winph4 Privacy Policy

1. Who We Are — Data Controller

winph4 ("winph4," "we," "us," "our") is the data controller responsible for the personal data processed through the winph4 platform accessible at winph4.co and through any winph4 mobile application. winph4 operates under the regulatory framework of the Philippine Amusement and Gaming Corporation (PAGCOR) and processes personal data in compliance with the Philippine Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations (IRR).

As a PAGCOR-licensed operator, winph4 is subject to additional data handling obligations specific to the gaming sector, including mandatory Anti-Money Laundering Act (AMLA, RA 9160) record-keeping requirements and age verification obligations. Where these sector-specific requirements impose stricter standards than the DPA, the stricter standard applies.

For all data privacy inquiries, the winph4 Data Protection Officer ("DPO") can be contacted at the details provided in Section 13 of this Policy.

2. Personal Data We Collect

winph4 collects personal data through several channels — directly from you during registration and account use, automatically through your use of the Platform, and in limited cases from third-party sources. The categories of personal data collected are as follows:

winph4 does not intentionally collect sensitive personal information beyond what is strictly required for identity verification and regulatory compliance purposes. We do not collect biometric data except where liveness verification is required during enhanced KYC, and such data is processed solely for identity matching and not retained beyond the verification event.

3. How winph4 Uses Your Personal Data

winph4 processes your personal data for the following purposes:

• Account Creation and Management: To register and maintain your winph4 account, verify your identity and age, authenticate your login sessions, and manage account settings and preferences.
• Service Delivery: To provide access to games, process wagers, credit winnings, manage bonuses, and deliver all features of the winph4 platform you choose to use.
• Payment Processing: To process deposits and withdrawals via GCash, Maya, and Philippine banking channels, verify payment method ownership, and maintain transaction records.
• Legal and Regulatory Compliance: To meet obligations under PAGCOR's operating license requirements, the Anti-Money Laundering Act (RA 9160 and amendments), the Data Privacy Act (RA 10173), and other applicable Philippine laws. This includes mandatory transaction monitoring, suspicious activity reporting, and record retention.
• Responsible Gaming: To administer deposit limits, session reminders, self-exclusion requests, and other responsible gaming tools; to monitor account activity for indicators of problem gambling where required under our PAGCOR license; and to process referrals to PAGCOR's Responsible Gaming program where appropriate.
• Security and Fraud Prevention: To detect, investigate, and prevent fraud, unauthorized access, money laundering, collusion, bonus abuse, and other prohibited conduct on the winph4 platform.
• Customer Support: To respond to inquiries, resolve disputes, process complaints, and maintain records of support interactions for quality and compliance purposes.
• Platform Improvement: To analyze aggregate usage data, diagnose technical issues, improve game performance, and develop new features. Where analytics involve personal data, it is aggregated or pseudonymized to the extent practicable.
• Marketing Communications: To send promotional offers, bonus notifications, and gaming-related content to players who have consented to receive such communications. See Section 11 for your opt-out rights.

4. Legal Basis for Processing

Under the Data Privacy Act of 2012 and its IRR, winph4 processes personal data on the following legal grounds:

• Contractual Necessity: Processing required to perform the winph4 Terms and Conditions — including account management, game provision, payment processing, and customer support.
• Legal Obligation: Processing required to comply with PAGCOR licensing conditions, AMLA obligations, NPC registration requirements, and other applicable Philippine regulatory and legal mandates.
• Legitimate Interest: Processing for fraud detection, platform security, responsible gaming monitoring, and service improvement, where winph4's legitimate interests are not overridden by your data protection rights.
• Consent: Processing for direct marketing communications, non-essential analytics cookies, and certain optional account features where consent is the appropriate basis. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Data Sharing and Disclosure

winph4 does not sell your personal data to third parties. winph4 may share your personal data with the following categories of recipients, strictly to the extent necessary for the stated purpose:

• Payment Processors: GCash (GXI/Mynt), Maya (PayMaya Philippines), and Philippine banking institutions — for deposit and withdrawal processing. These providers receive only the data necessary to execute and verify transactions.
• Game Content Providers: Licensed game studios (e.g., PG Soft, Pragmatic Play, Jili Games) that supply the games available on winph4. Game providers receive session and wager data necessary to operate and certify their games. They do not receive identity or financial documents.
• KYC Verification Services: Third-party identity verification providers engaged to conduct document verification and liveness checks during enhanced KYC. These providers operate under data processing agreements and process data solely for the verification purpose.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other Philippine government agencies — as required by law, court order, or regulatory instruction. winph4 does not have discretion to refuse such disclosures where legally mandated.
• Technology Service Providers: Cloud infrastructure, cybersecurity, analytics, and customer support platform providers engaged by winph4 under data processing agreements that restrict their use of your data to services rendered to winph4.
• Professional Advisers: Lawyers, auditors, and accountants engaged by winph4 in connection with legal proceedings, regulatory audits, or compliance reviews — bound by professional confidentiality obligations.

All third-party recipients are required to handle your personal data in a manner consistent with the Data Privacy Act of 2012 and are not permitted to use your data for any purpose beyond that for which it was shared.

6. Cookies and Tracking Technologies

winph4 uses cookies and similar tracking technologies on the Platform. Cookies are small data files stored on your browser or device that help winph4 deliver a functional and personalized experience.

