phwim Privacy Policy

1. Introduction

phwim ("phwim," "we," "us," or "our") operates the online gaming platform accessible at phwim.net and any associated mobile applications (collectively, the "Platform"). We are committed to protecting the privacy and personal data of all users ("you," "your," or "Player") who access or use the Platform.

This Privacy Policy describes the types of personal data phwim collects, the purposes for which that data is processed, the parties with whom it may be shared, and the rights available to you under applicable Philippine law — in particular, the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC).

By creating a phwim account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this policy, you should discontinue use of the Platform and contact us to close your account.

2. Personal Data We Collect

phwim collects personal data that is necessary to provide a safe, compliant, and enjoyable gaming experience. The categories of personal data we collect include:

2.1 Registration Data

When you create a phwim account, we collect:

• Full legal name;
• Date of birth (to verify you are 21 years of age or older);
• Residential address (including city, province, and postal code);
• Email address;
• Mobile phone number;
• Username and encrypted password.

2.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) regulations and verify your identity, phwim may collect:

• Copies of government-issued photo identification (e.g., Philippine passport, driver's license, SSS ID, UMID, PhilSys National ID);
• Proof of residential address (e.g., utility bill, bank statement);
• Source-of-funds declarations where required by applicable regulations;
• Selfie or liveness verification images for biometric identity matching.

2.3 Financial Data

When you make deposits or request withdrawals, phwim collects:

• Payment method details (e.g., GCash mobile number, PayMaya account reference, bank account name and number for BPI, BDO, or Metrobank transfers);
• Transaction amounts, dates, and reference numbers;
• Account balance and transaction history within the Platform.

Note: phwim does not store full card numbers or complete e-wallet credentials. Payment processing is handled by certified third-party payment processors.

2.4 Usage and Technical Data

When you use the phwim Platform, we automatically collect:

• IP address and approximate geolocation;
• Device type, operating system, and browser information;
• Pages visited, games played, session duration, and click-stream data;
• Login timestamps and session activity logs.

2.5 Communications Data

When you contact phwim's customer support team, we collect records of your communications, including live chat transcripts, email correspondence, and any attachments or documents you submit.

3. How We Use Your Personal Data

phwim uses the personal data we collect for the following purposes:

• Account Management: To create, maintain, and secure your phwim account, including authentication and password recovery;
• Age and Identity Verification: To confirm that you meet the 21+ age requirement and to verify your identity in accordance with KYC obligations;
• Transaction Processing: To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and other supported payment methods in Philippine Peso (PHP);
• Regulatory Compliance: To fulfil phwim's obligations under the Data Privacy Act of 2012, applicable AML and CTF regulations, and any requirements imposed by Philippine gaming regulators;
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, and other security threats;
• Responsible Gaming: To monitor gaming behaviour and apply responsible gaming tools such as deposit limits, cooling-off periods, and self-exclusion where requested or required;
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance;
• Platform Improvement: To analyse usage patterns and improve the performance, features, and user experience of the phwim Platform;
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — only where you have provided consent or where permitted by applicable law. You may opt out at any time.

4. Legal Basis for Processing

phwim processes your personal data on the following legal bases under the Data Privacy Act of 2012 and its Implementing Rules and Regulations:

• Consent: Where you have given phwim your explicit, informed consent to process your data for a specific purpose (e.g., marketing communications, optional analytics);
• Contractual Necessity: Where processing is necessary to perform the contract between you and phwim — specifically, to operate your account, process transactions, and deliver gaming services;
• Legal Obligation: Where processing is required to comply with a legal obligation applicable to phwim, including AML regulations, KYC requirements, and regulatory reporting obligations;
• Legitimate Interests: Where processing is necessary for phwim's legitimate interests — such as fraud prevention, platform security, and service improvement — provided those interests are not overridden by your rights and freedoms.

5. Data Sharing and Disclosure

phwim does not sell, rent, or trade your personal data to third-party marketers. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Privacy Policy:

5.1 Service Providers

phwim engages trusted third-party service providers to assist in operating the Platform, including payment processors (GCash, PayMaya, BPI, BDO, Metrobank), identity verification providers, cloud hosting services, and customer support platforms. These providers are contractually bound to process your data only on phwim's instructions and in accordance with applicable data protection law.

5.2 Regulatory and Law Enforcement Authorities

phwim may disclose your personal data to Philippine government agencies, regulatory bodies, law enforcement authorities, or courts where required by law, court order, or regulatory directive — including for AML reporting, fraud investigations, or compliance with gaming regulations.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of phwim's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material changes to this Privacy Policy that result from it.

5.4 With Your Consent

phwim may share your personal data with other third parties where you have given your explicit consent to such sharing for a specific purpose.

6. Cookies and Tracking Technologies

phwim uses cookies and similar tracking technologies to enhance your experience on the Platform. A cookie is a small text file stored on your device when you visit a website. phwim uses the following types of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled.
• Functional Cookies: Remember your preferences, such as language settings and game display options, to personalise your experience on phwim.
• Analytics Cookies: Help phwim understand how players use the Platform — which games are most popular, where users encounter difficulties, and how to improve overall performance. Data collected is aggregated and anonymised where possible.
• Marketing Cookies: Used to deliver relevant promotional content within the phwim Platform. phwim does not use third-party advertising networks that track you across external websites.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the phwim Platform.

7. Data Retention

phwim retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:

• Account Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements;
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of submission or account closure, whichever is later;
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction;
• Customer Support Records: Retained for three (3) years from the date of the last interaction;
• Marketing Consent Records: Retained until you withdraw consent, plus a reasonable period thereafter for compliance documentation purposes.

Upon expiry of the applicable retention period, phwim will securely delete or anonymise your personal data in accordance with its data disposal procedures.

8. Data Security

phwim implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and phwim's servers is encrypted using industry-standard SSL/TLS protocols;
• Encryption at Rest: Sensitive personal data stored on phwim's servers is encrypted at rest using AES-256 encryption;
• Access Controls: Access to personal data is restricted to authorised phwim personnel on a strict need-to-know basis, enforced through role-based access controls;
• Two-Factor Authentication: phwim supports two-factor authentication (2FA) for player accounts to provide an additional layer of login security;
• Regular Security Audits: phwim's systems and infrastructure are subject to regular internal and third-party security assessments and penetration testing;
• Incident Response: phwim maintains a data breach response plan. In the event of a personal data breach that poses a risk to your rights, phwim will notify the National Privacy Commission and affected users in accordance with the Data Privacy Act of 2012.

9. Your Data Privacy Rights

Under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, you have the following rights with respect to your personal data held by phwim:

• Right to Be Informed: The right to be informed of how your personal data is being collected and processed — which this Privacy Policy fulfils;
• Right of Access: The right to request a copy of the personal data phwim holds about you, along with information about how it is being used;
• Right to Rectification: The right to request correction of any inaccurate or incomplete personal data phwim holds about you;
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to phwim's legal retention obligations;
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on phwim's legitimate interests;
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible;
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe phwim has processed your personal data in violation of the Data Privacy Act of 2012.

To exercise any of the above rights, please contact phwim's Data Protection Officer using the contact details provided in Section 13 of this Privacy Policy. phwim will respond to all verified data subject requests within thirty (30) days of receipt.

10. Children's Privacy

The phwim Platform is strictly intended for individuals who are 21 years of age or older. phwim does not knowingly collect personal data from persons under the age of 21. Age verification is conducted as part of the account registration and KYC process.

If phwim becomes aware that personal data has been collected from a person under the age of 21 without appropriate parental or guardian consent, phwim will immediately suspend the relevant account, delete the associated personal data, and take appropriate action in accordance with applicable Philippine law.

11. Third-Party Links

The phwim Platform may contain links to third-party websites or services, such as payment provider portals or game developer pages. phwim is not responsible for the privacy practices or content of those third-party sites. We encourage you to review the privacy policies of any third-party sites you visit through links on the phwim Platform.

phwim does not endorse or make any representations about third-party websites, and the inclusion of a link does not imply any affiliation or endorsement by phwim.

12. Updates to This Privacy Policy

phwim reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The date of the most recent revision is displayed at the top of this page.

Where changes are material — meaning they significantly affect your rights or how phwim processes your personal data — phwim will provide advance notice via email to your registered address or through a prominent in-platform notification, at least seven (7) days before the changes take effect.

Your continued use of the phwim Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated policy, you should discontinue use of the Platform and contact phwim to close your account.

13. Contact Us & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or phwim's data processing practices, please contact our Data Protection Officer (DPO) or customer support team through the following channels:

• Data Protection Officer: [email protected]
• General Support: [email protected]
• Live Chat: Available 24/7 via the phwim Platform

phwim aims to acknowledge all privacy-related requests within five (5) business days and to resolve them within thirty (30) days. For complex requests, phwim may extend this period by a further thirty (30) days, with prior notice to you.

If you are not satisfied with phwim's response to your privacy request or complaint, you have the right to escalate the matter to the National Privacy Commission of the Philippines (NPC) through their official channels.