Privacy Policy — How wtfwin Collects, Uses, and Protects Your Personal Data

Who We Are — The Data Controller

1.1 Identity. This Privacy Policy is issued by wtfwin, the operator of the online gaming platform accessible at wtfwin.cam ("wtfwin", "we", "us", or "our"). wtfwin operates as a licensed online gaming platform under the oversight of the Philippine Amusement and Gaming Corporation (PAGCOR).

1.2 Data Controller Role. For the purposes of the Data Privacy Act of 2012 (Republic Act 10173) and its Implementing Rules and Regulations, wtfwin acts as the Personal Information Controller with respect to the personal data of its registered Members and platform visitors. This means wtfwin determines the purposes and means by which your personal data is processed.

1.3 Data Protection Officer. wtfwin has designated a Data Protection Officer (DPO) responsible for overseeing compliance with RA 10173 and this Privacy Policy. The DPO may be contacted via the support email address listed in Section 15 of this Policy or via the live chat function on the wtfwin platform.

1.4 Scope. This Privacy Policy applies to all personal data processed by wtfwin in connection with your use of the platform, including data collected during registration, account management, gaming activity, financial transactions, customer support interactions, and platform visits. It applies to both registered Members and unregistered visitors to the website.

Personal Data We Collect

wtfwin collects personal data that falls into the following categories. The specific data collected from you will depend on how you interact with the platform and the services you use.

2.1 Registration and Identity Data

When you register a wtfwin account, we collect the information you provide directly, including:

• Full legal name as it appears on a government-issued identification document;
• Date of birth (for age verification — minimum 21 years under PAGCOR regulations);
• Philippine mobile number (used as a primary identifier and for OTP authentication);
• Email address;
• Residential address in the Philippines;
• Username and encrypted password;
• Gender (optional, for preference personalization).

2.2 KYC and Identity Verification Data

Prior to activating withdrawal privileges, wtfwin is required by PAGCOR and anti-money laundering regulations to verify your identity. This requires collection of:

• Government-issued identification documents (PhilSys National ID, UMID, driver's license, or Philippine passport);
• Selfie or live facial verification image;
• Proof of payment method ownership where applicable (e.g., screenshot of GCash account in your name);
• Source of funds declaration for higher-value accounts as required by AMLC guidelines.

2.3 Financial Transaction Data

We record data related to all financial transactions on the platform, including:

• Deposit amounts, timestamps, and payment method references (GCash, Maya, BPI, BDO, etc.);
• Withdrawal requests, amounts, destinations, and processing records;
• Bonus credits and promotional fund allocations;
• Transaction identifiers and payment gateway reference numbers.

2.4 Gaming and Behavioural Data

• Game sessions played, wagers placed, wins and losses;
• Game preferences and category engagement patterns;
• Session durations, login timestamps, and activity logs;
• Responsible gaming tool usage (deposit limits set, session reminders activated, self-exclusion requests).

2.5 Technical and Device Data

• IP address at time of login and registration;
• Device type, operating system, and browser/app version;
• Geolocation data (country/region level, derived from IP address);
• Cookie and tracking data as described in Section 6.

2.6 Customer Support Data

Records of all communications between you and the wtfwin support team — including live chat transcripts, email correspondence, and any attachments — are retained to facilitate ongoing support and for quality assurance and dispute resolution purposes.

How We Collect Your Data

3.1 Directly From You. The majority of personal data wtfwin holds about you is provided directly by you — through the registration form, KYC document uploads, financial transactions, support communications, and your interactions with account settings and gaming features.

3.2 Automatically During Platform Use. When you access wtfwin through a browser or the mobile app, we automatically collect technical data about your device and session through server logs, cookies, and similar technologies. This data is collected regardless of whether you are logged into an account. See Section 6 for details on cookies.

3.3 From Payment Processors. When you make a deposit or withdrawal, wtfwin receives transaction confirmation data from payment processors (such as GCash, Maya, BPI, and BDO). We do not receive or store full card numbers or e-wallet PINs — these remain with your payment provider. We receive only the data necessary to reconcile transactions and maintain your account balance.

