phwing
Privacy Policy

This Privacy Policy is issued by the operator of the phwing platform ("phwing", "we", "us", or "the Company"), accessible at phwing.org. phwing operates an online gaming platform offering casino games, live dealer products, slot games, bingo services, and sports betting, primarily serving players in the Republic of the Philippines.

This Privacy Policy applies to all personal information collected by phwing through the following channels:

• The phwing website at phwing.org and all its subpages;
• The phwing account registration and KYC verification process;
• Customer support communications via live chat, email, or any other support channel;
• Payment processing interactions, including GCash, PayMaya, BDO, BPI, Metrobank, and 7-Eleven deposits and withdrawals;
• Any cookies, tracking technologies, or analytics tools deployed on the phwing Platform.

This Policy does not govern personal data collected by third-party services that may be linked from the phwing Platform. We encourage you to review the privacy policies of any third-party payment providers — including GCash, PayMaya, and your banking institution — separately, as their data handling practices are independent of this Policy.

phwing collects the following categories of personal information in the course of providing gaming services to Filipino players:

phwing does not collect sensitive personal information — such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond the facial image required for identity document verification — unless strictly required by law or with your explicit consent.

phwing collects personal information through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal request, contact support, respond to a promotion, or update your account settings;
• Automatically — through cookies, web beacons, server logs, and similar tracking technologies deployed on the phwing Platform when you access and navigate the site, log into your account, or interact with gaming products;
• From payment providers — phwing receives transaction confirmation data from GCash, PayMaya, BDO, BPI, Metrobank, and 7-Eleven in connection with deposits and withdrawals processed through your phwing Account;
• From identity verification services — where phwing uses third-party identity verification providers to assist in KYC processes, those providers may supply results of document verification checks;
• From fraud prevention and analytics providers — phwing may receive data from third-party risk and analytics services to assist in detecting and preventing fraudulent activity on the Platform.

In all cases, data collection is limited to what is reasonably necessary for the stated purpose. Where collection of a particular type of data is optional, this will be indicated at the point of collection.

phwing processes personal data for the following specific purposes:

1. Account Registration and Verification — to create and manage your phwing account, verify your identity and age eligibility (21+), and maintain the integrity of the player registration process;
2. Gaming Service Delivery — to allow you to access and use phwing's gaming products, including live casino tables, slot games, bingo rooms, and sports betting features;
3. Payment Processing — to process deposits to your phwing wallet and to execute withdrawal requests to your registered GCash, PayMaya, or bank account;
4. KYC and AML Compliance — to fulfill phwing's obligations under applicable Philippine anti-money laundering and counter-terrorism financing regulations, including maintaining records of identity verification and monitoring transaction activity for suspicious patterns;
5. Security and Fraud Prevention — to protect phwing's systems and its players from unauthorized access, account takeover, bonus abuse, identity fraud, and other malicious activities;
6. Customer Support — to respond to your queries, resolve complaints, and provide assistance in connection with your phwing account or any transaction;
7. Responsible Gaming Monitoring — to track account activity in connection with responsible gaming controls you have set, to identify patterns consistent with problem gambling, and to deliver responsible gaming interventions where required;
8. Legal and Regulatory Compliance — to maintain records required under applicable Philippine gaming regulation, tax law, and data protection law, and to respond to lawful requests from regulatory, law enforcement, or judicial authorities;
9. Platform Improvement — to analyze usage patterns in aggregate or anonymized form in order to improve the phwing Platform, optimize the user experience, and develop new features;
10. Marketing Communications — to send promotional offers, bonus alerts, and other marketing materials to players who have provided consent to receive such communications, and to manage opt-out requests from players who withdraw consent.

phwing processes your personal data on the following legal bases under the Philippine Data Privacy Act of 2012 and its implementing rules:

• Performance of a Contract — processing necessary to create and manage your phwing account and to deliver the gaming services you have requested, including payment processing and account security;
• Legal Obligation — processing required to comply with phwing's obligations under applicable Philippine laws, including KYC verification, AML monitoring, record retention, and cooperation with authorized regulatory inquiries;
• Legitimate Interests — processing carried out in furtherance of phwing's legitimate business interests, including fraud detection, security monitoring, platform improvement, and the defense of legal claims, where those interests are not overridden by your privacy rights;
• Consent — processing based on your freely given, specific, informed, and unambiguous consent, including for the delivery of marketing communications. You have the right to withdraw consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

phwing does not sell, rent, or trade personal data to any third party. Personal data is shared only in the following limited circumstances:

• Payment Service Providers — GCash, PayMaya, BDO, BPI, Metrobank, and 7-Eleven receive account reference and transaction data necessary to process deposits and withdrawals on your behalf;
• Identity Verification Providers — third-party KYC service providers receive identity document data and verification requests to assist phwing in fulfilling its age and identity verification obligations;
• Game Software Providers — game session data may be shared with game software providers to the extent necessary for RNG certification, dispute resolution, or technical support;
• Fraud and Security Service Providers — risk intelligence and analytics providers may receive technical data (such as IP address, device fingerprint, and session data) to support phwing's fraud detection and prevention operations;
• Regulatory and Legal Authorities — phwing will disclose personal data to Philippine gaming regulators, financial intelligence units, law enforcement agencies, or courts when required to do so by applicable law or a lawful court order;
• Professional Advisors — phwing's legal counsel, accountants, and auditors may access personal data to the extent necessary to provide professional services, under obligations of confidentiality.

All third parties with whom phwing shares personal data are required to handle that data in accordance with applicable data protection law. phwing implements data processing agreements with service providers to contractually enforce appropriate data security and usage restrictions.

phwing implements appropriate technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Key security measures include:

• Encryption in transit: 256-bit TLS encryption applied to all data transmission between your device and phwing's servers;
• Encryption at rest: Sensitive personal data stored on phwing's infrastructure is encrypted using industry-standard algorithms;
• Access controls: Access to personal data within phwing's systems is restricted on a need-to-know basis, with role-based access controls and audit logging of data access events;
• Two-factor authentication: Available and recommended for all phwing accounts to prevent unauthorized access resulting from compromised passwords;
• Anomaly detection: Automated monitoring for unusual login patterns, atypical transaction volumes, and other indicators of unauthorized account access;
• Penetration testing: Regular security assessments of phwing's infrastructure to identify and remediate vulnerabilities before they can be exploited.

Notwithstanding these measures, no system of security controls can guarantee absolute protection against all threats. In the event of a data security incident that poses a risk to the rights and freedoms of affected individuals, phwing will take prompt remedial action and notify affected players and the relevant Philippine authorities in accordance with applicable law.

phwing uses cookies and similar tracking technologies to support the operation, security, and improvement of the phwing Platform. Cookies are small data files stored on your device by your browser when you visit phwing.org.

phwing deploys the following categories of cookies:

• Strictly Necessary Cookies: Essential to the operation of the Platform, including session authentication, security tokens, and load balancing. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Used to remember your preferences and settings — such as language preferences and responsible gaming tool configurations — to improve your experience on subsequent visits.
• Analytics Cookies: Used to collect aggregate information about how players interact with the Platform — such as page views, session duration, and navigation paths — to help phwing improve the Platform experience. Data collected through analytics cookies is processed in aggregate or pseudonymized form.
• Security Cookies: Used as part of phwing's fraud detection and anomaly monitoring systems to identify unusual device behavior, bot activity, or credential stuffing attempts.

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies may affect your ability to log in to or use the phwing Platform. phwing does not deploy third-party advertising or retargeting cookies.

phwing retains personal data for the periods set out below, after which data is securely deleted or irreversibly anonymized:

• Account and identity data: Retained for the duration of your active phwing Account, plus a minimum period of five years following account closure, in order to comply with applicable AML record-keeping obligations under Philippine law;
• Financial and transaction data: Retained for a minimum of five years following the date of each transaction, consistent with applicable Philippine financial record-keeping requirements;
• Gaming activity data: Retained for the duration of the active Account plus three years following account closure, for dispute resolution and regulatory reporting purposes;
• KYC verification documents: Retained for the period required under applicable Philippine AML legislation, typically five years from the date of verification or account closure, whichever is later;
• Support communications: Retained for up to three years from the date of the last communication, or longer where the communication relates to an unresolved dispute or legal matter;
• Marketing preference data: Retained for the duration of the active Account. Where an Account is closed, marketing preferences are retained only for the period necessary to ensure that no further marketing communications are sent.

Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules, you have the following rights in respect of your personal data held by phwing:

A brief description of each right is provided below:

• Right to Access: You have the right to request a copy of the personal data phwing holds about you and information about how it is processed;
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data held in your phwing Account;
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis for processing applies. Note that this right is subject to overriding legal retention obligations;
• Right to Object: You have the right to object to phwing's processing of your personal data based on legitimate interests, including for profiling purposes;
• Right to Restriction: You have the right to request that phwing restrict its processing of your personal data in certain circumstances, such as while a rectification request is under review;
• Right to Data Portability: You have the right to receive personal data you provided to phwing in a structured, machine-readable format, where technically feasible;
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

To exercise any of these rights, please contact phwing's support team at [email protected] with the subject line "Data Privacy Request." phwing will acknowledge all data subject requests within five business days and aims to resolve them within 30 business days, subject to any verification requirements.

If you are not satisfied with phwing's response to a data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

Age verification is a mandatory component of phwing's registration process. All players are required to verify their date of birth and provide government-issued identification demonstrating eligibility before their account is approved for real-money play.

If phwing becomes aware that personal data has been collected from an individual below the minimum age of 21, phwing will immediately close the associated account, void all transactions and balances, and delete all personal data associated with that account without further notification. Any individual who has provided false information regarding their age will be in breach of phwing's Terms and Conditions.

If you have reason to believe that a minor below 21 years of age has registered on the phwing Platform, please contact [email protected] immediately.

phwing may send promotional communications — including bonus offers, free play credits, event invitations, and platform updates — to players who have provided consent to receive such communications during or after the registration process.

Marketing communications from phwing may be delivered via SMS to your registered Philippine mobile number, to your registered email address, or as in-Platform notifications within your phwing Account dashboard.

You have the right to withdraw your consent to marketing communications at any time by:

• Updating your communication preferences in the Account Settings page of your phwing Account;
• Replying "STOP" to any SMS marketing message from phwing;
• Contacting phwing support at [email protected] with the subject line "Unsubscribe."

Withdrawal of marketing consent will not affect your ability to receive account-related transactional communications — such as deposit confirmations, withdrawal notifications, OTP codes, and security alerts — which are necessary for the operation of your phwing Account and are not subject to opt-out.

phwing's primary data processing infrastructure is located in jurisdictions appropriate for the operation of the Platform. In the course of providing gaming services, providing certain technical services, or utilizing game software from international providers, personal data may be processed by phwing or its service providers in countries outside the Republic of the Philippines.

Where personal data is transferred internationally, phwing ensures that appropriate safeguards are in place to protect that data to a standard equivalent to or higher than that required by Philippine law. Such safeguards include:

• Data processing agreements containing contractual protections consistent with applicable Philippine data protection requirements;
• Transfers only to service providers that demonstrate adequate security standards for the relevant data processing activity;
• Limitation of transferred data to the minimum necessary for the service provider to fulfill their designated function.

For further information about the specific safeguards applied to any international data transfer, please contact phwing at [email protected].

phwing reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the services offered on the phwing Platform. The effective date at the top of this Policy reflects the date of the most recent revision.

Where changes to this Privacy Policy are material — for example, where we propose to process personal data for a new purpose, or where we materially change how we share or retain data — phwing will notify affected players through email, in-Platform notification, or a prominent notice on phwing.org prior to the changes taking effect.

For changes that are not material, we will update the Policy and its effective date without separate notification, though we encourage players to review this Policy periodically. Your continued use of the phwing Platform following a Policy update constitutes acknowledgment of the revised terms.

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, have a concern about phwing's data handling practices, or need to report a potential privacy or security incident, please contact us:

Privacy and Data Protection Inquiries:
Email: [email protected]
Subject line for data rights requests: "Data Privacy Request"
Subject line for security incidents: "Security Incident Report"
Response time: Within 5 business days for formal requests

Regulatory Authority:
If you are not satisfied with phwing's response to your data privacy concern, you have the right to submit a complaint to the National Privacy Commission of the Philippines, which is responsible for administering the Data Privacy Act of 2012.

Responsible Gaming Data Concerns:
If your privacy concern relates to responsible gaming data, including data collected in connection with self-exclusion or problem gambling interventions, please indicate this in your contact message. Such requests are treated with absolute priority and confidentiality. Please also visit our Responsible Gaming page for further guidance.