popwin Privacy Policy

popwin is committed to protecting the privacy and personal data of every player who uses our Platform. We understand that trust is the foundation of any relationship — and when it comes to your personal information, we take that responsibility seriously. This Privacy Policy has been prepared in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC).

This Policy describes the types of personal data we collect from you when you register, play, transact, or otherwise interact with the popwin Platform. It also explains how we use, store, share, and protect that data — and importantly, what rights you have over your own information. We encourage you to read this document in full alongside our Terms & Conditions.

popwin acts as the Personal Information Controller (as defined under RA 10173) with respect to the personal data you provide to us. Where we engage third-party service providers to process data on our behalf, those parties act as Personal Information Processors and are bound by strict contractual data protection obligations.

popwin collects personal data that is necessary to provide you with a safe, compliant, and enjoyable gaming experience. The categories of personal data we collect include:

popwin collects personal data through several channels, depending on how you interact with the Platform:

• Direct Submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in promotions.
• Automated Collection: Technical and usage data collected automatically when you access the Platform, including through cookies, web beacons, log files, and similar tracking technologies (see Section 7).
• Third-Party Sources: Data received from payment processors (e.g., GCash, PayMaya, BPI, BDO, Metrobank) to verify transactions; identity verification service providers for KYC purposes; and fraud prevention partners.
• Publicly Available Sources: In limited circumstances, popwin may supplement your profile with information from publicly available sources to fulfill our legal and regulatory obligations, such as sanctions screening.

popwin does not purchase personal data from data brokers or third-party marketing lists. All data we hold about you has been collected through one of the channels described above.

popwin uses your personal data only for legitimate, specified purposes. The primary ways we use your data include:

1. Account Management: Creating, maintaining, and securing your popwin account, including verifying your identity and age (21+ requirement) during registration and ongoing KYC checks.
2. Service Delivery: Enabling you to access and play games on the Platform, process your deposits and withdrawals in Philippine Peso (₱), and deliver the features and functionality you expect from popwin.
3. Regulatory Compliance: Meeting our obligations under applicable Philippine laws and regulations, including anti-money laundering (AML) requirements, responsible gaming mandates, and data privacy law.
4. Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, unauthorized account access, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
5. Responsible Gaming: Monitoring gameplay patterns to identify potential problem gambling behaviors and, where appropriate, applying responsible gaming interventions such as deposit limits or self-exclusion.
6. Customer Support: Responding to your inquiries, resolving disputes, and improving the quality of our support services based on interaction history.
7. Communications: Sending you transactional notifications (e.g., deposit confirmations, withdrawal updates), security alerts, and — where you have consented — promotional communications about popwin offers and new games.
8. Platform Improvement: Analyzing aggregated usage data to understand how players interact with the Platform, identify areas for improvement, and develop new features.

Under the Data Privacy Act of 2012, popwin processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform our contract with you — i.e., to provide the popwin gaming service, process transactions, and manage your account.
• Legal Obligation: Processing necessary to comply with applicable Philippine laws, including AML regulations, tax reporting requirements, and regulatory directives from relevant authorities.
• Legitimate Interests: Processing carried out for popwin's legitimate business interests — such as fraud prevention, platform security, and service improvement — where those interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for marketing communications and certain optional features. You may withdraw consent at any time without affecting the lawfulness of prior processing.

popwin does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your data only in the following circumstances:

• Service Providers: Trusted third-party vendors who assist in operating the Platform — including payment processors (GCash, PayMaya, BPI, BDO, Metrobank), KYC verification providers, cloud hosting services, and customer support platforms. All service providers are bound by data processing agreements that restrict their use of your data to the specific services they provide to popwin.
• Regulatory & Law Enforcement Authorities: Where required by Philippine law, court order, or regulatory directive, popwin may disclose personal data to government agencies, law enforcement bodies, or regulatory authorities. This includes disclosures required under AML legislation.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of popwin's business, your personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations.
• With Your Consent: In any other circumstances where you have given your explicit consent to the specific disclosure.

