Privacy Policy

This Privacy Policy applies to all personal data collected and processed by winingplus in connection with your access to and use of the winingplus Platform at winingplus.org, including all account registration, gaming, payment, and customer support interactions.

For the purposes of the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, winingplus (referred to in this Policy as "we," "us," or "the Company") is the Personal Information Controller (PIC) with respect to the personal data of winingplus account holders and Platform visitors.

This Policy applies to data subjects who are residents of or located in the Philippines. winingplus operates exclusively as a Philippine-market platform authorized by the Philippine Amusement and Gaming Corporation (PAGCOR). This Policy does not apply to third-party websites or services that may be linked from the winingplus Platform — each such third party maintains its own privacy practices for which winingplus is not responsible.

winingplus collects the following categories of personal data, depending on the nature of your interaction with the Platform:

winingplus does not intentionally collect sensitive personal information as defined under Section 3(l) of the Data Privacy Act (e.g., health data, religious beliefs, political affiliations) unless it is directly relevant to a specific legal obligation — for example, a health-related self-exclusion request made by the account holder or a referring third party.

winingplus collects personal data through the following channels:

• Direct collection: Information you provide directly when registering a winingplus account, completing KYC verification, making deposits or withdrawal requests, contacting customer support, or participating in promotions;
• Automated collection: Technical and usage data collected automatically through cookies, web server logs, and session tracking tools when you visit winingplus.org or interact with the Platform;
• Payment providers: Transaction confirmation data provided by GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, and other payment service providers in connection with deposit and withdrawal transactions;
• Identity verification services: Data returned by third-party KYC and identity verification providers engaged by winingplus to verify the identity and age of account holders in compliance with PAGCOR requirements;
• Anti-money laundering screening: Data from sanctions list screening, politically exposed persons (PEP) databases, and adverse media screening tools used for AMLA compliance;
• Responsible gaming referrals: Where a third party (e.g., a family member or healthcare provider) notifies winingplus of a concern about an account holder's gaming behaviour, winingplus may create a record of that referral.

Under the Philippine Data Privacy Act, winingplus processes personal data on the following legal bases:

• Contractual necessity: Processing that is necessary to create and maintain your winingplus account, process your deposits and withdrawals, and deliver the gaming services you have requested. Without this processing, winingplus cannot provide its services to you.
• Legal obligation: Processing required to comply with PAGCOR regulations, the Anti-Money Laundering Act (RA 9160), BSP regulations applicable to payment processing, NPC requirements, and any other Philippine law or regulatory obligation binding upon winingplus.
• Legitimate interests: Processing necessary for winingplus's legitimate operational interests, including fraud prevention, platform security, responsible gaming monitoring, and improvement of Platform features — provided such interests are not overridden by your rights and freedoms as a data subject.
• Consent: Processing for marketing communications and non-essential analytics, where winingplus relies on your freely given, specific, informed, and unambiguous consent. You may withdraw consent to marketing communications at any time without affecting the lawfulness of prior processing.
• Protection of vital interests: Processing in connection with responsible gaming interventions where there is a genuine concern for the wellbeing of the account holder.

winingplus uses your personal data for the following purposes:

• Account management: Creating, maintaining, and administering your winingplus account, including authentication, password recovery, and account settings;
• Identity verification (KYC): Verifying your identity and confirming that you meet the minimum age requirement of 21 years, as mandated by PAGCOR;
• Payment processing: Facilitating deposits via GCash, PayMaya, and Philippine bank transfers, and processing withdrawals to your verified payment account;
• Gaming services: Delivering the games and features available on the winingplus Platform, including maintaining your game history and bonus eligibility records;
• Fraud prevention and security: Detecting, investigating, and preventing fraud, unauthorized access, money laundering, and other prohibited activities on the Platform;
• AMLA compliance: Conducting transaction monitoring, suspicious activity reporting, and customer due diligence as required under the Anti-Money Laundering Act;
• Customer support: Responding to your enquiries, resolving disputes, and delivering after-sales support through our 24/7 live chat and email channels;
• Responsible gaming: Monitoring gaming behaviour to identify potential problem gambling patterns, administering self-exclusion requests and player-set limits, and reaching out to players where welfare concerns arise;
• Regulatory reporting: Complying with PAGCOR reporting obligations, NPC requirements, and other statutory obligations applicable to our operations in the Philippines;
• Platform improvement: Analysing aggregated usage data to improve the functionality, performance, and user experience of the winingplus Platform;
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates — with your consent, and subject to your right to unsubscribe at any time.

winingplus does not sell your personal data. We share personal data with third parties only in the following circumstances, and only to the extent necessary for each specific purpose:

• Payment service providers: GCash (Mynt), PayMaya (Maya Philippines), BPI, BDO, Metrobank, UnionBank, and any other payment processing partner engaged to execute deposit or withdrawal transactions on your behalf;
• KYC and identity verification providers: Third-party providers engaged by winingplus to verify government-issued identification documents, conduct age verification, and perform biometric matching where applicable;
• Game software providers: Licensed game providers (e.g., Pragmatic Play, NetEnt, Microgaming) who may receive session data necessary to operate their games on the winingplus Platform. These providers are contractually bound to use such data solely for the purpose of game delivery;
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and any Philippine court, tribunal, or law enforcement body to which disclosure is required by law, court order, or regulatory demand;
• IT and cloud service providers: Infrastructure, hosting, and cybersecurity providers engaged to operate and secure the winingplus Platform, subject to data processing agreements consistent with the Data Privacy Act;
• Professional advisers: Lawyers, auditors, accountants, and insurers engaged by winingplus in the ordinary course of business, subject to professional confidentiality obligations;
• Corporate transactions: In the event of a merger, acquisition, or sale of all or substantially all of the assets of winingplus, personal data may be transferred to the successor entity, subject to equivalent privacy protections and notification to affected data subjects.

