plwin Privacy Policy

plwin ("we," "us," "our") operates the online gaming platform accessible at https://plwin.org and is committed to protecting the personal data of all registered players, site visitors, and individuals who interact with our platform in the Philippines.

This Privacy Policy is issued pursuant to the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the relevant issuances of the National Privacy Commission (NPC) of the Philippines. It also reflects plwin's obligations as a PAGCOR-licensed operator to maintain strict data governance standards in connection with player identity verification and financial transaction records.

By registering a plwin account, accessing the platform, or submitting personal information in any form, you acknowledge that you have read, understood, and consented to the data practices described in this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the plwin platform and contact support to request account closure.

plwin is the data controller responsible for the personal data of players and visitors processed through plwin.org.

plwin collects the following categories of personal data in connection with account registration, gameplay, financial transactions, and platform use. We collect only the minimum data necessary for each processing purpose.

plwin collects personal data through the following methods:

• Direct Submission: Data you provide when registering an account, completing KYC verification, submitting deposit or withdrawal requests, contacting support, or participating in promotions.
• Automated Technical Collection: Data automatically captured when you access the plwin platform, including IP address, device identifiers, browser information, session data, and behavioral analytics through cookies and similar tracking technologies.
• Third-Party Payment Processors: Transaction reference data and payment status information shared by GCash, PayMaya (Maya), BDO, BPI, Metrobank, and Visa/Mastercard processing networks when you conduct financial transactions on plwin.
• Identity Verification Providers: Confirmation data received from third-party KYC and identity verification service providers engaged by plwin to authenticate government-issued ID documents.
• Regulatory Bodies: In limited circumstances, plwin may receive data from PAGCOR or AMLC (Anti-Money Laundering Council) in connection with compliance investigations or regulatory directives.

plwin processes personal data only where a valid legal basis exists under the Data Privacy Act of 2012 and applicable NPC regulations. The following bases apply to plwin's processing activities:

• Contractual Necessity: Processing required to fulfill the plwin Player Account Agreement, including account creation, gameplay facilitation, deposit and withdrawal processing, and customer support provision.
• Legal Obligation: Processing mandated by PAGCOR licensing conditions, the Anti-Money Laundering Act of 2001 (RA 9160) as amended, the Data Privacy Act of 2012, and other applicable Philippine laws requiring player identity verification, transaction monitoring, and record retention.
• Legitimate Interests: Processing carried out to protect plwin's operational security, prevent fraud and multi-accounting, improve platform performance, and ensure responsible gaming compliance — where these interests do not override the rights and freedoms of the data subject.
• Consent: Processing for optional activities such as marketing communications and optional analytics features, for which plwin obtains explicit consent during registration or through account settings. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

plwin uses collected personal data for the following defined purposes only:

• Account creation, authentication, and management — including password resets, OTP verification, and session management for plwin login security.
• Processing financial transactions — deposits via GCash and PayMaya, withdrawals to Philippine bank accounts, and fraud screening on payment activity.
• KYC identity verification — authenticating government-issued ID documents prior to withdrawal approval in compliance with PAGCOR and AMLC requirements.
• Gameplay delivery — connecting players to licensed game content from JILI, Evolution Gaming, Pragmatic Play, and other providers in the plwin lobby.
• Responsible gaming monitoring — tracking gaming patterns to identify indicators of problem gambling and administering deposit limits, session controls, and self-exclusion status.
• Anti-fraud and security operations — detecting multi-account activity, collusion, bonus abuse, unauthorized access, and other platform integrity threats.
• Regulatory compliance reporting — submitting required reports to PAGCOR, AMLC, NPC, and other Philippine regulatory authorities as mandated by law.
• Customer support — responding to account queries, dispute escalations, technical issues, and responsible gaming requests.
• Platform improvement — analyzing anonymized behavioral and technical data to improve usability, identify bugs, and optimize game loading performance on Philippine mobile networks.
• Marketing communications — sending promotional offers and bonus notifications to players who have opted in to receive such communications. This is subject to your consent and may be withdrawn at any time.

plwin does not sell, rent, or trade personal data. Data is shared only with the following categories of recipients and only to the extent necessary for the stated purpose:

• PAGCOR and Regulatory Authorities: Philippine Amusement and Gaming Corporation, Anti-Money Laundering Council (AMLC), National Privacy Commission (NPC), Bureau of Internal Revenue (BIR), and other competent Philippine government bodies — as required by law, license conditions, or lawful order.
• Payment Processors: GCash (Mynt/Globe Fintech), PayMaya/Maya, BDO Unibank, Bank of the Philippine Islands, Metrobank, and Visa/Mastercard processing networks — for transaction execution and fraud prevention only.
• KYC and Identity Verification Providers: Certified third-party identity verification service providers engaged to authenticate KYC documents. These providers operate under data processing agreements with security standards consistent with this policy.
• Game Providers: Licensed game studios (Evolution Gaming, Pragmatic Play, JILI Technology, Asia Gaming, and others) receive the minimum technical session data required to deliver game content to authenticated plwin players.
• IT and Security Service Providers: Cloud hosting, cybersecurity, and platform monitoring providers operating under strict confidentiality and data processing agreements, used solely to maintain platform availability and security.
• Law Enforcement: Philippine law enforcement agencies when plwin is legally compelled to disclose data by court order, subpoena, or lawful investigative demand.
• Professional Advisers: Legal counsel, auditors, and compliance consultants bound by professional confidentiality obligations, accessed only as needed for legal, audit, and regulatory matters.

