winluck Privacy Policy

This Privacy Policy is issued by winluck ("winluck," "we," "us," or "our"), the operator of the online casino platform accessible at winluck.org and all associated subdomains and mobile interfaces (the "Platform"). winluck is operated for the benefit of players located in the Republic of the Philippines.

For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations, winluck acts as the personal information controller in respect of the personal data of registered Players and Platform visitors.

This Privacy Policy applies to all personal data collected by winluck through the Platform, including data collected during account registration, gameplay, payment processing, customer support interactions, and general Platform use. It should be read together with our Terms & Conditions.

winluck collects the following categories of personal data from Players and Platform users:

winluck does not intentionally collect sensitive personal information beyond what is strictly necessary for identity verification and regulatory compliance. Where sensitive data is collected (such as government ID details), it is handled with enhanced security controls.

winluck collects personal data through the following means:

• Direct collection: Data you provide when registering an account, completing identity verification, making deposits or withdrawals, contacting customer support, or participating in promotions;
• Automated collection: Technical data collected automatically when you access the Platform, including IP address, device identifiers, browser information, and session activity via cookies and similar technologies;
• Third-party sources: Identity verification data from accredited verification service providers; fraud and risk screening data from anti-fraud partners; payment data from GCash, PayMaya, and banking partners in connection with transaction processing;
• Regulatory sources: Data received from PAGCOR or other competent Philippine authorities in connection with licensing, compliance, or investigation requirements.

winluck uses your personal data for the following specific purposes:

• Account management: To create, maintain, and administer your winluck account, including processing your registration, verifying your identity and age (21+), and managing your account settings;
• Service delivery: To provide access to the Platform's games, process deposits and withdrawals via GCash, PayMaya, and bank transfer, and deliver customer support;
• Regulatory compliance: To comply with anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, PAGCOR licensing conditions, and other applicable Philippine laws and regulations;
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, and other security threats to the Platform and its players;
• Responsible gaming: To monitor gaming activity for signs of problem gambling, enforce self-exclusion requests, and administer responsible gaming tools in accordance with our Responsible Gaming Policy;
• Communications: To send you transactional notifications (account activity, deposit/withdrawal confirmations), service updates, and — where you have consented — promotional communications about winluck offers;
• Platform improvement: To analyze aggregated, anonymized usage data to improve the Platform's performance, game selection, and user experience;
• Legal proceedings: To establish, exercise, or defend legal claims in connection with your use of the Platform.

winluck will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your consent or establishing a separate legal basis for the new processing activity.

Under the Data Privacy Act of 2012, winluck processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions you agreed to upon registration, including account management, game provision, and payment processing;
• Legal obligation: Processing required to comply with applicable Philippine laws and regulations, including AML/KYC obligations under Republic Act No. 9160 (Anti-Money Laundering Act) and PAGCOR licensing requirements;
• Legitimate interests: Processing necessary for winluck's legitimate interests in fraud prevention, Platform security, and responsible gaming enforcement, where those interests are not overridden by your data protection rights;
• Consent: Processing for marketing communications and non-essential cookies, where you have provided explicit, freely given, and informed consent. You may withdraw consent at any time by contacting winluck's support team or updating your account preferences.

winluck does not sell, rent, or trade your personal data to third parties for their own marketing purposes. winluck may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment processors: GCash, PayMaya/Maya, and Philippine banking partners (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank) for the purpose of processing deposits and withdrawals;
• Identity verification providers: Accredited KYC and age verification service providers engaged to verify your identity and confirm you meet the 21+ age requirement;
• Anti-fraud and security partners: Third-party fraud detection and risk management services used to protect the Platform and its players from fraudulent activity;
• Game content providers: Licensed game studios and content providers whose games are available on the Platform, to the extent necessary for game operation and dispute resolution;
• Regulatory and law enforcement authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other competent Philippine authorities, where disclosure is required by law or regulation;
• Professional advisers: Legal counsel, auditors, and other professional advisers engaged by winluck in connection with the operation of the Platform, subject to professional confidentiality obligations.

