winph21 Privacy Policy

winph21 is a PAGCOR-authorized online casino and sports betting platform serving Filipino players across the Philippines. For the purposes of the Data Privacy Act of 2012 (Republic Act 10173), winph21 acts as the Personal Information Controller (PIC) in respect of all personal data collected through the winph21.net platform.

As a Personal Information Controller, winph21 determines the purposes and means by which your personal data is processed. Where winph21 engages third-party service providers — such as payment processors, identity verification vendors, or game content providers — those parties act as Personal Information Processors (PIP) under winph21's written instruction and are contractually bound to process your data only as directed.

winph21 collects and processes the following categories of personal data, depending on your level of interaction with the platform:

winph21 collects personal data through the following channels and interactions:

• Account Registration: When you create a winph21 account, you directly provide your name, date of birth, contact details, and login credentials.
• KYC Verification: When you submit identity verification documents — either through the in-platform upload tool or via our third-party KYC verification partner — we collect and process the identity and document data you provide.
• Deposits and Withdrawals: When you transact via GCash, PayMaya, BPI, BDO, Metrobank, or card payment, our payment processing partners transmit confirmation data including partial payment method details and transaction references to winph21.
• Platform Usage: Your interactions with the winph21 platform — including game sessions, bets placed, bonuses activated, and pages visited — are automatically logged through our platform analytics infrastructure.
• Customer Support: When you contact our support team via email or live chat, the content of that communication is recorded and linked to your account for quality assurance and dispute resolution purposes.
• Cookies and Tracking Technologies: The winph21 website uses cookies and similar technologies as described in Section 8 of this Policy to collect technical and behavioral data about platform usage.
• Third-Party Sources: In limited circumstances, winph21 may receive data about you from third-party sources — such as PAGCOR's self-exclusion register, fraud prevention networks, or credit risk databases — where permitted by law and necessary for regulatory compliance.

Every data processing activity at winph21 is linked to a specific, documented lawful purpose. The table below maps our key processing activities to their legal basis under RA 10173:

winph21 does not sell your personal data. We share data with third parties only in the following limited and controlled circumstances:

• Payment Processors: GCash (GXI), PayMaya (Maya Philippines), BPI, BDO, Metrobank, and Visa/Mastercard acquiring banks receive the minimum data necessary to process your transactions. These entities operate under their own NPC-registered Privacy Policies.
• KYC and Identity Verification Vendors: winph21 uses third-party identity verification services to validate government-issued IDs and conduct liveness checks. These vendors process your KYC documents solely for verification purposes under written data processing agreements.
• Game Content Providers: Third-party game studios and live dealer providers that power games on the winph21 platform receive session-level data (player ID, wager amount, session token) necessary to operate game engines. They do not receive your personal identity data.
• PAGCOR and Regulatory Authorities: winph21 is legally obligated to provide player data, transaction records, and gaming activity reports to PAGCOR upon request or as part of periodic regulatory reporting obligations.
• Anti-Money Laundering Council (AMLC): In compliance with RA 9160 (as amended), winph21 reports covered and suspicious transactions to the AMLC. This reporting is a legal obligation and does not require your consent.
• Law Enforcement: winph21 will disclose personal data to Philippine law enforcement agencies — including the NBI, PNP, or DOJ — when required by a valid court order, subpoena, or lawful legal process.
• Fraud Prevention Networks: winph21 participates in industry-level fraud prevention sharing with other PAGCOR-licensed operators where permitted by law to prevent bonus abuse and identity fraud.

winph21 retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized using industry-standard data destruction methods. Anonymized aggregate data — from which no individual player can be identified — may be retained indefinitely for statistical and business analysis purposes.

The technical and organizational measures winph21 employs to protect your personal data include:

• TLS 1.3 Encryption in Transit: All data transmitted between your browser or app and winph21's servers is encrypted using TLS 1.3, the current industry-standard transport security protocol.
• AES-256 Encryption at Rest: Sensitive personal data stored in winph21's databases — including KYC documents, payment method details, and government ID numbers — is encrypted at rest using AES-256.
• Multi-Factor Authentication: Access to winph21's internal systems by staff is protected by multi-factor authentication. Players are encouraged to enable 2FA on their accounts for additional security.
• Role-Based Access Controls (RBAC): winph21 staff access to player data is restricted on a strict need-to-know basis. Customer support agents see only the data necessary to resolve your query; financial data is accessible only to authorized finance and compliance personnel.
• Penetration Testing: winph21's platform undergoes regular penetration testing and vulnerability assessments by accredited third-party security firms to identify and remediate security weaknesses before they can be exploited.
• ISO 27001-Certified Infrastructure: Our hosting infrastructure operates in data centers that hold ISO 27001 certification for information security management.
• Data Breach Response Plan: winph21 maintains a documented data breach response plan in compliance with NPC Circular 16-03, including procedures for containment, assessment, and notification within 72 hours of discovery.

