Table of Contents
Privacy at a Glance
A quick summary of how phwl handles your personal data. Full details are in the sections below.
Philippine DPA Compliant
phwl processes all personal data in accordance with Republic Act No. 10173 — the Philippine Data Privacy Act of 2012 — and all NPC-issued regulations and circulars.
Encrypted & Secured
All data transmitted between your device and phwl is protected by TLS 1.3 encryption. Sensitive data like passwords are stored using industry-standard one-way hashing algorithms and are never stored in plain text.
No Data Selling
phwl does not sell, rent, or trade your personal data to third parties for marketing purposes. Your information is shared only with verified partners directly necessary for operating our gaming and payment services.
Transparent Processing
Every category of data phwl collects is listed in this policy along with the specific purpose for collecting it. We do not collect data beyond what is necessary for our stated purposes.
Your Rights Are Protected
Under the Philippine Data Privacy Act, you have the right to access, correct, erase, and port your data, as well as the right to object to processing and to lodge complaints with the National Privacy Commission.
Minimum Retention Only
phwl retains your data only for as long as required by PAGCOR regulations, Philippine law, or the duration of your active account — whichever is longer. Data that is no longer needed is securely deleted or anonymised.
Overview and Scope
1.1 Who This Policy Applies To. This Privacy Policy applies to all individuals who visit the phwl website at phwl.app, register for a phwl account, participate in any game or promotion offered by phwl, or otherwise interact with phwl's customer support, live chat, Messenger, or Viber channels. It also applies to individuals who have previously held a phwl account and whose data phwl is legally required to retain after account closure.
1.2 What This Policy Covers. This policy describes how phwl, as the personal information controller under the Philippine Data Privacy Act of 2012 (RA 10173), collects, uses, stores, discloses, and protects your personal data. It also explains your rights as a data subject and the procedures for exercising those rights.
1.3 Relationship to Other Policies. This Privacy Policy should be read together with the phwl Terms and Conditions and the phwl Responsible Gaming Policy, both of which are incorporated by reference. By registering for and using phwl's services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.
1.4 Geographic Scope. phwl's services are designed for users physically located in the Philippines. While phwl may use cloud-based infrastructure with servers in multiple locations, all data processing practices described in this policy comply with Philippine law. If you access phwl from outside the Philippines, you do so at your own discretion and remain subject to this policy.
Data Controller: phwl (phwl.app) is the personal information controller responsible for your data. For all privacy-related inquiries, corrections, or complaints, you may contact our Data Protection Officer (DPO) using the details in Section 13 of this policy.
Personal Data We Collect
2.1 Categories of Data. phwl collects the following categories of personal data, grouped by collection stage:
| Category | Specific Data Points |
|---|---|
| Registration Data | Full legal name, date of birth, email address, mobile number, residential address (barangay, city, province), username, and encrypted password. |
| Identity Verification (KYC) | Government-issued Philippine ID type and number (e.g., PhilSys ID, passport, UMID, driver's license, PRC ID, voter's ID), front and back ID images, and selfie photograph for liveness verification. |
| Financial Data | GCash mobile number, Maya account details, bank name and account number (BPI, BDO, Metrobank, UnionBank), cryptocurrency wallet address, deposit and withdrawal transaction history, and account balance records. |
| Gaming Activity | Game types played, wager amounts, win/loss records, session duration, bonus usage history, and promotional participation records. |
| Device & Technical Data | IP address, browser type and version, operating system, device type (mobile/desktop), screen resolution, time zone, and session timestamps. |
| Communication Data | Live chat transcripts, email correspondence with support, Messenger and Viber message content (when you initiate contact), and complaint or dispute records. |
| Responsible Gaming Data | Deposit limits set, session limit configurations, self-exclusion requests, cooling-off period activations, and any responsible gaming assessments completed. |
2.2 Sensitive Personal Information. Government-issued ID data and financial account details are classified as sensitive personal information under RA 10173. phwl processes this information exclusively for identity verification, anti-money laundering compliance, and fraud prevention purposes as required by PAGCOR and Philippine law. phwl does not process sensitive personal information beyond what is strictly necessary for these lawful purposes.
2.3 Data You Are Not Required to Provide. Providing your personal data to phwl is generally a condition of receiving our services — particularly for registration and KYC verification. However, some data, such as optional profile details or marketing preferences, is entirely voluntary. Refusing to provide mandatory data (such as government ID for KYC) will limit your ability to make withdrawals but will not affect your ability to access the Platform for browsing purposes.
