Privacy Policy

winoh ("winoh", "we", "us", or "our") operates the online gaming platform accessible at winoh.cam (the "Platform"). winoh is committed to protecting the privacy and personal data of all individuals who use our Platform, including registered players, visitors, and applicants.

This Privacy Policy ("Policy") describes how winoh collects, processes, stores, discloses, and protects personal data in connection with the winoh Platform and all related services. It applies to all users of the Platform, regardless of whether they have a registered Account.

This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 (the "DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission of the Philippines (the "NPC"). It is incorporated into winoh's Terms & Conditions by reference.

For the purposes of the Philippine Data Privacy Act of 2012, winoh is the Personal Information Controller (PIC) with respect to personal data processed in connection with the Platform.

As Personal Information Controller, winoh determines the purposes and means of processing personal data collected through the Platform. winoh has appointed a Data Privacy Officer (DPO) who is responsible for overseeing data protection compliance and serving as the point of contact for data privacy matters.

Contact details for the winoh Data Privacy Officer are provided in Section 14 of this Policy. All data privacy enquiries, requests, and complaints may be directed to the DPO using those contact details.

3.1 Data You Provide Directly

winoh collects personal data that you provide directly when you interact with the Platform, including:

3.2 Data Collected Automatically

When you access or use the winoh Platform, certain technical data is collected automatically by our systems:

• Device & Technical Data: IP address, device type and model, operating system, browser type and version, screen resolution;
• Usage Data: Pages visited, games launched, session duration, navigation paths, features accessed, error logs;
• Location Data: Approximate geographic location derived from IP address (country and region level only; precise GPS location is not collected);
• Cookies & Tracking Data: Session cookies, preference cookies, analytics identifiers. See Section 7 for full details.

3.3 Data from Third Parties

winoh may receive personal data about you from authorised third-party sources in limited circumstances, including:

• Identity verification and KYC service providers, who confirm the authenticity of identity documents you submit;
• Payment processors (e.g., GCash, Maya), who provide transaction reference data necessary to reconcile deposits and withdrawals;
• Fraud prevention and AML screening services, which may provide risk scores or watchlist matching results.

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules, winoh processes your personal data on the following lawful bases:

• Contractual Necessity: Processing required to perform winoh's obligations under the Terms & Conditions you accepted upon registration — including operating your Account, processing deposits and withdrawals, and providing access to games;
• Legal Obligation: Processing required to comply with applicable Philippine law, including PAGCOR licensing requirements, the Anti-Money Laundering Act (AMLA), and the Data Privacy Act itself — particularly KYC verification and transaction record-keeping;
• Legitimate Interests: Processing necessary for winoh's legitimate business interests, including fraud detection and prevention, platform security, abuse prevention, and responsible gaming monitoring — provided these interests are not overridden by your rights and freedoms;
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — particularly for marketing communications and optional personalisation features. You may withdraw consent at any time without affecting the lawfulness of prior processing.

winoh uses the personal data it collects for the following specific purposes:

5.1 Platform Operations

• Creating, verifying, and managing your winoh Account;
• Processing deposits and withdrawals through your chosen payment method (GCash, Maya, BPI, BDO, Metrobank, etc.);
• Delivering and personalising your gaming experience across slots, live casino, bingo, and other game categories;
• Administering bonuses, promotions, cashback, and VIP program rewards;
• Providing customer support via live chat and email;
• Sending transactional communications (deposit confirmations, withdrawal notifications, security alerts).

5.2 Legal & Regulatory Compliance

• Verifying your age (21+) and identity in compliance with PAGCOR licensing requirements;
• Conducting KYC checks as required under the Philippines' Anti-Money Laundering Act;
• Maintaining transaction records for the minimum periods required by applicable law;
• Reporting to PAGCOR or other regulatory authorities as required by law or regulatory direction;
• Responding to lawful requests from Philippine law enforcement agencies.

5.3 Security & Fraud Prevention

• Detecting, investigating, and preventing fraud, cheating, collusion, money laundering, and other prohibited activities;
• Monitoring for technical abuse, automated bots, and exploitation of platform vulnerabilities;
• Enforcing winoh's Terms & Conditions and Responsible Gaming Policy;
• Managing self-exclusion requests and responsible gaming tool activations.

5.4 Marketing (Consent-Based Only)

Where you have opted in to marketing communications, winoh may use your contact details to send you promotional offers, new game announcements, bonus opportunities, and tournament invitations. You can opt out of marketing at any time via your Account settings or by contacting support — opting out does not affect transactional communications.

6.1 Service Providers (Processors)

winoh shares personal data with carefully selected third-party service providers acting as Personal Information Processors under the DPA, who process data strictly on winoh's documented instructions. These include:

• Payment processors: GCash (GXI), Maya Philippines, BancNet, and other licensed Philippine payment service providers — for deposit and withdrawal processing;
• KYC & identity verification providers: For document authentication, liveness checks, and AML watchlist screening;
• Cloud infrastructure and hosting providers: For secure data storage and platform operations;
• Analytics providers: For aggregated, anonymised platform usage analysis to improve the winoh user experience;
• Customer support platform providers: For operating the live chat support function.

