Privacy Policy — How phwil Handles Your Personal Data

1. Controller Identity

phwil ("we," "us," or "our") is the data controller responsible for personal information processed through the phwil Platform accessible at phwil.app. phwil processes personal data in accordance with the Republic Act No. 10173, also known as the Data Privacy Act of 2012 of the Philippines (the "DPA"), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission (NPC).

If you have questions about how phwil handles your personal data, you may contact our Data Protection Officer at the contact details set out in Section 14 of this Privacy Policy.

2. Personal Data We Collect

phwil collects the following categories of personal data in connection with your Account and use of the Platform:

• Identity Data: Full legal name, date of birth, gender, nationality, and government-issued identification document details (e.g., PSA National ID number, driver's license number, passport number).
• Contact Data: Email address, Philippine mobile number, and residential address.
• Financial Data: GCash or Maya wallet identifiers, bank account details where applicable, transaction history including deposits, withdrawals, and in-platform transfers, and cryptocurrency wallet addresses where applicable.
• KYC & Verification Data: Copies of government-issued photo identification, selfie photographs submitted for identity verification, and source of funds declarations.
• Gaming Data: Game play history, wagering records, bonus usage, session duration, and responsible gaming tool settings.
• Technical Data: IP address, device type and operating system, browser type and version, login timestamps, session data, and cookies and similar tracking identifiers.
• Communications Data: Records of your interactions with phwil customer support, including chat transcripts, email correspondence, and support ticket histories.

3. How We Collect Your Data

phwil collects personal data through the following means:

• Direct collection: Information you provide when registering an Account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical data collected automatically when you access the Platform, including through cookies, server logs, and device fingerprinting technologies. See Section 7 for further detail.
• Third-party sources: Identity verification results from KYC service providers; payment confirmation data from GCash, Maya, and other payment processors; fraud screening results from anti-money laundering compliance tools; and data received from regulatory bodies as required by law.

4. Lawful Basis for Processing

phwil processes your personal data on the following lawful bases under the Data Privacy Act of 2012:

• Performance of a contract: Processing necessary to provide you with phwil's Services pursuant to the Terms & Conditions you have accepted, including Account management, game access, payment processing, and customer support.
• Legal obligation: Processing required to comply with anti-money laundering obligations, KYC requirements, tax reporting, and regulatory instructions from PAGCOR or other competent authorities.
• Legitimate interests: Processing necessary for phwil's legitimate interests, including fraud prevention, platform security, responsible gaming enforcement, and service improvement, where such interests are not overridden by your data protection rights.
• Consent: Where phwil relies on your consent as the lawful basis for a specific processing activity, you have the right to withdraw such consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

5. How phwil Uses Your Personal Data

phwil uses the personal data collected for the following purposes:

• Creating, maintaining, and managing your phwil Account;
• Verifying your identity and age eligibility in compliance with KYC obligations and the 21+ age requirement;
• Processing deposits, withdrawals, and in-platform transactions via GCash, Maya, bank transfer, and other supported payment methods;
• Detecting, investigating, and preventing fraud, money laundering, and other prohibited conduct;
• Enforcing phwil's Terms & Conditions and responsible gaming commitments, including deposit limits and self-exclusion;
• Providing customer support and resolving disputes;
• Personalizing your experience on the Platform, including game recommendations based on your activity;
• Sending transactional notifications (e.g., deposit confirmations, withdrawal processing updates, security alerts) via email or SMS;
• Complying with legal and regulatory obligations under Philippine law and applicable gaming regulations;
• Improving Platform functionality, security, and player experience through anonymized analytics.

phwil will not use your personal data for purposes incompatible with those stated above without providing prior notice and, where required, obtaining your consent.

6. Data Sharing & Disclosure

phwil does not sell, rent, or trade your personal data to third parties for their own marketing purposes. phwil may disclose your personal data to the following categories of recipients:

• Payment processors: GCash, Maya, BPI, BDO, Metrobank, 7-Eleven Cliqq, and cryptocurrency processing partners — for the purpose of processing your financial transactions.
• KYC and identity verification providers: Third-party services engaged to verify government-issued identification documents and perform age verification checks.
• Fraud and AML screening tools: Compliance service providers used to screen transactions and account activity for indicators of money laundering, fraud, or other prohibited conduct.
• Game content providers: Providers of live dealer streams and slot game software may receive pseudonymized session and wagering data necessary to deliver their services.
• Regulatory and law enforcement authorities: phwil is required by applicable Philippine law to report certain transactions and disclose player data to PAGCOR, the Anti-Money Laundering Council (AMLC), the NPC, and other competent authorities upon lawful request.
• Legal and professional advisors: Lawyers, auditors, and other professional advisors bound by confidentiality obligations, where necessary to protect phwil's legal rights or comply with professional requirements.

