Privacy Policy

01 Overview

WinLuck ("WinLuck," "we," "us," or "our") operates the online gaming platform accessible at winluck.app and its associated mobile application (collectively, the "Platform"). As part of operating the Platform, WinLuck collects and processes personal information about registered players and visitors ("you" or "your").

This Privacy Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA) of the Philippines, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). It applies to all personal information collected by WinLuck through the Platform, our customer support channels, and any other interaction you have with us.

By registering an account on WinLuck or by continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection, use, and processing of your personal information as described herein. If you do not agree with this Privacy Policy, you must not use the Platform.

02 Data Controller

For the purposes of the Data Privacy Act of 2012 and this Privacy Policy, WinLuck is the personal information controller responsible for the personal data collected through the Platform. WinLuck determines the purposes and means of processing your personal information.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, you may contact our Data Protection Officer (DPO) using the contact details provided in Section 14 of this Policy.

03 Personal Data We Collect

WinLuck collects the following categories of personal information from players and Platform users:

04 How We Collect Your Data

WinLuck collects personal information through the following means:

• Direct Submission: Information you provide when registering an account, completing identity verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated Collection: Technical data collected automatically when you access the Platform, including IP address, device identifiers, browser information, and session activity logs. This data is collected through cookies, web beacons, and similar tracking technologies (see Section 10).
• Payment Processors: Transaction confirmation data received from GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers when you make deposits or withdrawals.
• Third-Party Verification Services: Identity and age verification data received from third-party KYC (Know Your Customer) service providers engaged by WinLuck to assist with regulatory compliance.
• Regulatory Bodies: In limited circumstances, WinLuck may receive information from regulatory authorities in connection with compliance obligations.

05 Purpose & Legal Basis for Processing

WinLuck processes your personal information only for legitimate, specified, and explicit purposes. The table below sets out the purposes for which we process your data and the legal basis under the Data Privacy Act of 2012 that applies to each purpose:

WinLuck will not process your personal information for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or establishing a separate lawful basis for such processing.

06 Sharing Your Personal Data

WinLuck does not sell, rent, or trade your personal information to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment Service Providers: GCash, PayMaya, BPI, BDO, Metrobank, and other payment processors, solely to facilitate deposits and withdrawals on your account.
• Identity Verification Providers: Third-party KYC and age verification service providers engaged to assist WinLuck in meeting its regulatory obligations.
• Technology and Hosting Providers: Cloud hosting, data storage, and IT infrastructure providers who process data on our behalf under strict data processing agreements.
• Game Content Providers: Game software providers whose titles are available on the Platform may receive anonymized or aggregated gameplay data for technical and compliance purposes.
• Regulatory and Law Enforcement Authorities: Government agencies, regulatory bodies, and law enforcement authorities in the Philippines where disclosure is required by law, court order, or regulatory directive.
• Professional Advisers: Legal counsel, auditors, and compliance consultants, subject to professional confidentiality obligations.

07 Data Retention

WinLuck retains your personal information only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law and regulation. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with anti-money laundering regulations applicable in the Philippines.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, as required by applicable financial regulations.
• Gaming History: Retained for a minimum of three (3) years from the date of each gaming session.
• Customer Support Communications: Retained for two (2) years from the date of the last communication, unless a longer period is required in connection with an ongoing dispute or legal proceeding.
• Technical and Log Data: Retained for up to twelve (12) months, unless required for longer in connection with a security investigation or legal matter.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in accordance with WinLuck's data disposal procedures. Where data is anonymized, it may be retained indefinitely for analytical and statistical purposes.

08 Data Security

WinLuck implements appropriate technical and organizational security measures to protect your personal information against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption of data in transit using industry-standard TLS (Transport Layer Security) protocols.
• Encryption of sensitive data at rest, including financial account details and identity verification documents.
• Access controls ensuring that personal data is accessible only to authorized WinLuck personnel who require it to perform their duties.
• Regular security assessments, vulnerability testing, and penetration testing of the Platform.
• Staff training on data privacy obligations and secure data handling practices.
• Incident response procedures to detect, investigate, and respond to personal data breaches in accordance with NPC notification requirements.

