winsir Privacy Policy

1 Introduction

winsir takes data privacy seriously. This is not a formality — it is a core operational commitment. Filipino players who use the winsir platform are entrusting us with personal information, financial data, and behavioral data generated through gameplay. The responsible handling of that information is an obligation winsir takes on from the moment a User creates an Account.

This Policy applies to all personal data processed by winsir in connection with the operation of winsir.asia, including data collected during registration, KYC verification, financial transactions, gameplay activity, customer support interactions, and marketing communications. It covers data processed through the winsir website as accessed on desktop browsers, mobile browsers, and any other interface through which the winsir Platform is accessible.

This Policy does not apply to third-party websites or services that may be referenced on the winsir Platform but are operated independently. winsir is not responsible for the privacy practices of third-party game providers or payment processors beyond what is covered in Section 7 of this Policy.

2 Data Controller

For the purposes of the Data Privacy Act of 2012 and this Policy, winsir Casino is the Data Controller responsible for the personal information you provide when using the winsir Platform. As Data Controller, winsir determines the purposes for which personal data is collected and the manner in which it is processed.

winsir has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable data protection laws. The DPO's contact details are provided in Section 16 of this Policy. Data Subjects wishing to exercise their rights under the DPA or raise any data privacy concern may contact the DPO directly.

3 Personal Data We Collect

winsir collects the following categories of personal data in connection with operating the winsir Platform:

winsir does not intentionally collect sensitive personal information beyond what is strictly required for identity verification and regulatory compliance. Sensitive data (e.g., biometric information used for liveness checks) is processed solely for KYC purposes and is not used for any other commercial purpose.

4 How Personal Data Is Collected

winsir collects personal data through the following channels:

• Direct submission by the User: Information provided by you during Account registration, KYC document upload, payment method setup, customer support interactions, and any form submission on the Platform.
• Automated technical collection: Technical data (IP address, device fingerprint, session data) collected automatically when you access winsir.asia through standard server logs, cookies, and similar tracking technologies described in Section 10.
• Third-party payment processors: Transaction confirmation data received from GCash, Maya, BPI, BDO, UnionBank, and other payment providers when you make deposits or withdrawals via those channels.
• Identity verification providers: Results of identity verification checks conducted by licensed third-party KYC service providers used by winsir for document authentication and liveness verification.
• Fraud prevention and compliance services: Data received from licensed fraud screening and AML (Anti-Money Laundering) compliance providers used by winsir to meet PAGCOR regulatory obligations.
• Game providers: Gameplay session data transmitted by licensed game software providers (such as Pragmatic Play, PG Soft, and others) in connection with games hosted on the winsir Platform.

5 Purposes of Data Processing

winsir processes personal data for the following defined purposes only:

1. Account registration and management: Creating and maintaining your winsir Account, verifying login credentials, and managing Account settings and preferences.
2. Identity verification (KYC): Verifying your identity and age (minimum 21 years) as required by PAGCOR regulations and the Anti-Money Laundering Act of the Philippines.
3. Payment processing: Processing deposits, withdrawals, and internal account transfers via GCash, Maya, and other accepted payment methods.
4. Game provision and platform operation: Enabling access to games, maintaining game session records, processing wager outcomes, and crediting winnings to your Account balance.
5. Regulatory compliance: Meeting winsir's obligations under PAGCOR licensing conditions, Republic Act 9160 (Anti-Money Laundering Act), Republic Act 10173 (Data Privacy Act), and other applicable Philippine law.
6. Customer support: Responding to inquiries, resolving complaints, and providing assistance related to your Account or use of the Platform.
7. Fraud prevention and security: Detecting and preventing unauthorized Account access, bonus abuse, money laundering, and other prohibited conduct described in winsir's Terms & Conditions.
8. Responsible gaming enforcement: Monitoring gameplay patterns for signs of problem gambling and enforcing deposit limits, self-exclusion, and age restriction controls.
9. Marketing communications (with consent): Sending promotional offers, bonus notifications, and platform updates to Users who have opted in to receive such communications. You may withdraw consent at any time through Account Settings.
10. Platform improvement and analytics: Analyzing aggregate, anonymized usage data to improve the Platform's performance, game offerings, and user experience.