All third-party processors engaged by phwil are required by contract to process personal data only on phwil's documented instructions and to implement appropriate technical and organizational security measures.

7. Cookies & Tracking Technologies

phwil uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in to your phwil Account during your visit. These cannot be disabled without impairing Platform functionality.
• Performance and analytics cookies: Used to collect anonymized data about how Players use the Platform — which pages are visited, how long sessions last, and where errors occur. This data is used solely to improve Platform performance and player experience.
• Functionality cookies: Used to remember your preferences, such as display settings and responsible gaming tool configurations, to provide a more personalized experience.
• Security cookies: Used to support fraud detection, login anomaly monitoring, and brute-force protection systems.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in to and use the phwil Platform.

8. Data Retention

phwil retains personal data for as long as necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods:

• Account registration and KYC records: retained for a minimum of five (5) years following Account closure, in accordance with anti-money laundering regulatory requirements.
• Transaction records: retained for a minimum of five (5) years from the date of the transaction, as required by AMLC regulations.
• Customer support communications: retained for a period of three (3) years from the date of the interaction.
• Technical and session logs: retained for a period of twelve (12) months from the date of generation, unless retention is required for an ongoing investigation.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymized in a manner that prevents re-identification.

9. Data Security

phwil implements technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phwil Platform;
• One-way cryptographic hashing of all Account passwords — phwil staff cannot access your password in plain text;
• Access controls limiting internal access to personal data on a strict need-to-know basis;
• Multi-factor authentication for internal systems handling sensitive player data;
• Regular security testing and vulnerability assessments of the phwil Platform;
• Player-facing two-factor authentication (2FA) available for all Accounts — strongly recommended.

While phwil implements industry-standard security measures, no digital platform can guarantee absolute security. You are responsible for maintaining the security of your Account credentials and for notifying phwil immediately if you suspect unauthorized access to your Account.

10. Your Data Rights

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights with respect to your personal data held by phwil:

• Right to be informed: The right to be notified of the manner in which your personal data is being processed, including the purposes and legal basis for such processing.
• Right of access: The right to obtain a copy of the personal data phwil holds about you and information about how it is processed.
• Right to correction: The right to request correction of inaccurate, incomplete, or outdated personal data held by phwil.
• Right to erasure / right to be forgotten: The right to request deletion of your personal data where phwil no longer has a lawful basis for processing it, subject to overriding legal retention obligations.
• Right to object: The right to object to processing of your personal data carried out on the basis of phwil's legitimate interests, where your interests override those of phwil.
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe phwil has processed your personal data in violation of the DPA.

To exercise any of these rights, contact phwil's Data Protection Officer using the details in Section 14. phwil will respond to all verified requests within thirty (30) days.

11. Children's Privacy

The phwil Platform is strictly intended for individuals who are twenty-one (21) years of age or older. phwil does not knowingly collect personal data from individuals under 21 years of age. If phwil becomes aware that personal data has been collected from an individual below the minimum age requirement, that Account will be immediately suspended and the personal data deleted in accordance with applicable law, subject to any retention obligations arising from the circumstances of the Account's creation.

Parents and guardians who believe that a minor has created a phwil Account should contact phwil support immediately using the contact details in Section 14.

12. International Data Transfers

phwil's primary operations and data storage are conducted within or in compliance with standards applicable to the Philippine jurisdiction. Where personal data is transferred to service providers or infrastructure located outside the Philippines, phwil ensures that such transfers are conducted only to jurisdictions with adequate data protection standards or pursuant to contractual data transfer safeguards equivalent to those required under Philippine law.

Game content and live dealer services are provided by international technology partners. Data shared with such partners for service delivery purposes is governed by data processing agreements requiring them to maintain security standards consistent with those described in this Privacy Policy.

13. Changes to This Privacy Policy

phwil reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform features. Material changes will be communicated to registered Players via the email address on file or by prominent notice on the Platform prior to the change taking effect.

Continued use of the phwil Platform following notification of a revised Privacy Policy constitutes your acknowledgment of the changes. Where a material change affects processing activities for which you have provided consent, phwil will seek renewed consent before the change takes effect.

14. Contact & Data Protection Officer

For any questions, requests, or complaints relating to this Privacy Policy or phwil's data processing practices, please contact our Data Protection Officer. All requests will be acknowledged within five (5) business days and substantively responded to within thirty (30) days.

Email (plain text — not a link): [email protected]

Please note that email addresses on this page are displayed as plain text and are not clickable. Please copy the address manually.