Privacy Policy

1. About This Policy

This Privacy Policy ("Policy") is issued by win2day ("we," "us," or "our") and applies to all personal data collected through the win2day website at win2day.one, the win2day mobile application, and any related services, features, or communications (collectively, the "Platform").

win2day is committed to complying with the Republic Act No. 10173, also known as the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC") of the Philippines. Where applicable, win2day also observes internationally recognized data protection principles consistent with the DPA framework.

By registering an account, accessing the Platform, or using any win2day service, you acknowledge that you have read and understood this Policy and consent to the collection, use, and processing of your personal data as described herein. If you do not agree with this Policy, you must not use the Platform.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, which together govern your use of the win2day Platform.

2. Personal Data We Collect

win2day collects the following categories of personal data, depending on how you interact with the Platform:

win2day does not intentionally collect sensitive personal information as defined under the DPA (such as health data, religious beliefs, or political affiliations) unless specifically required by law or regulatory directive. If such data is incidentally disclosed during a support interaction, it will be handled with the highest level of protection.

3. How We Collect Your Data

win2day collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in promotions.
• Automated collection: Technical data collected automatically when you access the Platform, including IP addresses, device identifiers, browser fingerprints, and session activity logs. This data is collected via server logs, cookies, and similar tracking technologies.
• Third-party sources: Identity verification data from KYC service providers; fraud risk scores from payment processors; geolocation data from IP intelligence services used to enforce jurisdictional restrictions.
• Payment providers: Transaction confirmation data from GCash, PayMaya, BPI, BDO, and Metrobank when you initiate deposits or withdrawals through their respective platforms.

4. How We Use Your Personal Data

win2day uses your personal data for the following purposes:

• Account management: Creating, maintaining, and securing your win2day account; processing login authentication and OTP verification.
• Service delivery: Enabling access to casino games, sports betting, bingo, sabong, and all other Platform features; processing bets and game outcomes; crediting winnings to your account balance.
• Payment processing: Facilitating deposits and withdrawals through your chosen payment method; reconciling transaction records; issuing refunds where applicable.
• Regulatory compliance: Fulfilling obligations under the Anti-Money Laundering Act (RA 9160, as amended), PAGCOR licensing requirements, and NPC data protection regulations, including mandatory reporting of suspicious transactions.
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behavior; enforcing self-exclusion orders and deposit limits; complying with PAGCOR's responsible gaming framework.
• Fraud prevention and security: Detecting and preventing unauthorized account access, bonus abuse, multi-accounting, and other fraudulent or prohibited activities.
• Customer support: Responding to inquiries, resolving disputes, and improving the quality of our support services.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to users who have opted in to receive such communications. You may opt out at any time.
• Platform improvement: Analyzing aggregated, anonymized usage data to improve game performance, user experience, and Platform features.

5. Legal Basis for Processing

Under the Data Privacy Act of 2012, win2day processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and win2day — specifically, to operate your account, process bets, and facilitate payments.
• Legal obligation: Processing required to comply with Philippine law, including AML reporting obligations, PAGCOR licensing conditions, and NPC data protection requirements.
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by your data protection rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have provided explicit, informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Data Sharing & Disclosure

win2day does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only in the following circumstances:

• Service providers: KYC verification providers, payment processors (GCash, PayMaya, BPI, BDO, Metrobank), game software providers, cloud hosting providers, and customer support platform operators — all bound by data processing agreements that restrict their use of your data to the specific service they provide.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council ("AMLC"), the National Privacy Commission, and other Philippine government agencies where disclosure is required by law, court order, or regulatory directive.
• Fraud prevention networks: Shared fraud intelligence databases used to identify and prevent multi-accounting, bonus abuse, and financial crime, where participation is required by our payment processors or licensing conditions.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all of win2day's assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.
• With your consent: Any other sharing that you have explicitly authorized.

7. Cookies & Tracking Technologies

win2day uses cookies and similar tracking technologies to operate the Platform, maintain your session, and analyze usage patterns. The following types of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional cookies: Remember your preferences such as language settings, preferred payment method, and responsible gaming limit configurations.
• Analytics cookies: Collect anonymized data about how users navigate the Platform, which pages are visited most frequently, and where users encounter errors. This data is used to improve Platform performance and user experience.
• Security cookies: Used to detect and prevent fraudulent login attempts, bot activity, and suspicious session behavior.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the Platform, but may affect certain personalization features. Note that strictly necessary cookies cannot be disabled via browser settings without logging out of your account.

