phwi Privacy Policy

1 Who We Are

phwi ("phwi," "we," "us," "our") is the operator of the online gaming platform accessible at phwi.one, serving players in the Philippines market. phwi provides JILI slots, live casino games via Vivo Live, bingo rooms, crash games, sports betting, and fishing games, all transacted in Philippine Peso (PHP) through GCash, PayMaya, and Philippine bank transfers.

phwi operates under the PAGCOR regulatory framework in the Philippines. In the context of this Privacy Policy, phwi acts as the Personal Information Controller (PIC) as defined under the Data Privacy Act of 2012 — meaning we determine the purposes and means of processing your personal data.

Our designated Data Protection Officer (DPO) can be contacted at the email address listed in Section 14 of this Policy. The DPO oversees phwi's compliance with the Data Privacy Act of 2012, the National Privacy Commission's issuances, and this Privacy Policy.

2 Personal Data We Collect

phwi collects several categories of personal data in the course of providing and operating the phwi platform. The specific data collected depends on how you interact with phwi and the stage of your account lifecycle.

3 How We Collect Your Data

phwi collects personal data through the following methods:

3.1 Direct Collection

Data you provide directly to phwi during account registration, KYC verification, payment setup, support interactions, and responsible gaming tool configuration. This includes all form inputs, document uploads, and live chat communications initiated by you.

3.2 Automated Collection

Data collected automatically when you access and use the phwi platform, including through server logs, session cookies, local storage, and browser fingerprinting technologies. Automated collection begins as soon as you load any page of the phwi website, whether or not you are logged in.

3.3 Third-Party Sources

phwi may receive data about you from third-party sources in limited and specific circumstances, including:

• Payment providers (GCash, PayMaya, BPI, BDO, Metrobank) — transaction confirmation data, payment reference numbers, and account name details necessary to match your deposit or withdrawal to your phwi account.
• Game providers (JILI Games, Pragmatic Play, PG Soft, Vivo Gaming, and others) — game round results, bet and win records, and RNG outcome logs that phwi reconciles with its own platform records for integrity and dispute resolution purposes.
• Fraud and AML screening services — watchlist status information where phwi is required to screen players against government-issued sanctions lists or PAGCOR exclusion registers.

4 Why We Use Your Personal Data

phwi processes your personal data for the following specific purposes. We do not process personal data for any purpose that is incompatible with the purposes listed below without first obtaining your separate consent.

4.1 Account Management

To register and maintain your phwi account, authenticate your identity at login, communicate account status changes, reset credentials, and manage account closure requests. This processing is necessary for the performance of our contract with you.

4.2 Payment Processing

To process deposits from and withdrawals to your registered Philippine payment methods (GCash, PayMaya, BPI, BDO, Metrobank), reconcile transaction records, investigate disputed transactions, and maintain complete financial audit records in PHP. This processing is necessary for contract performance and legal compliance.

4.3 KYC and Age Verification

To verify your identity, confirm that you meet the minimum age requirement of 21 years under the PAGCOR regulatory framework, and ensure that you are the genuine holder of the government-issued Philippine ID you have submitted. This processing is required by law and by PAGCOR compliance obligations.

4.4 Anti-Money Laundering Compliance

To monitor transactions for patterns indicative of money laundering or terrorist financing in accordance with the Anti-Money Laundering Act of the Philippines (Republic Act No. 9160, as amended), to file Suspicious Transaction Reports (STRs) and Covered Transaction Reports (CTRs) with the Anti-Money Laundering Council (AMLC) where required, and to screen players against applicable sanctions lists. This processing is required by law.

4.5 Responsible Gaming

To provide, maintain, and enforce responsible gaming tools including deposit limits, session reminders, cooling-off periods, and self-exclusion. To monitor gaming behaviour for indicators of potential problem gambling and to take appropriate protective action where necessary. This processing is in phwi's and your legitimate interest, and is required under PAGCOR's responsible gaming framework.

4.6 Platform Operation and Improvement

To operate, maintain, troubleshoot, and improve the phwi platform, including game lobby performance optimisation, payment flow improvement, mobile browser compatibility testing, and fraud detection system refinement. This processing is based on phwi's legitimate interest in maintaining a functional and secure platform.

4.7 Customer Support

To provide customer support, investigate and resolve complaints, respond to account queries, and maintain records of support interactions for quality assurance and training purposes. This processing is necessary for contract performance.

