winmaya Privacy Policy

This Privacy Policy ("Policy") is issued by winmaya ("winmaya," "we," "us," or "our") and governs the collection, processing, storage, and disclosure of personal information relating to all users ("Player," "User," or "you") of the winmaya online gaming platform accessible at winmaya.lat (the "Platform").

winmaya is committed to protecting the privacy and security of your personal information. We recognize that entrusting us with your data — your name, your payment details, your gaming history — requires genuine accountability on our part. This Policy is designed to be honest and readable, not a document intended to confuse or obscure what we actually do with your information.

This Policy should be read alongside the winmaya Terms & Conditions. Where terms used in this Policy are defined in the Terms & Conditions, those definitions apply here as well. By accessing the Platform, registering a winmaya account, or using any feature of our services, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

For the purposes of this Privacy Policy, the data controller responsible for your personal information is winmaya, the operator of the online gaming platform at winmaya.lat. winmaya operates within the Philippine online gaming regulatory framework as guided by the Philippine Amusement and Gaming Corporation (PAGCOR).

As the data controller, winmaya determines the purposes for which and the means by which personal data is processed. winmaya has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data protection laws. Contact details for the DPO are provided in Section 16 of this Policy.

Where winmaya engages third-party processors — such as payment providers, game studios, or identity verification services — to process personal data on its behalf, winmaya ensures that appropriate data processing agreements are in place, binding those processors to data handling standards consistent with this Policy and applicable law.

winmaya collects the following categories of personal data from players, either directly when you provide it or automatically through your use of the Platform:

• Full legal name (as it appears on a government-issued Philippine ID)
• Date of birth (to verify you are 21 years of age or older)
• Philippine residential address
• Email address
• Mobile phone number (including GCash- or PayMaya-linked numbers)
• Username and encrypted password
• Security question responses (if applicable)

• Government-issued ID type and number (Passport, Driver's License, PhilSys National ID, SSS/UMID, PRC ID, Voter's ID)
• Photographs or scanned copies of identity documents
• Selfie or facial verification image (where required for biometric KYC)
• Source of funds documentation (where required by anti-money laundering obligations)

• GCash account number / PayMaya account number
• Bank account details (BPI, BDO, Metrobank, or other PH banks) for withdrawal purposes
• Deposit amounts, dates, and payment method references
• Withdrawal requests, amounts, and processing status
• Bonus claims, wagering activity, and balance history
• Partial card numbers (last four digits) for debit/credit card transactions

• Game sessions played, games selected, bets placed, and outcomes
• Session duration and frequency of Platform use
• Sports betting selections and live betting activity
• Responsible gaming tool usage (deposit limits set, self-exclusion requests)

• IP address and geolocation data (country and city level)
• Device type, operating system, and browser version
• Cookie identifiers and session tokens
• Platform access logs and error logs

• Live chat transcripts between you and winmaya customer support
• Email correspondence with winmaya
• Feedback, complaint, or survey responses you submit voluntarily

winmaya collects personal data through the following channels:

The most significant portion of data is collected when you voluntarily provide it — during registration, KYC verification, depositing, withdrawing, completing promotional forms, or contacting customer support. You are in control of this data and should only provide information that is accurate and current.

When you visit winmaya.lat, our servers automatically record certain technical data including your IP address, device type, browser, operating system, pages visited, and session activity. This data is collected through server logs, cookies, and similar tracking technologies described in Section 8.

winmaya may receive data about you from third-party sources as follows:

• Payment Providers (GCash, PayMaya, banks): Transaction confirmation data, account name verification, and fraud signals relevant to your payment.
• Identity Verification Services: Confirmation of document authenticity and age/identity status as part of KYC processing.
• Fraud Prevention and AML Screening Services: Risk scores and screening results relevant to anti-money laundering compliance.

winmaya processes your personal data on the following legal grounds under the Data Privacy Act of 2012 (RA 10173) and applicable PAGCOR regulatory obligations:

winmaya uses the personal data it collects for the following purposes:

To create and maintain your winmaya account; to verify your identity and age; to process deposits, withdrawals, and bonus credits; to provide access to the full game library; and to enforce the one-account policy and other Terms & Conditions obligations.

To route your deposit and withdrawal transactions through your nominated Philippine payment channel (GCash, PayMaya, BPI, BDO, Metrobank, InstaPay, or card); to verify that payment accounts match your registered name; and to maintain transaction records as required by Philippine financial regulations.

