winhq Privacy Policy

01 Introduction

winhq is committed to protecting the privacy and personal data of every player who uses our platform. As an online gaming operator serving Filipino players, we understand that trust is the foundation of everything we do — and that trust begins with being transparent about how we handle your information.

This Privacy Policy applies to all personal data collected through the winhq website at winhq.app, our mobile-optimized platform, customer support channels, and any other services we provide. It applies to all registered players, prospective players who browse the platform, and any individual whose personal data we process in connection with our operations.

winhq acts as the personal information controller for the data collected through the platform. We are registered with the National Privacy Commission (NPC) of the Philippines as required by law. Our Data Protection Officer (DPO) oversees compliance with this Policy and applicable data privacy regulations.

02 Personal Data We Collect

winhq collects personal data that is necessary to operate the platform, verify your identity, process transactions, and comply with our legal and regulatory obligations. The categories of personal data we collect include:

We do not collect sensitive personal information beyond what is strictly necessary for identity verification and regulatory compliance. Where sensitive data is collected — such as government ID numbers — it is handled with the highest level of security and access controls.

03 How We Collect Your Data

winhq collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical data collected automatically when you access the winhq platform, including IP addresses, device identifiers, browser information, and session data collected through cookies and similar technologies.
• Third-party sources: Identity verification data from KYC service providers; transaction data from payment processors such as GCash, PayMaya, BDO, BPI, and Metrobank; fraud prevention data from security service providers; and publicly available information used to verify your identity or comply with AML obligations.
• Regulatory sources: Information received from PAGCOR or other Philippine regulatory authorities in connection with licensing, compliance, or investigation requirements.

04 How We Use Your Personal Data

winhq uses your personal data only for legitimate purposes that are consistent with the reason it was collected. The specific purposes for which we process your data include:

• Account management: Creating, maintaining, and managing your winhq player account, including processing your registration, verifying your identity, and managing your account settings and preferences.
• Transaction processing: Processing deposits, withdrawals, and bonus credits to and from your account using your chosen payment method (GCash, PayMaya, BDO, BPI, Metrobank, or other available methods).
• Regulatory compliance: Fulfilling our obligations under PAGCOR regulations, the Anti-Money Laundering Act (RA 9160), the Data Privacy Act (RA 10173), and other applicable Philippine laws, including conducting customer due diligence and reporting suspicious transactions to the AMLC.
• Responsible gaming: Monitoring gaming activity to identify signs of problem gambling, enforcing deposit and loss limits, processing self-exclusion requests, and complying with PAGCOR responsible gaming requirements.
• Customer support: Responding to your inquiries, resolving disputes, and providing assistance through our 24/7 support team.
• Security and fraud prevention: Detecting, investigating, and preventing fraudulent activity, unauthorized account access, money laundering, and other illegal conduct on the platform.
• Platform improvement: Analyzing aggregated usage data to improve the winhq platform, optimize game performance, and enhance the overall player experience.
• Marketing communications: Sending you promotional offers, bonus notifications, and platform updates — but only where you have provided consent or where we have a legitimate interest in doing so. You may opt out of marketing communications at any time.
• Legal proceedings: Establishing, exercising, or defending legal claims in connection with your use of the winhq platform.

05 Legal Basis for Processing

Under the Data Privacy Act of the Philippines, winhq processes your personal data on the following legal bases:

• Contractual necessity: Processing that is necessary to perform our contract with you — specifically, to operate your winhq account, process transactions, and provide gaming services.
• Legal obligation: Processing required to comply with our obligations under Philippine law, including PAGCOR regulations, the Anti-Money Laundering Act, the Data Privacy Act, and other applicable legislation.
• Legitimate interests: Processing for purposes such as fraud prevention, platform security, and improving our services, where our legitimate interests are not overridden by your rights and interests.
• Consent: Processing for purposes such as marketing communications and non-essential cookies, where we have obtained your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

06 Data Sharing & Disclosure

winhq does not sell your personal data. We share your data only in the following limited circumstances:

• Payment processors: We share financial data with payment service providers (including GCash, PayMaya, BDO, BPI, and Metrobank) to process your deposits and withdrawals. These providers are bound by their own privacy policies and applicable Philippine financial regulations.
• Identity verification providers: We share identity documents and biometric data with accredited KYC service providers to verify your identity as required by PAGCOR and AML regulations.
• Game providers: We share necessary account and session data with our game software providers to enable you to play games on the winhq platform. Game providers are contractually prohibited from using this data for any purpose other than providing the game service.
• Regulatory authorities: We are required by law to share certain data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities upon lawful request or as required by our operating license.
• Legal and professional advisors: We may share data with our lawyers, auditors, and other professional advisors where necessary to obtain advice or manage legal proceedings, subject to strict confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of winhq's business, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

07 Cookies & Tracking Technologies

winhq uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device when you visit a website. We use the following types of cookies:

• Strictly necessary cookies: These cookies are essential for the winhq platform to function. They enable core features such as account login, session management, and security. These cookies cannot be disabled without affecting platform functionality.
• Performance cookies: These cookies collect anonymized information about how players use the winhq platform — such as which pages are visited most frequently and whether error messages are received. This data helps us improve platform performance.
• Functional cookies: These cookies remember your preferences — such as your preferred language and display settings — to provide a more personalized experience.
• Analytics cookies: We use analytics tools to understand aggregate player behavior on the platform. This data is used in anonymized or pseudonymized form and does not identify individual players.
• Marketing cookies: With your consent, we may use cookies to deliver relevant promotional content about winhq. You may opt out of marketing cookies at any time through your browser settings.