3.4 From KYC Verification Partners. For certain identity verification processes, wtfwin may use accredited third-party KYC service providers to verify the authenticity of submitted identification documents and perform liveness checks. These providers process your data under strict confidentiality and data processing agreements consistent with RA 10173 requirements.

3.5 From Anti-Fraud and Compliance Systems. Automated risk and fraud detection systems analyze session patterns, device fingerprints, and transaction behaviors to identify potentially suspicious activity as required under PAGCOR's security standards. This processing occurs without human intervention for routine risk scoring.

Purpose & Legal Basis for Processing

Under RA 10173, personal data may only be processed if there is a lawful basis for doing so. The table below outlines the primary purposes for which wtfwin processes your data and the corresponding legal basis under Philippine data privacy law.

4.1 Consequences of Non-Provision. Where data collection is marked as required for contractual or legal obligation purposes, failure to provide the requested data will prevent wtfwin from opening or maintaining your account, processing withdrawals, or fulfilling its PAGCOR licensing obligations. This may result in account suspension or closure.

Who We Share Your Data With

5.1 No Sale of Data. wtfwin does not sell, rent, or otherwise transfer your personal data to any third party for commercial purposes. Data sharing is limited strictly to what is necessary for the categories below.

5.2 Service Providers and Data Processors

wtfwin engages trusted third-party service providers who process personal data on our behalf under strict contractual agreements and data processing terms consistent with RA 10173. These include:

• Payment processors: GCash (Mynt), Maya (Voyager Innovations), BancNet, and similar — to process deposits and withdrawals;
• KYC verification providers: Accredited identity verification services for document and liveness checks;
• Cloud infrastructure providers: Secure cloud hosting services that store wtfwin's platform data in access-controlled environments;
• Fraud prevention and security: Risk management systems that analyze transaction and behavioral data to detect suspicious activity;
• Customer support platform: The technical system used to manage live chat and email support interactions.

5.3 Regulatory Authorities

wtfwin is legally required to share certain data with Philippine regulatory and enforcement bodies, including:

• PAGCOR — for licensing compliance reporting, player dispute investigations, and audit purposes;
• Anti-Money Laundering Council (AMLC) — for covered transaction reports and suspicious transaction reports as required under RA 9160;
• National Privacy Commission (NPC) — in the event of a data breach notification obligation or regulatory inquiry under RA 10173;
• Courts of competent jurisdiction or law enforcement, where required by a valid court order, subpoena, or legal process under Philippine law.

5.4 Game Providers

Game software providers integrated into the wtfwin platform — such as JILI, Pragmatic Play, PG Soft, and Evolution — may receive limited anonymized or pseudonymized session data necessary for game functionality, fairness auditing, and technical support. These providers do not receive your full identity data and are bound by confidentiality obligations.

Cookies & Tracking Technologies

6.1 What Are Cookies. Cookies are small text files placed on your device when you visit the wtfwin website or use the web app. They allow the platform to recognize your device across sessions, maintain your login state, remember preferences, and gather usage analytics.

6.2 Types of Cookies Used by wtfwin. The following categories of cookies are deployed on the wtfwin platform:

• Strictly Necessary Cookies: Required for the platform to function — including session authentication, login state management, and security tokens. These cannot be disabled without breaking core platform functionality;
• Functional Cookies: Store your preferences such as language setting, display preferences, and responsible gaming configuration choices;
• Analytics Cookies: Collect anonymized or pseudonymized data about how visitors navigate the platform — which pages are visited, how long sessions last, and which features are used — to help us improve the platform experience;
• Security Cookies: Used by fraud detection systems to identify unusual access patterns and protect your account from unauthorized use.

6.3 Managing Cookies. You can control non-essential cookies through your browser's cookie settings. Disabling functional or analytics cookies will not prevent you from using the wtfwin platform but may reduce the quality of your experience. Disabling strictly necessary cookies will prevent certain core platform features from functioning correctly.