4.8 Legal and Regulatory Compliance

To comply with all applicable Philippine law and PAGCOR regulatory requirements, to respond to lawful requests from government authorities (including the NPC, AMLC, and BIR), and to defend phwi's legal position in any dispute or regulatory proceeding. This processing is required by law.

5 Legal Basis for Processing

Under the Data Privacy Act of 2012, phwi processes your personal data on the following legal bases:

• Contractual necessity — processing required to perform our contract with you as a phwi account holder, including account management, payments, and game delivery.
• Legal obligation — processing required to comply with Philippine law, including the Anti-Money Laundering Act, the PAGCOR regulatory framework, the Tax Code, and NPC regulations.
• Legitimate interests — processing for phwi's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and business analytics, provided those interests are not overridden by your rights and freedoms.
• Consent — processing for purposes that are not covered by the above bases, such as optional marketing communications, where phwi will seek and rely on your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Sharing Your Personal Data

phwi does not sell, rent, or trade your personal data to any third party for commercial marketing purposes. We share personal data only in the following circumstances and only to the extent necessary for the stated purpose:

6.1 Game Providers

phwi shares your account identifier (a pseudonymised player ID, not your full name or ID details) with game providers including JILI Games, Pragmatic Play, PG Soft, Fachai, and Vivo Gaming to facilitate game session initiation, round result reconciliation, and progressive jackpot eligibility checks. Game providers are contractually bound to use this data only for the purpose of delivering the game service to phwi and are prohibited from using it for their own commercial purposes.

6.2 Payment Processors

phwi shares the minimum personal data required to process your deposit or withdrawal with GCash, PayMaya, BPI, BDO, and Metrobank. This typically includes your registered account name, transaction amount in PHP, and a phwi-generated transaction reference number. Payment processors operate under their own privacy policies and Philippine BSP regulations.

6.3 Regulatory and Law Enforcement Authorities

phwi will disclose personal data to PAGCOR, the AMLC, the National Privacy Commission, the Bureau of Internal Revenue, the Philippine National Police, the National Bureau of Investigation, or any other competent Philippine government authority where disclosure is required by law, by court order, or by a lawful regulatory directive. phwi will, where legally permitted to do so, notify affected players of such disclosures.

6.4 Service Providers

phwi engages third-party service providers to assist with platform hosting, data analytics, fraud detection, identity verification, and customer support systems. These service providers act as Personal Information Processors (PIPs) and process your data solely on phwi's instructions under binding data processing agreements that require equivalent data protection standards. Service providers are not permitted to use your data for their own purposes.

7 Data Retention

phwi retains your personal data for as long as your phwi account remains open and for a defined period following account closure, in accordance with the following retention schedule:

Following the expiry of the applicable retention period, phwi will securely delete or anonymise your personal data so that it can no longer be attributed to you. Where anonymisation is not technically feasible within a system's architecture, phwi will apply access controls that effectively render the data inaccessible to operational staff.

8 Cookies & Tracking Technologies

The phwi platform uses cookies and similar tracking technologies (including local storage and session storage) to operate core platform functions and to improve the user experience. phwi does not use third-party advertising cookies or cross-site tracking technologies.

8.1 Essential Cookies

These cookies are strictly necessary for the phwi platform to function. They manage your login session, maintain your PHP wallet session state, and ensure that responsible gaming settings (such as session reminders) operate correctly during your visit. Essential cookies cannot be disabled without breaking core platform functionality.

8.2 Analytics Cookies

phwi uses first-party analytics to understand how players navigate the platform, which games attract the most engagement, and where technical issues may be occurring. Analytics data is aggregated and pseudonymised. phwi does not share analytics data with third-party advertising networks.

8.3 Preference Cookies

These cookies remember your platform preferences — such as language settings, lobby layout, and notification preferences — so you do not need to reset them on each visit.

You can manage cookie preferences through your browser settings. Note that disabling essential cookies will impair your ability to log in and use the phwi platform. Disabling analytics or preference cookies will not prevent you from using core platform features but will result in a less personalised experience.

