26phwin Privacy Policy

1. Introduction

26phwin is committed to protecting the privacy and personal information of every Filipino player who registers and plays on our Platform. As a PAGCOR-regulated online gaming operator, we are also subject to regulatory requirements regarding the collection, retention, and reporting of certain member data. This Policy is designed to be transparent about all data practices — not to bury important information in legal language that no one reads.

We encourage you to read this Policy in full. If anything is unclear, our Data Protection Officer (DPO) can be reached at the contact details in Section 14 of this Policy. For matters relating to your account terms and game rules, please refer to the Terms & Conditions.

2. Data Controller Identity

The data controller responsible for your personal information under this Policy is:

As data controller, 26phwin determines the purposes and means of processing your personal data and is accountable to you and to the National Privacy Commission of the Philippines for its data practices.

3. Personal Data We Collect

26phwin collects the following categories of personal data from members and Platform users:

We do not collect sensitive personal information as defined under the Data Privacy Act (such as health data, sexual orientation, or political affiliation) except where expressly required by PAGCOR regulations for responsible gaming or self-exclusion purposes.

4. How We Collect Your Data

26phwin collects your personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or submitting responsible gaming requests;
• Automated collection: Technical data collected automatically when you access the Platform, including IP address, device identifiers, browser data, and clickstream data via cookies and similar technologies (see Section 7);
• Third-party sources: Identity verification data from KYC service providers; payment data from GCash, PayMaya, and partner banks; fraud detection data from security providers; PAGCOR reporting data as required by regulation.

5. Purpose & Legal Basis for Processing

26phwin processes your personal data for the following purposes, each grounded in a lawful basis under the Data Privacy Act of 2012:

• Account creation and management — to establish and maintain your 26phwin account; legal basis: performance of a contract;
• Identity verification (KYC) — to verify your age (21+) and identity as required by PAGCOR; legal basis: compliance with a legal obligation;
• Payment processing — to facilitate deposits, withdrawals, and bonus credits; legal basis: performance of a contract;
• Gaming operations — to deliver games, record results, and calculate payouts; legal basis: performance of a contract;
• Fraud prevention and security — to detect unauthorized access, money laundering, and abuse; legal basis: legitimate interests and legal obligation;
• Regulatory compliance — to meet PAGCOR reporting, anti-money laundering, and responsible gaming obligations; legal basis: compliance with a legal obligation;
• Responsible gaming — to enforce self-exclusion requests, deposit limits, and cooling-off periods; legal basis: legal obligation and consent;
• Customer support — to respond to your enquiries and resolve complaints; legal basis: performance of a contract;
• Marketing communications — to send you promotional offers and updates (only with your explicit consent); legal basis: consent. You may withdraw consent at any time.

6. Data Sharing & Disclosure

26phwin does not sell your personal data to third parties. We share your data only in the following limited circumstances and with appropriate safeguards in place:

• PAGCOR and regulatory authorities: We are required by law to report certain gaming and financial data to PAGCOR and, where applicable, to the Anti-Money Laundering Council (AMLC);
• Payment service providers: GCash, PayMaya, BPI, BDO, Metrobank, and other payment processors receive only the payment data necessary to process your transactions;
• KYC and identity verification providers: Third-party identity verification services receive your identity documents solely for the purpose of age and identity verification;
• IT and security service providers: Hosting, fraud detection, and cybersecurity providers who process data on our behalf under data processing agreements consistent with the Data Privacy Act;
• Law enforcement and courts: Where we are legally compelled to disclose data by court order, subpoena, or lawful request from Philippine law enforcement agencies;
• Business transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred to the acquiring entity subject to the same privacy protections as described in this Policy.

All third-party service providers engaged by 26phwin are contractually bound to process your personal data only as instructed and in compliance with the Data Privacy Act of 2012.

7. Cookies & Tracking Technologies

26phwin uses cookies and similar tracking technologies to operate the Platform and improve your experience. The cookies we use fall into the following categories:

• Essential cookies: Required for the Platform to function — session management, login state, security tokens. These cannot be disabled without breaking core Platform functionality;
• Analytics cookies: Used to understand how members navigate the Platform — page views, session duration, feature usage. This data is aggregated and anonymized where possible;
• Preference cookies: Store your personal preferences such as language settings and display preferences;
• Security cookies: Assist in detecting fraudulent sessions, bot activity, and unauthorized access attempts.

By using the 26phwin Platform, you consent to the use of essential and security cookies. Analytics and preference cookies may be managed through your browser settings. Note that disabling certain cookies may affect Platform functionality.

8. Data Retention

26phwin retains your personal data for the following periods:

• Account and identity data: For the duration of your active 26phwin membership, plus a minimum of five (5) years following account closure, as required by PAGCOR regulations and the Anti-Money Laundering Act;
• Financial transaction records: A minimum of five (5) years from the date of the transaction, in compliance with AMLC requirements;
• Gaming activity logs: Three (3) years from the date of each gaming session, unless a longer period is required by PAGCOR or other applicable regulation;
• Support and correspondence records: Three (3) years from the date of the last interaction;
• Marketing consent records: Until you withdraw your consent, plus one (1) year thereafter as an audit record.

After applicable retention periods expire, personal data is securely deleted or anonymized in accordance with 26phwin's data disposal procedures.

9. Data Security

26phwin implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction:

• All data transmitted between your device and 26phwin servers is encrypted using industry-standard 256-bit SSL/TLS encryption;
• Passwords are stored in hashed format using industry-standard algorithms — 26phwin never stores plaintext passwords;
• Access to personal data within the 26phwin organization is restricted to authorized personnel on a strict need-to-know basis;
• Regular security audits and penetration testing are conducted on Platform infrastructure;
• Multi-factor authentication is available to all members for additional account protection;
• A documented incident response plan is maintained for the handling of data breaches, including NPC notification obligations under the Data Privacy Act.

10. Your Data Subject Rights

Under the Data Privacy Act of 2012 and its Implementing Rules, you have the following rights regarding your personal data held by 26phwin:

To exercise any of these rights, submit a written request to our Data Protection Officer at [email protected]. We will verify your identity before processing any data subject request and respond within the timeframes prescribed by NPC regulations.

11. Children's Privacy & Age Restriction

Parents and guardians who believe their child may have registered on the 26phwin Platform should contact our support team immediately at [email protected] for immediate account investigation and closure.

12. Cross-Border Data Transfers

26phwin's primary data processing infrastructure is located within the Philippines or in jurisdictions that provide an adequate level of data protection as recognized by the National Privacy Commission. Where personal data is transferred to service providers located outside the Philippines (for example, international fraud detection or KYC verification providers), such transfers are made subject to:

• Data processing agreements incorporating NPC-recognized data transfer safeguards;
• Binding contractual clauses requiring the recipient to protect personal data to a standard consistent with the Data Privacy Act of 2012;
• Transfers occurring only to jurisdictions with adequate data protection frameworks.

13. Updates to This Privacy Policy

26phwin may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or Platform features. In the event of material changes, we will notify you by email to your registered 26phwin account address and/or by posting a prominent notice on the Platform at least 7 days before the changes take effect. The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. We encourage you to review this Policy periodically. Continued use of the Platform after the effective date of an amended Policy constitutes your acceptance of the updated terms.

14. Contact & Data Protection Officer

For all privacy-related enquiries, data subject requests, or concerns regarding 26phwin's data practices, please contact our Data Protection Officer:

If you are not satisfied with our response to your privacy concern, you have the right to lodge a complaint directly with the National Privacy Commission of the Philippines (privacy.gov.ph).