winnerz Privacy Policy

1 Overview

winnerz operates an online gaming platform designed for eligible players in the Philippines. In the course of providing our services — including account registration, identity verification, gameplay, payments, and customer support — we necessarily collect and process certain personal data about you.

This Privacy Policy is intended to give you a clear, honest picture of our data practices. We believe that transparency is the foundation of trust, and we want every winnerz player to feel confident that their personal information is handled responsibly, securely, and in accordance with applicable Philippine law.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

2 Data Controller

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, the data controller responsible for your personal data is winnerz, operating the Platform at winnerz.one.

Our designated Data Protection Officer (DPO) can be reached at:

• Email: [email protected]
• Subject Line: "Privacy / DPO Inquiry"

We aim to respond to all privacy- related inquiries within five (5) business days.

3 Data We Collect

winnerz collects the following categories of personal data:

Category	Examples	Purpose
Identity Data	Full name, date of birth, nationality, government ID number	Account registration, KYC verification, age verification
Contact Data	Email address, mobile number, residential address	Account communication, support, regulatory notices
Financial Data	GCash number, bank account details, transaction history	Processing deposits and withdrawals, AML compliance
Technical Data	IP address, device type, browser, operating system, session logs	Security, fraud prevention, platform optimization
Usage Data	Games played, bet amounts, session duration, feature interactions	Responsible gaming monitoring, personalization, analytics
Communications Data	Support chat transcripts, email correspondence, feedback submissions	Customer support, dispute resolution, quality assurance
Verification Documents	Scanned government IDs, selfies, proof of address documents	KYC/AML compliance, identity verification

We do not collect sensitive personal information (as defined under RA 10173) unless strictly required for identity verification or legal compliance, and only with your explicit consent where required.

4 How We Collect Data

winnerz collects personal data through the following means:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated technologies: Technical and usage data collected automatically when you access the Platform, including through cookies, web beacons, server logs, and similar tracking technologies.
• Third-party sources: Identity verification providers, payment processors (e.g., GCash, Maya, partner banks), fraud detection services, and publicly available sources where permitted by law.
• Regulatory sources: Information received from PAGCOR, the National Privacy Commission (NPC), law enforcement, or other competent authorities in connection with legal obligations.

5 How We Use Your Data

winnerz uses your personal data for the following purposes:

• To create, manage, and maintain your winnerz account.
• To verify your identity and age (21+) in compliance with Philippine gaming regulations.
• To process deposits and withdrawals via GCash, Maya, bank transfer, and debit card.
• To detect, investigate, and prevent fraud, money laundering, and other illegal activities.
• To monitor gameplay for responsible gaming purposes and apply protective measures where necessary.
• To provide customer support and resolve disputes.
• To send you transactional communications (account notices, security alerts, payment confirmations).
• To send you promotional communications about winnerz offers and games, where you have consented to receive such communications.
• To comply with legal and regulatory obligations, including reporting to PAGCOR and other competent authorities.
• To improve and personalize the Platform experience through analytics and user research.

6 Legal Basis for Processing

winnerz processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform our contract with you (i.e., operating your account, processing payments, providing games).
• Legal obligation: Processing required to comply with applicable laws and regulations, including AML/CTF obligations, PAGCOR licensing requirements, and tax reporting.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and business analytics, where these interests are not overridden by your rights.
• Consent: Processing for marketing communications and certain non-essential cookies, where you have given explicit consent. You may withdraw consent at any time.

7 Sharing Your Data

winnerz does not sell, rent, or trade your personal data. We may share your data with the following categories of recipients, strictly on a need-to-know basis:

• Identity verification providers: Third-party KYC and AML service providers who assist in verifying your identity and screening against sanctions lists.
• Payment processors: GCash, Maya, partner banks, and debit card processors necessary to facilitate deposits and withdrawals.
• IT and platform service providers: Cloud hosting, data storage, cybersecurity, and analytics providers who process data on our behalf under strict data processing agreements.
• Regulatory and law enforcement authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other competent authorities, where required by law or court order.
• Professional advisors: Lawyers, auditors, and accountants, subject to professional confidentiality obligations.

