winph9 Privacy Policy

This Privacy Policy ("Policy") is published by winph9 ("winph9," "we," "us," or "our") and applies to all personal data collected, processed, stored, or otherwise handled in connection with the winph9 online gaming platform accessible at winph9.one (the "Platform").

This Policy governs the personal data of all registered players, prospective players who browse the Platform, and any individual who contacts winph9 support. By registering an account with winph9 or continuing to use the Platform, you acknowledge that you have read and understood this Policy.

This Policy is designed to comply with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC"). winph9 also processes data in connection with its obligations as a PAGCOR-licensed operator, which may include Anti-Money Laundering (AML) reporting requirements under the Anti-Money Laundering Act of 2001 (RA 9160) and its amendments.

For the purposes of the Philippine Data Privacy Act of 2012, winph9 is the Personal Information Controller ("PIC") in respect of the personal data described in this Policy. This means that winph9 determines the purposes for which your personal data is processed and the means by which that processing is carried out.

winph9 has appointed a Data Protection Officer ("DPO") who is responsible for overseeing compliance with this Policy and the DPA. The DPO may be contacted through the winph9 support channels listed in Section 15 of this Policy. Where winph9 engages third-party service providers to process data on its behalf, those providers act as Personal Information Processors ("PIPs") and are bound by contractual obligations consistent with this Policy and applicable law.

winph9 collects the following categories of personal data, depending on how you interact with the Platform:

winph9 does not collect or process sensitive personal information as defined by the DPA — such as political opinions, religious beliefs, health records, or genetic data — except where strictly necessary for KYC/AML compliance (e.g., facial photo for identity verification) or where you have provided explicit consent.

4.1 Direct Collection

winph9 collects data directly from you when you register an account, complete identity verification (KYC), make a deposit or withdrawal, contact our support team, or respond to a survey or promotion.

4.2 Automated Collection

When you access the Platform, winph9 automatically collects certain technical and usage data through cookies, server logs, and similar technologies. This includes your IP address (which may indicate your approximate location in the Philippines — e.g., Metro Manila, Cebu, Davao), device fingerprint, session duration, and the game pages or lobby sections you visit. Refer to Section 8 for full details on cookies.

4.3 Third-Party Sources

winph9 may receive data about you from third-party sources in limited circumstances, including: identity verification service providers used for KYC/AML compliance, payment processors (GCash, PayMaya, BPI, BDO, Metrobank) in connection with transaction processing, and fraud detection service providers.

winph9 processes your personal data for the following purposes, each supported by a lawful basis under the DPA:

winph9 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law or regulatory obligation.

• Account and Transaction Records: Retained for a minimum of five (5) years following account closure, as required for AML compliance and PAGCOR regulatory record-keeping.
• KYC Documentation: Retained for five (5) years from the date of verification, in accordance with the Anti-Money Laundering Act and its implementing rules.
• Gaming History: Retained for a minimum of three (3) years for regulatory audit purposes and dispute resolution.
• Support Communications: Retained for two (2) years from the date of last interaction, for service quality and legal purposes.
• Marketing Preferences: Retained until you withdraw consent or close your account, whichever is earlier.

After the applicable retention period expires, winph9 will securely delete or permanently anonymise personal data, unless an ongoing legal obligation or dispute requires its continued retention.

winph9 does not sell, rent, or trade your personal data. winph9 shares personal data only in the following limited circumstances:

7.1 Service Providers (Personal Information Processors)

winph9 engages third-party service providers to assist with platform operations, including payment processing (GCash, PayMaya, BPI, BDO, Metrobank), identity verification services, fraud detection and prevention services, IT infrastructure and hosting providers, and customer support tooling. These providers act under winph9's instructions and are bound by data processing agreements that require them to protect your data.

7.2 Regulatory and Legal Disclosures

winph9 may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other Philippine government agencies where required to do so by law, regulation, court order, or legitimate legal process.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of winph9 or a material part of its assets, personal data held by winph9 may be transferred to the relevant acquiring entity. Affected players will be notified in advance of any such transfer and of any changes to this Policy that result from it.

7.4 Game Providers

winph9 provides limited technical data (such as player session identifiers) to game providers for the purpose of game delivery, fairness monitoring, and technical support. This data does not include your full name, contact details, or financial information.

winph9 uses cookies and similar technologies on the Platform. Cookies are small text files stored on your device that help us operate and improve the Platform.

8.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for the Platform to function — including session authentication, security tokens, and load balancing. These cannot be disabled.
• Functional Cookies: Remember your preferences, such as language settings and game lobby display preferences.
• Analytical Cookies: Help winph9 understand how players use the Platform — which pages are most visited, where players navigate from, and how performance can be improved. Data collected is aggregated and does not identify individuals directly.
• Session Cookies: Exist only for the duration of your browser session and are deleted when you close your browser.

