winph8 Privacy Policy

1 Introduction and Scope

This Privacy Policy ("Policy") is issued by winph8 ("we," "us," "our," or "the Platform") and governs the collection, use, storage, disclosure, and protection of personal information obtained from individuals ("you," "User," "Player," or "Member") who access or use the winph8 website at winph8.cam, including all associated gaming services, promotional activities, customer support channels, and related digital interfaces (collectively, the "Services").

This Policy is issued in compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations, as administered by the National Privacy Commission of the Philippines. By registering an account, making a deposit, or otherwise using the winph8 platform, you confirm that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

This Policy applies to all personal information collected from players based in the Philippines, including individuals accessing the platform from Metro Manila, Cebu, Davao, Quezon City, Makati, and all other areas of the Philippine archipelago. If you are accessing winph8 from outside the Philippines, please be aware that data may be processed in jurisdictions with different privacy protections.

2 Data Controller Information

For the purposes of the Data Privacy Act of 2012, winph8 acts as the personal information controller in respect of data collected through the winph8 platform. As controller, winph8 determines the purposes and means of processing personal data obtained from registered members and platform visitors.

winph8 has designated a Data Protection Officer ("DPO") responsible for overseeing compliance with this Policy and applicable Philippine data protection law. Inquiries related to privacy, data subject rights requests, and complaints may be directed to our Data Protection Officer at:

3 What Personal Data We Collect

winph8 collects personal data that is adequate, relevant, and limited to what is necessary for the purposes described in this Policy. The categories of personal data we may collect include:

winph8 does not collect sensitive personal information as defined under Section 3(l) of the DPA — such as government-issued identification numbers like SSS, TIN, or PhilHealth numbers — unless specifically required for mandatory regulatory compliance purposes, in which case such data is handled with the heightened protections required by law.

4 How We Collect Your Data

winph8 collects personal data through the following means:

• Direct interactions: Data you voluntarily provide during account registration, identity verification, deposit and withdrawal requests, customer support interactions, and promotional opt-ins.
• Automated technologies: Technical and usage data collected automatically when you access the winph8 platform, including through cookies, web beacons, pixel tags, and server log files. See Section 8 for full details on our cookie practices.
• Third-party verification providers: Identity and age verification data obtained from licensed third-party KYC service providers where direct document verification is required.
• Payment processors: Transaction reference information shared by payment service providers (GCash, PayMaya, and banking partners) to confirm deposit and withdrawal status.
• Fraud prevention services: Risk signals and device fingerprint data provided by third-party fraud detection systems used to protect the security of player accounts and the integrity of the platform.

5 Legal Bases for Processing

winph8 processes your personal data only where a lawful basis exists under the Data Privacy Act of 2012 and its Implementing Rules and Regulations. The applicable legal bases for our processing activities are:

• Contractual necessity: Processing required to fulfil the account agreement between you and winph8, including identity verification, payment processing, and account management.
• Legal obligation: Processing required to comply with Philippine law, including anti-money laundering obligations under RA 9160 (AMLA), PAGCOR reporting requirements, and tax obligations.
• Legitimate interests: Processing necessary for the legitimate interests of winph8, including fraud prevention, platform security, responsible gaming monitoring, and service improvement, provided those interests are not overridden by your rights and interests.
• Consent: Processing for marketing communications and non-essential cookies, where you have provided explicit, freely given consent. You may withdraw your consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

6 How We Use Your Personal Data

winph8 uses the personal data it holds about you for the following purposes:

• To create, verify, and manage your winph8 account, including age verification to enforce the 21+ requirement mandated under PAGCOR regulations.
• To process deposits and withdrawals in Philippine Peso via GCash, PayMaya, BPI, BDO, Metrobank, Visa, and Mastercard.
• To detect and prevent fraud, money laundering, account takeover, and other forms of financial crime or platform abuse.
• To monitor gaming activity for responsible gaming purposes, including identifying patterns that may indicate problem gambling and activating player protection tools where appropriate.
• To communicate with you regarding your account status, transaction confirmations, security alerts, and changes to winph8 policies.
• To send promotional communications and bonus offers, but only where you have consented to receive such communications and not opted out.
• To resolve disputes, respond to support queries, and maintain records required for regulatory compliance and internal audit purposes.
• To improve the winph8 platform through analysis of aggregated usage data, game performance metrics, and player experience feedback.

7 Sharing and Disclosure of Data

winph8 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection agreements:

• Payment service providers: GCash, PayMaya, BPI, BDO, Metrobank, Visa, and Mastercard, to process your financial transactions. These providers act as independent data controllers for their own services.
• Identity verification partners: Licensed KYC and age verification service providers engaged by winph8 to confirm player identity and satisfy regulatory requirements.
• Fraud and security services: Third-party fraud detection and cybersecurity providers who assist in protecting the platform and its members from financial crime and unauthorized access.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other Philippine government authorities, where disclosure is required by law, court order, or regulatory mandate.
• Professional advisers: Legal counsel, auditors, and compliance consultants engaged by winph8, bound by applicable confidentiality obligations.
• Business successors: In the event of a merger, acquisition, or sale of all or substantially all of winph8's assets, personal data held on registered players may be transferred to the successor entity, subject to the data protection protections in this Policy.