How We Collect Your Data
3.1 Directly From You. The majority of your personal data is collected directly from you when you register an account, complete the KYC process, make a deposit or withdrawal, contact our support team, or participate in a promotion. You are in control of what you submit at each of these stages.
3.2 Automatically. When you access or use the phwl Platform, certain technical data is collected automatically through server logs, cookies, and analytics tools. This includes your IP address, browser fingerprint, session duration, and in-game activity. See Section 10 for full details on cookies and tracking technologies.
3.3 From Third-Party Service Providers. phwl may receive data from trusted third-party partners involved in delivering our services, including:
- Payment processors (GCash, Maya, BPI, BDO, Metrobank) who confirm transaction status and flag suspicious activity;
- KYC and identity verification service providers who validate the authenticity of government-issued IDs;
- Fraud prevention and AML screening providers who cross-reference account data against watchlists;
- Game software providers who supply game results, RTP data, and game round logs.
3.4 From Regulatory Authorities. In limited circumstances, phwl may receive data from PAGCOR, the AMLC, or other Philippine government agencies as part of regulatory compliance processes or lawful government directives.
Purpose of Processing
4.1 Core Service Delivery. phwl processes your personal data primarily to provide, operate, and maintain our online gaming and sports betting services. This includes creating and managing your account, processing deposits and withdrawals, delivering game results, awarding bonuses, and providing customer support.
4.2 Identity Verification and KYC. phwl is required by PAGCOR and Philippine AML laws to verify the identity and age of all players before processing withdrawal requests. Your KYC data is processed to confirm that you are who you say you are, that you are at least 21 years of age, and that your funds are not derived from illegal sources.
4.3 Regulatory Compliance and AML. phwl processes transaction and identity data to comply with the Anti-Money Laundering Act of 2001 (RA 9160) as amended by RA 10365, PAGCOR regulatory requirements, and NPC data privacy regulations. This includes monitoring for unusual transaction patterns and reporting to the AMLC where legally required.
4.4 Responsible Gaming Monitoring. phwl processes gaming activity data to monitor for signs of problem gambling behavior and to implement responsible gaming interventions such as deposit limit prompts, cooling-off suggestions, and self-exclusion facilitation. This processing protects the welfare of our players.
4.5 Fraud Prevention and Platform Security. Device and session data is processed to detect and prevent fraud, account takeover attempts, bot activity, bonus abuse, and other prohibited conduct that could harm phwl players or the integrity of the Platform.
4.6 Marketing and Promotions. With your consent, phwl may use your contact information and gaming preferences to send you personalized promotional offers, tournament invitations, and platform news via email or in-app notification. You may withdraw this consent at any time by updating your notification preferences in your account settings or by contacting our support team.
Legal Basis for Processing
Under the Philippine Data Privacy Act of 2012 and its implementing rules, phwl processes your personal data on the following legal bases:
| Legal Basis | Processing Activities Covered |
|---|---|
| Contractual Necessity | Account creation, game delivery, deposits, withdrawals, bonus management, and customer support — all necessary to fulfill phwl's obligations to you as a registered player. |
| Legal Obligation | KYC identity verification, AML transaction monitoring, PAGCOR regulatory reporting, AMLC disclosures, NPC compliance, and tax record-keeping as required by Philippine law. |
| Legitimate Interest | Fraud detection, platform security, responsible gaming monitoring, abuse prevention, and improving our services — where these interests are not overridden by your data protection rights. |
| Consent | Marketing emails, personalized promotional offers, push notifications, and any processing beyond what is strictly necessary for service delivery. Consent may be withdrawn at any time. |
Withdrawing Consent: Where phwl relies on your consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawing consent for marketing will not affect your ability to access phwl's gaming services.
Data Sharing and Disclosure
6.1 Service Providers. phwl shares personal data with carefully selected third-party service providers who assist in delivering our platform. These providers are contractually bound to process your data only on phwl's instructions, in accordance with RA 10173, and with appropriate security measures in place. Categories of providers include payment processors, KYC verification services, cloud hosting providers, fraud screening tools, and game software suppliers.