8. Data Retention

win2day retains your personal data for as long as necessary to fulfill the purposes described in this Policy, subject to the following minimum retention periods required by Philippine law:

• Account and identity data: Retained for a minimum of five (5) years from the date of account closure, as required by PAGCOR licensing conditions and AML regulations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with the Anti-Money Laundering Act and BSP regulations applicable to payment service providers.
• KYC documents: Retained for a minimum of five (5) years from account closure or the date of the last transaction, whichever is later.
• Gaming records: Retained for a minimum of three (3) years for dispute resolution purposes and responsible gaming monitoring.
• Support communications: Retained for two (2) years from the date of the last interaction, unless a longer period is required for an ongoing dispute.
• Marketing consent records: Retained for the duration of your account plus two (2) years, to demonstrate compliance with consent requirements.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in accordance with NPC guidelines on data disposal.

9. Data Security

win2day implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• TLS/SSL encryption: All data transmitted between your device and the win2day Platform is encrypted using TLS 1.2 or higher. Sensitive data at rest, including KYC documents and financial records, is encrypted using AES-256.
• Access controls: Personal data is accessible only to win2day staff who require it to perform their job functions. Access is governed by role-based permissions, and all access events are logged and audited.
• Two-factor authentication: All win2day staff accounts with access to personal data require multi-factor authentication. Player accounts are protected by OTP verification on login and withdrawal.
• Penetration testing: The Platform undergoes regular third-party security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident response: win2day maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, win2day will notify the NPC within 72 hours of becoming aware of the breach, and will notify affected data subjects without undue delay.

While win2day takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying win2day immediately if you suspect unauthorized access to your account.

10. Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by win2day:

• Right to be informed: The right to know what personal data win2day collects, how it is used, and with whom it is shared — as described in this Policy.
• Right of access: The right to request a copy of the personal data win2day holds about you, along with information about how it is processed.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data. You may update most account information directly through your account settings.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to win2day's legal retention obligations under AML and PAGCOR regulations.
• Right to object: The right to object to processing based on legitimate interests, including direct marketing. You may opt out of marketing communications at any time via the unsubscribe link in any marketing email or by contacting support.
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format, where technically feasible.
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission if you believe win2day has violated your data protection rights. The NPC can be reached at privacy.gov.ph.

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 14. win2day will respond to all verified data subject requests within thirty (30) days, as required by the DPA. Complex requests may require up to sixty (60) days, in which case we will notify you of the extension and the reason for it.

11. Children's Privacy

The win2day Platform is strictly intended for adults aged 21 years and older, in accordance with Philippine gaming regulations. win2day does not knowingly collect personal data from individuals under the age of 21.

If win2day discovers or is notified that personal data has been collected from a person under 21, the account will be immediately suspended, all associated data will be flagged for review, and the data will be deleted or returned to the extent required by law. Any deposits made by an underage user will be returned to the original payment method after deducting any bonuses received.

Parents and guardians who believe their child may have registered on the win2day Platform are encouraged to contact our support team immediately via live chat so that the matter can be investigated and resolved as a priority.

12. Cross-Border Data Transfers

win2day's primary data processing infrastructure is located within the Philippines. However, certain service providers — including cloud hosting providers, KYC verification platforms, and game software licensors — may process data in other jurisdictions.

Where personal data is transferred outside the Philippines, win2day ensures that appropriate safeguards are in place in accordance with NPC guidelines on cross-border data transfers. These safeguards include contractual clauses that require the recipient to apply data protection standards equivalent to those required under the DPA, and where applicable, adequacy assessments of the recipient country's data protection framework.

win2day will not transfer your personal data to a jurisdiction that does not provide an adequate level of data protection without your explicit consent, unless the transfer is required by Philippine law or a court order.

13. Changes to This Privacy Policy

win2day reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will notify registered users via email to their registered address and post a prominent notice on the Platform at least seven (7) days before the changes take effect.

The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

14. Contact & Data Protection Officer

win2day has appointed a Data Protection Officer ("DPO") in compliance with the Data Privacy Act of 2012 and NPC Circular 16-01. If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, you may contact our DPO directly.

Data Protection Officer — win2day
Email: [email protected]
Subject line: Data Privacy Request – [Your Registered Name]

For general customer support inquiries unrelated to data privacy, please use the live chat feature available on the Platform. Our Filipino support agents are available 24/7 and typically respond within two minutes during peak hours.

win2day is registered with the National Privacy Commission as a personal information controller. Our NPC registration details are available upon request.