• Customer Support: Responding to player inquiries, resolving disputes, and providing technical assistance through our live chat and email support channels.
• Platform Improvement: Analyzing aggregated usage data to improve platform performance, game selection, and user experience — always using anonymized or pseudonymized data sets where technically feasible.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have consented to receive such communications. You may withdraw consent at any time via your account settings.

Under the Data Privacy Act of 2012, ph2win processes your personal data on the following lawful bases:

• Consent: For marketing communications and optional platform features, where you have provided clear, freely-given consent that can be withdrawn at any time.
• Contractual Necessity: Where processing is necessary to perform our obligations under the Terms & Conditions agreement — for example, processing your account registration, deposits, game results, and withdrawal requests.
• Legal Obligation: Where processing is required for ph2win to comply with applicable Philippine laws, including PAGCOR regulations, RA 9160 (AML), and RA 10173 (DPA).
• Legitimate Interests: For fraud prevention, platform security, responsible gaming monitoring, and analytics — where our legitimate interests as a regulated gaming operator are balanced against and do not override your fundamental privacy rights.

ph2win does not sell, rent, or trade your personal data to unaffiliated third parties for their independent marketing purposes. We may share your personal data only in the circumstances described below, and only to the extent strictly necessary for the stated purpose.

ph2win engages third-party service providers who act as Personal Information Processors (PIPs) under the DPA — meaning they process personal data solely on ph2win's behalf and under ph2win's documented instructions. These providers include payment processors (GCash/Maya operators, Philippine banks), identity verification platforms, cloud hosting providers, fraud detection services, analytics providers, and customer support software vendors. All PIPs are contractually bound to implement adequate data protection measures consistent with RA 10173.

ph2win is required by law to disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Bureau of Internal Revenue (BIR), and other competent Philippine government authorities when lawfully requested to do so. ph2win will comply promptly with valid legal orders and will notify affected players of such disclosure where permitted by law.

In the event of a merger, acquisition, restructuring, or sale of all or part of ph2win's business assets, your personal data may be transferred to the relevant successor entity as part of that transaction. In such circumstances, ph2win will endeavor to ensure continuity of the protections described in this Policy and will notify affected players of any material changes to data processing arrangements.

ph2win uses cookies and similar technologies (including browser local storage and session tokens) to operate and improve the platform. Cookies are small data files stored on your device that help us recognize your session, maintain your login state, remember your preferences, and analyze platform usage patterns.

• Strictly Necessary Cookies: Required for the platform to function. These enable session management, login authentication, and security features. They cannot be disabled without impairing platform functionality.
• Functional Cookies: Store your preferences such as language settings and game history for a more personalized experience.
• Analytics Cookies: Help us understand how users interact with the platform — which pages are visited most, where users encounter difficulty, and how navigation can be improved. Data is aggregated and anonymized.
• Security Cookies: Assist in detecting and preventing fraudulent activity, bot access, and unauthorized login attempts.

You may configure your browser to refuse cookies or alert you when cookies are being placed. However, disabling strictly necessary cookies will impair your ability to use core ph2win platform features, including logging in to your account.

ph2win retains personal data only for as long as is necessary to fulfill the purposes for which it was collected and to comply with applicable legal and regulatory requirements. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, ph2win will securely destroy, delete, or anonymize personal data using industry-standard data disposal methods. Data that has been anonymized beyond re-identification may be retained indefinitely for statistical and analytical purposes.

ph2win implements technical, organizational, and physical security measures appropriate to the sensitivity of the personal data it processes and the risks associated with operating an online gaming platform in the Philippines. Our security framework includes:

• 256-bit Transport Layer Security (TLS/SSL) encryption for all data transmitted between your device and ph2win's servers — the same encryption standard used by major Philippine banks such as BPI and BDO.
• Cryptographic hashing of account passwords using modern, salted hashing algorithms. ph2win never stores plaintext passwords.
• Role-based access controls ensuring that personal data is accessible only to authorized ph2win personnel with a legitimate need-to-know basis for their specific job function.
• Multi-factor authentication for all internal administrative access to systems containing personal data.
• Regular security vulnerability assessments and penetration testing by qualified third-party security professionals.
• Real-time intrusion detection and prevention systems monitoring for unauthorized access attempts and suspicious data access patterns.
• A documented Personal Data Breach Response Plan in compliance with NPC Circular 16-03, providing for breach containment, assessment, notification to affected data subjects, and NPC reporting within prescribed timelines.

