gpwin Privacy Policy – Your Data, Your Rights, Our Responsibility

1. Identity and Contact Details of the Personal Information Controller

gpwin is the Personal Information Controller ("PIC") in respect of the personal data collected through the gpwin platform. gpwin is a PAGCOR-regulated online gaming operator serving players in the Philippines. For all data privacy inquiries, requests, and complaints, you may contact our Data Protection Officer ("DPO") at:

• Email: [email protected]
• Live Chat: Available 24/7 through the gpwin platform

gpwin has designated a Data Protection Officer in accordance with the requirements of the DPA and the NPC's guidelines on DPO designation.

2. Personal Information We Collect

gpwin collects personal information that is necessary for the lawful operation of an online gaming platform under PAGCOR's regulatory framework. The categories of personal information we collect include:

2.1 Information You Provide Directly

• Full legal name, date of birth, and gender;
• Residential address (including city, province, and postal code);
• Email address and mobile phone number;
• Government-issued identification documents (e.g., Philippine passport, driver's license, UMID, PhilSys National ID);
• Payment method details (e.g., GCash account name, bank account name and number for withdrawal purposes);
• Username and encrypted password;
• Responses to security questions and two-factor authentication data.

2.2 Information Collected Automatically

• IP address and approximate geolocation;
• Device type, operating system, and browser information;
• Session data including login timestamps, session duration, and pages visited;
• Gaming activity data including games played, wagers placed, and transaction history;
• Cookies and similar tracking technologies (see Section 8).

2.3 Information from Third Parties

• Identity verification data from KYC service providers;
• Payment confirmation data from GCash, PayMaya, and Philippine banking partners;
• Fraud detection signals from third-party risk management services.

3. Purposes and Legal Bases for Processing

gpwin processes your personal information for the following purposes, each supported by a lawful basis under the DPA:

4. Disclosure of Personal Information

gpwin does not sell, rent, or trade your personal information to third parties for their own marketing purposes. We may share your personal information with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• PAGCOR and other Philippine regulatory authorities: As required by our gaming license and applicable law;
• Anti-Money Laundering Council (AMLC): For compliance with Republic Act No. 9160 (Anti-Money Laundering Act) and its amendments;
• National Privacy Commission (NPC): In the event of a data breach or as otherwise required by the DPA;
• KYC and identity verification providers: To verify your identity during registration and ongoing compliance checks;
• Payment processors: GCash, PayMaya, and Philippine banking partners, solely for the purpose of processing your transactions;
• Game content providers: Limited technical data necessary to deliver game content and maintain game integrity;
• IT and security service providers: For platform hosting, maintenance, and cybersecurity services, under strict confidentiality obligations;
• Law enforcement agencies: Where required by a valid court order, subpoena, or other legal process under Philippine law.

All third-party service providers engaged by gpwin are required to process personal information only for the specified purpose and in accordance with gpwin's instructions and applicable Philippine data privacy law.

5. Data Retention

gpwin retains personal information for as long as necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods required by Philippine law and PAGCOR regulations:

• Account and KYC records: Retained for a minimum of five (5) years from the date of account closure, as required by PAGCOR and AMLC regulations;
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction;
• Gaming activity logs: Retained for a minimum of three (3) years;
• Customer support communications: Retained for a minimum of two (2) years from the date of the last interaction;
• Marketing consent records: Retained for the duration of your account and for two (2) years following account closure.

Upon expiry of the applicable retention period, personal information will be securely deleted or anonymized in accordance with NPC guidelines on data disposal.

6. Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal information held by gpwin:

• Right to be Informed: You have the right to be informed of how your personal information is being collected and processed, as set out in this Policy;
• Right of Access: You may request a copy of the personal information gpwin holds about you;
• Right to Rectification: You may request correction of inaccurate or incomplete personal information;
• Right to Erasure or Blocking: You may request deletion or blocking of your personal information where processing is no longer necessary or lawful, subject to gpwin's legal retention obligations;
• Right to Object: You may object to the processing of your personal information for direct marketing purposes at any time;
• Right to Data Portability: You may request a copy of your personal information in a structured, commonly used, and machine-readable format;
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission if you believe your data privacy rights have been violated.

To exercise any of these rights, please contact gpwin's Data Protection Officer via live chat or email. gpwin will respond to all data subject requests within fifteen (15) business days of receipt, in accordance with NPC guidelines.

7. Security Measures

gpwin implements appropriate technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS/SSL) encryption for all data transmitted between your device and the gpwin platform;
• Encryption of sensitive data at rest, including payment information and identity documents;
• Role-based access controls limiting employee access to personal information on a strict need-to-know basis;
• Regular security audits, vulnerability assessments, and penetration testing;
• Two-factor authentication (2FA) available for all player accounts;
• Continuous monitoring for suspicious activity and unauthorized access attempts;
• Staff training on data privacy obligations and information security best practices.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, gpwin will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, and will notify affected data subjects without undue delay, in accordance with the DPA and NPC Circular No. 16-03.

8. Cookies and Tracking Technologies

gpwin uses cookies and similar tracking technologies to operate and improve the platform. The types of cookies we use include:

• Strictly Necessary Cookies: Required for the platform to function. These cannot be disabled and do not require your consent;
• Functional Cookies: Remember your preferences (e.g., language, display settings) to improve your experience;
• Analytics Cookies: Collect aggregated, anonymized data about how players use the platform, helping us identify areas for improvement;
• Security Cookies: Used for fraud detection, session management, and platform security.

You may manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the gpwin platform. gpwin does not use third-party advertising cookies or share cookie data with advertising networks.

9. Children's Privacy

The gpwin platform is strictly for individuals aged 21 and above. gpwin does not knowingly collect personal information from persons under the age of 21. If we become aware that personal information has been collected from an underage individual, we will immediately delete that information and close the associated account. If you believe that a minor has registered on the gpwin platform, please contact our Data Protection Officer immediately.

10. Changes to This Privacy Policy

gpwin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. When material changes are made, gpwin will notify registered players via email or a prominent notice on the platform. The date of the most recent revision is displayed at the top of this page.

Your continued use of the gpwin platform following the publication of a revised Privacy Policy constitutes your acknowledgment of the changes. We encourage you to review this Policy periodically to stay informed about how gpwin protects your personal information.

11. Contact and Complaints

For any questions, concerns, or requests relating to this Privacy Policy or gpwin's data processing practices, please contact our Data Protection Officer:

• Live Chat: Available 24/7 through the gpwin platform
• Email: [email protected]

If you are not satisfied with gpwin's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). Information on how to file a complaint with the NPC is available on the NPC's official website.