6.2 Regulatory Authorities. phwl is legally obligated to disclose certain player data to Philippine regulatory bodies including PAGCOR, the AMLC, the Bureau of Internal Revenue (BIR), and the National Privacy Commission upon lawful request. Such disclosures are made strictly within the scope of the applicable legal requirement.
6.3 Law Enforcement. phwl may disclose personal data to Philippine law enforcement agencies (PNP, NBI) when required by a valid court order, subpoena, or other lawful process, or when phwl believes in good faith that disclosure is necessary to prevent fraud, illegal activity, or imminent harm to persons.
6.4 Business Transfers. In the event of a merger, acquisition, or sale of phwl's business or assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and the acquiring entity's privacy practices before your data is transferred, and you will retain all rights provided under this policy.
6.5 No Sale of Data. phwl does not and will not sell, rent, lease, or trade your personal data to any third party for their own marketing or commercial purposes. This prohibition applies regardless of any change in phwl's ownership or corporate structure.
Data Retention
7.1 Retention Periods. phwl retains your personal data for the periods set out in the table below, after which data is securely deleted or irreversibly anonymised:
| Data Category | Retention Period |
|---|---|
| Account & Registration Data | Duration of active account, plus 5 years after account closure (PAGCOR requirement). |
| KYC / Identity Documents | 5 years from the date of submission or account closure, whichever is later (AML Act requirement). |
| Financial Transaction Records | 5 years from the date of each transaction (BIR and AML Act requirements). |
| Gaming Activity Logs | 2 years from the date of each session, unless required for dispute resolution. |
| Customer Support Records | 3 years from the date of the last interaction. |
| Marketing Consent Records | Until consent is withdrawn, plus 1 year after withdrawal for audit purposes. |
| Device & Technical Logs | 90 days from collection, unless flagged for fraud investigation. |
7.2 Dispute Resolution Extension. Where data is relevant to an ongoing dispute, complaint, or legal proceeding, phwl will retain that data for the duration of the dispute plus an additional 12 months after final resolution, regardless of the standard retention period applicable to that data category.
7.3 Secure Deletion. When data reaches the end of its retention period, phwl will securely delete or irreversibly anonymise it using industry-standard methods. For physical documents, certified destruction methods are used. For digital data, cryptographic erasure or multi-pass overwriting is applied.
Data Security Measures
8.1 Technical Safeguards. phwl implements the following technical security measures to protect your personal data from unauthorized access, disclosure, alteration, and destruction:
- TLS 1.3 encryption for all data transmitted between your device and phwl's servers;
- AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records;
- One-way bcrypt hashing for all account passwords — phwl staff cannot view your password;
- Multi-factor authentication available for all player accounts;
- Firewalls, intrusion detection systems (IDS), and Web Application Firewall (WAF) protection;
- Regular automated vulnerability scanning and periodic third-party penetration testing;
- Role-based access controls ensuring only authorized personnel can access personal data, limited to what is necessary for their function.
8.2 Organizational Safeguards. phwl maintains internal data protection policies and provides mandatory data privacy training to all personnel who handle personal data. Access to player data is logged, monitored, and subject to regular audit. phwl has appointed a Data Protection Officer (DPO) who oversees compliance with RA 10173 and is the primary point of contact for all privacy matters.
8.3 Data Breach Notification. In the event of a personal data breach that is likely to result in a real risk of serious harm to any affected data subject, phwl will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay, in accordance with NPC Circular No. 16-03.
Your Role in Security: phwl's technical measures are only part of the security equation. You are responsible for keeping your account credentials confidential, using a strong unique password, enabling two-factor authentication, and logging out of shared devices. phwl will never ask for your password via email, live chat, or phone.
Your Data Subject Rights
Under the Philippine Data Privacy Act of 2012 and related NPC regulations, you have the following rights as a data subject. phwl is committed to honoring these rights promptly and transparently:
9.1 How to Exercise Your Rights. To exercise any of the above rights, please contact phwl's Data Protection Officer using the contact details in Section 13. Your request will be acknowledged within 5 business days and substantively responded to within 15 business days. Complex requests may take up to 30 business days, in which case phwl will notify you of the extension and provide a reason.
9.2 Identity Verification for Rights Requests. To protect your data, phwl will require you to verify your identity before processing any data subject rights request. This is to ensure that personal data is not disclosed to or altered at the request of an unauthorized party.