• Strictly Necessary Cookies: Required for core Platform functionality — login sessions, security tokens, load balancing, and fraud prevention. These cannot be disabled without preventing basic Platform use.
• Functional Cookies: Remember your preferences — language settings, display preferences, and game configuration. Disabling these cookies will reset preferences on each visit.
• Analytics Cookies: Aggregate usage data to help winph4 understand how players interact with the Platform and identify areas for improvement. These are pseudonymized where possible and require your consent where personal data is involved.
• Marketing Cookies: Used with your consent to personalize promotional content and track the effectiveness of winph4 marketing campaigns.

You may manage cookie preferences through your browser settings or through the winph4 cookie preference panel. Blocking strictly necessary cookies will affect your ability to use the Platform. Withdrawing consent for optional cookies does not affect your access to games or account features.

7. Data Security

winph4 implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the winph4 platform.
• Encryption of sensitive data fields at rest in winph4's databases, including payment reference data and identity document images.
• Strict role-based access controls limiting which winph4 personnel and system processes can access personal data.
• Multi-factor authentication requirements for winph4 staff accessing systems that process personal data.
• Regular security assessments, penetration testing, and vulnerability scanning of Platform infrastructure.
• Incident response procedures aligned with NPC notification requirements under the Data Privacy Act.

In the event of a personal data breach that poses a real risk to affected individuals, winph4 will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, as required by NPC Circular No. 16-03, and will notify affected players promptly thereafter.

8. Data Retention

winph4 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Account and Identity Data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, as required by PAGCOR licensing conditions and AMLA record-keeping obligations under RA 9160.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLA requirements.
• Gaming Activity Logs: Retained for a minimum of three (3) years following the relevant session, for dispute resolution, regulatory reporting, and responsible gaming monitoring purposes.
• Customer Support Records: Retained for a period of three (3) years from the date of the last interaction, for quality assurance and dispute resolution purposes.
• Marketing Consent Records: Retained for the duration of your consent plus a reasonable period thereafter to demonstrate compliance.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with NPC guidelines. Where data cannot be immediately deleted due to backup schedules or ongoing legal proceedings, it is isolated from further active processing until deletion is completed.

9. Your Data Subject Rights

Under the Data Privacy Act of 2012 (RA 10173) and its IRR, you have the following rights with respect to your personal data held by winph4:

• Right to Be Informed: The right to be notified of what personal data winph4 collects, how it is used, and with whom it is shared — as set out in this Privacy Policy.
• Right of Access: The right to obtain a copy of the personal data winph4 holds about you, and information about how it is processed. Requests will be fulfilled within fifteen (15) business days of receipt.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected. Some data corrections require KYC re-verification to comply with regulatory requirements.
• Right to Erasure or Blocking: The right to request deletion or blocking of personal data that is unlawfully processed or is no longer necessary for the purpose it was collected — subject to winph4's legal and regulatory retention obligations, which may prevent immediate deletion.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller where technically feasible.
• Right to Object: The right to object to processing based on legitimate interests, including direct marketing. Where you object to marketing, winph4 will cease processing for that purpose immediately.
• Right to Damages: The right to be indemnified for damages sustained as a result of inaccurate, incomplete, outdated, false, or unlawfully obtained personal data, in accordance with Section 16(f) of RA 10173.
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe your data rights have been violated. NPC contact details are available on the official NPC website.

To exercise any of these rights, contact winph4's Data Protection Officer using the details in Section 13. winph4 will respond to all data subject rights requests within fifteen (15) business days and will not charge a fee for reasonable requests.

10. Children's and Minors' Privacy

The winph4 platform is strictly for individuals aged 21 years or older. winph4 does not knowingly collect personal data from any person under the age of 21. This restriction is mandated by PAGCOR for all licensed gaming operators in the Philippines.

Age verification is conducted at registration and at the KYC verification stage. Where winph4 discovers that personal data has been collected from an individual who does not meet the 21+ age requirement, the account will be closed immediately, all data will be deleted to the extent permitted by law, and the matter will be reported to PAGCOR as required.

11. Marketing Communications

winph4 may send you promotional communications — including bonus offers, game recommendations, and platform updates — via SMS, email, or in-app notification, where you have consented to receive such communications at registration or subsequently through your account settings.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your notification preferences in your winph4 account settings.
• Clicking the unsubscribe link included in any marketing email sent by winph4.
• Contacting winph4 support via live chat or email at [email protected].

Withdrawal of marketing consent does not affect the lawfulness of communications sent prior to withdrawal, and does not affect winph4's ability to send you transactional or service communications — such as deposit confirmations, security alerts, or KYC notifications — that are necessary for your account and not subject to marketing consent requirements.

12. Changes to This Privacy Policy

winph4 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or Platform features. Material changes will be communicated to registered players via email notification or in-platform notice at least seven (7) calendar days before the changes take effect, except where immediate changes are required to comply with applicable law or regulatory instruction.

The "Effective Date" at the top of this Policy indicates when the current version came into force. Continued use of the winph4 platform following the effective date of any amendment constitutes your acknowledgment of the revised Policy. If you do not accept material changes, you may close your account before the changes take effect by contacting winph4 support.

13. Contact & Data Protection Officer

For all data privacy inquiries, access requests, complaints, or to exercise any of your data subject rights under the Data Privacy Act, please contact:

• Data Protection Officer (DPO) — winph4:
• Email: [email protected]
• General Support: [email protected]
• Live Chat: Available 24/7 via the winph4 platform and mobile app

winph4 is registered with the National Privacy Commission (NPC) as a personal information controller, as required under Section 46 of the Implementing Rules and Regulations of RA 10173. NPC registration details are available upon written request to the DPO.

For complaints that cannot be resolved directly with winph4, you have the right to escalate to the National Privacy Commission. Information about the NPC complaints process is available on the official NPC website (npc.gov.ph).