winluck Privacy Policy

The data controller responsible for the personal data collected through the winluck Platform is the operator of winluck.co ("winluck," "we," "us," or "our"). As data controller, winluck determines the purposes and means by which your personal data is processed.

winluck has designated a Data Protection Officer (DPO) responsible for overseeing compliance with applicable data privacy laws and responding to data subject requests. Enquiries concerning the processing of your personal data may be directed to winluck's support team, who will route your enquiry to the DPO where appropriate.

winluck collects the following categories of personal data in connection with the operation of the Platform:

winluck does not intentionally collect special categories of personal data (as defined under applicable data privacy law) unless you voluntarily provide such information — for example, when disclosing a health condition in connection with a responsible gaming request.

winluck collects your personal data through the following means:

• Direct provision by you: Information you enter during account registration, KYC verification, deposit and withdrawal requests, support enquiries, responsible gaming tool activations, and promotional registrations.
• Automated collection during Platform use: Technical data including IP address, device identifiers, session logs, and gameplay records are collected automatically as you interact with the Platform, through standard web server logs and first-party analytics systems.
• Payment processing partners: When you make a deposit or withdrawal using GCash, PayMaya, or a Philippine bank, winluck receives transaction confirmation data from the relevant payment processor necessary to credit or debit your Account.
• KYC verification partners: winluck may use third-party identity verification services to authenticate government-issued ID documents. These partners process your ID image and return a verification result; winluck retains the result and the document image in your account record.
• Game providers: Licensed game providers who supply games to the winluck Platform may return session data — including game results and wager amounts — to winluck's systems for reconciliation and responsible gaming monitoring purposes.

winluck processes your personal data on one or more of the following legal bases under the Data Privacy Act of 2012:

• Performance of a contract: Processing necessary to create and manage your winluck Account, process deposits and withdrawals, and deliver game services you have requested.
• Compliance with a legal obligation: Processing required to comply with KYC and anti-money laundering obligations under Philippine law, age verification requirements, tax reporting obligations, and orders from regulatory or law enforcement authorities.
• Legitimate interests: Processing carried out in winluck's legitimate interests — including fraud prevention, platform security monitoring, responsible gaming surveillance, and improving the quality of Platform services — where those interests are not overridden by your data protection rights.
• Consent: Where winluck relies on your consent as the legal basis for processing — including for optional marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

winluck uses the personal data it collects for the following purposes:

• Account creation and management: Registering your winluck Account, authenticating your identity at login (including 2FA), and managing your account profile and preferences.
• Payment processing: Processing your deposits via GCash, PayMaya, and Philippine banks; verifying your withdrawal requests; reconciling transactions; and complying with payment processor requirements.
• KYC and regulatory compliance: Verifying your identity, age (21+), and source of funds as required by Philippine anti-money laundering and responsible gaming regulations before processing withdrawals.
• Fraud prevention and security: Detecting and preventing fraudulent activity, bonus abuse, money laundering, multi-accounting, and unauthorised account access through transaction monitoring and behavioural analytics.
• Responsible gaming monitoring: Monitoring your gameplay patterns to identify potential indicators of problem gambling behaviour, enforcing deposit limits and self-exclusion requests, and making responsible gaming tools available to you.
• Customer support: Responding to your enquiries, processing your complaints, and maintaining records of support interactions for quality assurance and dispute resolution purposes.
• Platform improvement: Analysing aggregated and anonymised usage data to improve game selection, Platform performance, and the overall user experience for Filipino players.
• Marketing communications (with consent): Sending you promotional offers, bonus notifications, and winluck news where you have consented to receive such communications. You may withdraw this consent at any time through your Account settings or by contacting support.
• Legal and regulatory obligations: Maintaining records required by applicable Philippine law and responding to valid requests from the National Privacy Commission, PAGCOR, AMLC, and other competent authorities.

winluck does not sell your personal data to third parties for marketing or advertising purposes. winluck shares your personal data only with the following categories of recipients, and only to the extent necessary for the specified purpose:

• Licensed game providers (e.g., JILI, Pragmatic Play, PG Soft, Evolution Gaming, Ezugi) — receive session data necessary to deliver game services and return results to your Account. These providers are contractually bound to process your data only for game delivery purposes.
• Payment processors (GCash, PayMaya, BPI, BDO, Metrobank, and cryptocurrency payment rails) — receive the minimum data necessary to process your deposits and withdrawals, including your name and registered account details as required for payment reconciliation.
• KYC and identity verification partners — receive your government ID image and selfie photograph for automated identity verification. These partners operate under strict data processing agreements and are prohibited from retaining your ID data beyond the verification process.
• Regulatory and law enforcement authorities — winluck will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, the Bureau of Internal Revenue, or other competent Philippine authorities when required to do so by applicable law, court order, or regulatory directive.
• Professional advisers — winluck's lawyers, auditors, and compliance consultants may access personal data on a strictly need-to-know basis in connection with their professional services, subject to professional confidentiality obligations.
• Business successors — in the event of a merger, acquisition, or sale of winluck's business or assets, your personal data may be transferred to the successor entity, subject to the same privacy protections set out in this Policy.