6 Legal Basis for Processing

winsir processes personal data only where one or more of the following lawful bases applies under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform the contract between winsir and you (i.e., providing access to the Platform, processing deposits, paying out winnings).
• Legal obligation: Processing required to comply with Philippine law, including PAGCOR licensing conditions, AML regulations, KYC requirements, and data retention obligations.
• Legitimate interests: Processing necessary for the legitimate interests of winsir, such as fraud prevention, security monitoring, and platform improvement, where those interests are not overridden by the rights and interests of the Data Subject.
• Consent: Processing based on your freely given, informed, and specific consent — primarily for marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Disclosure

7.1 General Principle. winsir does not sell, rent, or trade your personal data to any third party for commercial purposes. Data sharing occurs only where strictly necessary for Platform operation, legal compliance, or the protection of our rights and the rights of our Players.

7.2 Categories of Recipients. winsir may share personal data with the following categories of third parties:

• Payment service providers: GCash (G-Xchange Inc.), Maya (Voyager Innovations), BPI, BDO, UnionBank, and other payment processors receive transaction data necessary to process deposits and withdrawals.
• KYC and identity verification providers: Licensed third-party KYC providers receive document images and personal information for identity authentication purposes only.
• Game software providers: Licensed game providers (including Pragmatic Play, PG Soft, and others) receive session and gameplay data necessary to deliver and record game outcomes.
• Fraud prevention and AML providers: Compliance screening services receive limited personal data (name, date of birth, identification numbers) for sanctions screening and fraud detection.
• PAGCOR and Philippine regulatory authorities: winsir is required to provide Player account and transaction data to PAGCOR and other Philippine authorities upon lawful request, as a condition of its operating license.
• Law enforcement agencies: Personal data may be disclosed to Philippine law enforcement agencies in response to a valid court order, subpoena, or other lawful legal process.
• IT and infrastructure service providers: Cloud hosting, data storage, and cybersecurity service providers who process data as Data Processors on winsir's behalf, bound by contractual data processing agreements.

7.3 Third-Party Agreements. All third-party service providers who process personal data on winsir's behalf are required to execute Data Processing Agreements (DPAs) that bind them to confidentiality obligations, purpose limitations, and security standards consistent with this Policy and Philippine data protection law.

8 Data Retention

winsir retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with winsir's data destruction procedures, unless retention is required to resolve an ongoing legal dispute or comply with a specific regulatory requirement.

9 Security Measures

winsir implements a comprehensive set of technical and organizational security measures to protect personal data against unauthorized access, accidental loss, destruction, or alteration:

• Encryption in transit: All data transmitted between your device and winsir.asia is encrypted using 256-bit TLS/SSL protocols. Connections using outdated encryption protocols are blocked.
• Encryption at rest: Personal data and financial records stored in winsir's databases are encrypted at rest using AES-256 encryption standards.
• Access controls: Access to personal data within winsir's systems is restricted on a strict need-to-know basis. All staff with data access are subject to confidentiality obligations and role-based access permissions.
• Multi-factor authentication: Internal system access by winsir staff requires multi-factor authentication. Players are encouraged (and for high-value accounts, required) to enable two-factor authentication on their winsir Accounts.
• Penetration testing and vulnerability management: winsir's systems undergo regular security assessments, including penetration testing by qualified third-party security professionals.
• Fraud monitoring: Automated systems monitor Platform activity for indicators of unauthorized access, account takeover attempts, and abnormal financial transaction patterns.
• Staff training: All winsir personnel with access to personal data undergo mandatory data privacy and information security training.

While winsir implements industry-standard security measures, no online platform can guarantee absolute security. Players are responsible for maintaining the security of their own login credentials and should report any suspected unauthorized Account access to winsir immediately.