To fulfil winmaya's obligations under PAGCOR's online gaming regulations; to conduct AML screening required under the Anti-Money Laundering Act (AMLA) of the Philippines; to maintain records required for regulatory audit; and to cooperate with lawful requests from Philippine government authorities.

To detect, investigate, and prevent fraud, unauthorized account access, money laundering, and other prohibited activities; to monitor for suspicious betting patterns; to identify and close duplicate accounts; and to ensure compliance with winmaya's prohibited conduct rules.

To respond to your inquiries, resolve disputes, investigate complaints, and provide technical assistance. Support communications — including live chat transcripts and email records — are retained for quality assurance and dispute resolution.

To send you bonus offers, promotional notifications, and platform updates via email or SMS, where you have opted in to receive such communications. You may withdraw consent to marketing communications at any time by contacting winmaya support or using the unsubscribe link in any promotional email.

To monitor your gaming activity for indicators of problem gambling; to enforce deposit limits, loss limits, and self-exclusion restrictions you have set; and to fulfil winmaya's responsible gaming obligations under PAGCOR guidelines.

winmaya does not sell, rent, or trade your personal information. We share personal data only in the following limited circumstances:

winmaya engages the following categories of third-party service providers who process personal data on our behalf, subject to written data processing agreements:

• Payment Processors: GCash (G-Xchange Inc.), PayMaya Philippines, BancNet, and card payment processors — to execute deposit and withdrawal transactions.
• Identity Verification Providers: Third-party KYC and document verification platforms that authenticate government-issued IDs and perform age verification.
• Game Studio Providers: Providers such as Pragmatic Play, Evolution Gaming, PG Soft, and Jili, who supply the games accessed through winmaya. These providers may receive your account identifier and game session data for the purpose of gameplay functionality and integrity monitoring.
• Cloud Infrastructure: Hosting and data storage providers operating data centers used to run the Platform securely.
• Fraud and AML Screening Services: Platforms that screen player data against sanctions lists and risk indicators as required by AMLA.

winmaya may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other Philippine government agencies where required to do so by law, court order, or regulatory directive. In such cases, winmaya will disclose only the minimum data necessary to satisfy the legal requirement.

In the event of a merger, acquisition, or sale of winmaya or substantially all of its assets, personal data held by winmaya may be transferred to the acquiring entity. Affected players will be notified in advance of such a transfer, and the acquiring entity will be required to honour commitments made in this Privacy Policy.

winmaya uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device by a website when you visit it. Cookies allow the site to recognize your device on subsequent visits and provide functionality, security, and analytics features.

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in to your winmaya account. They cannot be disabled without impairing Platform functionality.
• Performance and Analytics Cookies: Used to understand how players navigate the Platform — which pages are visited most, where errors occur, and how session flows can be improved. This data is aggregated and anonymized wherever possible.
• Functionality Cookies: Remember your preferences — such as language selection, display settings, and recently played games — to provide a more personalized experience across sessions.
• Security Cookies: Help winmaya detect and prevent fraud, bot activity, and unauthorized login attempts by recognizing trusted devices and flagging unusual access patterns.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to log in and use the winmaya Platform normally. winmaya does not use third-party advertising or behavioral tracking cookies.

winmaya implements comprehensive technical and organizational security measures to protect your personal data against unauthorized access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and winmaya servers is encrypted using industry-standard TLS protocols, consistent with what major Philippine banks use for online banking.
• AES-256 Encryption at Rest: Sensitive personal data stored in winmaya's databases — including KYC document data and payment account references — is encrypted at rest using AES-256 encryption.
• Role-Based Access Control: Access to player personal data within winmaya's internal systems is restricted based on job function and granted only to personnel with a legitimate need to access it for operational purposes.
• Two-Factor Authentication for Internal Systems: winmaya staff accessing internal systems that contain player data are required to use multi-factor authentication.
• Regular Security Audits: The Platform undergoes periodic security assessments and penetration testing conducted by independent security professionals.
• Data Breach Response Plan: winmaya maintains an incident response plan for data security breaches. In the event of a breach that poses a risk to your personal data, winmaya will notify affected players and the National Privacy Commission within the timeframes required under RA 10173.

Despite these measures, no internet-based system can be guaranteed to be 100% secure. You also bear responsibility for protecting your winmaya account by keeping your password confidential, enabling two-factor authentication, and logging out from shared devices after use.

winmaya retains personal data for the periods necessary to fulfil the purposes for which it was collected, as set out below:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with winmaya's data destruction procedures. Anonymized or aggregated data that can no longer be used to identify you may be retained indefinitely for statistical and analytical purposes.