Some of winluck's game providers, technical infrastructure partners, and KYC verification systems operate servers located outside the Philippines. Where your personal data is transferred to or processed in a country outside the Philippines, winluck takes the following steps to ensure that your data remains protected:

• winluck enters into data processing agreements with all international service providers that incorporate standard contractual clauses approved by the National Privacy Commission or equivalent recognised safeguards;
• winluck verifies that international recipients implement data security measures at least equivalent to those required under Philippine law;
• winluck limits cross-border data transfers to the minimum data necessary for the specific processing purpose;
• Where required, winluck registers cross-border data transfer arrangements with the National Privacy Commission in accordance with its regulations.

By registering a winluck Account and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data to service providers located in other jurisdictions as necessary for the operation of the Platform, subject to the safeguards described above.

winluck retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying applicable legal, regulatory, tax, and accounting requirements. The following general retention periods apply:

Upon expiry of the applicable retention period, winluck will securely delete or anonymise your personal data in accordance with its data destruction procedures. Anonymised data — from which it is not possible to identify you — may be retained indefinitely for analytical purposes.

winluck uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies: Essential for the Platform to function correctly — including session authentication cookies that keep you logged in to your winluck Account during a session. These cannot be disabled without affecting Platform functionality.
• Functional cookies: Remember your language preference, display settings, and responsible gaming tool configurations so you do not have to re-enter them on each visit.
• Analytics cookies: First-party analytics tools use cookies to collect anonymised data about how Players navigate and use the Platform, which winluck uses to identify performance issues and improve the user experience. This data does not identify you personally.
• Security cookies: Used to detect and prevent fraudulent activity, bot access, and unauthorised login attempts.

winluck does not use third-party advertising cookies or allow external advertising networks to place cookies on the Platform. You may manage cookie settings through your browser's privacy settings. Disabling strictly necessary cookies will impair your ability to use the Platform.

winluck implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption in transit: All data exchanged between your device and winluck's servers is encrypted using TLS 1.3 (Transport Layer Security). The winluck Platform operates exclusively over HTTPS.
• Encryption at rest: Sensitive data fields — including passwords (stored as salted cryptographic hashes), government ID numbers, and financial account details — are encrypted in winluck's databases using industry-standard algorithms.
• Access controls: Access to personal data within winluck's systems is restricted on a strict need-to-know basis. Staff members access only the data necessary for their specific role. All internal access is logged and audited.
• Two-factor authentication: winluck offers SMS-based 2FA for all Player accounts. winluck's own administrative systems require multi-factor authentication for all staff access.
• Vulnerability management: winluck's technical team conducts regular security reviews and applies security patches to all Platform software and infrastructure.
• Incident response: winluck maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, winluck will notify the National Privacy Commission within 72 hours of becoming aware of the breach and will notify affected Players without undue delay.

Despite these measures, no data transmission over the internet is completely secure. winluck cannot guarantee the absolute security of data transmitted to the Platform, and you transmit data at your own risk. You are responsible for ensuring the security of the device and credentials used to access your winluck Account.

Under the Data Privacy Act of 2012, you have the following rights with respect to the personal data winluck holds about you. To exercise any of these rights, contact winluck's support team with a description of your request. winluck will respond within fifteen (15) business days of receiving a verified request.

The winluck Platform is strictly intended for adults aged 21 years and older. winluck does not knowingly collect personal data from individuals under 21 years of age. Age is verified during the KYC process using government-issued identification documents, and accounts found to belong to individuals under 21 will be immediately closed.

If winluck becomes aware that personal data has been collected from an individual under 21 years of age, it will take immediate steps to delete that data from its systems and close the associated Account. If you are a parent or guardian and believe that your child may have registered an Account with winluck, please contact support immediately so the situation can be investigated and resolved.

The winluck Platform may contain references to third-party services — such as GCash, PayMaya, and banking partners — in the context of payment processing guidance. These services operate independently and are governed by their own privacy policies. winluck is not responsible for the privacy practices of third-party services and encourages you to review the privacy policy of any third-party service you use in connection with your winluck Account.

winluck does not host third-party advertising content, affiliate tracking pixels, or social media widgets that would allow external platforms to collect data about your activities on the winluck Platform without your knowledge.

winluck may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform services. The "Last Updated" date at the top of this page indicates when the most recent revision was made.

Where a change to this Policy is material — meaning it could significantly affect how your personal data is processed — winluck will notify you by posting a prominent notice on the Platform and, where practicable, by sending a notification to your registered email address at least seven (7) days before the change takes effect.

For non-material changes — such as clarifications of existing practices, corrections of typographical errors, or minor structural reorganisation — winluck may update the Policy without advance notice. Your continued use of the Platform after the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not agree with a material change, you may close your Account in accordance with the procedure set out in winluck's Terms and Conditions.

Data Rights Requests and Privacy Enquiries. If you have a question about this Privacy Policy, wish to exercise a data right, or have a concern about how winluck handles your personal data, please contact the winluck support team via live chat (available 24/7) or by email. Contact details are available in the footer of this page. Your enquiry will be routed to winluck's Data Protection Officer where appropriate.

Complaints to the National Privacy Commission. If you are not satisfied with winluck's response to your privacy enquiry or believe that winluck has processed your personal data in violation of the Data Privacy Act of 2012, you have the right to file a complaint with the National Privacy Commission of the Philippines. The Commission can be reached through its official website and offices. winluck encourages you to contact us directly in the first instance so we have the opportunity to resolve your concern before you escalate to the Commission.