Where personal data is shared with service providers located outside the Philippines, popwin ensures that appropriate safeguards are in place — including contractual data protection clauses — to maintain a standard of protection equivalent to that required under RA 10173.

popwin uses cookies and similar tracking technologies to enhance your experience on the Platform, maintain session security, and gather analytics data. The types of cookies we use include:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled without affecting core functionality.
• Performance & Analytics Cookies: Used to collect aggregated, anonymized data about how players use the Platform — such as pages visited, time spent, and error reports. This data helps us improve the popwin experience.
• Functional Cookies: Remember your preferences — such as language settings and display options — to provide a more personalized experience on return visits.
• Marketing Cookies: Used only where you have consented, to deliver relevant promotional content about popwin games and offers. These cookies do not track your activity on third-party websites.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. popwin does not use cookies to track your activity outside of the popwin.app domain.

popwin retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Our general retention principles are as follows:

• Active Account Data: Retained for the duration of your account's active status plus a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements under Philippine law.
• Transaction Records: Financial transaction records are retained for a minimum of five (5) years from the date of the transaction, as required by applicable financial regulations.
• KYC & Verification Documents: Retained for the period required by applicable AML and regulatory obligations, typically five (5) years from the end of the business relationship.
• Support Communications: Retained for up to three (3) years from the date of the last interaction, to support dispute resolution and service quality review.
• Marketing Consent Records: Retained for the duration of your consent plus a reasonable period thereafter to demonstrate compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with popwin's data disposal procedures. Where data is anonymized, it may be retained indefinitely for analytical purposes as it can no longer be linked to any individual.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by popwin. You may exercise any of these rights by contacting us using the details in Section 14.

popwin will respond to all verified data rights requests within thirty (30) calendar days of receipt. In complex cases, this period may be extended by a further thirty (30) days, in which case we will notify you of the extension and the reason for it. We may need to verify your identity before processing your request.

popwin implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the popwin Platform is encrypted using industry-standard TLS protocols.
• Encryption at Rest: Sensitive personal and financial data stored on popwin servers is encrypted at rest using AES-256 encryption.
• Access Controls: Strict role-based access controls ensure that only authorized popwin personnel can access personal data, and only to the extent required for their specific job function.
• Two-Factor Authentication (2FA): Available to all players and mandatory for administrative access to popwin systems.
• Regular Security Audits: popwin conducts periodic security assessments, penetration testing, and vulnerability scans to identify and remediate potential weaknesses.
• Data Breach Response: popwin maintains a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify you and the National Privacy Commission within the timeframes required by RA 10173.

The popwin Platform is strictly intended for adults aged 21 years and above, in accordance with Philippine gambling regulations. popwin does not knowingly collect personal data from any person under the age of 21.

If popwin becomes aware that personal data has been collected from a person under 21 — whether through misrepresentation during registration or any other means — we will immediately suspend the relevant account, delete the associated personal data, and take appropriate action in accordance with our Terms & Conditions and applicable law.

If you are a parent or guardian and believe that a minor has registered on the popwin Platform, please contact us immediately using the details in Section 14 so that we can investigate and take prompt action.

The popwin Platform may contain links to third-party websites or services — for example, payment provider portals or regulatory information pages. These third-party sites operate independently of popwin and have their own privacy policies, which we encourage you to review before providing any personal data to them.

popwin is not responsible for the privacy practices, content, or security of any third-party websites. The inclusion of a link to a third-party site does not constitute an endorsement of that site or its privacy practices by popwin.

popwin may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, we will notify registered players via email or a prominent notice on the Platform prior to the changes taking effect. The updated Policy will be posted on this page with a revised "Last Updated" date.

We encourage you to review this Privacy Policy periodically to stay informed about how popwin protects your personal data. Your continued use of the Platform after the effective date of any updated Policy constitutes your acknowledgment of the changes.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way popwin handles your personal data, please contact our Data Protection Officer (DPO) or support team using the details below. We are committed to addressing all privacy-related inquiries promptly and transparently.

Data Protection Officer: [email protected]
General Support: [email protected]
Live Chat: Available 24/7 within the popwin Platform
Website: popwin.app