9 Data Security

phwi implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, without limitation:

• Transport encryption: All data transmitted between your browser or device and the phwi platform is encrypted using TLS (Transport Layer Security) 1.2 or higher. This applies to all pages of the phwi website, including login, registration, deposit, and withdrawal flows.
• Data at rest encryption: Sensitive personal data stored in phwi's databases, including KYC documents and financial records, is encrypted at rest using industry-standard encryption algorithms.
• Access controls: phwi applies role-based access controls to all systems containing personal data. Access to KYC documents and financial records is restricted to staff with a demonstrable operational need and is logged for audit purposes.
• Multi-factor authentication: phwi's internal operational systems require multi-factor authentication for all staff. phwi strongly recommends that players enable SMS OTP verification on their phwi accounts.
• Incident response: phwi maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, phwi will notify the National Privacy Commission within 72 hours of discovery and will notify affected individuals without undue delay, in accordance with NPC Circular No. 16-03.

10 Your Data Privacy Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phwi. To exercise any of these rights, please contact phwi's Data Protection Officer at the contact details in Section 14. phwi will respond to verified rights requests within thirty (30) calendar days.

Please note that some rights are subject to limitations under applicable law. For example, phwi cannot delete data that it is legally required to retain under the Anti-Money Laundering Act or PAGCOR regulations, regardless of a deletion request. phwi will explain any applicable limitations clearly when responding to your request.

11 Children's Privacy and the 21+ Requirement

The phwi platform is strictly restricted to persons who are 21 years of age or older. phwi does not knowingly collect personal data from any individual under the age of 21. Age verification is a mandatory component of the phwi KYC process, and accounts that cannot be verified as belonging to a person of at least 21 years of age will not be permitted to deposit or withdraw.

If phwi becomes aware that personal data has been collected from an individual who is under 21 years of age, phwi will immediately close the relevant account, delete the personal data collected to the extent permitted by applicable law (noting that some records may need to be retained for regulatory reporting), and report the matter to PAGCOR as required.

If you are a parent or guardian and you believe that a minor has registered an account on the phwi platform using false age information, please contact our support team immediately via live chat. phwi will investigate and take appropriate action without delay.

12 Cross-Border Data Transfers

The phwi platform and its primary data infrastructure are operated with the Philippines as the principal jurisdiction. However, some of phwi's service providers and game provider partners are located outside the Philippines, and phwi may transfer certain categories of personal data to these parties in the course of providing the platform service.

Where phwi transfers personal data outside the Philippines, it does so only where:

• the recipient country provides an adequate level of protection for personal data as recognised by the National Privacy Commission; or
• phwi has entered into contractual arrangements with the recipient that impose data protection obligations equivalent to those required under Philippine law; or
• the transfer is necessary for the performance of a contract between you and phwi (e.g., transferring your pseudonymised player ID to an overseas game provider to deliver a game session you have initiated).

phwi does not transfer your government-issued ID images, selfie photographs, or bank account details to parties outside the Philippines except where required by Philippine law (e.g., AMLC international cooperation requests) or where you have given explicit consent.

13 Changes to This Privacy Policy

phwi may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, NPC guidance, or PAGCOR regulatory requirements. When changes are material — meaning they affect the purposes for which we process your data, the types of data we collect, or your rights — phwi will provide advance notice via the contact details on your registered phwi account, or via a prominent notice on the phwi website, no less than seven (7) calendar days before the changes take effect.

For non-material changes (such as formatting corrections, clarifications that do not alter the substance of the Policy, or updates to contact details), phwi will update the "Effective Date" at the top of this page and post the revised Policy without separate notification.

The current version of the phwi Privacy Policy is always available at phwi.one/privacy-policy. We encourage you to review this page periodically. Your continued use of the phwi platform after the effective date of any revised Policy constitutes your acceptance of the revised terms.

14 Contact Us & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or to phwi's handling of your personal data, please contact phwi through the following channels:

• Live Chat Support: Available 24/7 from within your phwi account dashboard — the fastest channel for account-specific queries.
• Data Protection Officer: [email protected] — for formal data subject rights requests, privacy complaints, and DPA compliance queries. Please include "Data Privacy Request" in your subject line.

phwi will acknowledge receipt of all formal data subject rights requests within five (5) business days and will provide a substantive response within thirty (30) calendar days of receipt, or within such shorter period as may be required by NPC regulations.

If you are not satisfied with phwi's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. Information on how to file a complaint with the NPC is available on the NPC's official website.