phwing Privacy Policy

1Introduction & Scope

This Privacy Policy ("Policy") describes how phwing ("phwing," "we," "us," "our"), the operator of the online gaming platform at phwing.club ("Platform"), collects, uses, stores, discloses, and protects the personal information of users ("Player," "you," "your") in accordance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), its Implementing Rules and Regulations, and the directives of the National Privacy Commission ("NPC").

This Policy applies to all personal data collected through the Platform, including during account registration, identity verification (KYC), payment processing, gameplay, customer support interactions, and marketing communications. It applies to Filipino players accessing phwing from Metro Manila, Cebu, Davao, Quezon City, Makati, Iloilo, and all other locations in the Philippines, as well as to Philippine nationals accessing the Platform from abroad.

By registering an account and using the phwing Platform, you acknowledge that you have read and understood this Policy and consent to the collection, use, and processing of your personal data as described herein. If you do not agree, you must not use the Platform.

2Data Controller

phwing is the personal information controller ("PIC") in respect of the personal data you provide or that is collected in connection with your use of the Platform. phwing is responsible for determining the purposes and means of processing your personal data, and for ensuring that such processing complies with the DPA and all applicable NPC regulations.

phwing operates under a licence issued by the Philippine Amusement and Gaming Corporation ("PAGCOR"). Certain personal data processing activities — particularly KYC verification, anti-money laundering ("AML") monitoring, and responsible gaming record-keeping — are mandatory under PAGCOR's regulatory requirements and are not subject to opt-out.

3Data We Collect

phwing collects the following categories of personal data:

phwing does not intentionally collect sensitive personal information (as defined by the DPA, including racial or ethnic origin, political opinions, religious beliefs, health data, or criminal history) except where such information is incidentally disclosed in support communications or required for specific regulatory compliance purposes.

4How We Collect Your Data

phwing collects personal data through the following means:

• Direct collection: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or responding to phwing surveys or promotions.
• Automated collection: Technical data collected automatically when you access the Platform, including through cookies, web beacons, and server logs. See Section 8 for cookie details.
• Third-party sources: Identity verification data from KYC service providers; fraud intelligence from third-party fraud prevention platforms; payment data from GCash, Maya, and banking partners in connection with transaction processing.
• PAGCOR reporting systems: Data shared with or received from PAGCOR in connection with phwing's regulatory obligations.

5How We Use Your Data

phwing processes your personal data for the following purposes:

• Account management: Creating and maintaining your phwing account, authenticating your identity at login, and managing account settings.
• KYC and age verification: Verifying that you meet the 21+ age requirement mandated by PAGCOR and confirming your identity before processing withdrawals.
• Payment processing: Facilitating deposits via GCash, Maya, BPI, BDO, Metrobank, and other supported methods; processing withdrawal requests to your verified account.
• Platform operation: Delivering games, processing bets, calculating outcomes, and maintaining your game history and balance records.
• Regulatory compliance: Meeting phwing's obligations under PAGCOR's licensing conditions, the Anti-Money Laundering Act (RA 9160 as amended), and other applicable Philippine laws. This includes mandatory AML transaction monitoring and regulatory reporting.
• Responsible gaming: Monitoring gaming patterns to identify problem gambling indicators; enforcing deposit limits, loss limits, and self-exclusion orders; maintaining exclusion records as required by PAGCOR.
• Fraud prevention and security: Detecting and preventing fraud, unauthorised access, and prohibited conduct on the Platform.
• Customer support: Responding to your enquiries, resolving disputes, and processing complaints.
• Marketing communications: Sending you information about phwing promotions, new games, and offers — but only where you have provided consent and only via the channels you have authorised. You may withdraw marketing consent at any time.
• Platform improvement: Analysing aggregate, anonymised usage data to improve the Platform's performance, design, and game offerings.

6Legal Basis for Processing

phwing processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to fulfil phwing's obligations to you under the Terms and Conditions — account management, payment processing, game delivery.
• Legal obligation: Processing mandated by PAGCOR licensing conditions, the Anti-Money Laundering Act, the DPA itself, and other applicable Philippine regulations.
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where phwing's legitimate interests are not overridden by your data protection rights.
• Consent: Processing for optional marketing communications, where you have expressly opted in. Consent may be withdrawn at any time without affecting prior processing.

7Data Sharing & Disclosure

phwing does not sell your personal data to third parties. phwing may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• PAGCOR: phwing is required to provide player data and gaming records to PAGCOR upon request as a condition of its operating licence.
• AML authorities: The Anti-Money Laundering Council (AMLC) and other competent Philippine authorities, as required by law in connection with suspicious transaction reporting and AML investigations.
• KYC service providers: Third-party identity verification platforms that assist phwing in verifying player identity and age.
• Payment processors: GCash (GXI), PayMaya (Maya Philippines Inc.), BPI, BDO, Metrobank, and other payment partners, strictly for the purpose of processing your transactions.
• Game providers: Third-party game studios whose games are available on phwing may receive pseudonymised session data necessary for game operation and RNG certification.
• IT and hosting providers: Cloud infrastructure and managed service providers who host and operate the Platform infrastructure, bound by confidentiality and data processing agreements.
• Legal and regulatory bodies: Courts, law enforcement, and regulatory authorities where disclosure is required by law or court order.