6.4 Mobile App Tracking. The wtfwin mobile app uses equivalent technologies (such as device identifiers and session tokens) that perform the same functions as browser cookies on a native app environment. These are managed through your device's app permissions and privacy settings.

Data Retention Periods

7.1 General Principle. wtfwin retains personal data only for as long as is necessary for the purpose for which it was collected, or for as long as required by applicable Philippine law and PAGCOR licensing obligations — whichever is longer.

7.2 Account Deletion Requests. When you request account closure or deletion, wtfwin will delete or anonymize all personal data that is not subject to a mandatory legal retention obligation. Data required to be retained for regulatory purposes will be stored securely in a restricted archive accessible only to the compliance team and not used for any operational purpose.

Data Security Measures

8.1 Technical Safeguards. wtfwin implements the following technical security measures to protect your personal data:

• 256-bit TLS (Transport Layer Security) encryption for all data in transit between your device and the wtfwin platform;
• AES-256 encryption for sensitive personal data at rest in our database systems;
• Password hashing using bcrypt with individual salting — passwords are never stored in recoverable form;
• Two-factor authentication (OTP to registered Philippine mobile number) available for all accounts;
• Automated anomaly detection systems flagging unusual login patterns, access from new devices, or unusual transaction behavior for security review;
• Regular third-party penetration testing and vulnerability assessments of the platform infrastructure.

8.2 Organisational Safeguards. Access to personal data within wtfwin is restricted on a need-to-know basis. Staff with access to personal data undergo background checks and data privacy training. All personnel handling personal data are bound by confidentiality obligations.

8.3 Data Breach Response. In the event of a personal data breach affecting your data, wtfwin will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach as required by NPC Circular 16-03. Where the breach poses a real risk to your rights and freedoms, we will notify you directly as soon as reasonably practicable.

Your Data Subject Rights

Under the Data Privacy Act of 2012 (RA 10173), all Philippine residents whose personal data is processed by wtfwin have the following rights. These rights may be exercised by contacting the wtfwin DPO as described in Section 15.

9.1 Response Timeframe. wtfwin will acknowledge data subject requests within five (5) business days and provide a full response within fifteen (15) business days of receipt, in accordance with NPC guidelines. Where requests are particularly complex or numerous, we may extend this period by a further fifteen (15) days with written notification.

Children & Minors — 21+ Platform

10.1 Age Restriction. The wtfwin platform is strictly restricted to individuals who are 21 years of age or older — the minimum legal age for participation in games of chance in the Philippines under PAGCOR regulations and Republic Act 9487. wtfwin does not knowingly collect personal data from individuals below the age of 21.

10.2 Age Verification. All Members are required to provide date of birth during registration and to verify their identity — including age — through government-issued documentation before withdrawal privileges are activated. Accounts where the stated age cannot be verified or where the Member is found to be under 21 will be immediately suspended and the matter referred to wtfwin's compliance team.

10.3 Discovery of Minor's Data. If wtfwin becomes aware that personal data has been collected from an individual below 21 years of age without appropriate parental or guardian consent and age verification, we will take immediate steps to delete that data, close the associated account, and if applicable, return any deposits through the original payment method following identity verification of the account holder.

10.4 Parental Responsibility. wtfwin strongly encourages parents and guardians in the Philippines to supervise minors' use of online platforms and to use device-level parental controls to prevent access to age-restricted gaming sites. If you believe a minor has accessed the wtfwin platform using falsified information, please contact support immediately.

Marketing Communications

11.1 Consent-Based Marketing. wtfwin sends promotional emails, SMS messages, and in-app push notifications about bonuses, new games, tournaments, and platform updates only to Members who have provided explicit consent during registration or through account settings. Marketing communications are never sent without a valid consent basis.

11.2 Opt-Out at Any Time. You can withdraw consent to receive marketing communications at any time by:

• Updating your notification preferences in your wtfwin account settings;
• Clicking the "Unsubscribe" link included in every marketing email;
• Replying STOP to any marketing SMS from wtfwin;
• Contacting the wtfwin support team via live chat or email.

