wtfwin Privacy Policy

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, wtfwin is the personal information controller responsible for the personal data of Members collected through and in connection with the wtfwin online gaming platform accessible at wtfwin.bio.

This Privacy Policy applies to all personal data processing activities carried out by wtfwin in the course of providing its online casino, sports betting, live dealer, bingo, and associated gaming and account services to Members registered on the Platform.

wtfwin collects the following categories of personal data from Members, prospective Members, and visitors to the Platform:

wtfwin collects personal data through the following methods and sources:

• Direct Submission: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, completing responsible gaming surveys, or entering promotions.
• Automated Technical Collection: Data collected automatically when you access the Platform — including IP address, device identifiers, browser type, and navigation data — via server logs, session cookies, and similar tracking technologies. See Section 10 for full cookie details.
• Payment Processors: Transaction confirmation data and payment reference identifiers received from GCash, Maya, BPI, BDO, UnionBank, 7-Eleven, Coins.ph, and cryptocurrency network confirmations. wtfwin does not store full card numbers or complete e-wallet credentials.
• Identity Verification Services: KYC verification may be processed in whole or in part through third-party identity verification providers who cross-reference your submitted identity documents against authoritative Philippine databases. These providers operate under data processing agreements with wtfwin and are bound to equivalent data protection standards.
• Fraud Prevention Systems: Device fingerprinting and risk-scoring data generated by third-party fraud detection systems when you access the Platform or initiate financial transactions.
• Publicly Available Sources: In limited circumstances related to AML compliance investigations, wtfwin may consult publicly available information sources, including PAGCOR self-exclusion registers and regulatory sanction lists.

wtfwin processes your personal data for the following specific, documented purposes:

• Account Creation and Management: To register your account, authenticate your identity on login, manage your account settings, and provide access to all Platform Services.
• Age and Identity Verification (KYC): To verify that you meet the minimum age requirement of 21 years as mandated by PAGCOR, and to confirm your identity before processing withdrawals, as required by Philippine AML law.
• Payment Processing: To process your deposit and withdrawal requests, reconcile transactions against your wallet balance, and maintain a complete transaction history for your records and our audit requirements.
• Anti-Money Laundering (AML) and Fraud Prevention: To fulfil wtfwin's obligations under the Anti-Money Laundering Act of the Philippines (RA 9160, as amended) — including transaction monitoring, suspicious activity reporting, and customer due diligence requirements imposed by the Anti-Money Laundering Council (AMLC).
• Game Delivery and Record-Keeping: To deliver game services, record game session outcomes for dispute resolution purposes, maintain fairness logs required by game certification standards, and calculate loyalty points and VIP tier status.
• Responsible Gaming Compliance: To implement and enforce member-set deposit limits, loss limits, session timers, and self-exclusion periods; to monitor for indicators of problem gambling; and to comply with PAGCOR's responsible gaming requirements.
• Customer Support: To respond to your support inquiries, investigate complaints, resolve disputes, and maintain records of support interactions for quality assurance purposes.
• Security and Fraud Prevention: To detect, investigate, and prevent unauthorised access to accounts, multi-account fraud, payment fraud, collusion, and other prohibited conduct.
• Marketing Communications: To send you promotional offers, new game announcements, VIP tier updates, and other marketing communications — subject to your having opted in to receive such communications and not having subsequently opted out.
• Platform Improvement: To analyse usage patterns, identify technical issues, test new features, and improve the overall performance and user experience of the wtfwin Platform.
• Legal and Regulatory Compliance: To comply with all applicable Philippine laws and regulatory obligations, respond to lawful requests from competent Philippine authorities, and enforce wtfwin's Terms & Conditions.

