ph2win Privacy Policy

Scope and Data Controller

This Privacy Policy applies to all personal information collected, processed, stored, or used by ph2win in connection with the ph2win online gaming platform accessible at ph2win.org, including all game products, wallet services, customer support interactions, and promotional communications.

ph2win is the personal information controller as defined under Republic Act No. 10173 (the Data Privacy Act of 2012 of the Philippines) and is responsible for ensuring that personal data processed in connection with the ph2win platform is handled in accordance with applicable law.

Personal Data We Collect

ph2win collects the following categories of personal data. The specific data points collected depend on the context — not all categories apply to all interactions with the ph2win platform.

ph2win does not collect sensitive personal information beyond what is strictly necessary for identity verification and regulatory compliance. Specifically, ph2win does not collect racial or ethnic origin, religious beliefs, political opinions, trade union membership, genetic data, or sexual orientation data.

How We Collect Personal Data

ph2win collects personal data through the following methods:

• Direct submission by you: When you register a ph2win account, complete KYC verification, make a deposit or withdrawal, contact ph2win support, or participate in a promotion, you directly provide personal data to ph2win.
• Automated technical collection: When you access the ph2win platform, our servers automatically collect technical data including your IP address, device identifiers, browser information, and session activity. This data is collected through server logs, cookies, and similar tracking technologies.
• Payment processors: When you make a deposit or withdrawal via GCash, Maya, or a Philippine bank's Instapay service, the payment processor transmits transaction confirmation data to ph2win, which ph2win records in association with your account.
• KYC and identity verification services: ph2win may use third-party identity verification services to validate the authenticity of government ID documents submitted during KYC. These services process document data on behalf of ph2win under strict data processing agreements.
• Fraud detection and security services: ph2win uses automated fraud and security monitoring tools that analyse login patterns, transaction behaviour, and device fingerprinting data to detect and prevent unauthorised account access and financial crime.

Purposes of Processing and Legal Basis

ph2win processes personal data only for specific, legitimate purposes. The table below sets out the primary purposes for which ph2win processes personal data and the corresponding legal basis under the Data Privacy Act of 2012:

ph2win will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or establishing a new legal basis for the processing.

Sharing Your Personal Data

ph2win does not sell, rent, or trade your personal data. ph2win shares personal data with third parties only in the following circumstances, and only to the extent strictly necessary for the purpose described:

• Payment processors: GCash, Maya (PayMaya), BPI, BDO, Metrobank, and other payment service providers receive transaction data required to process your deposits and withdrawals. These entities are regulated financial institutions or e-money operators under Bangko Sentral ng Pilipinas (BSP) supervision and maintain their own data protection standards.
• Game content providers: Third-party game studios whose games are offered on the ph2win platform may receive session and wager data necessary to operate the game. This data is shared under data processing agreements and is used only for game operation purposes.
• KYC and identity verification providers: Specialist identity verification services process government ID document images on behalf of ph2win during the KYC process. These providers act as data processors under ph2win's instruction and do not use the data for their own purposes.
• Fraud prevention and security services: ph2win uses specialist fraud detection tools that process technical and behavioural data to identify suspicious activity. These services operate under strict data processing agreements.
• Regulatory authorities: ph2win may be required to disclose player data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other Philippine regulatory authorities when required by law or regulatory directive.
• Law enforcement: ph2win may disclose personal data to the Philippine National Police (PNP), National Bureau of Investigation (NBI), or other competent law enforcement authorities where required by a valid legal order or where ph2win has a good-faith belief that disclosure is necessary to prevent or investigate a serious crime.

Cookies and Tracking Technologies

ph2win uses cookies and similar client-side tracking technologies to operate the platform, maintain your login session, remember your preferences, and analyse how the platform is used. The following categories of cookies are used on ph2win.org:

• Strictly Necessary Cookies: These cookies are essential for the ph2win platform to function. They maintain your authenticated session after login, preserve your game state between pages, and enable the wallet and cashier functions. These cookies cannot be disabled without preventing the platform from working correctly.
• Functional Cookies: These cookies remember your preferences — such as language settings and display options — so that you do not need to reset them on each visit. They improve the convenience of your ph2win experience.
• Analytics Cookies: ph2win uses first-party analytics to understand how players navigate the platform — which game categories are visited most frequently, where users encounter difficulty, and how sessions progress. This data is aggregated and used solely to improve the platform for Filipino players.
• Security Cookies: ph2win uses cookies as part of its fraud detection and session security infrastructure, including to detect and prevent credential stuffing attacks and session hijacking attempts.

ph2win does not use third-party advertising cookies or tracking pixels for cross-site advertising purposes. You may manage cookie settings through your browser's privacy controls. Note that disabling strictly necessary cookies will prevent you from logging in to your ph2win account.

