winluck Casino Privacy Policy

1. Who We Are (Data Controller)

winluck Casino ("winluck," "we," "us," or "our") operates the online casino and sports betting platform accessible at winluck.one. winluck is the data controller for personal information collected through the platform, as defined under the Philippine Data Privacy Act of 2012 (Republic Act 10173, "DPA") and its Implementing Rules and Regulations.

winluck is a PAGCOR-regulated gaming operator licensed to provide online gambling services to eligible residents of the Philippines. As a regulated entity, winluck is subject to data governance requirements imposed by both the National Privacy Commission (NPC) and the Philippine Amusement and Gaming Corporation (PAGCOR).

If you have any questions about this Privacy Policy or about how winluck handles your personal data, you may contact our Data Protection Officer (DPO) at the email address provided in Section 13 of this Policy.

2. Data We Collect

winluck collects personal information through several channels: account registration, identity verification, platform use, payment transactions, and customer support interactions. The categories of data collected include:

2.1 Registration and Identity Data

• Full legal name as it appears on your Philippine government ID;
• Date of birth (for age verification in compliance with PAGCOR's 21+ requirement);
• Registered mobile number (Philippine format) and/or email address;
• Username and encrypted password credentials;
• Nationality and residential address in the Philippines (city, province).

2.2 Identity Verification (KYC) Data

• Scanned copies or photographs of government-issued identification documents (PhilSys, driver's license, passport, UMID, SSS ID, or PRC ID);
• Facial verification data captured during liveness checks where applicable;
• Source of funds declarations for accounts subject to enhanced due diligence under PAGCOR and AMLC requirements.

2.3 Financial Transaction Data

• GCash, PayMaya, or bank account reference identifiers used for deposits and withdrawals;
• Transaction history including deposit amounts, withdrawal requests, and timestamps;
• Payment method verification data as required by Philippine anti-money laundering laws.

2.4 Platform Usage Data

• Games played, wagers placed, session duration, and gambling activity logs;
• Device type, operating system, browser type, and IP address;
• Login timestamps and geographic location data derived from IP address;
• Interaction data with responsible gaming tools (e.g., limit settings, self-exclusion requests).

2.5 Communications Data

• Records of live chat conversations and support ticket submissions;
• Email correspondence with the winluck support team;
• Feedback and survey responses submitted voluntarily through the platform.

3. How We Use Your Data

winluck uses the personal data it collects for the following purposes:

• Account Administration: To create and manage your winluck Account, authenticate your identity during login, and maintain the security of your Account;
• KYC and Regulatory Compliance: To verify your identity and age, comply with PAGCOR licensing requirements, meet obligations under the Anti-Money Laundering Act (AMLA) and its amendments, and fulfill reporting obligations to PAGCOR and AMLC;
• Payment Processing: To process your deposit and withdrawal requests through your selected Philippine payment method (GCash, PayMaya, BPI, BDO, Metrobank);
• Service Delivery: To provide access to the game lobby, process wagers, calculate winnings, and administer bonus programs;
• Responsible Gaming: To monitor gambling patterns for indicators of problem gambling, enforce deposit and loss limits you have set, and administer self-exclusion requests;
• Fraud Prevention and Security: To detect and prevent unauthorized Account access, fraudulent transactions, money laundering, and other prohibited activities;
• Customer Support: To respond to your inquiries, resolve disputes, and improve the quality of our support services;
• Marketing Communications: To send you promotional offers, bonuses, and platform updates via SMS, email, or push notification — only where you have provided consent to receive such communications;
• Platform Improvement: To analyze aggregated, anonymized usage data to improve game selection, interface design, and platform performance.

4. Legal Basis for Processing

Under the Philippine Data Privacy Act, winluck processes your personal data on the following legal bases:

• Contractual Necessity: Processing necessary for the performance of our contract with you (the Terms and Conditions) — including account management, payment processing, and service delivery;
• Legal Obligation: Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act, the Data Privacy Act itself, and other applicable Philippine laws and regulations;
• Legitimate Interests: Processing for fraud prevention, security monitoring, and platform performance analysis, where such interests are not overridden by your privacy rights;
• Consent: Processing for marketing communications and optional data analytics, where you have provided explicit, informed, and freely-given consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

5. Sharing Your Data

winluck does not sell, rent, or trade your personal information. We may share your data with third parties only in the following limited circumstances:

• Payment Processors: GCash (G-Xchange Inc.), PayMaya (Maya Philippines Inc.), and banking partners (BPI, BDO, Metrobank) receive transaction reference data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and regulatory frameworks;
• Game Providers: Game software providers (such as JILI and other licensed suppliers) may receive anonymized session identifiers to facilitate real-time game delivery. They do not receive your personally identifiable registration data;
• KYC and Identity Verification Services: Third-party identity verification providers process the documents you submit during the KYC process under strict data processing agreements;
• Regulatory Authorities: winluck is required to share player data with PAGCOR, the Anti-Money Laundering Council (AMLC), and other Philippine government agencies upon lawful request or as required by our operating license. This includes mandatory transaction reporting under AMLA thresholds;
• Professional Advisors: Legal counsel, auditors, and compliance consultants engaged by winluck, subject to professional confidentiality obligations;
• Law Enforcement: Philippine law enforcement agencies upon receipt of a valid legal order or where disclosure is required to prevent imminent harm.