8.2 Cookie Management

You can manage non-essential cookies through your browser settings. Disabling functional or analytical cookies will not prevent you from using the Platform, but may affect some non-essential features. Strictly necessary cookies cannot be disabled as they are required for platform operation.

winph9 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform.
• Encryption at rest for all stored personal data and financial records.
• Password hashing using industry-standard one-way cryptographic algorithms — meaning no winph9 employee can read your password.
• Role-based access controls limiting internal access to personal data to authorised personnel on a need-to-know basis.
• Regular security audits and penetration testing of the Platform infrastructure.
• Two-factor authentication (2FA) options for player accounts.
• Automated fraud monitoring and anomaly detection systems.

While winph9 takes security seriously and implements industry-standard protections, no system is completely immune to security incidents. In the event of a data breach that poses a risk to your rights, winph9 will notify you and the NPC as required by Philippine law.

winph9 primarily stores and processes data within infrastructure located in or serving the Philippines. However, some service providers — including cloud infrastructure providers and certain specialist KYC/AML vendors — may process data in other jurisdictions.

Where personal data is transferred outside the Philippines, winph9 ensures that such transfers are subject to appropriate safeguards consistent with the requirements of the DPA, including: contractual clauses that impose data protection obligations on the recipient equivalent to those applicable in the Philippines, or processing in jurisdictions that offer an adequate level of data protection as recognised by the NPC.

winph9 will not transfer personal data to jurisdictions that do not provide an adequate level of protection without implementing appropriate additional safeguards.

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights in respect of your personal data held by winph9:

• Right to Be Informed: The right to know that winph9 processes your personal data, for what purposes, and under what legal basis — which this Policy sets out.
• Right to Access: The right to request a copy of the personal data winph9 holds about you, subject to verification of your identity.
• Right to Correction: The right to request correction of inaccurate or outdated personal data in your winph9 account.
• Right to Erasure (Right to Be Forgotten): The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to winph9's legal retention obligations under PAGCOR licensing and AML law.
• Right to Object: The right to object to the processing of your personal data, particularly for marketing purposes.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used format where technically feasible.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe winph9 has processed your data in violation of the DPA.

To exercise any of the above rights, please contact winph9 through the support channels listed in Section 15. winph9 will respond to verified requests within a reasonable timeframe and in any event within the period prescribed by the DPA and NPC regulations.

The winph9 Platform is strictly intended for individuals who are at least 21 years of age, as required by PAGCOR and Philippine law governing online casino gambling. winph9 does not knowingly collect personal data from individuals under the age of 21.

All registered players are required to confirm their date of birth during registration and may be required to submit government-issued identification to verify their age as part of the KYC process. Where winph9 discovers or has reasonable grounds to believe that a player is under 21 years of age, the account will be immediately suspended and any deposits returned to the payment source, pending verification.

If you are a parent or guardian and believe that a minor has registered on the winph9 Platform, please contact us immediately through the support channels in Section 15 and we will act promptly to close the account and return any funds.

winph9 may send you promotional communications about bonuses, new games, and platform offers where you have consented to receive such communications at the time of registration or through your account settings.

You can withdraw your consent to marketing communications at any time by:

• Updating your communication preferences in the winph9 account settings section.
• Clicking the unsubscribe link included in any marketing email sent by winph9.
• Contacting winph9 support via live chat or email and requesting to be removed from marketing communications.

Withdrawal of consent to marketing will not affect your ability to use the Platform or receive service-related communications (such as account security alerts, transaction confirmations, or KYC requests), which are sent on the basis of contract or legal obligation rather than consent.

winph9 may update this Privacy Policy from time to time to reflect changes in applicable law, NPC guidance, PAGCOR requirements, operational practices, or platform features. The effective date of the current version is displayed at the top of this page.

Material changes — meaning changes that affect your rights or the way winph9 processes your personal data in a significant way — will be communicated to you via the email address registered to your winph9 account at least seven (7) days before the changes take effect.

Non-material changes (such as formatting improvements, typographical corrections, or clarifications that do not alter the substantive content of the Policy) may be made without prior notice and will be effective from the date of publication.

Your continued use of the winph9 Platform following the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must stop using the Platform and contact support to close your account.

For any questions, concerns, or requests relating to this Privacy Policy or the personal data winph9 holds about you, please contact the winph9 Data Protection Officer through the following channels:

• Live Chat: Available 24/7 directly on the winph9 Platform — the fastest way to reach our team for privacy-related enquiries.
• Email: [email protected] — please include "Privacy Request" in the subject line so your enquiry is directed to the DPO team promptly.

winph9 will acknowledge your request promptly and respond within the timeframe required by the DPA, typically within 15 business days for standard requests and as soon as practically possible for urgent matters such as suspected data breaches.

Complaints to the National Privacy Commission

If you believe that winph9 has processed your personal data in a manner that violates the Philippine Data Privacy Act of 2012, you have the right to lodge a formal complaint with the National Privacy Commission (NPC). The NPC is the Philippine government authority responsible for enforcing the DPA and may be contacted through the NPC's official government website and offices. winph9 will cooperate fully with any NPC investigation or mediation process.