Cookies and Tracking Technologies
10.1 What Are Cookies. Cookies are small text files placed on your device by the phwl website when you visit. They allow phwl to recognize your device, remember your preferences, maintain your session, and collect usage data to improve the Platform. phwl uses both session cookies (deleted when you close your browser) and persistent cookies (retained for a set period).
10.2 Types of Cookies phwl Uses.
| Cookie Type | Purpose |
|---|---|
| Strictly Necessary | Required for the Platform to function. Includes session management, login authentication, and security tokens. Cannot be disabled without affecting core functionality. |
| Functional | Remembers your preferences such as language settings, notification preferences, and game display options. Improves your experience without tracking you. |
| Analytics | Collects anonymised data about how players use the Platform — page views, session duration, feature usage — to help phwl improve the experience. No personally identifiable information is used. |
| Security | Detects fraudulent activity, bot traffic, and suspicious login attempts. Used alongside phwl's fraud prevention systems to protect player accounts. |
10.3 Managing Cookies. You can control cookie settings through your browser's privacy settings. Disabling strictly necessary cookies will impair the functionality of the phwl Platform, including your ability to log in. Disabling analytics or functional cookies will not prevent you from using the Platform but may affect your experience. phwl does not use third-party advertising or tracking cookies.
Minors and Age Policy
11.1 Strict 21+ Requirement. phwl's services are strictly restricted to individuals aged 21 years and above, as mandated by PAGCOR regulations governing casino-style gambling in the Philippines. phwl does not knowingly collect personal data from individuals under the age of 21.
11.2 Age Verification. As part of the KYC process, phwl verifies the date of birth of every player using government-issued Philippine identification. Any account found to belong to an individual under 21 years of age will be immediately suspended, all pending withdrawals will be frozen pending review, and the matter will be reported to PAGCOR in accordance with our regulatory obligations.
11.3 Parental Awareness. If you are a parent or guardian and believe that a minor in your household has accessed or registered for a phwl account, please contact our support team immediately at the contact details in Section 13. phwl will investigate and take appropriate action, including account closure and data deletion to the extent permitted by law, as promptly as possible.
⚠️ Age Restriction Reminder: Gambling is strictly for adults aged 21 years and older in the Philippines. If you are under 21, you are not permitted to register, deposit, or play on phwl. phwl takes this requirement seriously and enforces it through mandatory ID verification.
Changes to This Privacy Policy
12.1 Right to Amend. phwl reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, NPC regulations, or PAGCOR requirements. The updated policy will be posted on this page with a revised "Last Updated" date at the top of the document.
12.2 Notification of Material Changes. Where changes to this policy are material — meaning they significantly affect how phwl processes your personal data or your rights as a data subject — phwl will notify registered players via email or a prominent in-platform notification at least 14 days before the changes take effect. Your continued use of phwl's services after the effective date of any change constitutes your acknowledgment of the updated policy.
12.3 Prior Versions. Players who wish to review prior versions of this Privacy Policy may request them from phwl's Data Protection Officer. phwl maintains an archive of all prior policy versions with their respective effective dates.
Contact Our Data Protection Officer
If you have any questions, concerns, or requests relating to this Privacy Policy or phwl's data processing practices, you may contact our Data Protection Officer through any of the following channels:
- Email: [email protected] — please include the subject line "Privacy / DPO Inquiry" so your message is routed correctly.
- Live Chat: Via the phwl Platform live chat feature, available 24 hours a day, 7 days a week including Philippine public holidays.
- Messenger: Via the official phwl Facebook Messenger channel.
- Viber: Via the official phwl Viber community.
Our support team is available 24 hours a day, 7 days a week, including all Philippine public holidays. For legal or compliance-specific inquiries, please mark your message with the subject line "Legal / Privacy Inquiry" so it can be routed to the appropriate team. Average response time for DPO inquiries is two (2) business days.
You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you believe phwl has handled your personal data in a manner inconsistent with RA 10173. The NPC can be reached through their official government website.
Responsible Gaming Resources: If gambling is negatively affecting your life or the life of someone you know, please visit the phwl Responsible Gaming page at phwl.app/responsible-gaming or contact PAGCOR's responsible gaming helpline. Help is available — you do not have to manage it alone.
Have Questions About Your phwl Privacy?
Our 24/7 Filipino-speaking support team is always on standby — whether you need help with a data request, want to update your information, or have questions about how phwl protects your personal data.