phwim Privacy Policy

1. Introduction

phwim ("the Company," "we," "us," "our") operates the online gaming platform accessible at phwim.one. As a Philippines-based operator licensed and regulated by the Philippine Amusement and Gaming Corporation (PAGCOR), phwim is subject to the Republic Act No. 10173 — the Data Privacy Act of 2012 (DPA) — and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC). This Privacy Policy is designed to comply fully with those obligations.

We collect and process personal data because it is necessary to provide you with a safe, compliant, and properly functioning gaming service. We do not sell your personal data to third parties for their own marketing purposes. Every piece of data phwim collects serves a defined, lawful purpose described in this Policy.

This Policy should be read alongside phwim's Terms and Conditions and Responsible Gaming Policy, which together form the complete framework governing your use of the phwim platform.

2. Data Controller

For the purposes of the Data Privacy Act of 2012 and this Privacy Policy, the data controller responsible for your personal data is:

phwim has designated an internal data protection point of contact responsible for overseeing compliance with this Policy and with Philippine data protection law. All formal data-related correspondence should be directed to the email address above.

3. Personal Data We Collect

phwim collects the following categories of personal data in the course of providing its services:

4. How We Collect Your Data

phwim collects personal data through the following channels and means:

• Direct submission: When you create a phwim Account, you provide your name, mobile number, date of birth, and email address directly through our registration interface.
• KYC verification: When you submit identity documents (government ID, selfie) to complete Know Your Customer verification prior to withdrawals, phwim collects and securely stores those document images and extracted data.
• Payment transactions: When you deposit or withdraw funds via GCash, Maya, bank transfer, or cryptocurrency, phwim's payment systems record the transaction reference, amount, currency, and associated payment method identifier.
• Platform usage: Automatically, through your use of phwim.one — your device's IP address, browser type, session activity, pages visited, games played, and bets placed are recorded by phwim's server and analytics infrastructure.
• Cookies and tracking technologies: phwim uses cookies and similar technologies to maintain your session, remember your preferences, detect fraud, and analyse platform performance. See Section 10 for details.
• Customer support interactions: When you contact phwim support via email, the content of that communication and any attached documents become part of your account record.
• Third-party verification services: phwim may receive identity verification results from third-party KYC service providers engaged to verify the authenticity of documents submitted by Players.

5. How We Use Your Personal Data

phwim uses the personal data it collects for the following defined purposes:

6. Legal Basis for Processing

Under the Data Privacy Act of 2012, phwim processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to perform the contract between phwim and you — specifically, to operate your phwim Account, process your wagers, and execute payment transactions.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, Anti-Money Laundering Act requirements, NPC data protection obligations, and other applicable Philippine law.
• Legitimate interests: Processing for phwim's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and internal analytics — where those interests are not overridden by your data protection rights.
• Consent: Processing for marketing communications, non-essential cookies, and any other processing activities where we have sought and obtained your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing & Disclosure

phwim does not sell, rent, or trade your personal data. We share your data only in the circumstances described below:

• Payment service providers: GCash (GXI), Maya (Paymaya Philippines), BancNet, and other licensed Philippine payment processors receive transaction data necessary to execute deposit and withdrawal instructions. These providers are bound by their own regulatory data protection obligations.
• KYC and identity verification providers: Third-party identity verification services engaged by phwim receive copies of identity documents you submit during KYC verification, solely for the purpose of verifying their authenticity.
• Game software providers: Third-party casino game studios and RNG certification bodies may receive anonymised gameplay data for audit and certification purposes. No personally identifiable information is included in these data transfers.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other competent Philippine government authorities may receive your data where phwim is legally required to report or disclose it.
• Law enforcement: Where required by a valid court order or lawful request from Philippine law enforcement authorities, phwim will disclose personal data as legally compelled.
• Service providers: IT infrastructure providers, cloud hosting services, and customer support platform operators engaged by phwim to support the operation of the platform. These service providers act as data processors under phwim's instructions and are contractually bound to handle your data only for specified purposes.
• Business transfers: In the event of a merger, acquisition, or asset sale involving phwim, personal data held by the Company may be transferred to the acquiring entity, subject to the same data protection obligations set out in this Policy.

8. Data Retention

phwim retains your personal data for as long as necessary to fulfil the purposes for which it was collected, comply with legal and regulatory obligations, and resolve disputes. The following retention periods apply:

Upon expiry of the applicable retention period, phwim will securely delete or irreversibly anonymise your personal data in accordance with its data destruction policy.