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the winhq platform. For detailed instructions on managing cookies in your browser, refer to your browser's help documentation.

08 Data Retention

winhq retains your personal data for as long as necessary to fulfill the purposes for which it was collected, including compliance with legal, regulatory, and contractual obligations. The following retention periods apply:

• Account data: Retained for the duration of your account and for a minimum of five (5) years after account closure, as required by PAGCOR regulations and AML obligations.
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction, in accordance with the Anti-Money Laundering Act and PAGCOR record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years after the end of the business relationship, as required by AML regulations.
• Support communications: Retained for three (3) years from the date of the communication, or longer if related to an ongoing dispute or legal proceeding.
• Technical and log data: Retained for up to twelve (12) months for security and fraud prevention purposes, after which it is deleted or anonymized.
• Marketing data: Retained until you withdraw consent or opt out of marketing communications, after which it is deleted from our marketing systems within 30 days.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with our data disposal procedures. Where data cannot be immediately deleted due to technical constraints, it is isolated and protected until deletion is possible.

09 Data Security

winhq implements comprehensive technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. Our security measures include:

• Encryption: All data transmitted between your device and the winhq platform is encrypted using Transport Layer Security (TLS). Sensitive data stored on our servers — including financial data and identity documents — is encrypted at rest using industry-standard encryption algorithms.
• Access controls: Access to personal data is restricted to authorized winhq personnel who require it to perform their job functions. All staff with access to personal data are subject to confidentiality obligations and regular data privacy training.
• Two-factor authentication: winhq supports two-factor authentication (2FA) for player accounts to provide an additional layer of security against unauthorized access.
• Regular security assessments: We conduct regular security audits, vulnerability assessments, and penetration testing to identify and address potential security weaknesses in our platform.
• Incident response: winhq maintains a documented data breach response plan. In the event of a security incident, our team is trained to respond promptly to contain the breach, assess the impact, and notify affected parties as required by law.

10 Your Rights as a Data Subject

Under the Data Privacy Act of the Philippines, you have the following rights with respect to your personal data held by winhq:

• Right to be informed: You have the right to be informed about how your personal data is collected, used, and processed. This Privacy Policy fulfills that obligation.
• Right of access: You have the right to request a copy of the personal data winhq holds about you, along with information about how it is being processed.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You may update certain information directly through your account settings.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. Note that we are required by law to retain certain data for a minimum of five years.
• Right to object: You have the right to object to the processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests, subject to our overriding legal obligations.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to lodge a complaint: If you believe that winhq has violated your data privacy rights, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

11 Children's Privacy

The winhq platform is strictly intended for adults aged 21 years and above, in accordance with PAGCOR regulations governing online gaming in the Philippines. winhq does not knowingly collect personal data from individuals under the age of 21.

If we become aware that personal data has been collected from a person under 21 years of age, we will immediately suspend the associated account, delete the personal data in question, and handle any funds in the account in accordance with applicable PAGCOR guidelines.

12 Cross-Border Data Transfers

winhq primarily processes and stores personal data within the Philippines. However, in certain circumstances — such as when using internationally-based game providers, cloud infrastructure providers, or KYC service providers — your personal data may be transferred to and processed in countries outside the Philippines.

Where such transfers occur, winhq ensures that appropriate safeguards are in place to protect your personal data, including:

• Transferring data only to countries that have been assessed as providing an adequate level of data protection.
• Implementing contractual clauses in agreements with international service providers that require them to protect your data to standards equivalent to those required by the Data Privacy Act of the Philippines.
• Conducting due diligence on all international service providers to verify their data security practices before engaging their services.

By using the winhq platform, you consent to the transfer of your personal data to international service providers as described in this section, subject to the safeguards outlined above.

13 Updates to This Privacy Policy

winhq may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will notify registered players by email or through a prominent notice on the winhq platform at least seven (7) days before the changes take effect.

The "Last updated" date at the top of this Policy indicates when it was most recently revised. We encourage you to review this Policy periodically to stay informed about how winhq protects your personal data.

Your continued use of the winhq platform after the effective date of any update to this Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you must cease using the platform and may request account closure through your account settings.

14 Contact Us & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the way winhq handles your personal data, please contact our Data Protection Officer (DPO). Our DPO is responsible for overseeing compliance with the Data Privacy Act of the Philippines and this Privacy Policy.

You may also contact our general customer support team for account-related privacy inquiries. Our support team is available 24 hours a day, 7 days a week, including Philippine public holidays.

We are committed to resolving all privacy-related inquiries promptly and transparently. All requests submitted to our DPO will be acknowledged within three (3) business days and resolved within fifteen (15) business days, as required by the Data Privacy Act.