10 Cookies & Tracking Technologies

winsir uses cookies and similar tracking technologies on winsir.asia for the following purposes:

• Strictly necessary cookies: Required for the Platform to function correctly — including maintaining your login session, storing your basket/balance state, and enabling security features. These cookies cannot be disabled.
• Functional cookies: Store your preferences (such as language preference, game layout settings) to improve your experience on return visits.
• Analytics cookies: Aggregate, anonymized data about how visitors use winsir.asia, used to improve Platform performance and user experience. No individual identity is tracked through analytics cookies.
• Session security tokens: Short-lived tokens used to authenticate your active session and prevent cross-site request forgery (CSRF) attacks.

winsir does not use third-party advertising cookies or behavioral tracking technologies that profile your activity for marketing purposes outside the Platform. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will impair the functionality of the winsir Platform.

11 Data of Minors

All Account registrations require KYC verification, including submission of a government-issued ID that confirms the User's date of birth. Where winsir discovers or has reasonable grounds to believe that personal data has been collected from an individual under 21 years of age, winsir will take immediate steps to: (a) suspend the relevant Account; (b) securely delete the minor's personal data; and (c) report the matter to PAGCOR as required by the Platform's licensing conditions.

If you are a parent or legal guardian and believe that a minor under your care has attempted to register or has accessed the winsir Platform, please contact us immediately at [email protected] so that we may take appropriate action.

12 Your Data Subject Rights

Under Republic Act 10173 (Data Privacy Act of 2012) of the Philippines, you have the following rights with respect to your personal data held by winsir:

To exercise any of these rights, please submit a written request to winsir's Data Protection Officer at [email protected] with the subject line "Data Privacy Request – [Your Name]." winsir will respond within fifteen (15) business days. Identity verification may be required before processing data access or deletion requests.

13 Data Breach Protocol

In the event of a personal data breach that is reasonably likely to result in harm to any Data Subject, winsir will take immediate steps to contain the breach and assess its scope. winsir will notify the National Privacy Commission (NPC) of any qualifying breach within seventy-two (72) hours of becoming aware of it, in accordance with the Data Privacy Act and NPC Circular No. 16-03.

Affected Data Subjects will be notified of a breach without undue delay where the breach is likely to result in a high risk to their rights and freedoms. The notification will include: a description of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.

winsir maintains an Incident Response Plan that outlines the procedures for breach detection, containment, investigation, notification, and post-incident review. This plan is reviewed and updated at least annually.

14 Cross-Border Data Transfers

Some of winsir's technology service providers (including cloud hosting and game software providers) may process or store data on servers located outside the Philippines. Where personal data is transferred to a country that does not provide an adequate level of data protection comparable to the Data Privacy Act of 2012, winsir ensures that appropriate safeguards are in place, including:

• Standard contractual clauses approved by the National Privacy Commission;
• Data Processing Agreements that impose DPA-equivalent obligations on the recipient;
• Transfers to jurisdictions that have been recognized by the NPC as providing adequate data protection;
• Binding corporate rules where applicable within a group of companies.

By using the winsir Platform and consenting to this Policy, you acknowledge that your personal data may be transferred and processed in jurisdictions outside the Philippines subject to the safeguards described above.

15 Changes to This Policy

winsir reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the services we offer. Material changes to this Policy will be communicated to registered Users via in-Account notification or email to your registered address, with a minimum of seven (7) days' notice prior to the effective date of the change, unless a shorter notice period is required by law.

The "Last Updated" date at the top of this document reflects the most recent revision. We encourage you to review this Policy periodically. Your continued use of the winsir Platform following notification of any amendment constitutes your acceptance of the revised Policy.

16 Contact Information & Data Protection Officer

For all data privacy inquiries, requests to exercise Data Subject rights, or complaints about how winsir handles personal data, please contact winsir's Data Protection Officer through the following channels: