popwin Privacy Policy

1. Introduction & Scope

1.1 This Privacy Policy ("Policy") describes how popwin ("popwin", "we", "us", "our") collects, uses, discloses, stores, and protects the personal information of individuals ("you", "Data Subject") who access and use the online gaming platform operated at popwin.cam, including all associated mobile interfaces and communications channels.

1.2 This Policy applies to all personal data processed in connection with your use of popwin's services, including account registration, identity verification, deposits, withdrawals, gameplay, customer support interactions, marketing communications, and participation in the popwin VIP program.

1.3 This Policy should be read in conjunction with popwin's Terms & Conditions, available at popwin.cam/terms-conditions. Where this Policy references specific processing activities that are subject to additional terms (such as bonus eligibility or VIP membership), those additional terms also apply.

1.4 popwin is committed to compliance with Republic Act No. 10173, known as the Data Privacy Act of 2012, and its Implementing Rules and Regulations, as well as applicable issuances of the National Privacy Commission (NPC) of the Philippines.

2. Data Controller Information

2.1 For the purposes of the Data Privacy Act of 2012, popwin acts as the Personal Information Controller (PIC) with respect to the personal data collected through the popwin.cam platform.

2.2 popwin has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable data privacy law. The DPO may be contacted at the details provided in Section 15 of this Policy.

3. Personal Data We Collect

3.1 popwin collects the following categories of personal data in the course of operating its platform and providing services to registered players:

3.1.1 Registration & Identity Data

• Full legal name as it appears on a valid government-issued identification document
• Date of birth
• Gender
• Nationality and country of residence
• Residential address (including barangay, city/municipality, province)
• Email address
• Philippine mobile number
• Username and encrypted account password

3.1.2 Identity Verification (KYC) Data

• Copies of valid government-issued identification documents (e.g., PhilSys National ID, UMID, driver's license, Philippine passport)
• Proof of address documentation (e.g., utility bill, bank statement)
• Selfie photographs or live facial recognition data used for face-match verification
• Proof of payment method (where required)

3.1.3 Financial & Transaction Data

• Deposit and withdrawal amounts, dates, and payment methods used
• GCash account reference numbers (tokenized — we do not store your GCash PIN)
• Maya account reference numbers (tokenized)
• Bank account names and partial account numbers for BPI, BDO, Metrobank, and other bank transfer methods
• Transaction history and account balance records

3.1.4 Gaming & Activity Data

• Game session records, including games played, wagers placed, outcomes, and session duration
• Bonus and promotion participation records
• VIP tier status and loyalty point accumulation
• Responsible gaming tool settings (deposit limits, session limits, self-exclusion status)

3.1.5 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser type
• Login timestamps and session duration
• Cookie identifiers and similar tracking technologies (see Section 8)

3.1.6 Communications Data

• Records of live chat, email, and SMS communications with the popwin support team
• Survey responses, feedback submissions, and complaint records

4. How We Collect Your Data

4.1 popwin collects personal data through the following channels:

• Direct collection: Information you provide during account registration, KYC verification, payment processing, customer support interactions, survey participation, and promotional claims
• Automated collection: Technical and device data collected automatically when you access and interact with the popwin.cam platform, including via cookies, web beacons, and server logs
• Third-party providers: Identity verification data confirmed through KYC partners; fraud and AML screening data from compliance service providers; geolocation data from IP address resolution services
• Payment providers: Transaction confirmation data from GCash, Maya, BPI, BDO, Metrobank, InstaPay, and other integrated payment processors

5. Legal Basis for Processing

5.1 popwin processes your personal data on the following legal bases under the Data Privacy Act of 2012:

Processing Purpose	Legal Basis
Account registration and contract performance	Performance of contract (Section 12(b), RA 10173)
Identity verification (KYC) and AML compliance	Compliance with legal obligation (Section 12(c), RA 10173)
Payment processing and transaction records	Performance of contract; legal obligation
Fraud prevention and platform security	Legitimate interests of popwin; legal obligation
Responsible gaming tool management	Legal obligation; protection of vital interests
Marketing and promotional communications	Consent (Section 12(a), RA 10173) — opt-in only
Platform analytics and improvement	Legitimate interests of popwin
Customer support and complaint handling	Performance of contract; legitimate interests

6. How We Use Your Data

6.1 popwin uses your personal data for the following specific purposes:

• Creating and managing your popwin player account
• Verifying your identity and age (21+) in compliance with PAGCOR requirements and the Anti-Money Laundering Act of the Philippines
• Processing deposits, withdrawals, and other financial transactions through your chosen payment method
• Delivering the gaming services available on the platform, including maintaining accurate game history and balance records
• Administering bonuses, promotions, and the popwin VIP loyalty program
• Detecting, investigating, and preventing fraudulent account activity, bonus abuse, money laundering, and other prohibited conduct
• Providing customer support and resolving disputes
• Sending service communications, including account security alerts, transaction confirmations, and policy update notices
• Sending marketing communications, exclusively where you have provided explicit opt-in consent
• Enforcing popwin's Terms & Conditions and this Privacy Policy
• Complying with legal and regulatory obligations, including disclosures required by PAGCOR, the Anti-Money Laundering Council (AMLC), and Philippine courts
• Analyzing platform usage patterns to improve product quality and user experience

6.2 popwin does not use your personal data for automated decision-making that produces significant legal effects without human review, except where such processing is required by law or where you have consented to it.

7. Sharing Your Data

7.1 popwin does not sell, rent, or trade your personal data to third parties for their independent commercial purposes.

7.2 popwin may share your personal data with the following categories of third parties, strictly for the purposes described in this Policy:

• Payment processors: GCash (GXI), Maya (Voyager Innovations), participating banks, and other integrated payment service providers — solely to process your transactions
• KYC / identity verification partners: Third-party providers engaged to perform automated or manual identity verification, age verification, and document authentication
• AML / fraud screening providers: Services used to screen transactions and accounts against sanctions lists, politically exposed persons databases, and fraud risk indicators
• Game providers: Certified third-party game studios whose games are integrated into the popwin platform may receive your session identifiers and game history data to support game functionality and dispute resolution
• IT and hosting infrastructure providers: Cloud hosting, database management, and security service providers operating under data processing agreements that restrict their use of your data to service delivery purposes only
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and Philippine law enforcement agencies, where popwin is legally obligated to disclose data or where disclosure is necessary to prevent serious harm
• Professional advisors: Legal counsel, auditors, and compliance consultants engaged by popwin, subject to professional confidentiality obligations

7.3 Where data is shared with third-party processors, popwin requires those parties to maintain appropriate technical and organizational security measures and to process the data only for the purposes specified in a written data processing agreement.

8. Cookies & Tracking Technologies

8.1 popwin uses cookies and similar technologies (collectively "Cookies") on the popwin.cam platform. Cookies are small data files stored on your device that help popwin operate the platform correctly and improve your experience.

8.2 popwin uses the following categories of Cookies:

• Strictly necessary Cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled.
• Functional Cookies: Enable personalized features such as remembering your preferred language, game lobby layout, and responsible gaming settings.
• Analytics Cookies: Used by popwin to understand how players interact with the platform — which pages are visited most, how long sessions last, and where navigation issues occur. This data is used in aggregate, anonymized form.
• Marketing Cookies: Set only where you have provided explicit consent, and used to deliver relevant promotional content to players who have opted in to marketing communications.

8.3 You may control non-essential Cookies through your browser settings. Note that disabling certain Cookies may affect the functionality of the popwin platform. popwin's Cookie preferences panel, accessible from the platform, allows you to manage your consent by category.

9. Data Retention

9.1 popwin retains your personal data for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, and reporting obligations. The following general retention periods apply:

• Active account data: Retained for the duration of your active account relationship with popwin
• Financial and transaction records: Retained for a minimum of five (5) years following account closure, as required by the Anti-Money Laundering Act and related AMLC regulations
• KYC / identity verification documents: Retained for a minimum of five (5) years following account closure or the last transaction date, whichever is later
• Customer support records: Retained for three (3) years from the date of the interaction
• Marketing consent records: Retained until consent is withdrawn and for a period thereafter sufficient to demonstrate compliance
• Self-exclusion records: Retained for the duration of the exclusion period and for five (5) years thereafter

9.2 Upon expiry of applicable retention periods, personal data will be securely deleted or anonymized so that it can no longer be associated with an individual data subject.

10. Data Security

10.1 popwin implements technical and organizational measures designed to protect your personal data against unauthorized access, disclosure, alteration, destruction, and accidental loss. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the popwin platform
• Encryption at rest for sensitive personal information stored in popwin's database infrastructure
• Tokenization of payment credentials — popwin does not store your full GCash number, Maya PIN, or bank account details in retrievable plain text
• Role-based access controls limiting staff access to personal data to those with a documented operational need
• Regular penetration testing and security audits by independent third-party security firms
• Intrusion detection and real-time monitoring of popwin's production systems
• Two-factor authentication requirements for all internal administrative systems that access player data

10.2 In the event of a personal data breach that is likely to result in risk to the rights and freedoms of affected data subjects, popwin will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, and will notify affected players as required under RA 10173 and NPC Circular No. 16-03.

11. Your Rights as a Data Subject

11.1 Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights with respect to your personal data held by popwin:

• Right to be Informed: You have the right to be notified about how popwin processes your personal data — which is the purpose of this Privacy Policy.
• Right to Access: You may request a copy of the personal data that popwin holds about you, including information on how that data is being used.
• Right to Rectification: You have the right to correct inaccurate or incomplete personal data in your popwin account. For basic account details, corrections can be made directly in your account settings. For KYC data, you must contact popwin support.
• Right to Erasure or Blocking: You may request deletion or blocking of your personal data where processing is unlawful, the data is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and there is no other legal basis for processing. Note that this right may be limited by popwin's legal obligations to retain certain data.
• Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests on grounds relating to your particular situation.
• Right to Data Portability: Where processing is based on your consent or a contract and is carried out by automated means, you may request your personal data in a structured, commonly used, and machine-readable format.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe popwin has violated your data privacy rights.

11.2 To exercise any of the above rights, please contact popwin's Data Protection Officer using the details in Section 15. popwin will respond to all verified data subject requests within fifteen (15) business days of receipt of a complete request. Where additional time is required to process a complex request, popwin will notify you within the initial 15-day period and provide an updated timeline.

11.3 popwin may require you to verify your identity before processing a data subject request, to protect against unauthorized access to another person's data.

12. Children's Privacy

12.1 popwin's platform is strictly for adults aged 21 years and over. popwin does not knowingly collect personal data from individuals under the age of 21. All registering players are required to confirm their age and complete identity verification prior to accessing real-money gaming services.

12.2 If popwin becomes aware that personal data has been collected from a person under the age of 21 through misrepresentation during registration, popwin will immediately close the account, delete the associated personal data (subject to any AML retention obligations), and refund any real-money balance to the verified identity of the adult account holder or legal guardian.

12.3 Parents or guardians who believe a minor may have accessed the popwin platform should contact popwin support immediately.

13. Cross-Border Data Transfers

13.1 In the course of delivering its services, popwin may transfer certain categories of personal data to third-party service providers operating in jurisdictions outside the Philippines — for example, cloud infrastructure providers or game studios with servers in other countries.

13.2 Where such transfers occur, popwin ensures that appropriate safeguards are in place to protect your personal data to a standard consistent with the Data Privacy Act of 2012. These safeguards include data processing agreements incorporating standard contractual clauses recognized by the NPC, assessments of the recipient jurisdiction's data protection framework, and technical security measures applied to transferred data.

13.3 By using the popwin platform and accepting this Privacy Policy, you acknowledge that your data may be processed in jurisdictions outside the Philippines as described in this section.

14. Amendments to This Privacy Policy

14.1 popwin may update this Privacy Policy from time to time to reflect changes in how we process personal data, changes in applicable law, or changes to the popwin platform's features and services.

14.2 Material changes to this Policy will be communicated to registered players via email notice and/or a prominent notice on the popwin.cam website at least seven (7) days before the revised Policy takes effect, except where immediate changes are required by law.

14.3 The most current version of this Policy is always accessible at popwin.cam/privacy-policy. The "Last Updated" date at the top of this document reflects the date of the most recent revision. Your continued use of the popwin platform following the effective date of any revised Policy constitutes your acceptance of the updated terms.

15. Contact & Data Protection Officer

15.1 If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or want to report a data privacy concern, please contact popwin's Data Protection Officer:

15.2 If you believe your data privacy rights have not been adequately addressed by popwin, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Philippines.