9. Security Measures

phwim implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key technical and organisational measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and phwim servers — including login credentials, account data, and payment information.
• Password hashing — your phwim account password is never stored in plain text. Passwords are processed using industry-standard one-way hashing algorithms so that even phwim staff cannot read your password.
• OTP two-factor authentication — phwim requires SMS one-time password verification for logins from new devices, adding a critical second layer of identity confirmation beyond the password alone.
• Access controls — phwim's internal systems operate on a strict need-to-know principle. Staff access to player personal data is restricted to those roles where access is directly necessary for their function.
• Network security — phwim's infrastructure is protected by firewalls, intrusion detection systems, and DDoS mitigation services appropriate for a Philippine financial services context.
• Regular security audits — phwim conducts periodic vulnerability assessments and penetration testing of its platform infrastructure as required under its PAGCOR licensing conditions.
• Incident response — phwim maintains a documented data breach response plan compliant with NPC breach notification requirements. In the event of a data breach that poses risk to your rights, you will be notified in accordance with DPA timelines.

10. Cookies & Tracking Technologies

phwim uses cookies and similar tracking technologies on phwim.one. Cookies are small text files stored on your device by your browser when you visit the site. phwim uses the following categories of cookies:

• Strictly necessary cookies: Required for core platform functionality — including maintaining your login session, remembering your wallet balance display preferences, and enabling secure access through the phwim login system. These cookies cannot be disabled without impairing your ability to use the platform.
• Functional cookies: Remember your preferences such as language settings, game display preferences, and whether you have acknowledged certain notifications. Disabling these may result in a less personalised experience.
• Analytics cookies: Collect anonymised, aggregated information about how Players use phwim — including which pages are visited most frequently and where users exit the platform. This data helps phwim improve its product. No individual player is identified in analytics reports.
• Security cookies: Used to detect suspicious activity, prevent cross-site request forgery (CSRF), and support phwim's fraud detection infrastructure. These are strictly necessary for platform integrity.

phwim does not use third-party advertising cookies or share cookie data with external advertising networks. You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging into your phwim Account.

11. Your Data Rights

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phwim. To exercise any of these rights, contact [email protected] with the subject line "Privacy / Data Request". phwim will respond within thirty (30) days of receiving a valid request.

• Right to be informed: The right to know that phwim is collecting your personal data and to receive clear information about how it is used — which this Privacy Policy provides.
• Right of access: The right to request a copy of the personal data phwim holds about you, including your account data, transaction history, and KYC records.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data held in your phwim Account. You can update most account details directly through your Account settings.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected — subject to phwim's legal obligations to retain certain data under PAGCOR and AMLA requirements.
• Right to object: The right to object to processing of your personal data where that processing is based on legitimate interests, particularly processing for direct marketing purposes.
• Right to data portability: The right to receive your personal data in a structured, machine-readable format to enable transfer to another service provider where technically feasible.
• Right to withdraw consent: Where processing is based on your consent, the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before the withdrawal.
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe phwim has not handled your personal data in accordance with the Data Privacy Act.

12. Minors & Age Verification

12.1 phwim's services are strictly restricted to individuals aged 21 years and above as mandated by PAGCOR. phwim does not knowingly collect personal data from persons under 21 years of age.

12.2 phwim uses automated age verification checks at registration and manual document review during KYC verification to detect and prevent access by underage individuals. Where phwim determines or has reasonable grounds to believe that an account is being used by a person under 21, the account will be suspended immediately and any real-money balance returned to the source payment method. No winnings generated during underage use will be paid out.

12.3 If you believe a minor has registered a phwim Account or is using your phwim Account, contact [email protected] immediately. phwim treats underage gambling reports as priority matters and will investigate promptly.

12.4 Any personal data inadvertently collected from a person subsequently confirmed to be under 21 years of age will be deleted as soon as the Account is closed, except where retention is required by law.

13. Cross-Border Data Transfers

phwim's primary data infrastructure is hosted in server facilities serving the Philippine market. In some circumstances, personal data may be processed by service providers (such as KYC verification platforms or cloud infrastructure providers) whose servers are located outside the Philippines.

Where such transfers occur, phwim ensures that adequate data protection safeguards are in place — including contractual provisions requiring overseas processors to maintain data protection standards equivalent to those required under the Philippine Data Privacy Act. phwim does not transfer player personal data to jurisdictions that lack adequate data protection frameworks without appropriate contractual protections.

14. Changes to This Privacy Policy

phwim reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or platform functionality. Material changes — particularly those that affect how your data is used or shared — will be communicated to registered Players via SMS or email notification to your registered contact details, or through a prominent notice on phwim.one.

The effective date at the top of this Policy indicates when the current version took effect. Your continued use of phwim following the effective date of an updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not accept the revised Policy, you should stop using the phwim platform and contact [email protected] to close your Account and arrange return of your balance.

Previous versions of this Privacy Policy are available on request by contacting [email protected].

15. Contact & Complaints

phwim takes data privacy seriously and is committed to resolving privacy concerns promptly. If you have any question about this Policy, wish to exercise a data right, or have a complaint about how phwim has handled your personal data, please contact us using the details below.