winmaya Privacy
Policy

1. Introduction

winmaya ("winmaya," "we," "us," or "our") is committed to protecting the privacy and personal data of every player who uses the winmaya online gaming platform at winmaya.one (the "Platform"). This Privacy Policy ("Policy") describes how winmaya collects, uses, stores, shares, and protects personal information in connection with your use of the Platform and its associated services.

This Policy applies to all registered players, visitors to the winmaya website, and any individual whose personal data is processed by winmaya in connection with the Platform. It should be read alongside winmaya's Terms and Conditions and Responsible Gaming Policy, which together form the complete agreement governing your relationship with winmaya.

winmaya operates in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the guidelines issued by the National Privacy Commission (NPC) of the Philippines. By accessing or using the winmaya Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

2. Personal Data We Collect

2.1 Registration & Account Data

When you create a winmaya account, we collect the following information:

• Full legal name as it appears on your government-issued Philippine ID
• Date of birth (to verify the 21+ age requirement)
• Philippine mobile number and/or email address
• Username and encrypted password
• Residential address in the Philippines
• Nationality and citizenship information

2.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) obligations, winmaya may collect:

• Copies of government-issued Philippine identification documents (e.g., PhilSys National ID, passport, driver's license, SSS ID, GSIS ID, PRC ID, Voter's ID)
• Proof of address documents (e.g., utility bills, bank statements, barangay certificates)
• Proof of payment method ownership (e.g., GCash or PayMaya account screenshots showing your registered name)
• Selfie or facial verification images where required for identity confirmation

2.3 Financial & Transaction Data

winmaya collects financial information necessary to process deposits and withdrawals, including:

• GCash or PayMaya account details (mobile number associated with the account)
• Philippine bank account details (account name, account number, bank name) for bank transfer transactions
• Debit card details (card number is tokenized and never stored in plain text)
• Transaction history, including deposit amounts, withdrawal amounts, dates, and payment methods used

2.4 Gaming Activity Data

winmaya records data related to your gaming activity on the Platform, including:

• Games played, wagers placed, and game outcomes
• Session duration and frequency of play
• Bonus and promotion usage history
• Responsible gaming tool settings (deposit limits, session reminders, self-exclusion status)

2.5 Technical & Device Data

When you access the winmaya Platform, we automatically collect certain technical information, including:

• IP address and approximate geographic location
• Device type, operating system, and browser type and version
• Pages visited, time spent on each page, and navigation patterns
• Referring URL and exit pages
• Cookie identifiers and session tokens

2.6 Communications Data

If you contact winmaya's customer support team via live chat or email, we retain records of those communications, including the content of messages, timestamps, and the resolution of any issues raised.

3. How We Collect Your Data

winmaya collects personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or update your account settings.
• Automatically: Through cookies, web beacons, and similar tracking technologies when you access and navigate the winmaya Platform.
• From third-party verification services: winmaya may use third-party identity verification and fraud prevention services to validate the information you provide during registration and KYC. These services may cross-reference your data against publicly available records and Philippine government databases.
• From payment processors: When you make a deposit or withdrawal, winmaya receives transaction confirmation data from GCash, PayMaya, and Philippine banking partners.

4. How We Use Your Personal Data

winmaya uses the personal data we collect for the following purposes:

• Account creation and management: To register your winmaya account, verify your identity, and maintain your account in good standing.
• Age and eligibility verification: To confirm that you meet the 21+ age requirement and are legally permitted to use the Platform.
• Payment processing: To process deposits and withdrawals via GCash, PayMaya, bank transfer, and debit card in Philippine Peso (₱).
• KYC and anti-money laundering compliance: To fulfill our legal obligations under Philippine anti-money laundering regulations and gaming regulatory requirements.
• Platform operation and improvement: To deliver, maintain, and improve the winmaya gaming experience, including game performance, platform stability, and new feature development.
• Customer support: To respond to your inquiries, resolve disputes, and provide technical assistance.
• Responsible gaming: To monitor gaming patterns, enforce responsible gaming limits you have set, and identify players who may be at risk of problem gambling.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, and other security threats.
• Marketing communications: To send promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications.
• Legal compliance: To comply with applicable Philippine laws, regulations, court orders, and requests from regulatory authorities including PAGCOR and the National Privacy Commission.

5. Legal Basis for Processing

winmaya processes your personal data on the following legal bases under the Philippine Data Privacy Act of 2012:

• Consent: Where you have given your explicit consent to the processing of your personal data, such as for marketing communications or optional data collection.
• Contractual necessity: Where processing is necessary to perform our obligations under the Terms and Conditions you have agreed to, including account management, payment processing, and game delivery.
• Legal obligation: Where processing is required to comply with applicable Philippine laws and regulations, including KYC obligations, anti-money laundering requirements, and gaming regulatory compliance.
• Legitimate interests: Where processing is necessary for winmaya's legitimate business interests, such as fraud prevention, platform security, and service improvement, provided that such interests are not overridden by your data protection rights.

6. Data Sharing & Disclosure

winmaya does not sell, rent, or trade your personal data to third-party marketers. We may share your personal information with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

6.1 Service Providers

winmaya engages trusted third-party service providers to assist in operating the Platform, including payment processors (GCash, PayMaya, Philippine banks), identity verification services, cloud hosting providers, customer support platforms, and analytics services. These providers are contractually bound to process your data only on winmaya's instructions and in accordance with applicable data protection laws.

