auwin Privacy Policy

1 Data Controller

The data controller responsible for the personal information collected and processed through the auwin platform is the operator of auwin.app, a PAGCOR-licensed online gaming entity operating in the Republic of the Philippines (hereinafter referred to as "auwin," "we," "us," or "the Company").

As data controller, auwin determines the purposes and means of processing your personal data and is accountable for ensuring that such processing complies with the Philippine Data Privacy Act of 2012, its Implementing Rules and Regulations, and all applicable issuances of the National Privacy Commission.

2 Personal Data We Collect

auwin collects the following categories of personal data in connection with your account and use of the platform:

2.1 Identity & Registration Data

• Full legal name as it appears on your government-issued identification;
• Date of birth (used to verify that you meet the 21-year minimum age requirement);
• Residential address in the Philippines (province, city/municipality, barangay, postal code);
• Nationality and citizenship;
• Gender (where voluntarily provided during registration).

2.2 Contact & Account Data

• Email address registered to your auwin account;
• Mobile phone number registered to your account (used for OTP verification and account communications);
• Username and encrypted password hash (plaintext passwords are never stored);
• Account preferences and responsible gaming settings you have configured.

2.3 Identity Verification (KYC) Data

• Copies of government-issued photo identification (Philippine passport, driver's license, SSS ID, PhilHealth ID, UMID, or equivalent);
• Proof of address documentation (utility bill, bank statement, or equivalent issued within the last three months);
• Selfie or live photo where required by our KYC procedures for identity confirmation;
• Source-of-funds documentation where required by PAGCOR's anti-money laundering compliance requirements.

2.4 Financial & Transaction Data

• GCash mobile number and transaction reference numbers associated with deposits and withdrawals;
• PayMaya account reference details for transactions conducted via PayMaya;
• Bank account details (account name, account number, bank name) for bank transfer withdrawals to BPI, BDO, Metrobank, or other supported banks;
• Masked Visa or Mastercard details for card-based transactions (full card numbers are never stored by auwin — they are tokenized by the card processor);
• Complete history of deposits, withdrawals, and bonus transactions on your account.

2.5 Gaming Activity Data

• Full history of game sessions, bets placed, wins, and losses across all game categories;
• Responsible gaming settings and any self-exclusion or limit requests you have made;
• Game preferences and in-game behaviour data collected for platform improvement purposes.

2.6 Technical & Device Data

• IP address at the time of login and during active sessions;
• Device type, operating system, and browser version;
• Session duration, pages visited, and features used within the platform;
• Geolocation data (at country/region level, derived from IP address) used for fraud detection and regulatory compliance.

3 How We Collect Your Data

auwin collects personal data through the following means:

1. Directly from you — during account registration, KYC submission, payment processing, support interactions, and voluntary communications you initiate with auwin.
2. Automatically during platform use — through server logs, session tracking, and platform analytics that record technical and behavioural data as you interact with auwin.app.
3. From payment providers — GCash, PayMaya, and banking partners transmit transaction confirmation data to auwin as part of normal payment processing.
4. From identity verification services — where auwin employs third-party KYC service providers to verify the authenticity of identity documents you submit.
5. From cookies and similar tracking technologies — as described in Section 8 of this Policy.

4 Purpose & Legal Basis for Processing

auwin processes your personal data for the following purposes, each supported by a lawful basis under the Philippine Data Privacy Act:

5 Sharing Your Personal Data

auwin may share your personal data with the following categories of recipients:

5.1 Payment Processors

GCash (GXchange Inc.), PayMaya (Voyager Innovations), Visa, Mastercard, and banking partners receive transaction data necessary to process your deposits and withdrawals. These parties process your financial data under their own privacy policies and applicable Philippine financial regulations.

5.2 Identity Verification Partners

Third-party KYC service providers process the identity documents you submit during verification. These partners are contractually bound to process your data solely for the purpose of identity verification on behalf of auwin and in compliance with applicable Philippine law.

5.3 Game Technology Providers

auwin's game providers — including JILI Games, PG Soft, Pragmatic Play, and other licensed studios — receive anonymized or pseudonymized session data necessary to facilitate the delivery of their games. These providers do not receive your full identity or financial details.

5.4 Regulatory and Law Enforcement Authorities

auwin is required by PAGCOR regulations and Philippine law to report certain transactions and account information to the Philippine Amusement and Gaming Corporation, the Anti-Money Laundering Council (AMLC), and, where legally compelled, to law enforcement agencies. auwin will comply with valid legal orders and regulatory directives without prior notice to the data subject where the law so requires.

5.5 Professional Advisers

Lawyers, auditors, accountants, and other professional advisers engaged by auwin may access personal data on a confidential basis where necessary to provide professional services to the Company.

6 Data Retention

auwin retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to longer retention periods required by law. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents re-identification. Where data has been anonymized, it may be retained indefinitely for statistical and analytical purposes.