All third parties who receive plwin player data are required to handle it in a manner consistent with this Privacy Policy and applicable Philippine data protection law.

Some of plwin's service providers — including game studios, cloud infrastructure providers, and identity verification platforms — may process or store data outside the Philippines. Where such international transfers occur, plwin takes the following safeguards:

• Data is transferred only to jurisdictions or processors that provide an adequate level of protection consistent with the Data Privacy Act of 2012 and NPC cross-border transfer requirements.
• International data processing agreements incorporating standard contractual clauses or equivalent protections are in place with all relevant offshore processors.
• Game providers operating licensed studios in jurisdictions such as Malta, Gibraltar, Isle of Man, Curaçao, or the Philippines are engaged only where they maintain certifications from recognized gaming regulatory bodies and demonstrate appropriate information security standards.

plwin retains personal data for the minimum period necessary to fulfill the purposes for which it was collected, subject to mandatory retention requirements under Philippine law:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with NPC-recommended disposal procedures.

plwin uses cookies and similar tracking technologies on plwin.org to enable essential platform functionality, improve performance, and — with your consent — deliver personalized experiences.

• Essential Cookies: Required for the plwin platform to function — including maintaining your login session, remembering language preferences, and securing the connection. These cannot be disabled without breaking core functionality.
• Performance Cookies: Collect anonymized data about how players navigate plwin — page load times, feature usage rates, and error occurrences — used to improve platform performance on Philippine mobile networks and browsers.
• Functional Cookies: Remember your plwin account preferences such as lobby display settings and responsible gaming configurations between sessions.
• Analytics Cookies: Used only with your consent to analyze aggregate player behavior patterns for product improvement purposes. Data is anonymized before analysis.

Most browsers — including Chrome and Safari used by the majority of Filipino players — allow you to control cookie acceptance through browser settings. Disabling non-essential cookies does not affect your ability to log in and play at plwin, but may reduce certain convenience features.

Under the Data Privacy Act of 2012 (RA 10173) and NPC implementing rules, plwin players located in the Philippines hold the following rights with respect to their personal data:

To exercise any of the above rights, submit a request to [email protected] with the subject line "Data Subject Request." plwin will acknowledge receipt within 3 business days and respond substantively within 15 business days of identity verification. Requests may require identity confirmation before processing to protect against unauthorized data access.

plwin does not knowingly collect personal data from any individual under the age of 21. If plwin discovers that personal data has been collected from an underage individual — including through false declaration of age at registration — the following actions will be taken immediately:

• The account will be permanently suspended and all associated balances voided.
• All personal data collected from the underage individual will be securely deleted to the extent permitted by legal reporting obligations.
• The matter will be reported to PAGCOR as required under licensing conditions.

Parents, guardians, and other responsible adults are encouraged to use device-level parental controls to prevent minors from accessing online gambling platforms, including plwin. If you believe an individual under 21 has registered a plwin account, please contact [email protected] immediately.

plwin implements a layered approach to personal data security, incorporating technical, organizational, and procedural safeguards appropriate to the sensitivity of the data processed.

• Encryption in Transit: All data transmitted between players' devices and plwin servers is protected by 256-bit SSL/TLS encryption. All plwin.org pages are served exclusively over HTTPS.
• Encryption at Rest: Sensitive data including KYC documents, financial data, and identity records are encrypted at rest on plwin's infrastructure using industry-standard AES-256 encryption.
• Access Controls: Personal data access within plwin is restricted on a need-to-know basis. Staff access to player data is logged, monitored, and subject to regular review. No staff member has blanket access to all player data.
• Two-Factor Authentication: plwin's internal systems require multi-factor authentication for staff accessing player data management systems.
• Security Testing: plwin engages third-party security specialists to conduct regular penetration testing and vulnerability assessments of the platform infrastructure.
• Incident Response: plwin maintains a documented Data Breach Response Plan. In the event of a personal data breach that poses risk to player rights, affected players and the NPC will be notified within 72 hours of breach discovery, consistent with NPC breach notification requirements.

The plwin platform integrates services from third-party providers including game studios, payment processors, and identity verification partners. These providers operate under their own privacy policies in addition to plwin's data processing agreements with them.

plwin.org does not contain links to external third-party websites for marketing or reference purposes. All internal navigation links on plwin.org resolve to pages within the plwin.org domain. plwin is not responsible for the data practices of external platforms or services accessed independently by players outside of the plwin ecosystem.

plwin reserves the right to update this Privacy Policy to reflect changes in Philippine data protection law, NPC guidance, PAGCOR regulatory requirements, or plwin's data processing practices. Material amendments will be communicated to registered players through:

• A notification banner displayed on the plwin platform at next login.
• An email notification sent to the registered email address at least 7 days before the amendment takes effect.

The effective date and version number at the top of this page always reflect the current version. For non-material clarifications and corrections, plwin may update the policy without prior notice. Continued use of the plwin platform after the effective date of any amendment constitutes acceptance of the revised Privacy Policy.

All previous versions of the Privacy Policy are retained in plwin's records and available on request from the data protection contact below.

plwin has designated a Data Protection Officer (DPO) as required under the Data Privacy Act of 2012. All data subject rights requests, privacy concerns, breach notifications, and related inquiries should be directed to:

If you are not satisfied with plwin's response to your privacy inquiry, you may escalate the matter to the National Privacy Commission (NPC) of the Philippines, the government body responsible for administering and enforcing RA 10173. The NPC accepts complaints through its official government channels.