Under the Philippine Data Privacy Act of 2012, wtfwin relies on the following lawful bases for processing your personal data:

• Consent: For marketing communications, analytics cookies, and optional preference-based personalisation. You may withdraw consent at any time without affecting the lawfulness of prior processing. Withdrawal of consent for marketing does not affect your ability to use the Platform.
• Contract Performance: Processing necessary to deliver the Services you have contracted for by accepting the wtfwin Terms & Conditions — including account management, game delivery, payment processing, and support.
• Legal Obligation: Processing required by Philippine law — KYC under PAGCOR regulations, AML obligations under RA 9160, tax reporting obligations, and compliance with NPC requirements.
• Legitimate Interests: Processing necessary for wtfwin's legitimate interests in fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by your privacy rights. wtfwin performs a balancing test before relying on this basis for any processing activity.

wtfwin does not sell your personal data. Your personal data may be shared with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment Service Providers: GCash (Mynt), Maya (PayMaya Philippines Inc.), BPI, BDO, UnionBank, and other payment processors integrated with the Platform receive transaction data necessary to process your financial instructions. These entities are independent data controllers subject to their own privacy policies and BSP oversight.
• KYC and Identity Verification Providers: Third-party identity verification specialists who process your identity documents under data processing agreements with wtfwin, operating under equivalent data protection standards.
• Game Providers: Licensed game software providers (including Pragmatic Play, PG Soft, Jili Games, and others) may receive anonymised or pseudonymised session data necessary for game certification, fairness auditing, and jackpot system operation. No personally identifiable information is shared with game providers beyond what is technically required for jackpot confirmation.
• Fraud Prevention and Security Services: Third-party fraud detection and cybersecurity providers who process device and behavioural data for the purpose of protecting your account from unauthorised access.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Bureau of Internal Revenue (BIR), and other competent Philippine government agencies, where wtfwin is legally required to disclose personal data.
• Law Enforcement: Philippine law enforcement agencies (NBI, PNP, DOJ) where disclosure is required by a lawful court order, warrant, or equivalent legal process.
• Professional Advisors: Legal counsel, auditors, and compliance consultants engaged by wtfwin, who are bound by professional confidentiality obligations.

wtfwin retains personal data only for as long as necessary for the purposes for which it was collected or as required by applicable Philippine law. The following general retention schedule applies:

Upon expiry of the applicable retention period, personal data will be securely deleted, anonymised, or aggregated such that individual re-identification is no longer possible. You may request earlier deletion in accordance with your rights under Section 9, subject to overriding legal retention requirements.

wtfwin implements technical and organisational security measures appropriate to the nature and sensitivity of the personal data we process. These measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your device and wtfwin servers is protected by TLS 1.2 or higher (256-bit encryption). The padlock symbol visible in your browser when accessing wtfwin.bio confirms an active encrypted connection.
• Encryption at Rest: Sensitive personal data — including identity document scans and financial data — is encrypted at rest using AES-256 encryption on wtfwin's servers.
• Password Hashing: Account passwords are stored using a one-way cryptographic hashing algorithm with salt. wtfwin staff cannot read your password; if you forget it, it must be reset, not retrieved.
• Two-Factor Authentication: SMS-based OTP authentication is implemented for new device logins and high-risk account actions, providing a second factor of verification beyond your password.
• Access Controls: Access to personal data on wtfwin's internal systems is restricted to authorised personnel who require it to perform their specific job functions. Access is logged, monitored, and reviewed regularly.
• Penetration Testing: wtfwin engages third-party security firms to conduct regular penetration testing of the Platform's technical infrastructure.
• Data Breach Response Plan: wtfwin maintains a documented incident response procedure consistent with NPC Circular No. 16-03. In the event of a breach, affected Members and the NPC will be notified within 72 hours of wtfwin's awareness of the incident.

Under Republic Act No. 10173 (Data Privacy Act of 2012), you have the following rights in relation to your personal data held by wtfwin. To exercise any of these rights, contact the wtfwin Data Protection Officer as described in Section 13. Requests will be acknowledged within five (5) business days and fulfilled within thirty (30) calendar days, unless an extension is required under complex circumstances.

