lawinph Privacy Policy

01 Data Controller

lawinph acts as the personal information controller for the personal data collected through the lawinph Platform. lawinph is a PAGCOR-licensed online gaming operator and is registered with the National Privacy Commission (NPC) of the Republic of the Philippines as required under RA 10173.

All data processing activities described in this Privacy Policy are carried out in accordance with the principles of transparency, legitimate purpose, and proportionality as established under the Data Privacy Act and its Implementing Rules and Regulations.

---

02 Data We Collect

2.1 Registration Data

When you create a lawinph Account, we collect the following personal information:

• Full legal name (as it appears on your government-issued ID)
• Date of birth (for age verification — you must be 21 or older)
• Philippine mobile number
• Email address
• Username and encrypted password
• Residential address in the Philippines

2.2 Identity Verification (KYC) Data

As required by PAGCOR's licensing conditions and Philippine AML regulations, lawinph collects identity verification documents including:

• A copy or photograph of a valid Philippine government-issued ID (PhilSys National ID, Philippine passport, driver's licence, SSS/GSIS ID, or PRC ID)
• A selfie photograph for biometric verification where required
• Proof of payment method ownership (e.g., screenshot of GCash account, bank statement header)
• Source of funds documentation where required by AML procedures

2.3 Transaction Data

lawinph records all financial transactions conducted through your Account, including deposit amounts, withdrawal requests, bonus credits, payment method details (account number reference, not full card numbers), timestamps, and transaction status.

2.4 Gaming Activity Data

lawinph maintains a full record of your gaming activity on the Platform, including games played, bet amounts, game outcomes, session durations, and responsible gaming tool usage. This data is required by PAGCOR for regulatory compliance.

2.5 Technical & Device Data

When you access lawinph, we automatically collect technical data including your IP address, device type, operating system, browser type and version, referring URL, and session timestamps. This data is used for security monitoring, fraud prevention, and platform analytics.

---

03 How We Use Your Data

lawinph uses the personal data collected for the following purposes:

• Account management: Creating and maintaining your lawinph Account, verifying your identity and age, processing deposits and withdrawals, and providing access to lawinph games and services.
• PAGCOR compliance: Fulfilling all reporting, audit, and data retention obligations imposed by lawinph's PAGCOR operating license.
• AML compliance: Monitoring transactions for suspicious activity and reporting to the Anti-Money Laundering Council (AMLC) as required by the Anti-Money Laundering Act (RA 9160 as amended).
• Responsible gaming: Monitoring gaming behaviour to identify potential gambling harm and administering responsible gaming tools including deposit limits, cooling-off periods, and self-exclusion.
• Platform security: Detecting and preventing fraud, unauthorised account access, bonus abuse, and other prohibited activities.
• Customer support: Responding to account queries, technical issues, payment disputes, and responsible gaming requests.
• Communications: Sending account notifications, security alerts, deposit and withdrawal confirmations, and — where you have consented — promotional communications about lawinph offers.
• Platform improvement: Analysing aggregated, anonymised usage data to improve game selection, user experience, and platform performance.

---

04 Legal Basis for Processing

Under the Philippines Data Privacy Act, lawinph processes your personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil lawinph's obligations under the Terms & Conditions you agreed to upon account registration (e.g., processing deposits, settling game winnings).
• Legal obligation: Processing required to comply with PAGCOR licensing requirements, Philippine AML law, NPC regulations, and other applicable legal obligations (e.g., KYC verification, transaction reporting).
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring — where these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for optional purposes such as marketing communications — where your explicit, informed consent has been obtained and can be withdrawn at any time.

---

05 Data Sharing & Disclosure

lawinph does not sell, rent, or trade your personal data. We may disclose your personal data in the following limited circumstances:

5.1 Regulatory & Legal Disclosures

lawinph is required to share personal data and transaction records with PAGCOR as part of its licensing obligations and regulatory audits. lawinph is also required to report suspicious transactions to the AMLC under Philippine AML law. Law enforcement disclosures may be made where required by court order or lawful legal process.

5.2 Service Providers

lawinph shares personal data with a limited number of third-party service providers who assist in operating the Platform, including payment processors (GCash/GXI, banks), KYC/identity verification providers, cloud hosting and infrastructure providers, and customer support platform vendors. All third-party providers are required to process data only on lawinph's instructions and under data processing agreements that meet RA 10173 requirements.