All third-party service providers who process personal data on behalf of winnerz are required to implement appropriate technical and organizational security measures and to process data only in accordance with our instructions.

8 Data Retention

winnerz retains your personal data for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, regulatory, accounting, and reporting requirements. Specific retention periods include:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years after account closure, in compliance with AML regulations.
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction.
• Support communications: Retained for three (3) years from the date of the interaction.
• Marketing consent records: Retained until you withdraw consent, plus a reasonable period thereafter for compliance documentation.
• Technical and usage logs: Retained for up to twelve (12) months, unless required longer for security investigations.

When personal data is no longer required, winnerz will securely delete or anonymize it in accordance with our data disposal procedures.

9 Data Security

winnerz implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• AES-256 encryption for data at rest and TLS 1.2+ encryption for data in transit.
• Multi-factor authentication (MFA) for administrative access to systems containing personal data.
• Regular penetration testing and vulnerability assessments conducted by independent security firms.
• Role-based access controls ensuring that only authorized personnel can access personal data on a need-to-know basis.
• Continuous monitoring and intrusion detection systems.
• Staff training on data protection and information security best practices.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, winnerz will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, and will notify affected individuals without undue delay, in accordance with RA 10173.

10 Cookies & Tracking Technologies

winnerz uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device that help us recognize you, remember your preferences, and understand how you use the Platform.

10.1 Types of Cookies We Use

• Strictly necessary cookies: Essential for the Platform to function. These cannot be disabled as they are required for security, session management, and core functionality.
• Performance cookies: Collect anonymized data about how visitors use the Platform (e.g., pages visited, error messages) to help us improve performance.
• Functional cookies: Remember your preferences (e.g., language, display settings) to provide a more personalized experience.
• Analytics cookies: Help us understand aggregate usage patterns to improve the Platform. Data collected is anonymized where possible.

10.2 Managing Cookies

You can control non-essential cookies through your browser settings or our cookie preference center. Please note that disabling certain cookies may affect the functionality of the Platform. Strictly necessary cookies cannot be disabled without impacting your ability to use the Platform.

11 Your Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by winnerz:

To exercise any of these rights, please contact our Data Protection Officer at [email protected] with the subject line "Data Subject Request." We will respond within thirty (30) days. We may need to verify your identity before processing your request.

If you believe your data privacy rights have been violated, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

12 Minors

The winnerz Platform is strictly intended for individuals aged 21 years and above, in accordance with Philippine gambling regulations. winnerz does not knowingly collect personal data from individuals under the age of 21.

If we become aware that personal data has been collected from a person under 21, we will take immediate steps to delete that data and close the associated account. If you believe a minor has registered on the Platform, please contact us immediately at [email protected].

13 International Data Transfers

winnerz primarily stores and processes personal data within the Philippines. In certain circumstances, data may be transferred to or processed by service providers located outside the Philippines (for example, cloud infrastructure providers or international KYC services).

Where such transfers occur, winnerz ensures that appropriate safeguards are in place, including contractual clauses that require the recipient to protect your data to a standard equivalent to that required under Philippine law. We will not transfer your personal data to a country that does not provide an adequate level of data protection without implementing appropriate safeguards.

14 Policy Amendments

winnerz reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform features. When material changes are made, we will notify registered players via email or a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this page indicates when the Policy was most recently revised. We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms.

15 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact the winnerz Data Protection Officer:

• Email: [email protected]
• Subject Line: "Privacy Inquiry" or "Data Subject Request"
• Response Time: Within 5 business days for general inquiries; within 30 days for formal data subject requests
• Support Hours: 24/7, English and Filipino

You also have the right to escalate unresolved privacy complaints to the National Privacy Commission (NPC) of the Philippines.