All third parties with whom winluck shares personal data are required to process that data in accordance with applicable Philippine data protection law and winluck's data processing requirements. winluck does not transfer personal data outside the Philippines except where required by law or where adequate data protection safeguards are in place.

winluck uses cookies and similar tracking technologies on the Platform to enhance your experience, maintain your session, and analyze Platform usage. The following types of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function. These include session cookies that keep you logged in during your visit. These cannot be disabled without affecting Platform functionality;
• Functional cookies: Remember your preferences (such as language settings and responsible gaming limits) to personalize your experience across sessions;
• Analytics cookies: Collect anonymized data about how players use the Platform (pages visited, session duration, game preferences) to help winluck improve its services. This data is aggregated and does not identify individual players;
• Security cookies: Used to detect and prevent fraudulent activity, unauthorized access attempts, and bot traffic on the Platform.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. winluck does not use third-party advertising cookies or behavioral tracking cookies for cross-site advertising purposes.

winluck implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the winluck Platform;
• Encryption of sensitive data at rest, including financial data and government ID information;
• Role-based access controls ensuring that winluck staff can only access personal data necessary for their specific job functions;
• Regular security assessments, penetration testing, and vulnerability scanning of the Platform;
• Two-factor authentication (OTP) available for all player accounts;
• Automated monitoring systems to detect and respond to suspicious account activity in real time;
• Staff training on data protection obligations and secure data handling practices.

While winluck takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, winluck will notify you and the National Privacy Commission in accordance with the requirements of the Data Privacy Act of 2012.

winluck retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and regulation. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Anonymized data may be retained indefinitely for statistical and analytical purposes, as it no longer constitutes personal data.

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by winluck. You may exercise any of these rights by contacting our Data Protection Officer using the contact details in Section 13.

• Right to Access: You may request a copy of the personal data winluck holds about you, together with information about how it is being used;
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data winluck holds about you;
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to winluck's legal retention obligations;
• Right to Object: You may object to processing of your personal data based on legitimate interests, including direct marketing;
• Right to Block or Restrict: You may request that winluck restricts processing of your personal data in certain circumstances, such as while a rectification request is being assessed;
• Right to Data Portability: You may request a copy of personal data you have provided to winluck in a structured, commonly used, machine-readable format;
• Right to Damages: You have the right to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.

winluck will respond to data subject requests within thirty (30) days of receipt. Where a request is complex or winluck receives a high volume of requests, this period may be extended by a further thirty (30) days, with notice provided to you. winluck reserves the right to decline requests that are manifestly unfounded, excessive, or that would require disclosure of third-party personal data.

The winluck Platform is strictly intended for adults aged 21 years and above, in accordance with Philippine gaming regulations. winluck does not knowingly collect personal data from individuals under the age of 21.

If winluck becomes aware that personal data has been collected from a person under 21 years of age, it will take immediate steps to delete that data and close the associated account. Any winnings generated by an underage player are void and will be forfeited.

If you are a parent or guardian and believe that your child has registered on the winluck Platform, please contact our support team immediately so that we can take appropriate action.

winluck reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Where we make a material change to this Policy, we will notify you via the Platform or by email to your registered address before the change takes effect.

The date of the most recent revision is displayed at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how winluck protects your personal data. Your continued use of the Platform following notification of any amendment constitutes your acknowledgment of the revised Policy.

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have a concern about how winluck handles your personal data, please contact our Data Protection Officer:

winluck will acknowledge your inquiry within five (5) business days and provide a substantive response within thirty (30) days. If you are not satisfied with winluck's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the competent supervisory authority for data protection matters in the Philippines.

Information about the NPC and how to file a complaint is available through official Philippine government channels. winluck cooperates fully with NPC investigations and takes all privacy complaints seriously.