11.3 Transactional Communications. Opting out of marketing communications does not affect your receipt of transactional messages — these are service-essential communications such as deposit confirmations, withdrawal processing updates, OTP codes, account security alerts, and KYC status notifications. Transactional messages are sent on the basis of contractual necessity and cannot be disabled while your account remains active.

11.4 Self-Excluded Members. Members who have activated self-exclusion are automatically removed from all marketing communication lists for the duration of the exclusion period. Exclusion from marketing communications during self-exclusion is a mandatory requirement under wtfwin's responsible gaming obligations.

Third-Party Links & Integrated Services

12.1 Integrated Payment Services. The wtfwin platform integrates payment services including GCash and Maya, which are operated by independent entities. When you initiate a transaction, you interact with these providers' own interfaces and systems. Your use of these services is subject to the respective providers' privacy policies in addition to this one.

12.2 Game Provider Integrations. Games in the wtfwin lobby are provided by third-party game studios accessed through the platform. While you interact with these games through the wtfwin interface, the underlying game software is operated by the respective provider. Game providers receive only the session and game data necessary for game function and do not receive your full personal profile.

12.3 No Responsibility for Third-Party Policies. wtfwin is not responsible for the privacy practices of third-party services. We recommend reviewing the privacy policies of GCash, Maya, BPI, BDO, and any other service provider you use in connection with your wtfwin activity.

International Data Transfers

13.1 Transfers Outside the Philippines. Some of wtfwin's service providers — including cloud infrastructure providers and certain technical systems — may process or store data outside the Republic of the Philippines. Where such transfers occur, wtfwin ensures they are conducted only to countries or organizations that provide an adequate level of data protection, or through appropriate contractual safeguards such as standard data protection clauses that require the recipient to protect your data to Philippine RA 10173 standards.

13.2 Primary Data Location. The primary storage of wtfwin player data and transaction records is located within infrastructure designed to comply with PAGCOR's data sovereignty and security requirements. The Philippine operations and KYC records are maintained in jurisdictions subject to PAGCOR audit access.

13.3 AMLC Reporting. Required reports submitted to the Anti-Money Laundering Council (AMLC) are processed within the Philippines in accordance with RA 9160 requirements and do not constitute international data transfers.

Changes to This Privacy Policy

14.1 Right to Update. wtfwin reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or the services we provide. The "Last Updated" date at the top of this Policy will always reflect when the most recent revision was made.

14.2 Notification of Material Changes. Where updates to this Privacy Policy involve a material change to how your personal data is processed — including a new purpose, a new category of data, or a new third-party recipient — wtfwin will notify registered Members by email to their registered address and/or by a prominent in-platform notification at least fourteen (14) days before the change takes effect, where practically possible.

14.3 Continued Use. Your continued use of the wtfwin platform after the effective date of a revised Privacy Policy constitutes your acknowledgment of the changes. If you object to any revised terms, you may exercise your right to account closure and data deletion as described in Sections 7 and 9 of this Policy.

14.4 Previous Versions. Previous versions of the wtfwin Privacy Policy are available upon request by contacting the Data Protection Officer. All prior versions are retained for a minimum of five years to support regulatory audit requirements.

Contact Us & Data Protection Officer

15.1 Data Subject Requests. To exercise any of the data rights described in Section 9 of this Policy — including access, rectification, erasure, portability, or objection — please contact the wtfwin Data Protection Officer through one of the following channels:

• Support Email: [email protected] — include "Data Privacy Request" in the subject line;
• Live Chat: Available 24/7 on the wtfwin platform — response under 90 seconds;
• In-Account Settings: Many data management actions are available directly through your account settings panel.

15.2 Identity Verification for Data Requests. To protect your privacy, wtfwin will require you to verify your identity before processing any data subject request. This typically involves confirming your registered mobile number via OTP and/or providing your account username. We will not fulfill data requests from individuals who cannot be verified as the account holder.

15.3 NPC Complaints. If you are not satisfied with how wtfwin has handled your personal data or a data subject request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. The NPC can be reached through their official government website and maintains a formal complaints process for data privacy violations.