Any third-party service provider receiving personal data from winph8 is required to process that data only in accordance with winph8's documented instructions and to implement appropriate technical and organizational security measures. winph8 does not transfer personal data to recipients outside the Philippines without ensuring that adequate protections equivalent to those required under the DPA are in place.

8 Cookies and Tracking Technologies

The winph8 platform uses cookies and similar tracking technologies to support platform functionality, maintain session security, and — where you have consented — to analyze usage patterns and deliver relevant content. A cookie is a small text file placed on your device by the winph8 platform when you visit.

The cookies used by winph8 fall into the following categories:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without affecting core platform functionality.
• Functional cookies: Remember your preferences such as language settings, last game played, and responsible gaming tool configurations. These improve your experience but are not essential.
• Analytics cookies: Collect anonymized or pseudonymized data about how players navigate the platform, which games attract the most sessions, and where technical issues occur. This data helps winph8 improve the platform. These are set only with your consent.
• Security cookies: Assist in fraud detection and account security monitoring by identifying unusual device or session behavior. These are considered strictly necessary for player protection.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to log in and use the winph8 platform. For more granular control, you may also manage non-essential cookie preferences through the cookie settings panel accessible from the platform footer.

9 Data Retention

winph8 retains personal data for as long as necessary to fulfil the purposes described in this Policy, to maintain your active account, or to comply with applicable legal and regulatory obligations. The following retention periods apply as a general guide:

• Active account data: Retained for the duration of your account plus a minimum of five (5) years following account closure, in compliance with PAGCOR and AMLC record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, as required under Philippine anti-money laundering regulations.
• Identity verification documents: Retained for the period required by applicable KYC regulations, typically five (5) years from the date of verification or account closure, whichever is later.
• Customer support records: Retained for three (3) years from the date of the last interaction, unless a longer period is required by an ongoing dispute or legal proceeding.
• Marketing consent records: Retained for the duration of your consent plus two (2) years, to evidence that marketing communications were lawfully sent.
• Technical and usage logs: Retained for twelve (12) months in their identifiable form, after which they are anonymized or deleted.

Upon expiry of the applicable retention period, winph8 will securely delete or anonymize personal data in a manner that prevents recovery or re-identification. Where data cannot be immediately deleted due to technical constraints, it will be isolated from active processing until deletion is possible.

10 Security of Your Personal Data

winph8 implements appropriate technical and organizational measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include but are not limited to:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the winph8 platform.
• Encryption at rest for sensitive data fields including financial account references and identity document data.
• Role-based access controls limiting internal access to personal data to personnel with a documented business need.
• Multi-factor authentication requirements for internal systems that process or store player data.
• Regular security assessments, penetration testing, and vulnerability scanning of platform infrastructure.
• Incident response procedures enabling rapid detection, containment, and notification in the event of a personal data breach.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, winph8 will notify the National Privacy Commission within 72 hours of becoming aware of the breach and will notify affected players without undue delay, in compliance with Section 20(f) of the Data Privacy Act of 2012.

11 Your Rights as a Data Subject

Under the Data Privacy Act of 2012, registered players and platform visitors have the following rights in relation to their personal data held by winph8:

• Right to be informed: The right to know whether winph8 holds personal data about you and to receive a copy of this Privacy Policy explaining how that data is processed.
• Right of access: The right to request a copy of the personal data winph8 holds about you, together with information about how it is processed.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data held by winph8.
• Right to erasure: The right to request deletion of your personal data, subject to winph8's legal and regulatory retention obligations which may override this right in specific circumstances.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes. This right is absolute and winph8 will honor it without requiring justification.
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines if you believe winph8 has processed your personal data in violation of the DPA.

To exercise any of the above rights, submit a written request to winph8's Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request." winph8 will respond within fifteen (15) business days of receipt. winph8 may request proof of identity before fulfilling a data subject rights request to ensure personal data is not disclosed to unauthorized parties.

12 Children and Minors

winph8 does not knowingly collect, process, or store personal data belonging to individuals under 21 years of age. Age verification is a mandatory step in the winph8 account registration process, and accounts flagged as potentially belonging to underage individuals are suspended pending document verification.

If winph8 becomes aware that personal data has been collected from a person under 21, it will take immediate steps to delete that data and close the associated account. Parents and guardians who believe their child has registered on the winph8 platform should contact [email protected] immediately to initiate account closure and data deletion.

13 Changes to This Policy

winph8 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Where changes are material, winph8 will provide advance notice to registered members via the email address on file or through a prominent notice on the platform, prior to the changes taking effect.

The "Effective Date" at the top of this Policy indicates when the current version came into force. Continued use of the winph8 platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with a proposed change, you should cease using the platform and submit a data deletion request before the revised Policy takes effect.

14 Contact and Complaints

For any questions, concerns, or requests relating to this Privacy Policy or winph8's data protection practices, please contact our Data Protection Officer directly:

• Email: [email protected] (subject: "Privacy Inquiry")
• Response time: Within 15 business days
• Support languages: English and Tagalog
• Support hours: 24 hours a day, 7 days a week

If you are not satisfied with winph8's response to a privacy complaint, you have the right to escalate your complaint to the National Privacy Commission of the Philippines. The NPC handles complaints from Philippine data subjects regarding violations of the Data Privacy Act of 2012. You can reach the NPC through their official government channels — details are publicly available from the NPC's official website.