Privacy Policy — winmaya Online Casino

1. Introduction

winmaya ("winmaya," "we," "us," or "our") operates the online gaming platform accessible at winmaya.bio ("Platform"). As a data controller, winmaya is responsible for the personal data of registered users ("Players," "you") collected through the Platform.

This Privacy Policy is issued in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines. winmaya also processes data in connection with its obligations under the Anti-Money Laundering Act (Republic Act No. 9160, as amended) and the requirements of the Philippine Amusement and Gaming Corporation (PAGCOR).

By accessing and using the winmaya Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not consent to the data practices described herein, please do not register for or use the Platform. This Policy should be read together with winmaya's Terms & Conditions.

2. Personal Data We Collect

2.1 Registration Data

When you create a winmaya account, we collect: full legal name, date of birth, email address, mobile phone number, residential address, and the preferred username you choose. This information is required to open and maintain your account in compliance with PAGCOR licensing requirements.

2.2 Identity Verification (KYC) Data

In compliance with PAGCOR requirements and anti-money laundering obligations, winmaya collects copies of government-issued identification documents (e.g., Philippine passport, PhilSys National ID, UMID, SSS ID, driver's license), proof of address documentation, and — for high-value transactions — source of funds declarations. This data is collected once and retained for the minimum period required by law.

2.3 Financial Data

winmaya collects data relating to your deposits and withdrawals, including payment method identifiers (e.g., registered GCash mobile number, PayMaya account name, bank account name and partial number), transaction amounts, timestamps, and transaction reference numbers. winmaya does not store full payment card numbers or full bank account numbers on its servers.

2.4 Gaming Activity Data

We record your gaming history on the Platform, including games played, wager amounts, win/loss outcomes, session durations, bonus credits claimed and wagered, and jackpot wins. This data is used for regulatory reporting, dispute resolution, responsible gaming monitoring, and platform improvement.

2.5 Technical & Device Data

winmaya automatically collects technical data when you access the Platform: IP address, device type and operating system, browser type and version, screen resolution, referring URL, pages visited within the Platform, session duration, and clickstream data. This data is used to optimize Platform performance and detect security anomalies.

2.6 Communications Data

If you contact winmaya's customer support via live chat, email, Messenger, or Viber, we retain records of those communications for quality assurance, dispute resolution, and compliance purposes.

3. How We Use Your Personal Data

winmaya uses personal data collected from Players for the following purposes:

• Account creation and management: To open, maintain, verify, and administer your winmaya account;
• Identity and age verification: To confirm that you meet the 21+ age requirement mandated by PAGCOR and to verify your identity for KYC compliance;
• Transaction processing: To process deposits, withdrawals, and bonus credits accurately and in accordance with your instructions;
• Regulatory compliance: To meet winmaya's obligations under PAGCOR regulations, the Anti-Money Laundering Act, and other applicable Philippine laws, including mandatory reporting of suspicious transactions to the AMLC;
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, money laundering, bonus abuse, and other prohibited conduct;
• Responsible gaming: To monitor gaming patterns, identify potentially problematic gambling behaviour, and deliver responsible gaming interventions where appropriate;
• Customer support: To respond to your enquiries, resolve disputes, and provide technical assistance;
• Platform improvement: To analyse usage patterns and technical performance data in order to improve the Platform's functionality, user experience, and game offerings;
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates, where you have provided consent or where we have a legitimate interest. You may opt out of marketing communications at any time via your account settings or by contacting support.

4. Legal Basis for Processing

Under the Data Privacy Act of 2012, winmaya processes personal data on the following legal bases:

• Contractual necessity: Processing required to perform the gaming services contract you entered into by registering on the Platform;
• Legal obligation: Processing required to comply with PAGCOR regulations, the Anti-Money Laundering Act, the Data Privacy Act, and other applicable Philippine law;
• Legitimate interests: Processing for fraud prevention, Platform security, and responsible gaming monitoring, balanced against your privacy rights;
• Consent: Processing for direct marketing purposes and for the use of non-essential cookies, where your explicit consent has been obtained and may be withdrawn at any time.

5. Data Sharing & Disclosure

winmaya does not sell, rent, or trade your personal data to third parties for their own commercial purposes. winmaya may share your data in the following limited circumstances:

5.1 Service Providers

winmaya engages third-party service providers who process personal data on winmaya's behalf under strict data processing agreements, including: payment processing providers (GCash/Maya, BPI, BDO, Metrobank), identity verification and KYC service providers, game software providers, cloud hosting and data centre operators, customer support platform providers, and cybersecurity and fraud detection services.

