wtfwin Privacy Policy

1. Who We Are (Data Controller)

wtfwin ("the Platform," "we," "us") is the data controller responsible for the personal information collected through the wtfwin website and all associated gaming and sports betting services. wtfwin operates under the oversight of the Philippine Amusement and Gaming Corporation (PAGCOR).

This Privacy Policy applies to all personal data processed by wtfwin in connection with the registration, operation, and use of player accounts. By registering a wtfwin account or using any of our Services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

For all privacy-related enquiries, please contact our Data Protection Officer at [email protected] (plain text — not a clickable link).

2. Personal Data We Collect

2.1 Registration Data

When you create a wtfwin account, we collect the following information:

• Full legal name (as it appears on your government-issued ID)
• Date of birth (to verify the 21+ age requirement)
• Philippine mobile number and/or email address
• Residential address
• Chosen username and password (stored in hashed form — we never store plaintext passwords)

2.2 Identity Verification (KYC) Data

As required by PAGCOR regulations and Philippine anti-money laundering legislation, we collect:

• Copy of a valid Philippine government-issued photo ID (PhilSys National ID, passport, driver's license, SSS ID, UMID, or equivalent)
• Selfie photograph for facial verification against your ID document
• Proof of address (where required for enhanced due diligence)

2.3 Financial Data

To process deposits and withdrawals, we collect payment-related information including GCash account numbers, Maya (PayMaya) account identifiers, bank account names and numbers (for InstaPay/PESONet withdrawals), and transaction reference numbers. We do not store full card numbers or CVV codes for credit/debit card transactions — these are processed by our PCI-compliant payment partners.

2.4 Gaming Activity Data

We record your gaming history on wtfwin, including game sessions, wagers placed, outcomes, bonuses claimed and played through, and sports betting markets engaged. This data is used for account management, dispute resolution, responsible gaming monitoring, and regulatory compliance.

2.5 Technical Data

When you access wtfwin, we automatically collect technical data including your IP address, device type and operating system, browser type and version, session timestamps, and geolocation data (at the country/region level) for fraud detection and regulatory compliance purposes.

3. How We Collect Your Data

wtfwin collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or respond to a promotion
• Automatically — through cookies, server logs, and similar technologies when you visit or interact with the wtfwin platform (see Section 9)
• Third parties — from identity verification service providers, payment processors, fraud detection services, and PAGCOR or government databases where legally required

4. Legal Basis for Processing

wtfwin processes your personal data on the following legal grounds under the Philippine Data Privacy Act of 2012 (RA 10173):

• Contractual necessity: Processing required to fulfil our obligations to you as a registered player — including account management, game provision, and payment processing
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160 as amended), and other applicable Philippine laws
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where these interests are not overridden by your rights
• Consent: Processing for marketing communications, where you have provided explicit opt-in consent. You may withdraw consent at any time by contacting support or updating your communication preferences in Account Settings.

5. How We Use Your Personal Data

wtfwin uses your personal data for the following purposes:

• Registering and managing your wtfwin player account
• Verifying your identity and age (21+ requirement) as required by PAGCOR
• Processing deposits, withdrawals, and all financial transactions through GCash, Maya, and Philippine bank channels
• Delivering the gaming and betting services you have requested
• Detecting and preventing fraud, money laundering, cheating, and platform abuse
• Monitoring gaming patterns to identify potential problem gambling and fulfilling our responsible gaming obligations
• Providing customer support, resolving disputes, and handling complaints
• Complying with PAGCOR reporting requirements and obligations under Philippine law
• Sending transactional communications (account notifications, transaction confirmations, security alerts)
• Sending marketing communications — only where you have opted in and subject to your right to unsubscribe at any time

6. Data Sharing & Disclosure

wtfwin does not sell, rent, or trade your personal data to third parties for commercial purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis:

6.1 Service Providers

We share data with third-party service providers who assist in operating the wtfwin platform, including identity verification providers, payment processors (GCash/Maya/banking partners), cloud hosting providers, game technology suppliers, and customer support platform providers. All such providers are contractually bound to process your data only as instructed by wtfwin and to maintain appropriate security standards.