All service providers are bound by data processing agreements requiring them to maintain appropriate security standards and to process data only as instructed by winoh.

6.2 Regulatory & Legal Disclosure

winoh may disclose personal data to regulatory authorities (including PAGCOR and the National Privacy Commission), law enforcement agencies, and courts of competent jurisdiction where required to do so by applicable Philippine law, a court order, or regulatory direction. winoh will endeavour to notify affected players of such disclosures where legally permitted to do so.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of winoh's business assets, personal data held by winoh may be transferred to the acquiring entity as part of the transaction, provided that the acquiring entity agrees to be bound by privacy protections substantially equivalent to those described in this Policy.

7.1 What Are Cookies

Cookies are small text files placed on your device when you access a website. winoh uses cookies and similar tracking technologies (such as local storage and session storage) to operate and improve the Platform.

7.2 Types of Cookies winoh Uses

You can manage non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the winoh Platform. winoh does not use third-party advertising or behavioural targeting cookies.

8.1 Retention Periods

winoh retains personal data for the following minimum periods, after which it is securely deleted or anonymised unless a longer retention period is required by law:

8.2 Deletion Process

Upon expiry of applicable retention periods, personal data is deleted from winoh's active systems and from backup archives on their next scheduled rotation cycle. Where complete deletion is not technically feasible, data is anonymised such that it can no longer be associated with any identifiable individual.

Under Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules, you have the following rights with respect to your personal data held by winoh. These rights may be exercised by contacting the winoh Data Privacy Officer as described in Section 14.

winoh implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Measures in place include:

• Encryption in transit: All data exchanged between your device and winoh's servers is protected by TLS 1.2 or higher (256-bit SSL encryption);
• Encryption at rest: Sensitive data fields, including identity document data and financial account references, are encrypted at the database level;
• Access controls: winoh employee access to personal data is granted on a strict need-to-know basis, with role-based access controls and multi-factor authentication required for all administrative system access;
• Password hashing: Player passwords are never stored in plain text. winoh uses industry-standard cryptographic hashing algorithms with salting;
• Security monitoring: winoh's systems are monitored for anomalous activity, unauthorised access attempts, and data exfiltration indicators on a continuous basis;
• Penetration testing: Regular third-party security assessments and penetration tests are conducted to identify and remediate vulnerabilities;
• Incident response: winoh maintains a documented data breach incident response procedure, including NPC notification obligations within seventy-two (72) hours of discovering a notifiable breach.

While winoh takes all reasonable steps to protect your personal data, no transmission over the internet or electronic storage system is completely secure. You are responsible for maintaining the security of your own Account credentials.

Age verification is conducted as part of the winoh Account registration process. Where winoh has reason to believe that personal data has been collected from a person under 21 years of age — whether through misrepresentation at registration or otherwise — winoh will:

• Immediately suspend the Account in question;
• Delete all personal data associated with the Account, subject to any overriding legal retention obligations;
• Return any real money balance in the Account to the payment source used for deposits, where technically feasible;
• Report the incident to relevant authorities where required by applicable law.

If you become aware that a person under 21 has registered on winoh, please notify the winoh Data Privacy Officer immediately using the contact details in Section 14.

Some of winoh's third-party service providers — including cloud infrastructure providers and technology platform vendors — may be located outside the Philippines or may process data on servers located in other jurisdictions.

Where personal data is transferred outside the Philippines, winoh ensures that such transfers are made in compliance with the cross-border transfer provisions of the Data Privacy Act of 2012 and the applicable NPC rules, including by:

• Transferring data only to countries or organisations that provide an adequate level of data protection, as recognised by the NPC;
• Implementing appropriate safeguards such as data processing agreements incorporating DPA-compliant data protection clauses; or
• Relying on other permitted legal grounds for the transfer, including your explicit consent where required.

winoh takes steps to ensure that personal data transferred outside the Philippines is protected at a standard substantially equivalent to that required by Philippine law.

winoh reserves the right to update or revise this Privacy Policy at any time. The revised Policy will be posted at winoh.cam/privacy-policy with an updated effective date. Where changes are material — meaning they substantively affect how winoh processes your personal data or your rights under this Policy — winoh will notify registered Players via email or in-platform notification at least seven (7) days before the revised Policy takes effect.

Your continued use of the winoh Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically to stay informed about how winoh is protecting your data.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by winoh, please contact the winoh Data Privacy Officer:

• Live Chat: Available 24/7 via the live chat widget on winoh.cam — reference "Data Privacy Request" at the start of your message;
• Email: [email protected] — use subject line "Data Privacy Request" or "NPC Complaint — winoh";

winoh will acknowledge receipt of your request within five (5) business days. Substantive responses to data rights requests will be provided within fifteen (15) business days. winoh may request proof of identity before processing requests that involve the disclosure or deletion of personal data.

If you are not satisfied with winoh's response to a data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). Information about filing a complaint with the NPC is available through Philippine government channels.