09 Your Data Privacy Rights

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights with respect to your personal information held by WinLuck:

These rights are described in further detail below:

• Right to Be Informed: You have the right to be informed of how your personal data is being collected and processed, which is the purpose of this Privacy Policy.
• Right of Access: You may request a copy of the personal information WinLuck holds about you, along with information about how it is being processed.
• Right to Rectification: You may request that inaccurate or incomplete personal information be corrected or updated. You may update certain account details directly through your WinLuck account settings.
• Right to Erasure or Blocking: You may request the deletion or blocking of your personal data where it is no longer necessary for the purpose for which it was collected, or where processing is unlawful, subject to WinLuck's legal retention obligations.
• Right to Object: You may object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interest, subject to applicable legal grounds.
• Right to Data Portability: You may request that your personal data be provided to you in a structured, commonly used, and machine-readable format.
• Right to Damages: You have the right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.

To exercise any of these rights, please contact WinLuck's Data Protection Officer using the contact details in Section 14. WinLuck will respond to all verified requests within a reasonable time and in accordance with the timelines prescribed by the NPC.

10 Cookies & Tracking Technologies

WinLuck uses cookies and similar tracking technologies on the Platform to enhance your user experience, maintain session security, and collect analytical data about Platform usage. The following types of cookies may be used:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session authentication cookies and security tokens. These cookies cannot be disabled without affecting Platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings and display preferences, to provide a more personalized experience.
• Analytical Cookies: Used to collect anonymized data about how players use the Platform, including pages visited, time spent, and navigation paths. This data helps WinLuck improve the Platform.
• Security Cookies: Used to detect and prevent fraudulent activity, unauthorized access, and other security threats.

You may control cookie settings through your browser preferences. Please note that disabling certain cookies may affect the functionality of the Platform. WinLuck does not use cookies to serve third-party advertising or to track your activity across unrelated websites.

11 Minors & Age Restriction

The WinLuck Platform is strictly intended for persons who are 21 years of age or older. WinLuck does not knowingly collect personal information from individuals under the age of 21. If you are under 21 years of age, you must not register an account or use the Platform.

If WinLuck becomes aware that personal information has been collected from a person under the age of 21 without appropriate parental or guardian consent, we will take immediate steps to delete that information and close the associated account. Any winnings accrued on such an account will be forfeited.

If you are a parent or guardian and believe that your child under the age of 21 has registered an account on WinLuck, please contact us immediately using the details in Section 14 so that we can take appropriate action.

12 Cross-Border Data Transfers

In the course of operating the Platform, WinLuck may transfer your personal information to service providers or technology partners located outside the Philippines. Any such cross-border transfer of personal data will be conducted in compliance with the requirements of the Data Privacy Act of 2012 and the rules of the National Privacy Commission governing cross-border data flows.

Specifically, WinLuck will ensure that any recipient of personal data outside the Philippines provides an adequate level of data protection, either through contractual data processing agreements incorporating the NPC's standard contractual clauses, or through other legally recognized transfer mechanisms.

Where personal data is transferred to cloud hosting or data storage providers located outside the Philippines, WinLuck will ensure that such providers are bound by contractual obligations to process the data only in accordance with WinLuck's instructions and to implement appropriate security measures.

13 Amendments to This Privacy Policy

WinLuck reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made to this Privacy Policy, WinLuck will notify registered players by posting a prominent notice on the Platform or by sending a notification to the mobile number or email address associated with your account.

The "Last Updated" date at the top of this page indicates when this Privacy Policy was most recently revised. Your continued use of the Platform following the posting of any amendments constitutes your acceptance of the revised Privacy Policy. We encourage you to review this Privacy Policy periodically to stay informed about how WinLuck protects your personal information.

If you do not agree with any amendment to this Privacy Policy, you must cease using the Platform and may request account closure by contacting WinLuck support.

14 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by WinLuck, please contact our Data Protection Officer:

Data Protection Officer — WinLuck
Email: [email protected]

For general support inquiries, you may also reach our customer support team at:

[email protected]  |  Available 24/7 via in-app live chat

If you believe that WinLuck has not adequately addressed your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. The NPC is the government body responsible for administering and implementing the Data Privacy Act of 2012 and for ensuring compliance with its provisions.