Privacy Policy
winluck – Your Data, Protected

1.1 winluck is an online gaming platform licensed and regulated by the Philippine Amusement and Gaming Corporation (PAGCOR). We operate winluck.vip and all associated sub-domains, mobile-optimized interfaces, and related digital services offered to Filipino players across the Philippines.

1.2 This Privacy Policy applies to all personal data collected from or about: registered Members of the winluck platform; unregistered visitors who browse winluck.vip; individuals who contact winluck support; and any other person whose personal data is processed by winluck in connection with the operation of its platform.

1.3 This Policy should be read in conjunction with the winluck Terms & Conditions and the Responsible Gaming Policy. In the event of conflict between this Policy and the Terms & Conditions in respect of data privacy matters, this Privacy Policy prevails.

1.4 winluck is committed to the principles of transparency, legitimate purpose, and proportionality in data processing, as mandated by the Data Privacy Act of 2012. We process personal data only for declared, lawful, and proportionate purposes.

2.1 For the purposes of the Data Privacy Act of 2012, winluck acts as the Personal Information Controller (PIC) in respect of the personal data collected and processed through the winluck platform.

2.2 winluck has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with the Data Privacy Act and this Policy, and who serves as the primary point of contact for data subject rights requests and National Privacy Commission correspondence. Contact details for the winluck DPO are provided in Section 15 of this Policy.

2.3 Where winluck engages third-party service providers to process personal data on its behalf (for example, KYC verification providers, payment processors, or IT infrastructure providers), those parties act as Personal Information Processors (PIPs) under binding data processing agreements that impose obligations consistent with the Data Privacy Act.

3.1 winluck collects and processes the following categories of personal data in connection with its platform operations:

3.2 winluck does not intentionally collect sensitive personal information as defined by the Data Privacy Act (such as health data, religious beliefs, or political affiliations) except where specifically required by applicable law or regulation. Where such data is incidentally disclosed by a Member, winluck will handle it with the heightened protection afforded to sensitive personal information under the Act.

winluck collects personal data through the following channels and mechanisms:

• Direct Registration: Information provided by you when creating your winluck account, including name, mobile number, date of birth, and residential address.
• KYC Document Submission: Copies of government-issued Philippine identification documents submitted during the identity verification process.
• Payment Transactions: Information shared by you and your payment provider (GCash, Maya, BPI, BDO, Metrobank, InstaPay) during deposit and withdrawal processing.
• Customer Support Interactions: Communications via live chat, email, and any other support channel you use to contact winluck.
• Automated Platform Collection: Technical and behavioral data collected automatically when you access and use the winluck platform, including through cookies, log files, and session tracking technologies.
• Third-Party Verification Providers: Identity and fraud screening data received from licensed KYC and AML verification service providers used by winluck to fulfill its compliance obligations.
• Responsible Gaming Disclosures: Information you voluntarily provide when setting responsible gaming limits, requesting self-exclusion, or communicating with winluck's responsible gaming support team.

winluck processes personal data on the following legal bases as recognized under the Data Privacy Act of 2012:

6.1 winluck uses the personal data it collects for the following declared purposes:

• Account Creation and Management: Creating and maintaining your winluck account, verifying your identity, and managing your account preferences and settings.
• Payment Processing: Processing deposits, withdrawals, and refunds to and from your registered Philippine payment methods.
• PAGCOR and AML Compliance: Fulfilling winluck's obligations under PAGCOR regulations and Philippine AML laws, including player activity reporting and suspicious transaction monitoring.
• Platform Security and Fraud Prevention: Detecting, investigating, and preventing unauthorized account access, fraudulent transactions, and prohibited activities.
• Customer Support: Responding to your support inquiries, resolving disputes, and maintaining records of support interactions.
• Responsible Gaming: Monitoring gaming patterns to identify potential problem gambling indicators and administering responsible gaming tools including deposit limits and self-exclusion.
• Platform Improvement: Analyzing aggregated usage data to improve the winluck platform's performance, features, and user experience.
• Marketing Communications (Consent-Based): Sending you promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications.

6.2 winluck does not use personal data for automated decision-making that produces legal or similarly significant effects without human review, except where expressly permitted by the Data Privacy Act and applicable PAGCOR regulations.

7.1 Service Providers (Personal Information Processors). winluck shares personal data with carefully selected third-party service providers who process data on winluck's behalf under binding agreements. These include:

• KYC and identity verification service providers;
• Payment processors and e-wallet providers (GCash, Maya, BPI, BDO, Metrobank, InstaPay);
• IT infrastructure and cloud hosting providers;
• Fraud detection and AML screening providers;
• Customer support software providers;
• Game content providers whose games are hosted on the winluck platform.

7.2 Regulatory and Legal Authorities. winluck discloses personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities where required by law, court order, or valid legal process. winluck will, where legally permitted, notify affected Members of such disclosures.

7.3 Business Transfers. In the event of a merger, acquisition, or sale of substantially all of winluck's assets, personal data may be transferred to the acquiring entity, subject to that entity assuming the obligations of this Privacy Policy. winluck will notify affected Members via registered email at least 30 days before any such transfer takes effect.