6. Cookies and Tracking Technologies

winluck uses cookies and similar technologies on the platform to deliver core functionality, maintain your login session, and understand how the platform is used. The types of cookies we use include:

• Strictly Necessary Cookies: Required for the platform to function — including session authentication, security tokens, and load balancing. These cannot be disabled without breaking the service;
• Performance Cookies: Collect anonymized data about page load times and error rates to help us improve platform performance. No personally identifiable information is collected by these cookies;
• Functional Cookies: Remember your preferences (such as language settings and game lobby view) to personalize your experience on return visits;
• Analytics Cookies: Used to understand aggregate usage patterns — which games are most popular, which pages have the highest exit rates, and how players navigate the lobby. Used only with your consent.

You may manage or delete cookies through your browser settings. Disabling strictly necessary cookies will affect the functionality of the winluck platform.

7. Data Retention

winluck retains personal data for the following periods:

• Active Account Data: Retained for the duration of your active account plus five (5) years following permanent account closure, in compliance with PAGCOR record-keeping requirements and the Anti-Money Laundering Act;
• KYC and Identity Documents: Retained for a minimum of five (5) years from submission as required by AMLC regulations and PAGCOR conditions;
• Financial Transaction Records: Retained for five (5) years from the date of each transaction, consistent with AMLA and tax record obligations;
• Customer Support Records: Retained for three (3) years from the date of the relevant interaction;
• Marketing Consent Records: Retained for three (3) years from the date of consent, or until consent is withdrawn, whichever is earlier.

Upon expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymized, such that it can no longer be associated with any identifiable individual.

8. Security Measures

winluck implements a multi-layered security framework to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and winluck's servers;
• AES-256 encryption for sensitive data stored at rest, including financial records and identity documents;
• Multi-factor authentication options for player accounts, including SMS OTP;
• Intrusion detection and prevention systems monitoring for unauthorized access attempts;
• Regular security audits and penetration testing by qualified cybersecurity professionals;
• Strict internal access controls — winluck staff access personal data only on a need-to-know basis relevant to their job function;
• Staff training on data privacy obligations under the Philippine DPA.

In the event of a personal data breach that is likely to result in significant harm to affected data subjects, winluck will notify the National Privacy Commission and affected individuals in accordance with the DPA's breach notification requirements (within 72 hours of discovery where the breach meets the notification threshold).

9. Your Rights as a Data Subject

Under the Philippine Data Privacy Act (RA 10173), you have the following rights with respect to your personal data held by winluck:

• Right to Be Informed: You have the right to be notified of what personal data winluck collects about you and how it is processed — which this Policy provides;
• Right of Access: You may request a copy of the personal data winluck holds about you, along with information about how it is processed;
• Right to Rectification: You may request correction of inaccurate or incomplete personal data in your Account. Basic details (name, address) can be updated through your Account profile; corrections to ID documents require a support request;
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing was unlawful. Note that legal and regulatory retention obligations may limit the scope of erasure requests;
• Right to Object: You may object to processing of your personal data where such processing is based on legitimate interests or for direct marketing purposes. Objection to marketing will be honored immediately; objections to other processing grounds will be assessed against applicable legal requirements;
• Right to Data Portability: You may request your personal data in a structured, commonly-used, machine-readable format where processing is based on consent or contract, and is carried out by automated means;
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe winluck has breached your data privacy rights.

To exercise any of the above rights, please contact our Data Protection Officer at the contact details provided in Section 13. winluck will respond to verified data subject requests within thirty (30) days of receipt.

10. Children and Minors

winluck's Services are strictly restricted to individuals who are 21 years of age or older, as mandated by PAGCOR regulations. winluck does not knowingly collect personal data from individuals under the age of 21. If winluck becomes aware that personal data has been collected from an individual under this age threshold, the Account will be immediately suspended and the data will be deleted in accordance with applicable legal requirements.

Parents or guardians who believe a minor may have registered an Account on winluck are urged to contact our support team immediately through the live chat facility or by email at [email protected].

11. Cross-Border Data Transfers

Some of winluck's service providers and technology partners may be located outside the Philippines. Where personal data is transferred to a recipient in another country, winluck ensures that appropriate safeguards are in place in accordance with NPC requirements, including contractual data processing agreements that impose data protection standards equivalent to those required under Philippine law.

winluck does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate contractual or technical safeguards.

12. Changes to This Policy

winluck reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or platform functionality. Material changes to this Policy will be communicated to registered players via the email address on record no less than fourteen (14) days before the updated Policy takes effect.

The "Last Updated" date at the top of this Policy indicates when it was most recently revised. We encourage you to review this Policy periodically. Continued use of the winluck platform following the effective date of any updates constitutes your acknowledgment of the revised Policy.

13. Contact and DPO Details

For any questions, concerns, or requests relating to this Privacy Policy or to your personal data held by winluck, please contact our Data Protection Officer:

If you are not satisfied with winluck's response to a data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. Information about the NPC and its complaint process is available through the NPC's official government website.

This Privacy Policy is written in English. In the event of any inconsistency between this English version and any translated version, the English version shall prevail. The governing law for this Policy is the law of the Republic of the Philippines.