8Cookies & Tracking Technologies

phwing uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies: Required for the Platform to function — session authentication, security tokens, game state management. These cannot be disabled without preventing you from using the Platform.
• Functional cookies: Remember your preferences (e.g., language, last-played game category) to improve your experience across sessions.
• Analytics cookies: Collect aggregate, anonymised data on how Filipino players use the Platform, which games are most played, and where navigation issues occur. Used to improve Platform performance.
• Security cookies: Detect fraud, bot activity, and account takeover attempts.

phwing does not use advertising or cross-site tracking cookies. You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent Platform login.

9Data Retention

phwing retains personal data for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal and regulatory obligations:

• Active account data: Retained for the lifetime of your phwing account and for a minimum of 5 years after account closure, as required by PAGCOR and AMLC regulations.
• KYC documents: Retained for a minimum of 5 years from the date of collection, or longer if required by AML regulations in connection with a specific investigation or reporting obligation.
• Financial transaction records: Retained for a minimum of 5 years as required by the Anti-Money Laundering Act.
• Marketing consent records: Retained for 3 years from the date of last consent action, or until you withdraw consent, whichever is earlier.
• Technical logs: Retained for 12 months for security and fraud investigation purposes, then deleted or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with phwing's data destruction procedures.

10Data Security

phwing implements technical and organisational security measures appropriate to the risk level associated with processing your personal data. These measures include:

• TLS/SSL encryption for all data transmitted between your device and phwing's servers.
• Encryption of sensitive data fields (passwords, payment account numbers) at rest using industry-standard algorithms.
• Access controls restricting phwing personnel access to personal data on a strict need-to-know basis, with all access logged and auditable.
• Regular penetration testing and vulnerability assessments of the Platform infrastructure.
• Two-factor authentication available for all player accounts and required for all phwing internal system access.
• Incident response procedures including notification to affected players and the NPC within 72 hours of discovering a personal data breach that poses a risk to your rights and freedoms, as required by the DPA.

While phwing takes all reasonable precautions, no system is completely immune to security incidents. You are responsible for keeping your phwing account credentials confidential and for notifying phwing immediately if you suspect unauthorised access.

11Your Rights Under the Data Privacy Act

As a data subject under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phwing:

• Right to be informed: The right to know that your personal data is being collected and processed, as described in this Policy.
• Right of access: The right to request a copy of the personal data phwing holds about you, and information about how it is processed.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure or blocking: The right to request deletion or blocking of your personal data where processing is no longer necessary, unlawful, or where you have withdrawn consent — subject to phwing's legal retention obligations under PAGCOR and AML regulations, which may override this right.
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format where technically feasible.
• Right to object: The right to object to processing of your personal data for marketing purposes at any time.
• Right to damages: The right to claim compensation for damages sustained as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of your personal data.
• Right to file a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe phwing has not complied with the DPA in relation to your personal data.

To exercise any of these rights, contact phwing's Data Protection Officer at [email protected] (plain text — not a clickable link). phwing will respond within 15 business days of receiving a verifiable request.

12Minors

The phwing Platform is strictly for players who are 21 years of age or older, as required by PAGCOR. phwing does not knowingly collect personal data from individuals under 21. If phwing discovers or has reason to believe that a player is under 21, their account will be immediately suspended, all gaming activity will be voided, any deposits returned (subject to verification), and all associated personal data deleted as promptly as permitted by applicable legal obligations.

If you believe that a person under 21 has registered an account or accessed the phwing Platform, please notify phwing immediately at [email protected].

13Amendments to This Policy

phwing reserves the right to update or amend this Privacy Policy at any time. Where changes are material, phwing will provide notice by posting the updated Policy on the Platform and, where practicable, by sending a notification to your registered mobile number or email address. The "Last Updated" date at the top of this Policy indicates when the most recent revision was made.

Your continued use of the phwing Platform after the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept any amendment, you must stop using the Platform and close your account.

14Contact & Data Protection Officer

phwing has designated a Data Protection Officer ("DPO") as required by the Data Privacy Act. For all data privacy enquiries, requests to exercise your data subject rights, or to report a privacy concern, contact:

• Data Protection Officer, phwing
• Email: [email protected] (plain text — not a clickable link)
• Response time: phwing aims to respond to all privacy requests within 15 business days.

For complaints that remain unresolved after contacting phwing, you may contact the National Privacy Commission (NPC) through the NPC's official government channels.