Data Retention

ph2win retains personal data for as long as necessary to fulfil the purpose for which it was collected, and in accordance with applicable Philippine legal retention requirements. The following general retention periods apply:

• Account and identity data: Retained for the duration of your ph2win account and for a minimum of five (5) years following permanent account closure, as required by anti-money laundering regulations applicable to Philippine gaming operators.
• Transaction records: Financial transaction records are retained for a minimum of five (5) years following the date of the transaction, in compliance with AMLC record-keeping requirements.
• KYC documents: Government ID images and verification records are retained for a minimum of five (5) years following completion of the verification or account closure, whichever is later.
• Gaming activity logs: Game session records and wager histories are retained for a minimum of three (3) years following the date of the session, for dispute resolution and regulatory audit purposes.
• Support communications: Customer support transcripts and email correspondence are retained for two (2) years following the resolution of the relevant matter.
• Marketing consent records: Records of marketing consent and opt-out requests are retained for the duration of your account and for one (1) year following account closure.

Where retention beyond these minimum periods is required by a specific legal obligation, regulatory investigation, or ongoing legal proceeding, ph2win will retain the relevant data until that obligation is discharged.

On expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents reconstruction of the original data.

Data Security Measures

ph2win implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit Transport Layer Security (TLS/SSL) encryption for all data transmitted between your device and ph2win's servers.
• Encrypted storage of sensitive personal data and financial records at rest using industry-standard encryption protocols.
• Role-based access controls ensuring that ph2win employees access personal data only to the extent required for their specific function.
• Multi-factor authentication requirements for ph2win staff accessing production systems containing player data.
• Automated intrusion detection and anomaly monitoring systems covering ph2win's server infrastructure.
• Regular security assessments and penetration testing of the ph2win platform.
• Formal data breach response procedures including notification protocols consistent with National Privacy Commission (NPC) requirements.

Your Rights Under the Data Privacy Act

As a data subject under Republic Act No. 10173, you have the following rights with respect to your personal data held by ph2win. To exercise any of these rights, contact ph2win's Data Protection Officer using the contact information in Section 13.

ph2win will respond to all verifiable data subject rights requests within thirty (30) days of receipt. Where a request is complex or ph2win receives a large volume of requests, the response period may be extended by a further two months, subject to notification within the initial 30-day period.

Children and Minors

ph2win does not knowingly collect personal data from individuals under 21 years of age. The ph2win platform is strictly for adults aged 21 and above in accordance with Philippine gaming regulations. If ph2win becomes aware that personal data has been collected from a minor, that data will be deleted promptly and the associated account closed.

Cross-Border Data Transfers

Some of the third parties with whom ph2win shares personal data — including international game content providers and specialist security services — are located outside the Philippines. Where personal data is transferred outside the Philippines, ph2win ensures that adequate safeguards are in place to protect that data, in accordance with Section 21 of the Data Privacy Act of 2012 and the rules issued by the National Privacy Commission.

Adequate safeguards for cross-border transfers include: contractual data processing agreements incorporating the NPC's standard data protection clauses; transfers to countries or organisations that have been determined to provide an adequate level of data protection; and, where applicable, your explicit consent to the transfer.

Where ph2win uses international game providers, those providers access only the game session data necessary to deliver the game — they do not receive your KYC documents, financial account details, or full identity profile.

Changes to This Privacy Policy

ph2win may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, regulatory requirements, or the scope of the ph2win platform. Material changes will be communicated to registered players via the mobile number or email address registered on their ph2win account, or via a prominent notice on the ph2win.org website, no less than seven (7) days before the change takes effect, unless a shorter notice period is required by law.

The effective date at the top of this page indicates when the current version of the Privacy Policy came into force. Your continued use of the ph2win platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept a material change to this Policy, you should close your ph2win account before the change takes effect.

The current version of this Privacy Policy is always available at ph2win.org/privacy-policy.

Contact, Data Protection Officer, and Complaints

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have a concern about the way ph2win processes your personal data, please contact ph2win's Data Protection Officer:

Data Protection Officer, ph2win
Email: support@ph2win.org (plain text — not a clickable link)
Available via live chat on the ph2win platform, 24 hours a day, 7 days a week.

ph2win will acknowledge all privacy-related enquiries and rights requests within five (5) business days and will endeavour to resolve them within thirty (30) days of acknowledgement.

Right to Complain to the National Privacy Commission. If you believe that ph2win has processed your personal data in breach of the Data Privacy Act of 2012, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. Information about how to file a complaint with the NPC is available on the NPC's official government website. ph2win encourages Filipino players to raise concerns directly with ph2win in the first instance, as many issues can be resolved quickly through ph2win's internal privacy complaint process.