• Right to Be Informed: The right to be informed that your personal data is being processed, the purposes of processing, and the basis on which it is processed. This Privacy Policy serves as the primary vehicle for fulfilling this obligation.
• Right to Access: The right to obtain a copy of your personal data held by wtfwin, including information on how it was obtained, its purposes, and to whom it has been disclosed. Identity verification is required before any access response is provided.
• Right to Rectification: The right to have inaccurate, incomplete, outdated, false, or unlawfully obtained personal data corrected or updated. Account details (name, mobile number, email) may be updated through the account settings or by contacting support.
• Right to Erasure / Right to be Forgotten: The right to request the deletion of your personal data where: (a) it is no longer necessary for its original purpose; (b) you have withdrawn consent (where consent was the processing basis); or (c) it was unlawfully processed. This right is subject to overriding legal retention obligations — particularly the 5-year AML record-keeping requirement.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., CSV or JSON), and to request its transmission to another organisation, where technically feasible.
• Right to Object: The right to object to: (a) direct marketing communications (honoured immediately upon request); (b) processing based on legitimate interests (subject to wtfwin demonstrating compelling legitimate grounds that override your interests); and (c) profiling for direct marketing purposes.
• Right to File a Complaint: If you believe your data privacy rights have been violated, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines. wtfwin encourages Members to contact our DPO in the first instance to seek resolution before escalating to the NPC.
• Right to Damages: The right to be compensated for damages sustained from inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised processing of your personal data, as provided under Section 16(f) of RA 10173.

wtfwin uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyse usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential to the operation of the Platform — session authentication tokens, security tokens, and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember your preferences — language settings, game lobby display preferences, and responsible gaming timer configurations. Disabling these will result in loss of personalised settings between sessions.
• Analytics Cookies: Collect anonymised usage data to help wtfwin understand how the Platform is used, identify performance bottlenecks, and prioritise feature improvements. These are consent-based and may be declined.
• Security and Fraud Detection Cookies: Used by wtfwin's fraud prevention systems to fingerprint devices and detect anomalous access patterns. These are treated as strictly necessary given the financial nature of the Platform.

wtfwin does not deploy third-party advertising or retargeting cookies. No cookie data is shared with advertising networks or marketing platforms. You may manage cookie preferences via your browser settings; however, disabling strictly necessary cookies will impair your ability to use the Platform.

The wtfwin Platform is strictly intended for individuals who are 21 years of age or older. wtfwin does not knowingly collect, store, or process personal data from persons under 21 years of age.

• Registration requires confirmation that the applicant is 21 or older. This is enforced through KYC identity document verification.
• If wtfwin discovers that an account has been registered by or on behalf of a person under 21, that account will be immediately suspended, all personal data will be securely deleted to the extent permitted by applicable law, and any balances will be processed in accordance with wtfwin's Terms & Conditions.
• Parents and guardians are encouraged to use device-level parental controls to prevent minors from accessing gambling platforms, including wtfwin.
• If you believe that a minor has submitted personal data to wtfwin, please contact our Data Protection Officer immediately using the contact details in Section 13.

wtfwin reserves the right to update this Privacy Policy at any time to reflect changes in our processing practices, applicable Philippine law, NPC guidance, or PAGCOR requirements. The following process applies to all Policy amendments:

• The "Last Revised" date displayed at the top of this Policy will be updated whenever a change takes effect.
• Material changes — those that significantly affect your rights or how your personal data is processed — will be communicated to registered Members via email to your registered address and/or via an in-platform notification, no less than fourteen (14) days before the change takes effect where reasonably practicable.
• Continued use of the Platform after the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not agree to the revised Policy, you must cease using the Platform and request account closure.
• Minor updates — typographical corrections, clarifications that do not alter processing activities, and updates required by regulatory guidance — may be made without advance notice.

We recommend reviewing this Privacy Policy periodically to stay informed of how wtfwin protects your personal data.

For all privacy-related inquiries, data subject rights requests, complaints regarding wtfwin's data handling practices, or reports of suspected data breaches, please contact:

All data subject rights requests must include sufficient information to verify your identity before wtfwin can disclose, correct, or delete personal data. This typically requires your registered mobile number, registered email address, and, for high-sensitivity requests, a copy of the government-issued ID on file in your account. This verification requirement is a security measure to protect you from unauthorised access to your personal data by third parties.

If you are not satisfied with wtfwin's response to your privacy concern, you have the right to escalate your complaint directly to the National Privacy Commission of the Philippines. Information on how to file a complaint with the NPC is available on the NPC's official website.