7.4 With Your Consent. winluck may share personal data with additional third parties where you have given explicit prior consent for such sharing.

8.1 winluck uses cookies, web beacons, pixel tags, and similar tracking technologies on the winluck.vip platform to enable core platform functionality, maintain login sessions, and collect analytics data. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the platform to function. These include session cookies that maintain your login state and security tokens. These cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your preferences such as language, game lobby layout, and notification settings to personalize your winluck experience.
• Analytics Cookies: Collect aggregated data about how Members use the platform, which pages are visited most frequently, and how performance can be improved. winluck uses this data internally and does not share individual-level analytics data with third parties.
• Security Cookies: Support fraud detection by identifying unusual patterns of platform access and flagging suspicious session behavior for review.

8.2 You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair or prevent your ability to use the winluck platform. winluck does not use third-party advertising cookies or allow external advertisers to track Members through the platform.

9.1 winluck retains personal data for as long as is necessary to fulfill the purposes for which it was collected, to comply with applicable Philippine laws and PAGCOR regulations, and to protect winluck's legitimate legal interests. The following general retention periods apply:

9.2 Upon expiry of the applicable retention period, winluck will securely delete or irreversibly anonymize the relevant personal data in accordance with its data destruction procedures. Anonymized data that can no longer identify any individual is not subject to this Policy.

10.1 winluck implements a comprehensive set of technical, administrative, and physical security measures to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption: All data in transit is encrypted using TLS 1.3. All sensitive data at rest (including identity documents and financial records) is encrypted using AES-256.
• Access Controls: Access to personal data is restricted to authorized winluck personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication on internal systems.
• Network Security: The winluck platform is protected by enterprise-grade firewalls, intrusion detection and prevention systems, and regular third-party penetration testing.
• Data Minimization: Personal data displayed within the winluck platform (such as payment method details) is masked to show only the minimum necessary information.
• Vendor Security: All third-party processors engaged by winluck are subject to security due diligence and contractual security obligations consistent with the Data Privacy Act.
• Staff Training: All winluck personnel with access to personal data receive mandatory data privacy training on appointment and annually thereafter.

10.2 While winluck employs industry-standard security measures, no online platform can guarantee absolute security. winluck encourages all Members to use strong, unique passwords for their winluck account and to enable two-factor authentication to reduce the risk of unauthorized account access.

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by winluck:

11.1 To exercise any of the above rights, submit a written request to winluck's Data Protection Officer at the contact details provided in Section 15. winluck will acknowledge your request within 5 business days and provide a substantive response within 15 business days. Complex requests may require up to 30 business days with prior notification of the extension.

11.2 winluck will require identity verification before processing any data subject rights request to protect against unauthorized disclosure of personal data.

11.3 Exercising your rights under this section will not result in any penalty, discrimination, or change to your winluck account standing.

12.1 The winluck platform is strictly intended for persons aged 21 years and above, in accordance with PAGCOR minimum gambling age requirements. winluck does not knowingly collect or process personal data from individuals under the age of 21.

12.2 winluck employs age verification procedures during account registration to enforce the 21+ requirement. Where winluck becomes aware that personal data has been collected from a person under 21, that account will be immediately closed, all data associated with the account will be deleted (subject to any overriding legal retention obligations), and any deposited funds will be returned to the originating payment method.

12.3 Parents and guardians who believe their child may have accessed the winluck platform are encouraged to contact winluck immediately via the support channels listed in Section 15. winluck will investigate and respond within 2 business days.

13.1 winluck's primary data processing operations are located within the Philippines. Certain third-party service providers engaged by winluck (such as global cloud infrastructure providers or international game content providers) may process personal data in servers located outside the Philippines.

13.2 Where personal data is transferred outside the Philippines, winluck ensures that such transfers are made only to recipients in countries that provide an adequate level of data protection, or under binding contractual protections (such as standard contractual clauses) that require the recipient to apply protection standards consistent with the Data Privacy Act of 2012.

13.3 winluck maintains a record of all cross-border data transfers and the safeguards applied to each, which is available to the National Privacy Commission upon request.

14.1 winluck reserves the right to update or revise this Privacy Policy at any time to reflect changes in applicable law, PAGCOR regulations, winluck's data processing practices, or the structure of the winluck platform.

14.2 Material changes to this Policy — those that significantly affect Members' rights or the nature of data processing — will be communicated to Members via registered email and an in-platform notification at least 14 days before the changes take effect.

14.3 Non-material changes (such as typographical corrections, clarifications of existing practices, or contact detail updates) may be made without advance notice. The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision.

14.4 Continued use of the winluck platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you may close your account in accordance with the winluck Terms & Conditions.

For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data by winluck, please contact our Data Protection Officer through the following channels:

Response times: acknowledgment within 5 business days; substantive response within 15 business days; complex matters within 30 business days with advance notification. All formal privacy notices and data subject rights requests must be submitted in writing via the email above.