6.2 Regulatory and Law Enforcement Authorities

winmaya may disclose your personal data to Philippine regulatory authorities (including PAGCOR and the National Privacy Commission), law enforcement agencies, courts, or other government bodies where required by applicable law, court order, or regulatory directive. winmaya will notify you of such disclosures where legally permitted to do so.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of winmaya's business, your personal data may be transferred to the acquiring entity as part of that transaction. winmaya will notify affected players of any such transfer and ensure that the receiving entity is bound by data protection obligations no less stringent than those in this Policy.

6.4 Responsible Gaming Partners

Where necessary to protect a player's wellbeing, winmaya may share limited data with responsible gaming support organizations or self-exclusion registries in the Philippines, strictly for the purpose of enforcing self-exclusion requests or providing support to at-risk players.

7. Data Retention

winmaya retains your personal data for as long as necessary to fulfill the purposes for which it was collected, subject to the following retention guidelines:

• Active account data: Retained for the duration of your winmaya account and for a period of five (5) years following account closure, in compliance with Philippine anti-money laundering record-keeping requirements.
• KYC and identity verification documents: Retained for a minimum of five (5) years from the date of submission, or longer if required by applicable law or regulatory directive.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer support communications: Retained for two (2) years from the date of the last communication, unless a longer retention period is required for dispute resolution or legal proceedings.
• Marketing consent records: Retained for the duration of your consent and for one (1) year following withdrawal of consent, as evidence of your prior consent.

Upon expiry of the applicable retention period, winmaya will securely delete or anonymize your personal data in accordance with its data disposal procedures.

8. Data Security

winmaya implements a comprehensive set of technical and organizational security measures to protect your personal and financial data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the winmaya Platform
• AES-256 encryption for sensitive data stored in winmaya's databases
• Tokenization of payment card details — raw card numbers are never stored on winmaya's servers
• Multi-factor authentication options for player accounts
• Regular security audits, vulnerability assessments, and penetration testing by independent security professionals
• Strict access controls limiting employee access to personal data on a need-to-know basis
• Comprehensive data breach response procedures, including notification to affected players and the National Privacy Commission within the timeframes required by Philippine law

9. Cookies & Tracking Technologies

9.1 What Are Cookies?

Cookies are small text files placed on your device when you visit the winmaya Platform. They help winmaya recognize your device, remember your preferences, and improve your overall experience on the Platform.

9.2 Types of Cookies Used by winmaya

• Strictly necessary cookies: Essential for the Platform to function correctly. These include session authentication cookies and security tokens. They cannot be disabled.
• Performance and analytics cookies: Used to collect anonymized data about how players use the Platform, helping winmaya identify areas for improvement.
• Functionality cookies: Used to remember your preferences, such as language settings and display options, to personalize your experience.
• Marketing cookies: Used to deliver relevant promotional content to players who have opted in to marketing communications. These cookies track your interaction with winmaya promotions.

9.3 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the winmaya Platform. Strictly necessary cookies cannot be disabled as they are required for the Platform to operate securely.

10. Your Data Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by winmaya:

• Right to be informed: The right to be notified of how your personal data is collected, used, and processed — which is the purpose of this Privacy Policy.
• Right of access: The right to request a copy of the personal data winmaya holds about you, along with information about how it is being processed.
• Right to rectification: The right to request correction of any inaccurate or incomplete personal data winmaya holds about you.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to winmaya's legal retention obligations.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on winmaya's legitimate interests.
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines if you believe winmaya has violated your data privacy rights.

To exercise any of these rights, please contact winmaya's Data Protection Officer using the contact details provided in Section 14 of this Policy. winmaya will respond to all data rights requests within thirty (30) days of receipt, in accordance with the requirements of the Philippine Data Privacy Act.

11. Children & Minors

The winmaya Platform is strictly intended for adults aged 21 years and above. winmaya does not knowingly collect personal data from individuals under the age of 21. If winmaya becomes aware that personal data has been collected from a person under 21, that data will be deleted immediately and the associated account will be closed.

If you are a parent or guardian and believe that your child has registered on the winmaya Platform or provided personal data without your consent, please contact our support team immediately so that we can take appropriate action.

12. Third-Party Links

The winmaya Platform does not contain links to third-party websites. This Privacy Policy applies solely to data collected and processed by winmaya through the winmaya.one Platform and its associated services. winmaya is not responsible for the privacy practices of any third-party services you may access independently.

13. Updates to This Privacy Policy

winmaya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, or regulatory requirements. When material changes are made, winmaya will notify registered players via email or a prominent notice on the Platform prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this page. Your continued use of the winmaya Platform following the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not agree to the updated Policy, you must cease using the Platform and may request closure of your account.

14. Contact Us & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by winmaya, please contact our Data Protection Officer (DPO) through the following channels:

• Email: [email protected]
• General Support Email: [email protected]
• Live Chat: Available 24/7 directly on the winmaya Platform

winmaya's DPO will acknowledge receipt of all privacy-related inquiries within five (5) business days and will provide a substantive response within thirty (30) days, in accordance with the requirements of the Philippine Data Privacy Act of 2012.

If you are not satisfied with winmaya's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.