winjili Privacy Policy

1. Overview & Data Controller Identity

winjili is the data controller responsible for the personal information of all registered players and visitors to the winjili platform. As a data controller, winjili determines the purposes and means of processing your personal data and is accountable for ensuring that such processing complies with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations ("IRR"), as enforced by the National Privacy Commission ("NPC").

winjili operates under the regulatory oversight of the Philippine Amusement and Gaming Corporation (PAGCOR). Our data processing activities are conducted in a manner consistent with PAGCOR's player protection requirements and the NPC's data privacy guidelines for online gaming operators.

This Policy covers all personal data collected through the winjili website, mobile-optimized platform, customer support channels, and any other touchpoints through which you interact with winjili. It does not apply to third-party websites or services that may be referenced on the winjili platform.

2. Personal Data We Collect

winjili collects only the personal data that is necessary to provide you with a safe, compliant, and enjoyable gaming experience. The categories of personal data we collect include:

2.1 Identity & Registration Data

• Full legal name as it appears on your government-issued ID
• Date of birth (used to verify the 21+ age requirement)
• Gender
• Nationality and country of residence
• Government-issued ID number (e.g., PhilSys ID, passport, driver's license, SSS/GSIS/PRC/voter's ID)
• Username and encrypted password

2.2 Contact Data

• Email address
• Philippine mobile number
• Residential address (province, city/municipality, barangay, ZIP code)

2.3 Financial & Transaction Data

• GCash or Maya account details (mobile number only; we do not store PINs or passwords)
• Bank account name and number for bank transfer withdrawals
• Debit card details (card number, expiry — stored in tokenized form only)
• Deposit and withdrawal history
• Account balance and transaction timestamps

2.4 Gaming Activity Data

• Game session logs (games played, duration, bet amounts, outcomes)
• Bonus and promotion usage history
• Responsible gaming tool settings (deposit limits, self-exclusion status)

2.5 Technical & Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Session timestamps and login history
• Cookie identifiers and similar tracking data (see Section 9)

2.6 Communications Data

• Customer support chat transcripts and email correspondence
• Feedback, complaints, and dispute records
• Marketing preference settings

3. How We Collect Your Data

winjili collects personal data through the following means:

• Direct collection: Information you provide when registering a winjili account, completing KYC verification, making deposits or withdrawals, contacting support, or updating your account profile.
• Automated collection: Technical and device data collected automatically when you access the winjili platform, including through cookies, web beacons, and server logs.
• Third-party sources: Identity verification data from KYC service providers; payment confirmation data from GCash, Maya, and banking partners; fraud detection signals from security service providers.
• Regulatory sources: Information shared with winjili by PAGCOR or other competent authorities in connection with regulatory compliance obligations.

4. Purpose of Processing

winjili processes your personal data for the following specific and legitimate purposes:

5. Legal Basis for Processing

Under the Philippine Data Privacy Act, winjili processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and winjili (i.e., providing gaming services, processing payments, managing your account).
• Legal obligation: Processing required to comply with applicable Philippine laws, including the DPA, Anti-Money Laundering Act (AMLA), and PAGCOR regulations.
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where such interests are not overridden by your rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have given explicit, informed consent. You may withdraw consent at any time.

6. Data Sharing & Third Parties

winjili does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the following limited circumstances:

• Payment processors: GCash, Maya, and banking partners receive only the transaction data necessary to process your deposits and withdrawals.
• KYC verification providers: Identity data is shared with licensed third-party KYC service providers solely for the purpose of verifying your identity and age.
• Fraud and security providers: Technical and behavioral data may be shared with fraud detection service providers to protect the integrity of the winjili platform.
• Regulatory authorities: winjili is required by law to share certain data with PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other competent Philippine government authorities upon lawful request.
• Legal proceedings: Personal data may be disclosed to courts, law enforcement, or legal counsel where required by a valid court order or legal process.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity, subject to the same privacy protections described in this Policy.

All third-party service providers engaged by winjili are bound by data processing agreements that require them to process your personal data only on winjili's instructions and in compliance with the Philippine Data Privacy Act.