All third parties with whom winingplus shares personal data are required to maintain the confidentiality and security of that data and to process it only for the specified purpose for which it was shared. winingplus conducts due diligence on third-party data processors and requires contractual data processing agreements where required under the Data Privacy Act.

The winingplus Platform uses cookies and similar tracking technologies to operate core Platform functionality, improve user experience, and analyse Platform performance. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function, including session management, authentication tokens, and security verification. These cookies cannot be disabled without preventing core Platform features from working.
• Functional cookies: Store your preferences (e.g., language settings, game filter preferences) to personalise your experience on the winingplus Platform.
• Analytics cookies: Collect aggregated, anonymised data about how visitors use the Platform — which pages are most visited, how long users spend on each section, and which features are used most frequently. This data helps winingplus improve the Platform.
• Security cookies: Support fraud detection and account security functions, including identifying unusual login patterns or suspicious activity.

Most web browsers allow you to manage cookie settings through your browser preferences. Disabling strictly necessary cookies will affect core Platform functionality and may prevent you from logging in to your winingplus account. Instructions for managing cookies are available in your browser's help documentation.

winingplus does not use cookies to track your activity on third-party websites or to build advertising profiles for use outside the winingplus Platform.

winingplus implements appropriate technical and organisational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• TLS 1.3 encryption with 256-bit keys for all data in transit between your device and winingplus servers;
• Encryption at rest for stored personal data, particularly sensitive data such as identity documents and financial information;
• Role-based access controls ensuring that winingplus staff can only access personal data necessary for their specific job functions;
• Multi-factor authentication for winingplus staff accessing systems holding personal data;
• Regular penetration testing and vulnerability assessments conducted by independent security firms;
• 24/7 security monitoring and intrusion detection systems;
• Staff training on data privacy and information security, conducted at least annually;
• Incident response procedures aligned with NPC Circular No. 16-03 (Personal Data Breach Management).

No online security system is impenetrable. While winingplus takes the security of your personal data very seriously and continuously invests in our security infrastructure, we cannot guarantee that unauthorized third parties will never circumvent our security measures. You play an important role in your account's security by maintaining a strong, unique password and keeping your winingplus login credentials confidential.

winingplus retains your personal data for the periods described below, after which data is securely deleted or anonymised:

At the end of each applicable retention period, winingplus will securely delete or permanently anonymise the relevant personal data, unless a longer retention period is required or permitted by Philippine law.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to the personal data that winingplus holds about you. To exercise any of these rights, please contact our Data Protection Officer using the contact details in Section 14.

The winingplus Platform is strictly prohibited to individuals under the age of 21, consistent with PAGCOR regulations governing online gaming in the Philippines. winingplus does not knowingly collect personal data from individuals below the age of 21.

Where winingplus discovers that personal data has been collected from an individual below the age of 21 — whether through self-declaration, parental notification, or discovery during KYC processing — the associated account will be immediately closed, all data collected will be deleted (subject to any legal retention obligations), and the matter will be reported to PAGCOR as required under our regulatory obligations.

If you are a parent or guardian and believe that a minor has created a winingplus account using false age information, please contact our Data Protection Officer immediately using the contact details in Section 14. We treat all such reports as a priority.

Some of winingplus's technology infrastructure and game software providers are located outside of the Philippines. Where personal data is transferred to recipients in jurisdictions outside the Philippines, winingplus ensures that such transfers comply with the cross-border transfer provisions of the Data Privacy Act and its Implementing Rules and Regulations, specifically Section 21 of the Act and NPC Advisory Opinion guidance on cross-border transfers.

Cross-border transfers are implemented through one or more of the following safeguards:

• A binding contractual agreement with the data recipient incorporating standard data protection clauses consistent with the Data Privacy Act;
• Where the recipient country has been recognised as providing an adequate level of data protection under NPC advisory guidance;
• Binding Corporate Rules applicable to intra-group transfers within our group of companies, where applicable.

You may request information about the specific safeguards applicable to cross-border transfers of your personal data by contacting the winingplus Data Protection Officer.

winingplus reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, PAGCOR regulations, or NPC guidance. The most current version of the Privacy Policy will always be published at winingplus.org/privacy-policy.

Where changes are material — meaning they significantly affect your rights or how your personal data is processed — winingplus will notify registered account holders by email and/or via a prominent notice on the Platform at least 14 days before the changes take effect. Your continued use of the Platform following the effective date of amended Terms constitutes your acceptance of the revised Privacy Policy.

The "Last updated" date at the top of this Policy indicates when the most recent revision was made. We recommend that you review this Policy periodically to remain informed of how winingplus protects your personal data.

winingplus has designated a Data Protection Officer (DPO) as required under Section 21(a) of the Data Privacy Act of 2012. The DPO oversees winingplus's compliance with data privacy obligations and serves as the point of contact for data subject rights requests, privacy complaints, and regulatory enquiries.

To exercise your privacy rights, submit a data subject access request, report a potential data breach, or raise any concern about how winingplus handles your personal data, you may contact us through the following channels:

• Data Protection Officer — winingplus:
• Support email (plain text only): [email protected]
• Live Chat: Available 24/7 through the winingplus Platform — mark your message as a "Data Privacy Request" for priority routing to the DPO team.
• Operating hours: Philippines Standard Time (UTC+8), 24/7, 365 days a year.

If you are not satisfied with winingplus's response to a privacy complaint, you have the right to lodge a formal complaint with the National Privacy Commission of the Philippines through NPC's official complaint channels.