5.2 Regulatory and Law Enforcement Authorities

winmaya is legally required to disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other Philippine government agencies or law enforcement authorities upon valid legal demand or where winmaya reasonably believes disclosure is required to comply with applicable law.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of winmaya's assets, personal data held by winmaya may be transferred to the acquiring or successor entity, subject to the same privacy protections as described in this Policy.

6. Cookies & Tracking Technologies

The winmaya Platform uses cookies and similar tracking technologies to deliver and improve Platform services. The categories of cookies used are:

• Strictly necessary cookies: Required for the Platform to function, including session authentication and security tokens. Cannot be disabled;
• Performance and analytics cookies: Collect anonymised data about how Players navigate the Platform to help winmaya optimise performance and user experience;
• Functional cookies: Remember your preferences such as language settings and display options;
• Marketing cookies: Used to deliver relevant promotional content. Only placed with your explicit consent.

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair Platform functionality and may prevent you from logging in to your winmaya account.

7. Data Retention

winmaya retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to the following retention schedule:

• Account and KYC data: Retained for the duration of your active account plus a minimum of five (5) years after account closure, as required by the Anti-Money Laundering Act and PAGCOR regulations;
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction in accordance with AMLC requirements;
• Gaming activity logs: Retained for a minimum of three (3) years from the date of each gaming session;
• Customer support communications: Retained for two (2) years from the date of the last interaction;
• Marketing consent records: Retained until consent is withdrawn and for a period sufficient to demonstrate compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with NPC-approved disposal procedures.

8. Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal data processed by winmaya:

• Right to be informed: The right to be notified of the data processing activities winmaya conducts in relation to your personal data — as fulfilled by this Privacy Policy;
• Right of access: The right to request a copy of the personal data winmaya holds about you;
• Right to rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to erasure: The right to request deletion of your personal data, subject to winmaya's legal retention obligations;
• Right to object: The right to object to processing based on legitimate interests or for direct marketing purposes;
• Right to data portability: The right to receive your personal data in a structured, machine-readable format;
• Right to withdraw consent: Where processing is based on consent, the right to withdraw consent at any time without affecting the lawfulness of prior processing;
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated.

To exercise any of the above rights, please contact winmaya's Data Protection Officer at the details in Section 13. winmaya will respond to verified data subject requests within fifteen (15) business days of receipt.

9. Data Security

winmaya implements technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction, including:

• 256-bit SSL/TLS encryption for all data transmitted between your device and winmaya's servers;
• Encryption of sensitive data at rest in winmaya's databases;
• Two-factor authentication (2FA) available to all account holders;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Regular security audits and penetration testing of the Platform;
• Incident response procedures meeting the NPC's 72-hour breach notification requirement.

While winmaya employs industry-standard safeguards, no data transmission over the internet or storage system can be guaranteed to be 100% secure. You are responsible for maintaining the security of your winmaya account credentials.

10. Children's Privacy

11. Cross-Border Data Transfers

Certain winmaya service providers — including cloud infrastructure, game software providers, and security vendors — may be located outside the Philippines. Where personal data is transferred internationally, winmaya ensures that such transfers are subject to appropriate safeguards consistent with the Data Privacy Act, including data processing agreements containing standard contractual clauses approved by the National Privacy Commission or equivalent protections.

winmaya does not transfer your personal data to jurisdictions that do not provide adequate data protection without first obtaining your explicit consent or implementing appropriate contractual safeguards.

12. Changes to This Privacy Policy

winmaya may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or operational structure. Material changes will be communicated to registered Players via email to the address on file and/or by a prominent notice on the Platform prior to the changes taking effect. The effective date displayed at the top of this Policy indicates when the current version was last updated.

Your continued use of the winmaya Platform following notification of material changes constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised Policy, you should cease using the Platform and contact support to request account closure.

13. Contact & Data Protection Officer

For all data privacy enquiries, requests to exercise your data subject rights, or to contact winmaya's designated Data Protection Officer (DPO), please reach out through the following channels:

For complaints that remain unresolved after contacting winmaya's DPO, you have the right to file a complaint with the National Privacy Commission of the Philippines. Information on how to file an NPC complaint is available on the NPC's official website.