phwine Privacy Policy

This Privacy Policy covers the personal data of all individuals who visit, register on, or interact with the phwine platform at phwine.cam, including prospective players who begin but do not complete registration, registered players with active accounts, and former players whose accounts have been closed.

phwine acts as the data controller in respect of personal data collected through the Platform. As data controller, phwine determines the purposes and means by which your personal data is processed. phwine is committed to complying with the Philippine Data Privacy Act of 2012 (Republic Act 10173), its Implementing Rules and Regulations, and the relevant issuances of the National Privacy Commission of the Philippines.

This Policy does not apply to third-party game providers, payment gateways, or other external services that have their own separate privacy policies governing their independent data processing activities. While phwine exercises due diligence in selecting third-party service providers who maintain appropriate data protection standards, phwine is not responsible for the independent privacy practices of those third parties.

phwine collects the following categories of personal data from players:

phwine does not collect sensitive personal information beyond what is strictly necessary for identity verification, regulatory compliance, and responsible gaming monitoring. Specifically, phwine does not collect racial or ethnic origin, political opinions, religious beliefs, or health data except where a player voluntarily discloses health-related information in the context of a responsible gaming self-assessment.

phwine collects personal data through the following mechanisms:

3.1 Direct Collection

Data you actively provide to phwine: registration form entries, KYC document submissions, payment method details entered during deposit or withdrawal, communications sent to phwine support via live chat or email, and voluntary responses to responsible gaming assessments or player surveys.

3.2 Automated Collection

Data collected automatically when you use the phwine Platform: login session data including timestamps and IP addresses, device and browser information collected via standard HTTP headers, gameplay activity generated as you interact with games and the platform interface, and cookie-based session identifiers as described in Section 6 of this Policy.

3.3 Third-Party Collection

Data received from third parties in the course of providing phwine's services: payment confirmation and transaction reference data received from GCash, Maya, BDO, BPI, Metrobank, USDT processors, and Coins.ph following a player-initiated payment; identity verification data received from KYC verification service providers; and fraud screening signals received from fraud detection service providers that help phwine identify suspicious account activity.

phwine processes your personal data for the following purposes, each supported by a legal basis under the Philippine Data Privacy Act of 2012:

phwine does not process your personal data for purposes incompatible with those listed above without first obtaining your explicit consent or establishing a new legal basis for processing.

phwine does not sell your personal data. phwine shares your data only in the following circumstances and only to the extent necessary for the stated purpose:

5.1 Game Providers

phwine shares session and account identifiers with its certified game providers (including JILI, Pragmatic Play, PG Soft, Evolution Gaming, and SA Gaming) to enable game delivery, maintain session state, and resolve game disputes. Game providers receive only the minimum data necessary to provide their services to phwine and are contractually prohibited from using phwine player data for independent marketing or profiling purposes.

5.2 Payment Processors

phwine shares transaction-specific data with payment processors (GCash, Maya, BDO, BPI, Metrobank, USDT processor networks, Coins.ph) to initiate and confirm deposit and withdrawal transactions. Payment processors are PCI-DSS certified and process payment data under their own privacy frameworks. phwine does not store full payment card numbers.

5.3 Identity Verification Providers

phwine uses third-party KYC verification services to authenticate government-issued Philippine identification documents submitted during account verification. These providers receive identity data solely for the purpose of verification and are prohibited from retaining or repurposing that data.

5.4 Regulatory Authorities

phwine will disclose player data to PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and any other competent Philippine authority where required to do so by applicable law, court order, or regulatory directive. Such disclosures are limited to the data specifically required by the relevant authority and are documented in phwine's regulatory compliance records.

5.5 Law Enforcement

phwine will cooperate with Philippine law enforcement agencies in relation to investigations of fraud, money laundering, cybercrime, and other offenses where a lawful request for data has been made by the relevant agency with appropriate legal authority. Players will be notified of such disclosures where phwine is legally permitted to do so.

phwine uses cookies and similar tracking technologies to operate the platform, maintain login sessions, and analyze platform usage patterns. The following categories of cookies are used:

6.1 Strictly Necessary Cookies

These cookies are essential for the phwine platform to function and cannot be disabled. They maintain your authenticated session after login, preserve your language and display preferences, and enable the secure operation of payment flows. No consent is required for strictly necessary cookies as they are required to deliver the service you have requested.

6.2 Analytics Cookies

phwine uses first-party analytics cookies to understand how players navigate the platform — which pages are visited most, where sessions end, and how long players engage with different game categories. This data is processed in aggregated, non-personally-identifiable form. You may opt out of analytics cookies through your browser settings or phwine's cookie preference manager.

6.3 Session Security Cookies

These cookies help phwine detect and prevent session hijacking, cross-site request forgery (CSRF), and other security threats. They store session tokens and CSRF protection tokens that are validated with each request to the phwine platform. Disabling these cookies may prevent you from accessing secure areas of the platform.

phwine does not use third-party advertising or behavioral tracking cookies. No third-party advertiser or social media platform receives cookie data from phwine player sessions.

You can manage cookie settings through your browser's privacy controls. Note that disabling essential cookies may prevent you from logging in to your phwine account or completing payment transactions.

phwine implements technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, alteration, and disclosure. These measures include:

• Transport encryption: All data transmitted between your device and phwine's servers is encrypted using TLS 1.3. Older, less secure protocol versions (TLS 1.0, TLS 1.1, SSL 3.0) are disabled on all phwine endpoints.
• Data at rest encryption: Sensitive personal data fields — including government ID numbers, payment account references, and authentication credentials — are encrypted at rest in phwine's database systems using AES-256 encryption.
• Password handling: phwine stores passwords using a one-way cryptographic hash with per-account salting. phwine staff cannot retrieve your plaintext password. If you forget your password, a reset is required — not a lookup.
• Access controls: Access to phwine's production systems containing personal data is restricted to a defined set of authorized personnel. Access is logged, reviewed, and subject to the principle of least privilege.
• Penetration testing: phwine's platform undergoes periodic security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response: phwine maintains a documented data breach response procedure. In the event of a breach affecting your personal data, phwine will notify you and the National Privacy Commission of the Philippines within the timeframes specified by the Data Privacy Act.

phwine retains personal data for as long as necessary to fulfill the purpose for which it was collected, subject to minimum retention periods required by Philippine law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted from phwine's active systems or anonymized such that it can no longer be associated with an identifiable individual. Anonymized, aggregated data may be retained indefinitely for analytical and reporting purposes.

Under the Philippine Data Privacy Act of 2012 (Republic Act 10173), you have the following rights in relation to your personal data held by phwine:

To exercise any of these rights, contact phwine's Data Protection Officer as described in Section 15. phwine will respond to verified rights requests within 30 calendar days. Where the complexity or volume of requests requires additional time, phwine will notify you of the extension and the reasons for it within the initial 30-day window.

If you are unsatisfied with phwine's response to a rights request or with phwine's data processing practices generally, you have the right to lodge a complaint with the National Privacy Commission of the Philippines through the NPC's official complaint channels.

If you are a parent or guardian and believe your child (under 21) has registered on phwine, please contact us immediately at [email protected]. Include your contact details and the email address used to register the account. phwine will investigate and respond within 2 business days.

phwine uses date of birth verification during account registration and government ID document verification during KYC to screen for underage players. These controls are continuously reviewed and updated as part of phwine's PAGCOR compliance obligations.

Some of phwine's service providers — including game server infrastructure, cloud hosting, and KYC verification services — operate data centers outside the Philippines. Where phwine transfers personal data to recipients in other countries, phwine takes the following steps to ensure your data remains appropriately protected:

• phwine only transfers data to countries or recipients whose data protection standards are assessed as adequate or equivalent to the protections provided by the Philippine Data Privacy Act;
• Contractual data processing agreements incorporating data protection obligations are in place with all third-party recipients of phwine player data, regardless of jurisdiction;
• Transfers to game providers are limited to session identifiers and are governed by the game provider's certification and contractual obligations to phwine;
• phwine maintains records of all cross-border data transfer arrangements as required by the National Privacy Commission's regulations.

phwine processes a specific category of data related to responsible gaming that deserves particular attention. This includes self-imposed deposit limits, loss limits, session time limits, cooling-off periods, self-exclusion status, and behavioral indicators that may suggest a player is experiencing gambling-related harm.

Responsible gaming data is processed for the following strictly limited purposes:

• To enforce player-set limits and restrictions on gameplay and deposits, ensuring phwine honors the boundaries a player has established for themselves;
• To monitor gaming behavior patterns for indicators consistent with problem gambling, allowing phwine's responsible gaming team to proactively contact at-risk players;
• To comply with PAGCOR's responsible gaming regulatory requirements and to produce required compliance reporting to PAGCOR;
• To prevent self-excluded players from creating new accounts on phwine or accessing the platform during an active exclusion period.

Responsible gaming data is never used for marketing purposes. A player who has self-excluded or applied responsible gaming restrictions will not receive promotional communications from phwine. Self-exclusion records are retained indefinitely, as deletion of these records could allow an excluded player to re-register without detection.

phwine sends marketing communications — including promotional emails, SMS bonus notifications, and in-platform promotional messages — only to players who have given explicit consent to receive such communications. Consent is collected separately from the acceptance of these Terms during the registration process and is not a condition of using the phwine platform.

phwine's marketing communications may include information about new games, reload bonuses, weekly promotions, sportsbook odds boosts, VIP program updates, and Philippine gaming events such as PBA season promotions and international boxing event specials.

You may withdraw your marketing consent at any time through the following channels:

• Unsubscribe link included in every phwine marketing email;
• SMS opt-out using the reply keyword specified in each promotional SMS;
• Marketing preferences settings in your phwine account dashboard under Account Settings → Notifications;
• Written request to phwine support at [email protected].

Opt-out requests are processed within 5 business days. Please note that transactional communications — including deposit confirmations, withdrawal notifications, KYC status updates, and security alerts — are not marketing communications and will continue to be sent regardless of marketing preferences as they are necessary for account management.

phwine reviews this Privacy Policy periodically and updates it to reflect changes in phwine's data processing practices, changes in applicable Philippine data protection law, or guidance issued by the National Privacy Commission of the Philippines.

Where a proposed amendment materially affects your rights or the purposes for which phwine processes your data, phwine will notify registered players via their registered email address and will display a prominent notice on the phwine.cam platform no less than 14 days before the amendment takes effect. Non-material amendments — such as clarifications to existing practices or corrections to typographical errors — may be published without advance notice.

The version of this Privacy Policy currently published at phwine.cam/privacy-policy is the operative version. The effective date displayed at the top of this Policy indicates when the current version came into effect.

phwine has designated a Data Protection Officer (DPO) in accordance with the requirements of the Philippine Data Privacy Act. The DPO is responsible for overseeing phwine's compliance with data protection obligations, handling data subject rights requests, and serving as the point of contact for the National Privacy Commission.

For any questions about this Privacy Policy, to exercise your data protection rights, to report a suspected data breach, or to make a complaint about phwine's data processing practices, please contact phwine through the following channels:

• Email: [email protected] — please include "Privacy Request" or "DPO Contact" in your subject line to ensure your message reaches the data protection team promptly.
• Live Chat: Available 24/7 inside your phwine account dashboard. For DPO-level requests, ask the agent to escalate to the Data Protection team.

When submitting a data rights request, please provide your full name as registered on your phwine account, your registered email address, and a clear description of your request. phwine may need to verify your identity before processing the request to ensure your data is not disclosed to an unauthorized party.