As a registered winmaya player and a data subject under the Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by winmaya. To exercise any of these rights, contact winmaya's Data Protection Officer at the details provided in Section 16.

The winmaya Platform is strictly intended for individuals who are 21 years of age or older, in accordance with the age requirement mandated by PAGCOR for online gaming in the Philippines. winmaya does not knowingly collect personal data from any person under the age of 21.

All account registrations at winmaya are subject to KYC identity verification using a valid Philippine government-issued ID. This process is designed specifically to confirm that every player meets the 21+ age requirement before any real-money activity is permitted on their account.

If winmaya becomes aware, at any point, that a registered account belongs to a person under 21 years of age, the account will be immediately and permanently suspended, all real-money balances will be forfeited, and any personal data associated with that account will be handled in accordance with applicable legal obligations. Parents or guardians who believe a minor may have registered on the winmaya Platform are encouraged to contact our support team immediately at [email protected].

winmaya's primary operations and data storage are oriented toward the Philippine market and Philippine-based infrastructure. However, certain third-party service providers engaged by winmaya — including some game studio providers, cloud hosting partners, and identity verification platforms — may process or store data in data centers located outside the Philippines.

Where personal data is transferred to recipients in jurisdictions outside the Philippines, winmaya takes the following steps to ensure your data remains adequately protected:

• Data processing agreements are executed with all third-party processors, requiring them to maintain security and privacy standards at least equivalent to those mandated by RA 10173.
• Where technically and commercially feasible, data transfers are subject to standard contractual clauses or equivalent legal mechanisms recognized under Philippine data protection law.
• winmaya conducts due diligence on third-party processors prior to engagement to assess their data security practices and regulatory compliance posture.

winmaya does not transfer personal data to jurisdictions that do not provide an adequate level of protection for personal information without first implementing appropriate safeguards consistent with the requirements of the National Privacy Commission.

The winmaya Platform may contain references to third-party services — such as payment providers like GCash and PayMaya — whose own privacy policies and data practices are separate from and independent of this Policy. When you interact with a third-party service linked from or integrated into the winmaya Platform, that third party's own privacy policy governs the handling of any data you provide directly to them.

winmaya is not responsible for the privacy practices, data security measures, or content of third-party platforms. We encourage you to review the privacy policies of any third-party service you engage with in connection with your winmaya account, particularly your chosen payment provider, before providing them with personal information.

This Policy applies solely to personal data collected and processed by winmaya through the winmaya.lat Platform and does not extend to data processed independently by third-party service providers beyond the scope of their role as winmaya data processors.

winmaya reserves the right to update, revise, or amend this Privacy Policy at any time. Changes may be made to reflect updates in Philippine data protection law, new regulatory guidance from the National Privacy Commission or PAGCOR, changes in winmaya's data processing practices, or improvements to how we describe our practices.

When material changes are made to this Policy — meaning changes that significantly affect how your personal data is processed or your rights as a data subject — winmaya will provide advance notice to registered players via email to the address on record, a prominent notification displayed on the Platform upon login, or both. The notice will describe the nature of the change and its effective date.

Non-material changes — such as formatting corrections, clarifications that do not alter the substance of our practices, or updates to contact information — may be made without advance notice, though the effective date at the top of the Policy will always reflect when the document was last revised.

Your continued use of the winmaya Platform after the effective date of any revision constitutes your acknowledgment of the updated Policy. If you do not agree with any revision, you may close your winmaya account in accordance with the account closure procedure described in the Terms & Conditions.

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data by winmaya, you may contact us through the following channels:

Data Protection Officer (DPO)
[email protected]

General Support
[email protected]
Live Chat: Available 24/7 via the chat widget on winmaya.lat
Languages: English and Filipino

winmaya aims to acknowledge all data rights requests and privacy-related inquiries within five (5) business days and to resolve them within fifteen (15) business days of receipt, consistent with the timelines prescribed under RA 10173. Complex requests involving retrieval of historical records or coordination with third-party processors may require additional time, and you will be kept informed of progress throughout the process.

If you are not satisfied with winmaya's response to a privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). The NPC is the independent authority responsible for administering and enforcing RA 10173, and accepts complaints from data subjects regarding alleged violations of their data privacy rights.