7. Data Retention

winjili retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

• Account and identity data: Retained for the duration of your winjili account and for a minimum of five (5) years after account closure, in compliance with PAGCOR and AMLC record-keeping requirements.
• Transaction and financial data: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act.
• Gaming activity logs: Retained for three (3) years from the date of each session, or longer if required for dispute resolution or regulatory purposes.
• Customer support records: Retained for three (3) years from the date of the last interaction.
• Marketing consent records: Retained until you withdraw consent, plus one (1) year thereafter for compliance documentation.
• Technical and device data: Retained for twelve (12) months from collection, unless required longer for security investigations.

Upon expiry of the applicable retention period, winjili will securely delete or anonymize your personal data in accordance with NPC-approved data disposal procedures.

8. Data Security

winjili implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the winjili platform;
• Encryption at rest for sensitive personal and financial data stored on winjili servers;
• Tokenization of payment card details — winjili never stores raw card numbers;
• Multi-factor authentication (MFA) options for player accounts;
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis;
• Regular security audits and penetration testing of the winjili platform;
• Incident response procedures aligned with NPC breach notification requirements (72-hour notification for high-risk breaches).

While winjili takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for keeping your winjili account credentials confidential and for notifying us immediately of any suspected unauthorized access.

9. Cookies & Tracking Technologies

winjili uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyze usage patterns. The following types of cookies are used:

• Strictly necessary cookies: Required for the winjili platform to function (e.g., session management, login state, security tokens). These cannot be disabled.
• Functional cookies: Remember your language preferences, display settings, and responsible gaming tool configurations.
• Analytics cookies: Collect aggregated, anonymized data about how players use the winjili platform to help us improve the service. Used only with your consent.
• Marketing cookies: Used to deliver relevant promotional content about winjili. Used only with your explicit consent.

You can manage your cookie preferences through your browser settings or the winjili cookie preference center. Disabling non-essential cookies will not affect your ability to use the core winjili gaming services.

10. Your Data Privacy Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by winjili:

• Right to be informed: You have the right to know what personal data winjili collects about you and how it is processed — which is the purpose of this Policy.
• Right of access: You may request a copy of the personal data winjili holds about you at any time.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data in your winjili account.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to winjili's legal retention obligations.
• Right to object: You may object to the processing of your personal data for direct marketing purposes at any time.
• Right to data portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe winjili has violated your data privacy rights.

To exercise any of the above rights, please contact the winjili Data Protection Officer (DPO) using the contact details in Section 14. winjili will respond to all verified data subject requests within fifteen (15) business days, as required by the DPA IRR.

11. Minors & Age Policy

The winjili platform is strictly intended for persons aged 21 years and above, in compliance with PAGCOR regulations governing online gaming in the Philippines. winjili does not knowingly collect personal data from persons under 21 years of age.

If winjili discovers that personal data has been collected from a person under 21, the account will be immediately suspended, all associated data will be deleted (subject to any legal retention obligations), and any deposits will be returned in accordance with applicable regulations.

If you are a parent or guardian and believe that a minor has registered a winjili account, please contact our support team immediately so that we can take appropriate action.

12. Cross-Border Data Transfers

Some of winjili's third-party service providers (such as KYC verification platforms, cloud infrastructure providers, and fraud detection services) may process personal data outside the Philippines. Where such cross-border transfers occur, winjili ensures that:

• The recipient country provides an adequate level of data protection, as recognized by the NPC; or
• Appropriate safeguards are in place, such as standard contractual clauses or binding corporate rules approved by the NPC; and
• The transfer is limited to the minimum data necessary for the specific processing purpose.

winjili will not transfer your personal data to any jurisdiction that does not provide adequate protection without your explicit consent, except where required by Philippine law.

13. Changes to This Privacy Policy

winjili may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, or NPC guidance. When material changes are made, winjili will notify registered players via the email address associated with their account and by displaying a prominent notice on the winjili platform for at least thirty (30) days.

The effective date of the current version of this Policy is always displayed at the top of this page. Your continued use of the winjili platform after the effective date of any revised Policy constitutes your acceptance of the changes. If you do not agree to the revised Policy, you must stop using the winjili platform and may request account closure as described in our Terms & Conditions.

14. Contact Us & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by winjili, please contact our Data Protection Officer (DPO):

You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated. The NPC can be reached through its official government channels.

For responsible gaming concerns and self-exclusion requests, please visit our Responsible Gaming page. For the full terms governing your use of winjili, please review our Terms & Conditions.