winph21 uses cookies and similar tracking technologies on the winph21.net platform. Cookies are small text files stored on your device that help the platform function correctly, remember your preferences, and analyze usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function — including session authentication tokens, security cookies, and load-balancing identifiers. These cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your preferences such as language settings, last game played, and responsible gaming tool configurations. Disabling these does not prevent platform use but will reset your preferences on each visit.
• Analytics Cookies: Used to understand aggregate usage patterns — which games are most popular, common navigation paths, and page performance metrics. Analytics data is processed in aggregate and does not identify individual players.
• Fraud Prevention Cookies: Device fingerprinting and behavioral analytics cookies used to detect unusual access patterns, bot activity, and multi-account creation attempts. These are necessary for PAGCOR compliance and platform security.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary or fraud prevention cookies may impair your ability to log in or use certain platform features. winph21 does not use third-party advertising or retargeting cookies.

winph21 enforces the following age-verification controls to prevent underage access:

• Date of Birth Verification at Registration: All prospective players must declare their date of birth during account registration. Any declared age below 21 results in immediate rejection of the registration.
• KYC Age Confirmation: All accounts are subject to KYC verification that requires submission of a government-issued Philippine ID bearing the player's date of birth. Accounts where the submitted ID reveals an age below 21 are permanently suspended and all funds are returned.
• Suspicious Account Monitoring: winph21's compliance team monitors for behavioral patterns that may indicate underage use, including device-sharing with verified minors or inconsistent age-related data across verification documents.

If winph21 discovers or is notified that personal data has been collected from an individual below the age of 21, that data will be immediately deleted, the account will be suspended, and the incident will be reported to PAGCOR as required. If you believe a minor has registered on the winph21 platform, contact our DPO immediately at [email protected].

In certain circumstances, the operation of the winph21 platform involves the transfer of personal data outside the Philippines — for example, to game content providers whose servers are located abroad, or to international payment network processors. winph21 ensures that all cross-border transfers of personal data comply with Section 21 of RA 10173 and the relevant NPC implementing rules.

Specifically, cross-border transfers from winph21 occur only where at least one of the following conditions is met:

• The recipient country has been deemed by the NPC to provide an adequate level of data protection;
• Adequate contractual safeguards — such as NPC-standard data transfer agreements or binding corporate rules — are in place with the receiving entity;
• The transfer is necessary for the performance of a contract between winph21 and the player (e.g., processing an international card payment); or
• The player has given explicit, informed consent to the transfer after being advised of the risks of transferring data to a jurisdiction without equivalent DPA protections.

To exercise any of the data subject rights described in this Privacy Policy, you may submit a formal Data Subject Rights Request (DSRR) to winph21 through any of the following channels:

• Email: Send your request to [email protected] with the subject line DATA SUBJECT RIGHTS REQUEST. Please include your full registered name, account username, and a clear description of the right you wish to exercise.
• Account Portal: Certain rights — including access, rectification, and marketing opt-out — can be exercised directly through your winph21 Account Settings panel without needing to contact the DPO.

winph21 will acknowledge receipt of your DSRR within 3 business days and will provide a substantive response within 15 business days of receiving your request. In complex cases, this period may be extended by a further 15 business days, in which case you will be notified of the extension and the reason for it.

winph21 does not charge a fee for processing Data Subject Rights Requests unless the request is manifestly unfounded, repetitive, or excessive — in which case a reasonable administrative fee reflecting the cost of processing may be applied, with prior notice to the requester.

winph21 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, NPC guidance, or PAGCOR regulatory requirements. The most current version of this Privacy Policy will always be published at winph21.net/privacy-policy with an updated effective date and version number prominently displayed.

Where a proposed change is material — meaning it significantly affects how your personal data is processed, the rights available to you, or the parties with whom data is shared — winph21 will notify registered players through at least one of the following methods:

• An in-platform notification displayed upon next login;
• An email notice to your registered email address; or
• A prominent banner on the winph21.net homepage for a minimum of 14 days prior to the change taking effect.

Your continued use of the winph21 platform after the effective date of a revised Privacy Policy constitutes your acknowledgment of the updated terms. If you do not agree with any material change to this Policy, you have the right to close your account and request deletion of your personal data, subject to our legal retention obligations.

For any questions, concerns, or requests relating to this Privacy Policy or winph21's handling of your personal data, please contact our Data Protection Officer directly:

If you are not satisfied with winph21's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines: