win36 Casino — Privacy Policy

1 About This Policy

This Privacy Policy ("Policy") describes how win36 Casino ("win36," "we," "us," "our") collects, uses, stores, shares, and protects the personal information of individuals ("you," "your," "the Player") who access or use the win36 website, mobile platform, and associated services (collectively, the "Platform").

win36 is committed to protecting your privacy and handling your personal data in a transparent, lawful, and responsible manner. This Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations ("IRR"), and the issuances of the National Privacy Commission ("NPC") of the Philippines.

This Policy should be read together with win36's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated herein by reference. By registering a win36 account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

2 Personal Data We Collect

win36 collects the following categories of personal data, depending on how you interact with the Platform:

win36 does not intentionally collect sensitive personal information (as defined under the DPA) beyond what is strictly necessary for KYC compliance and responsible gaming obligations. Where sensitive personal information is collected (e.g., government ID numbers), it is handled with the heightened protections required by the DPA.

3 How We Collect Your Data

win36 collects personal data through the following means:

• Direct collection: Information you provide when registering a win36 account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically when you access the Platform, including through cookies, web beacons, pixel tags, and server logs.
• Third-party sources: Identity verification data from KYC service providers; fraud and risk signals from payment processors; analytics data from platform analytics tools used by win36.
• Regulatory sources: Information received from PAGCOR, the Anti-Money Laundering Council (AMLC), or other Philippine regulatory bodies in connection with win36's compliance obligations.

4 How We Use Your Personal Data

win36 uses your personal data for the following purposes:

• Account management: To create, maintain, and administer your win36 account, including processing your registration, verifying your identity, and managing your account settings.
• Payment processing: To process deposits and withdrawals via GCash, PayMaya, bank transfer, and debit card, and to maintain accurate financial records.
• KYC and compliance: To verify your identity and age (21+), comply with PAGCOR licensing requirements, and meet obligations under the Anti-Money Laundering Act (AMLA) and other applicable Philippine laws.
• Game delivery: To provide access to win36 games, record your gaming activity, calculate and credit winnings, and resolve disputes.
• Responsible gaming: To monitor gaming patterns, enforce deposit and loss limits, process self-exclusion requests, and identify players who may be at risk of problem gambling.
• Customer support: To respond to your enquiries, resolve complaints, and improve the quality of our support services.
• Marketing and promotions: To send you promotional offers, bonus notifications, and platform updates, where you have consented to receive such communications. You may opt out at any time.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent activity, money laundering, account takeovers, and other security threats.
• Platform improvement: To analyse usage patterns, conduct research, and improve the features, performance, and user experience of the win36 Platform.
• Legal compliance: To comply with applicable laws, regulations, court orders, and regulatory directives, including those issued by PAGCOR, the NPC, and the AMLC.

5 Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, win36 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you (i.e., the win36 Terms & Conditions), including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable Philippine laws, including KYC obligations under PAGCOR regulations, AMLA reporting requirements, and NPC data privacy obligations.
• Legitimate interests: Processing necessary for win36's legitimate business interests, including fraud prevention, platform security, and service improvement, where such interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent, including for marketing communications. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6 Data Sharing & Disclosure

win36 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. win36 may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• KYC and identity verification providers: Third-party service providers engaged by win36 to verify your identity and age in connection with KYC compliance.
• Payment processors: GCash, PayMaya / Maya, and banking partners involved in processing your deposits and withdrawals.
• IT and platform service providers: Cloud hosting providers, cybersecurity firms, and software vendors who support the operation of the win36 Platform, subject to strict data processing agreements.
• Regulatory and law enforcement authorities: PAGCOR, the NPC, the AMLC, the Bureau of Internal Revenue (BIR), and other Philippine government agencies, where disclosure is required by law or regulatory directive.
• Professional advisers: Lawyers, auditors, and accountants engaged by win36, subject to professional confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of win36's business, your personal data may be transferred to the acquiring entity, subject to equivalent data protection commitments.

All third parties with whom win36 shares personal data are required to handle such data in accordance with the DPA and win36's data protection standards.

7 Cookies & Tracking Technologies

win36 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you visit the win36 website. win36 uses the following types of cookies:

• Strictly necessary cookies: Essential for the Platform to function, including session management, login authentication, and security features. These cannot be disabled.
• Functional cookies: Remember your preferences (e.g., language, game settings) to provide a personalised experience.
• Analytics cookies: Collect anonymised data about how players use the Platform to help win36 improve its services.
• Marketing cookies: Used to deliver relevant promotional content to you, where you have consented to receive marketing communications.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the win36 Platform. win36 does not use cookies to collect sensitive personal information.

8 Data Retention

win36 retains your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. The following indicative retention periods apply:

• Account and KYC data: Retained for a minimum of five (5) years following account closure, in accordance with PAGCOR regulations and AMLA record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years following the date of the transaction, as required by the AMLA and BIR regulations.
• Gaming history: Retained for a minimum of three (3) years following account closure.
• Customer support communications: Retained for two (2) years following the resolution of the relevant enquiry or complaint.
• Marketing consent records: Retained until you withdraw your consent or for three (3) years following your last interaction with win36, whichever is earlier.

Upon expiry of the applicable retention period, win36 will securely delete or anonymise your personal data in accordance with its data disposal procedures.

9 Data Security

win36 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption: All data transmitted between your device and the win36 Platform is encrypted using industry-standard TLS (Transport Layer Security) protocols. Sensitive data at rest, including financial records and KYC documents, is encrypted using AES-256 encryption.
• Access controls: Access to personal data is restricted to win36 personnel and authorised service providers who require it to perform their duties, on a strict need-to-know basis. All access is logged and audited.
• Two-factor authentication: win36 supports two-factor authentication (2FA) for player accounts to reduce the risk of unauthorised access.
• Penetration testing: win36 conducts regular security assessments and penetration tests to identify and remediate vulnerabilities in the Platform.
• Incident response: win36 maintains a data breach response plan. In the event of a personal data breach that poses a real risk to your rights and freedoms, win36 will notify the NPC and affected players in accordance with the DPA's breach notification requirements.

While win36 takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. You are responsible for keeping your win36 login credentials confidential and for notifying win36 immediately if you suspect unauthorised access to your account.

10 Your Data Privacy Rights

You have the following rights with respect to your personal data processed by win36:

• Right to be informed: The right to be informed of how your personal data is collected, used, stored, and shared — which is the purpose of this Policy.
• Right of access: The right to request a copy of the personal data win36 holds about you, along with information about how it is being processed.
• Right to rectification: The right to request correction of any inaccurate, incomplete, or outdated personal data win36 holds about you.
• Right to erasure or blocking: The right to request deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, or where processing is unlawful, subject to win36's legal retention obligations.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on win36's legitimate interests.
• Right to data portability: The right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, where technically feasible.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe win36 has violated your data privacy rights.

To exercise any of the above rights, please contact win36's Data Protection Officer (DPO) using the contact details set out in Section 14 of this Policy. win36 will respond to all data subject requests within fifteen (15) business days of receipt, in accordance with NPC guidelines.

win36 may need to verify your identity before processing a data subject request to ensure that personal data is not disclosed to an unauthorised person.

11 Children's Privacy

The win36 Platform is strictly intended for individuals aged twenty-one (21) years and above, as required by Philippine law and PAGCOR regulations. win36 does not knowingly collect personal data from individuals under the age of 21.

If win36 discovers or is notified that it has inadvertently collected personal data from a person under 21 years of age, win36 will immediately suspend the relevant account, delete the personal data in question, and report the matter to the appropriate regulatory authorities where required.

If you are a parent or guardian and believe that your child under the age of 21 has provided personal data to win36, please contact our DPO immediately using the contact details in Section 14 so that we can take appropriate action.

12 Cross-Border Data Transfers

win36 primarily processes and stores personal data within the Philippines. In certain circumstances, personal data may be transferred to, or accessed by, service providers located outside the Philippines — for example, cloud infrastructure providers or KYC verification platforms operating in other jurisdictions.

Where personal data is transferred outside the Philippines, win36 ensures that appropriate safeguards are in place to protect your data, including:

• Entering into data processing agreements with overseas recipients that impose data protection obligations equivalent to those required under the Philippine DPA.
• Transferring data only to countries or organisations that the NPC has determined provide an adequate level of data protection.
• Obtaining your explicit consent for the transfer where required by applicable law.

By using the win36 Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside the Philippines, subject to the safeguards described above.

13 Changes to This Privacy Policy

win36 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, win36 will notify registered players via email or a prominent notice on the Platform at least seven (7) days before the changes take effect, where reasonably practicable.

The version number and effective date at the top of this Policy indicate the current version. Your continued use of the win36 Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. We encourage you to review this Policy periodically to stay informed about how win36 protects your personal data.

Previous versions of this Privacy Policy are available upon request by contacting win36's Data Protection Officer.

14 Contact & Data Protection Officer

win36 has appointed a Data Protection Officer (DPO) in accordance with the requirements of the Philippine Data Privacy Act. If you have any questions, concerns, or requests relating to this Privacy Policy or win36's data processing practices, please contact our DPO through the following channels:

• Live Chat: Available 24/7 directly within the win36 Platform — the fastest way to reach us.
• Email (DPO): [email protected]
• General Support: [email protected]

win36 aims to respond to all privacy-related enquiries within fifteen (15) business days. If you are not satisfied with win36's response, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.