6.2 Regulatory Authorities

We are legally obligated to share data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and law enforcement agencies where required by law, court order, or regulatory directive.

6.3 Fraud Prevention

We may share limited data with industry fraud-prevention networks and third-party risk management systems to protect the platform and its players from fraudulent activity.

6.4 Corporate Transactions

In the event of a merger, acquisition, or corporate restructuring, your personal data may be transferred to the relevant successor entity, subject to equivalent privacy protections. We will notify you of any such transfer where required by law.

7. Data Retention

wtfwin retains your personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Specific retention periods include:

• Account data: Retained for the duration of your account and for a minimum of 5 years following account closure, as required by PAGCOR and AML legislation
• KYC documents: Retained for a minimum of 5 years from the date of submission or from account closure, whichever is later
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction
• Gaming history: Retained for a minimum of 3 years following account closure for dispute resolution and regulatory compliance
• Marketing consent records: Retained until consent is withdrawn, plus 3 years thereafter as evidence of consent

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised.

8. Data Security

wtfwin implements industry-standard technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• TLS/SSL encryption for all data transmitted between your device and the wtfwin platform
• Encryption of sensitive data at rest, including KYC documents and financial records
• Password hashing using bcrypt or equivalent — plaintext passwords are never stored
• Multi-factor authentication options for player accounts
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis
• Regular security assessments and penetration testing of the wtfwin platform infrastructure
• Documented incident response procedures in the event of a data breach, including NPC notification obligations under RA 10173

In the event of a personal data breach that poses a real risk of harm to affected individuals, wtfwin will notify the National Privacy Commission and affected players within 72 hours of discovery, as required by RA 10173.

9. Cookies & Tracking Technologies

wtfwin uses cookies and similar tracking technologies to operate and improve the platform. The types of cookies used include:

• Strictly Necessary Cookies: Required for the platform to function — including session management and security tokens. These cannot be disabled without impairing your ability to use wtfwin.
• Functional Cookies: Remember your preferences (such as language and game filters) to personalize your experience
• Analytics Cookies: Collect aggregated, anonymized data on how players use the platform, helping us improve game discovery, navigation, and performance
• Fraud Detection Cookies: Used to detect unusual or suspicious activity that may indicate account compromise or platform abuse

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from accessing wtfwin, though some features may behave differently. Strictly necessary cookies cannot be disabled via browser settings.

10. Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by wtfwin:

To exercise any of the above rights, submit a written request to [email protected]. We will respond within 15 business days of receiving a verifiable request. Certain rights are subject to exceptions where legal retention or regulatory obligations require continued processing.

11. Children's Privacy (Under 21)

wtfwin's services are strictly limited to individuals who are 21 years of age or older. We do not knowingly collect personal data from any person under the age of 21. If we discover or are notified that personal data belonging to a person under 21 has been collected in connection with a wtfwin account, we will immediately suspend the account, delete the associated personal data to the extent legally permissible, and void any associated transactions.

If you are a parent or guardian and believe your child has registered on wtfwin without your knowledge, please contact us immediately at [email protected] so we can take immediate action.

12. Changes to This Privacy Policy

wtfwin reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable legislation, or PAGCOR regulatory requirements. The date of the most recent revision is displayed at the top of this document.

Where a change is material — meaning it significantly affects how we process your personal data or alters your rights — we will provide advance notice via email to your registered address or via an in-platform notification, at least 7 days before the change takes effect. Your continued use of the wtfwin platform following the effective date of any amendment constitutes your acknowledgment of the revised Privacy Policy.

13. Contact & Data Protection Officer

For all privacy-related requests, queries, or complaints, please contact the wtfwin Data Protection Officer:

• Email: [email protected]
• Live Chat: 24/7 support available via the wtfwin platform
• Response Time: Acknowledgment within 24 hours; substantive response within 15 business days

If you believe your data subject rights have not been adequately addressed, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). Information about how to file a complaint with the NPC is publicly available on their official government website.