Under the Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations, you have the following rights with respect to your personal data processed by ph2win. To exercise any of these rights, contact our Data Protection Officer (DPO) as described in Section 13.

• Right to be Informed: The right to be notified of the processing of your personal data — which this Policy fulfills. ph2win must inform you of any material changes to this Policy before they take effect.
• Right of Access: The right to request a copy of the personal data ph2win holds about you and information about how it is being processed.
• Right to Correction: The right to request correction of any inaccurate or incomplete personal data ph2win holds about you.
• Right to Erasure or Blocking: The right to request deletion or blocking of personal data that is incomplete, outdated, false, unlawfully obtained, or no longer necessary for the purpose it was collected — subject to ph2win's legal retention obligations.
• Right to Object: The right to object to processing based on legitimate interests, including direct marketing. Where you object to marketing communications, ph2win will cease such processing promptly.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller where technically feasible.
• Right to Damages: The right to be indemnified for damages sustained due to inaccurate, incomplete, or outdated personal data or any violation of your rights under RA 10173.
• Right to File a Complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe ph2win has violated your data privacy rights under the DPA.

ph2win will respond to verified data subject requests within fifteen (15) working days from receipt of a complete and valid request, in accordance with NPC guidelines. Requests may be submitted to our DPO as specified in Section 13.

If you are a parent or guardian and believe that a person under 21 years of age has created a ph2win account, please contact our Data Protection Officer immediately with supporting information. ph2win will investigate and, if confirmed, delete all personal data associated with that account within 72 hours of receiving sufficient verification.

Some of ph2win's service providers — including cloud infrastructure providers, game content delivery networks, and anti-fraud platforms — may be located outside the Republic of the Philippines. In such cases, personal data may be transferred to and processed in foreign jurisdictions.

Where personal data is transferred outside the Philippines, ph2win ensures that adequate safeguards are in place as required under Section 21 of the DPA and NPC guidance — including data transfer agreements incorporating standard contractual clauses or transfers to recipients in jurisdictions deemed by the NPC to provide adequate data protection.

ph2win maintains a record of all cross-border data transfer arrangements and can provide information on applicable safeguards upon request to our Data Protection Officer.

ph2win may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or NPC guidance. The "Last Updated" date at the top of this page indicates when this Policy was most recently revised.

Where changes are material — meaning they significantly affect how we process your personal data or the rights available to you — ph2win will provide advance notice via email to your registered address or through a prominent notice on the platform prior to the effective date of the change.

Your continued use of the ph2win platform after any updated Policy takes effect constitutes your acknowledgment and acceptance of the revised terms. If you disagree with material changes to this Policy, you may close your account in accordance with the Terms & Conditions.

ph2win has appointed a Data Protection Officer (DPO) in compliance with Section 21(c) of the Data Privacy Act and NPC Circular 17-01. The DPO is responsible for overseeing ph2win's compliance with RA 10173 and serving as the primary point of contact for data subject rights requests and privacy inquiries.

If you wish to exercise any of your data subject rights described in Section 9, have a question about how ph2win processes your personal data, or wish to report a potential data privacy concern, you may contact our DPO through the ph2win support channels accessible after logging in to your account.

For general inquiries, you may also reach our support team via the contact information available in the footer of this page. ph2win will acknowledge receipt of all privacy-related requests within five (5) working days and provide a substantive response within fifteen (15) working days, consistent with NPC guidelines.