onewin Privacy Policy

1. Introduction

1.1 onewin is committed to protecting the privacy and personal data of all players and visitors to the onewin platform. We understand that trust is the foundation of any relationship between a player and their online casino, and we take our data protection obligations seriously.

1.2 This Policy applies to all personal data collected through the onewin website at onewin.asia, our mobile platform, customer support channels, and any other services we provide. It applies to all registered players, prospective players, and visitors to the Platform.

1.3 This Policy should be read alongside our Terms & Conditions, which govern your use of the Platform. Capitalized terms not defined in this Policy have the meanings given to them in the Terms & Conditions.

1.4 onewin operates within the regulatory framework of the Philippine Amusement and Gaming Corporation (PAGCOR) and processes personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines.

2. Data Controller

2.1 For the purposes of the Data Privacy Act of 2012, onewin is the personal information controller in respect of the personal data collected through the Platform. As personal information controller, onewin determines the purposes and means of processing your personal data.

2.2 onewin has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with applicable data protection laws and this Policy. You may contact the DPO at [email protected] with the subject line "Data Protection Officer."

2.3 Where onewin engages third-party service providers to process personal data on its behalf, those providers act as personal information processors and are bound by data processing agreements that require them to process data only on onewin's instructions and in accordance with applicable law.

3. Personal Data We Collect

3.1 onewin collects personal data that you provide directly, data generated through your use of the Platform, and data received from third parties. The categories of personal data we collect include:

3.1 Identity and Contact Data

• Full legal name, date of birth, and gender;
• Residential address, city, province, and postal code;
• Email address and mobile phone number;
• Government-issued identification documents (e.g., Philippine passport, SSS ID, PhilSys ID, driver's license) submitted for KYC verification.

3.2 Account and Transaction Data

• Username, account ID, and account registration date;
• Deposit and withdrawal history, transaction amounts, and payment method details;
• Betting history, game activity, wagering patterns, and session data;
• Bonus and promotional activity records;
• Account balance and transaction logs.

3.3 Technical and Usage Data

• IP address, device type, operating system, and browser type;
• Login timestamps, session duration, and pages visited;
• Geolocation data (country and region level) derived from IP address;
• Cookies and similar tracking technologies (see Section 8).

3.4 Communications Data

• Records of communications with our customer support team, including chat transcripts and email correspondence;
• Feedback, complaints, and dispute records;
• Responses to surveys or promotional communications where you have opted in.

3.5 Responsible Gaming Data

• Self-exclusion requests and status;
• Deposit limits, session limits, and other responsible gaming tool settings;
• Responsible gaming assessments where conducted.

4. How We Use Your Personal Data

4.1 onewin uses your personal data for the following purposes:

4.1 Account Management and Service Delivery

• To create, maintain, and manage your onewin account;
• To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, and other supported payment methods;
• To provide access to games, betting markets, and all Platform features;
• To verify your identity and eligibility in accordance with KYC requirements and PAGCOR regulations.

4.2 Legal and Regulatory Compliance

• To comply with PAGCOR licensing requirements and applicable Philippine law;
• To fulfill anti-money laundering (AML) and counter-terrorism financing (CTF) obligations;
• To respond to lawful requests from regulatory authorities, law enforcement agencies, and courts;
• To maintain records as required by applicable retention laws.

4.3 Security and Fraud Prevention

• To detect, investigate, and prevent fraudulent activity, cheating, and prohibited conduct;
• To monitor Platform activity for security threats and unauthorized access;
• To enforce our Terms & Conditions and protect the integrity of the Platform.

4.4 Responsible Gaming

• To administer deposit limits, session limits, self-exclusion, and other responsible gaming tools;
• To identify players who may be at risk of problem gambling and take appropriate action;
• To comply with PAGCOR's responsible gaming requirements.

4.5 Customer Support

• To respond to your inquiries, complaints, and support requests;
• To resolve disputes and process refunds where applicable;
• To improve the quality of our customer support services.

4.6 Platform Improvement

• To analyze usage patterns and improve the functionality, performance, and user experience of the Platform;
• To conduct internal research and analytics using aggregated, anonymized data;
• To test new features and services before wider rollout.

4.7 Marketing Communications

• To send you promotional offers, bonus notifications, and Platform updates where you have provided consent or where permitted by applicable law;
• You may opt out of marketing communications at any time by contacting [email protected] or using the unsubscribe mechanism in any marketing email.

5. Legal Basis for Processing

5.1 onewin processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform our contract with you, including account management, payment processing, and service delivery;
• Legal obligation: Processing required to comply with PAGCOR regulations, AML/CTF laws, tax obligations, and other applicable Philippine legal requirements;
• Legitimate interests: Processing for fraud prevention, security monitoring, Platform improvement, and responsible gaming purposes, where these interests are not overridden by your data protection rights;
• Consent: Processing for marketing communications and certain cookie-based tracking, where you have provided explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5.2 Where processing is based on consent, you have the right to withdraw that consent at any time by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Data Sharing and Disclosure

6.1 onewin does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

6.1 Regulatory and Law Enforcement Authorities

onewin is required to share certain player data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other competent Philippine authorities as required by law. We may also disclose data to law enforcement agencies in response to lawful requests, court orders, or legal process.

6.2 Payment Service Providers

To process deposits and withdrawals, we share necessary transaction data with payment service providers including GCash, PayMaya, BPI, BDO, Metrobank, and UnionBank. These providers process data under their own privacy policies and applicable financial regulations.

6.3 KYC and Identity Verification Providers

We may engage third-party identity verification services to assist with KYC compliance. These providers process identity documents and verification data solely on our instructions and under binding data processing agreements.

6.4 Technology and Infrastructure Providers

We engage cloud hosting, cybersecurity, analytics, and customer support technology providers who may process personal data on our behalf as personal information processors. All such providers are bound by contractual obligations to process data only as instructed by onewin and to maintain appropriate security standards.

6.5 Game Software Providers

Certain game providers may receive limited technical data (such as session tokens and game results) necessary to deliver their games on the Platform. Game providers do not receive your full identity or financial data.

7. Data Retention

7.1 onewin retains your personal data for as long as necessary to fulfill the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes or enforce our agreements.

7.2 The following retention periods apply as a general guide:

• Account and transaction data: Retained for a minimum of five (5) years from the date of the last transaction, as required by PAGCOR regulations and applicable AML laws;
• KYC and identity verification documents: Retained for a minimum of five (5) years from account closure or the last transaction, whichever is later;
• Customer support communications: Retained for three (3) years from the date of the communication;
• Marketing consent records: Retained for the duration of your account and for three (3) years following account closure;
• Technical and usage logs: Retained for up to twelve (12) months, unless required for longer periods for security or legal purposes.

7.3 Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in accordance with our data disposal procedures. Where data cannot be immediately deleted due to technical constraints, it will be isolated and protected from further processing until deletion is possible.

8. Cookies & Tracking Technologies

8.1 onewin uses cookies and similar tracking technologies on the Platform to enhance your user experience, maintain session security, and analyze Platform usage. A cookie is a small text file placed on your device when you visit the Platform.

8.2 We use the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function, including session management, login authentication, and security features. These cannot be disabled without affecting Platform functionality;
• Performance and analytics cookies: Used to collect anonymized data about how visitors use the Platform, helping us identify areas for improvement;
• Functional cookies: Used to remember your preferences, such as language settings and display options;
• Marketing cookies: Used to deliver relevant promotional content where you have consented to receive marketing communications.

8.3 You may control cookie settings through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. For strictly necessary cookies, no consent is required as they are essential to the operation of the service.

8.4 onewin does not use cookies to collect sensitive personal information or to track your activity on third-party websites outside the Platform.

9. Security Measures

9.1 onewin implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• Encryption at rest for sensitive personal data stored on our servers;
• Multi-factor authentication options for account access;
• Role-based access controls limiting employee access to personal data on a need-to-know basis;
• Regular security audits and penetration testing of Platform infrastructure;
• Intrusion detection systems and continuous security monitoring;
• Secure data disposal procedures for data that has reached the end of its retention period.

9.2 While onewin employs industry-standard security measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, onewin will notify the National Privacy Commission and affected individuals in accordance with the requirements of the Data Privacy Act of 2012.

9.3 You are responsible for maintaining the security of your account credentials. Do not share your password with anyone. onewin will never ask for your password via email, chat, or any other channel.

10. Your Data Protection Rights

10.1 Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by onewin:

• Right to be informed: The right to be informed about how your personal data is collected and processed, as set out in this Policy;
• Right of access: The right to obtain confirmation of whether onewin holds personal data about you and to receive a copy of that data;
• Right to rectification: The right to have inaccurate or incomplete personal data corrected or completed;
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to applicable legal retention requirements;
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests;
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format where technically feasible;
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines if you believe your data protection rights have been violated.

10.2 To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Privacy Request." onewin will respond to your request within fifteen (15) business days, or within the timeframe required by applicable law.

10.3 onewin may need to verify your identity before processing a data rights request to ensure that personal data is not disclosed to unauthorized parties. We may request a copy of a government-issued ID for this purpose.

10.4 Please note that certain rights are subject to limitations. For example, onewin may be unable to delete data that it is legally required to retain under PAGCOR regulations or AML laws. In such cases, we will inform you of the reason for the limitation.

11. Children's Privacy

11.1 If onewin discovers or is notified that personal data has been collected from a person under 21 years of age, we will immediately close the associated account, delete the personal data, and return any deposited funds to the payment source.

11.2 If you believe that a person under 21 years of age has registered on the Platform, please notify us immediately at [email protected] so that we can take appropriate action.

12. Changes to This Privacy Policy

12.1 onewin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The date of the most recent revision is indicated at the top of this page.

12.2 Where material changes are made to this Policy, onewin will notify registered players via email or a prominent notice on the Platform prior to the changes taking effect, where reasonably practicable.

12.3 Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acknowledgment of the changes. If you do not agree to the revised Policy, you must cease using the Platform and may request account closure in accordance with our Terms & Conditions.

13. Contact Us & Data Protection Officer

13.1 If you have any questions, concerns, or complaints regarding this Privacy Policy or the way onewin processes your personal data, please contact us:

13.2 If you are not satisfied with our response to your privacy complaint, you have the right to lodge a complaint directly with the National Privacy Commission of the Philippines through its official channels.