5.3 Game Studio Providers

Game studios whose products appear in the lawinph lobby may receive anonymised session and bet data for RNG certification audit and game performance purposes. No directly identifiable personal data is shared with game studios without your explicit consent.

5.4 No International Transfers Without Safeguards

Where personal data is transferred to service providers operating outside the Philippines, lawinph ensures appropriate safeguards are in place consistent with NPC requirements, including contractual clauses and adequacy assessments.

---

06 Data Security

lawinph implements technical and organisational security measures proportionate to the risk associated with the personal data we process. These measures include:

• 256-bit SSL/TLS encryption for all data in transit
• AES-256 encryption for sensitive data at rest (including KYC documents and payment data)
• Hashed and salted password storage — passwords are never stored in plain text
• Role-based access controls limiting staff access to personal data on a need-to-know basis
• Multi-factor authentication for internal systems accessing player data
• Regular third-party security audits and penetration testing
• 24/7 automated anomaly detection on login and transaction systems

Notwithstanding these measures, no internet-based system is completely secure. lawinph will notify affected players and the NPC promptly in the event of a data breach as described in Section 11.

---

07 Cookies & Tracking Technologies

lawinph uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential cookies: Required for the Platform to function — including session management, authentication state, and security tokens. These cannot be disabled.
• Analytics cookies: Used to collect anonymised data about how players interact with the Platform, enabling lawinph to improve game discoverability, page performance, and user experience.
• Preference cookies: Store your Platform settings such as language preference, game lobby filters, and display preferences.

You can manage non-essential cookie preferences through your browser settings. Note that disabling certain cookies may affect Platform functionality. lawinph does not use third-party advertising or behavioural targeting cookies.

---

08 Data Retention

lawinph retains personal data for the following periods:

• Active account data: Retained for the full duration of your account being active on the Platform.
• Post-closure retention: Following account closure, lawinph retains personal data for a minimum of 5 years, as required by PAGCOR licensing conditions and Philippine AML regulations (RA 9160).
• KYC documentation: Retained for a minimum of 5 years post-account closure in compliance with PAGCOR and AMLC requirements.
• Transaction records: Retained for a minimum of 5 years as required by AML law.
• Support communications: Retained for 3 years from the date of the communication, unless they relate to an active dispute.

Data that is no longer required and is past its retention period is securely deleted or irreversibly anonymised.

---

09 Your Privacy Rights

Under the Philippines Data Privacy Act (RA 10173), you have the following rights with respect to your personal data held by lawinph:

• Right to be informed: You have the right to know that lawinph is collecting your personal data, for what purpose, and on what legal basis — as described in this Privacy Policy.
• Right of access: You have the right to request a copy of the personal data lawinph holds about you, including details of how it is used and with whom it has been shared.
• Right to rectification: You have the right to request correction of inaccurate or incomplete personal data held by lawinph.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected — subject to lawinph's legal retention obligations under PAGCOR and AML law.
• Right to object: You have the right to object to the processing of your personal data for purposes based on legitimate interests or consent.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to damages: You have the right to claim compensation for any damage suffered as a result of inaccurate, incomplete, or unauthorised use of your personal data.

To exercise any of the above rights, contact lawinph's Data Protection Officer at the contact details provided in Section 12. lawinph will respond to data rights requests within 30 days.

---

10 Children & Minors

The lawinph Platform is strictly restricted to persons aged 21 years and older. lawinph does not knowingly collect personal data from individuals below the age of 21. If lawinph becomes aware that an account has been registered by a person below the minimum age, the account will be immediately suspended, all associated personal data will be handled in accordance with RA 10173, and the matter will be reported to PAGCOR as required. If you believe a minor has created a lawinph account, please contact support immediately.

---

11 Updates to This Privacy Policy

lawinph may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory obligations, or Platform features. Where material changes are made, lawinph will notify registered Players via their registered mobile number or email address at least 7 days before the changes take effect. The updated policy will be published at lawinph.net/privacy-policy with the revised effective date. Continued use of the Platform following the effective date of any update constitutes acceptance of the revised Privacy Policy.

---

12 Contact & Data Protection Officer

For any privacy-related enquiries, requests to exercise your data rights, or to report a potential data incident, please contact the lawinph Data Protection Officer:

If you are not satisfied with lawinph's response to a privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines at [email protected] or via the NPC website.