pasawin Privacy Policy

pasawin is a Philippines-facing online gaming platform accessible at pasawin.app. This Policy governs the collection, storage, processing, and disclosure of personal data that pasawin receives from individuals who visit, register on, or interact with the platform — including players from Manila, Cebu, Davao, Quezon City, and all other parts of the Philippines.

pasawin is committed to respecting the privacy and data rights of every individual whose personal data it processes. This commitment is grounded in the principles of transparency, legitimate purpose, and proportionality — the three core principles of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA").

This Policy applies to all personal data processed by pasawin regardless of the medium through which it is collected — browser access, mobile access, customer support interactions, payment processing, and KYC (Know Your Customer) verification. It does not apply to third-party websites, services, or platforms that may be linked to or from the pasawin platform.

For the purposes of the Philippine Data Privacy Act of 2012, the data controller responsible for the personal data processed through pasawin.app is:

• Platform Name: pasawin
• Website: pasawin.app
• Data Protection Officer (DPO) Contact: [email protected]
• Market: Republic of the Philippines

pasawin has designated a Data Protection Officer (DPO) in accordance with Section 21 of the DPA. The DPO is responsible for overseeing pasawin's data protection compliance, handling data subject requests, and serving as the primary contact point for the National Privacy Commission (NPC) of the Philippines.

pasawin collects the categories of personal data set out in the table below. We collect only what is necessary for the purposes described in Section 5.

pasawin does not intentionally collect sensitive personal information as defined under Section 3(l) of the DPA (including race, ethnicity, health data, religious beliefs, or criminal history) except to the extent that criminal history may be relevant to AML or regulatory compliance obligations.

pasawin collects personal data through the following means:

• Direct Provision: When you register a pasawin account, you provide your name, mobile number, email address, and password directly. When you complete KYC verification, you provide government ID documents and additional identity information.
• Payment Processors: When you deposit or withdraw via GCash, PayMaya, BPI, BDO, or Metrobank, pasawin receives transaction confirmation data from the payment processor sufficient to record the transaction in your account and comply with AML obligations.
• Automated Technical Collection: pasawin's platform automatically logs technical data (IP address, device, session data) each time you access the site. This is standard practice for web-based platforms and is described further in Section 9 on cookies.
• Customer Support: When you contact pasawin support via live chat or email, the content of those communications is stored as part of your account record for service continuity and quality purposes.
• Third-Party Verification Providers: pasawin uses accredited third-party KYC and identity verification services. Data submitted for KYC is processed by these providers on pasawin's behalf under data processing agreements.

pasawin uses the personal data it collects for the following purposes:

• Account Creation and Management: To register and maintain your pasawin account, verify your identity, process your login, and manage account settings;
• Payment Processing: To process deposits from and withdrawals to your GCash, PayMaya, or bank account in Philippine Peso;
• KYC and Age Verification: To verify that you are at least 21 years old and legally permitted to use the platform, as required by PAGCOR regulations;
• AML Compliance: To monitor transactions for patterns consistent with money laundering and to fulfil reporting obligations under the Anti-Money Laundering Act (RA 9160 as amended);
• Gaming Operations: To operate games and sports betting markets, record your bets and results, manage bonuses, and administer the loyalty programme;
• Responsible Gaming: To monitor gaming patterns that may indicate problem gambling, enforce deposit and loss limits you have set, and process self-exclusion requests;
• Security and Fraud Prevention: To detect and prevent unauthorised account access, bonus abuse, collusion, and other prohibited conduct described in the pasawin Terms and Conditions;
• Customer Support: To respond to your enquiries, complaints, and requests, and to maintain records of support interactions;
• Platform Improvement: To analyse anonymised usage data to improve platform performance, identify popular features, and fix technical issues;
• Legal and Regulatory Compliance: To comply with applicable Philippine laws, respond to regulatory enquiries from PAGCOR and the AMLC, and manage any legal disputes.

Under the Philippine Data Privacy Act of 2012, pasawin processes personal data on one or more of the following legal bases:

pasawin does not sell personal data. We share personal data only where necessary to operate the platform and comply with Philippine law, with the following categories of recipients:

• Payment Processors: GCash (G-Xchange Inc.), PayMaya Philippines Inc., BPI, BDO, Metrobank, Visa, Mastercard — to process deposits and withdrawals on your behalf;
• KYC and Identity Verification Providers: Accredited third-party identity verification services that process your government ID documents and biometric data on pasawin's behalf under strict data processing agreements;
• Game Software Providers: Licensed game suppliers (including Pragmatic Play, PG Soft, Jili, and others) receive anonymised session tokens to serve game content — they do not receive your name or payment details;
• PAGCOR: The Philippine Amusement and Gaming Corporation, as the applicable regulatory authority, may require pasawin to disclose player data and transaction records as part of its regulatory oversight functions;
• AMLC: The Anti-Money Laundering Council of the Philippines, where pasawin is obligated to report covered and suspicious transactions under RA 9160 as amended;
• Law Enforcement: Philippine law enforcement agencies where required by court order, subpoena, or other lawful process;
• Fraud Prevention Services: Third-party fraud detection and security services that help pasawin identify suspicious account activity — operating under data processing agreements;
• Cloud and Infrastructure Providers: Technical infrastructure and cloud hosting providers that process data on pasawin's behalf under binding confidentiality and security obligations.

All third parties with whom pasawin shares personal data are required to handle that data in a manner consistent with the Philippine Data Privacy Act. Where processing occurs outside the Philippines, pasawin ensures that appropriate safeguards are in place to protect the data.

pasawin retains personal data for as long as necessary to fulfil the purposes for which it was collected, and to comply with applicable Philippine legal and regulatory retention requirements. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or permanently anonymised so that it can no longer be attributed to an identifiable individual.

pasawin uses cookies and similar tracking technologies to operate the platform, improve your experience, and collect the technical data described in Section 3. The following types of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in to your pasawin account during a session. These cannot be disabled without preventing you from using the platform.
• Functional Cookies: Remember your preferences such as language settings, game lobby filters, and responsible gaming settings you have configured. Disabling these may affect platform functionality.
• Performance and Analytics Cookies: Collect anonymised data about how players use the pasawin platform — which pages are most visited, how long sessions last, and which features are most used. This data helps pasawin improve the platform.
• Security Cookies: Used to detect and prevent fraudulent login attempts, account takeovers, and other security threats by tracking device fingerprints and session patterns.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to the personal data that pasawin holds about you:

pasawin implements technical and organisational security measures appropriate to the nature and volume of the personal data it processes. These measures include:

• Encryption in Transit: All data exchanged between your device and the pasawin platform is protected by 256-bit SSL encryption using TLS 1.3 — the current industry standard for secure web communication;
• Encryption at Rest: Sensitive data stored on pasawin's servers, including identity documents and financial data, is encrypted at rest using AES-256 encryption;
• Password Hashing: Account passwords are never stored in plaintext. pasawin uses a strong one-way cryptographic hashing algorithm with per-user salting, meaning passwords cannot be reversed or recovered even by pasawin staff;
• Two-Factor Authentication: pasawin supports SMS OTP-based two-factor authentication. Players are strongly encouraged to enable 2FA to add a second layer of protection to their accounts;
• Access Controls: Access to player data within pasawin's systems is restricted to authorised staff on a need-to-know basis. All internal data access is logged and auditable;
• Security Monitoring: pasawin operates continuous security monitoring to detect and respond to unauthorised access attempts, anomalous login patterns, and other security incidents;
• Breach Response: In the event of a personal data breach that poses a risk to the rights and freedoms of affected players, pasawin will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected players as required by the DPA.

pasawin implements age verification as part of its KYC process to confirm that all registered players meet the minimum age requirement. If you are a parent or guardian and believe that a minor in your care has registered a pasawin account, please contact us immediately at [email protected] so we can take appropriate action.

pasawin encourages all adults in households with minors to use parental control software and to keep their pasawin login credentials private and inaccessible to minors.

pasawin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, or regulatory requirements. When material changes are made to this Policy, pasawin will:

• Publish the updated Policy on this page with a revised "Last Updated" date;
• Notify registered players via their registered email address or mobile number at least seven (7) days before the changes take effect, where those changes materially affect how pasawin uses their personal data;
• Where a change requires fresh consent (for example, a new marketing purpose), request that consent separately before processing.

Your continued use of the pasawin platform after the effective date of any Privacy Policy update constitutes acceptance of the revised Policy. If you do not accept the updated Policy, you may close your account by contacting pasawin support.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to report a privacy concern, please contact pasawin's Data Protection Officer through the following channels:

• Email: [email protected] — use subject line "Privacy / Data Subject Request"
• Live Chat: Available 24/7 via the pasawin platform after logging in to your account
• Response Time: pasawin acknowledges all privacy-related requests within 5 business days. Substantive responses are provided within 30 calendar days. Complex requests may take longer — you will be informed.

If you are not satisfied with pasawin's handling of your personal data or your data rights request, you have the right to escalate your concern to the National Privacy Commission (NPC) of the Philippines — the independent government body responsible for enforcing the Data Privacy Act. pasawin cooperates fully with all NPC enquiries and investigations.