7 Data Security

auwin implements technical and organizational security measures appropriate to the nature and sensitivity of the personal data we process. These measures include:

• Encryption in transit: All data transmitted between your browser and auwin.app is encrypted using SSL/TLS protocols. Look for the padlock icon and https:// in your browser address bar;
• Encryption at rest: Personal data and financial records stored on auwin's servers are encrypted at rest using industry-standard encryption;
• Access controls: Access to personal data is restricted to authorised personnel based on role and need-to-know principles. All staff with access to personal data are subject to confidentiality obligations;
• Password security: User passwords are stored as salted cryptographic hashes. Plaintext passwords are never stored or visible to any auwin employee;
• Penetration testing and security audits: auwin conducts regular security assessments to identify and remediate vulnerabilities;
• Incident response: auwin maintains a data breach response procedure. In the event of a personal data breach that poses a real risk to data subjects, auwin will notify the National Privacy Commission and affected individuals within the timeframes prescribed by law.

8 Cookies & Tracking Technologies

auwin uses cookies and similar technologies (including local storage and session tokens) on auwin.app for the following purposes:

8.1 Strictly Necessary Cookies

These cookies are essential for you to use the platform. They manage your login session, maintain your authenticated state as you navigate between pages, and support security features. These cookies cannot be disabled without preventing access to your account.

8.2 Functional Cookies

These cookies remember your preferences — such as language settings, game display preferences, and responsible gaming reminder configurations — so you do not need to re-enter them each session. They do not track your activity across other websites.

8.3 Analytics Cookies

auwin uses first-party analytics to understand how Players use the platform — which game categories are most visited, how long sessions last, and where technical issues occur. This data is aggregated and used solely to improve platform performance and user experience. auwin does not use third-party advertising networks or tracking pixels for cross-site ad targeting.

8.4 Managing Cookies

You may control non-essential cookies through your browser settings. Note that disabling strictly necessary cookies will prevent you from accessing your auwin account. Most modern browsers allow you to view, manage, and delete cookies through their privacy or settings menu.

9 Your Data Privacy Rights

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by auwin:

To exercise any of the above rights, contact auwin's Data Protection Officer as described in Section 13. We will respond to valid requests within thirty (30) calendar days. In complex cases, we may extend this period by a further thirty (30) days with written notice to you.

10 Minors

Parents and guardians who believe that a minor may have registered an account on auwin are encouraged to contact us immediately at [email protected]. We take such reports seriously and will investigate and act promptly upon receiving credible information.

11 International Data Transfers

Some of auwin's game technology providers and infrastructure partners are located outside the Philippines. Where personal data is transferred to entities in other countries, auwin takes appropriate measures to ensure that such transfers comply with the Philippine Data Privacy Act, including:

• Entering into data processing agreements that incorporate contractual provisions equivalent to those required under Philippine data privacy law;
• Ensuring that recipient countries or entities provide an adequate level of data protection as assessed by the National Privacy Commission's guidelines;
• Limiting the scope of data transferred internationally to the minimum necessary for the specific processing purpose.

Where your personal data is processed by a game provider outside the Philippines, that provider acts as a data processor under contract with auwin and is not permitted to use your data for their own independent purposes.

12 Changes to This Privacy Policy

auwin may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or platform features. When material changes are made — meaning changes that significantly affect how we handle your personal data or your privacy rights — auwin will notify registered Players via email and/or a prominent notice on the platform prior to the changes taking effect.

The current version of this Privacy Policy, including the effective date shown at the top of this page, is always accessible at auwin.app/privacy-policy. We encourage you to review this Policy periodically. Your continued use of the auwin platform following notification of changes constitutes your acknowledgement of the updated Policy.

13 Data Protection Officer

In compliance with Section 21 of the Philippine Data Privacy Act and National Privacy Commission Circular No. 16-01, auwin has designated a Data Protection Officer (DPO) responsible for ensuring compliance with this Policy and with applicable data privacy law.

The auwin Data Protection Officer is the appropriate point of contact for:

• Exercising your data subject rights as described in Section 9;
• Raising concerns about how your personal data is being handled;
• Requesting a copy of auwin's Privacy Management Program or related documentation;
• Reporting a suspected unauthorized access to or misuse of your personal data.

You may contact the auwin Data Protection Officer at: [email protected] with the subject line "Data Privacy — DPO Request."

14 Contact & Regulatory Complaints

For all data privacy inquiries, requests to exercise your rights, or general questions about this Privacy Policy, contact us:

• Live Chat: Available 24/7 at auwin.app — staffed by Filipino support agents
• Email: [email protected] — responses within 24 hours on business days

If you are not satisfied with our response to a data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. The NPC oversees the enforcement of the Data Privacy Act and accepts complaints from data subjects whose rights have been violated. Information on how to file a complaint with the NPC is available on the NPC's official government website.