Privacy Policy

This Privacy Policy ("Policy") describes how shewin ("shewin," "we," "us," or "our"), the operator of the online gaming platform at shewin.asia ("the Platform"), collects, processes, stores, shares, and protects the personal information of users who access or register on the Platform ("Players," "Users," or "you").

shewin is committed to protecting the privacy and personal data of all Filipino players in accordance with Republic Act No. 10173, the Philippine Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), and all relevant circulars and guidelines issued by the National Privacy Commission ("NPC").

This Policy applies to all personal data collected through: the shewin.asia website; account registration and KYC processes; payment transactions; customer support interactions; and any other interaction you have with the shewin Platform. By registering a shewin account or using the Platform in any capacity, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

For the purposes of the Philippine Data Privacy Act of 2012, shewin is the Personal Information Controller (PIC) in respect of the personal data collected through the Platform. shewin has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and the DPA.

The shewin Data Protection Officer may be contacted at:

• Email: [email protected] (subject line: "Data Protection Officer / DPA Request") — plain text only, not a link.
• Platform: Via the in-platform live chat function (request to speak with the DPO team).

shewin operates under the oversight of the Philippine Amusement and Gaming Corporation (PAGCOR) as its primary gaming regulator. Data processing obligations are aligned with both DPA requirements and PAGCOR's Know Your Customer (KYC) and Anti-Money Laundering (AML) compliance standards.

shewin collects the following categories of personal data from Players, depending on the nature of their interaction with the Platform:

shewin automatically collects certain technical data when you access the Platform, including: IP address; device type, operating system, and browser version; session timestamps and duration; game play logs (rounds played, bets placed, outcomes — for dispute resolution and RNG audit purposes); and pages visited within the Platform.

shewin collects personal data through the following channels and mechanisms:

• Directly from you — data you provide during account registration, KYC submission, payment transactions, support interactions, and communications with shewin's team.
• Automatically through Platform use — technical and usage data collected via cookies, server logs, and analytics tools when you browse shewin.asia or use Platform features.
• From payment processors — transaction confirmation data received from GCash, PayMaya, and bank partners in order to verify and reconcile deposits and withdrawals.
• From identity verification services — where shewin employs third-party KYC verification tools to assist in document authentication, limited data may be processed by the verification partner under strict contractual data processing agreements.
• From regulatory authorities — PAGCOR and other competent authorities may provide or require the exchange of specific data in connection with licensing, compliance monitoring, or investigations.

shewin processes personal data only where a valid lawful basis exists under the Philippine Data Privacy Act. The primary purposes and their corresponding legal bases are as follows:

shewin does not sell, rent, or trade personal data to third parties for any commercial purpose. shewin may share personal data with third parties only in the following strictly limited circumstances:

• Payment processors — GCash, PayMaya, and banking partners receive transactional data strictly necessary to process deposits and withdrawals on behalf of players.
• KYC verification service providers — where third-party tools assist in identity document authentication, processing is limited to what is necessary and governed by contractual data processing agreements.
• Game software providers — JILI and other game providers integrated into the shewin Platform may receive anonymised or pseudonymised gameplay data for game integrity audit purposes.
• PAGCOR and government regulatory authorities — shewin is legally required to share certain data with PAGCOR and other government bodies in connection with licensing compliance, regulatory audits, and investigations.
• Anti-Money Laundering Council (AMLC) — shewin is required to file suspicious transaction reports (STRs) and covered transaction reports (CTRs) with the AMLC under Philippine law. These reports include transaction and identity data as specified in the AMLA implementing rules.
• Law enforcement authorities — shewin will disclose personal data to Philippine law enforcement or courts when required by a valid court order, subpoena, or other lawful demand.
• Professional advisors — lawyers, auditors, and compliance consultants engaged by shewin may access personal data under strict confidentiality obligations.

KYC documents submitted to shewin — including images of your UMID, Philippine passport, LTO driver's license, PhilSys National ID, or other accepted Philippine government ID — are processed exclusively for the following purposes:

• Verifying that you are the person registered to the shewin account.
• Confirming that you are 21 years of age or older, as required by PAGCOR.
• Satisfying shewin's AML customer due diligence obligations under Philippine law.
• Enabling shewin to comply with Covered Transaction Reporting requirements to the AMLC where applicable.

KYC documents are stored in encrypted form on secure servers. Access is restricted to shewin's compliance team members who require it to perform the verification function. KYC documents are never used for marketing purposes, shared with game providers, or used for any purpose other than those listed above.

KYC data is retained for the period required by PAGCOR regulations and the Anti-Money Laundering Act — currently a minimum of five (5) years from the date of the relevant transaction or account closure, whichever is later.

shewin processes payment data to facilitate deposits and withdrawals in Philippine Peso via GCash, PayMaya, BPI, BDO, and Metrobank. shewin does not store complete payment card numbers, banking passwords, or full e-wallet credentials. Payment transactions are processed through secure payment gateway integrations, and full financial credentials remain with the respective payment provider.

Transaction records — including deposit amounts, dates, withdrawal amounts, and payment method references — are retained by shewin as required by PAGCOR regulations and the Anti-Money Laundering Act. These records are accessible to PAGCOR auditors and AMLC as part of shewin's regulated obligations.

For withdrawals, shewin verifies that the payment method used matches the KYC-verified identity of the account holder before processing. This verification step protects players against unauthorised fund diversion and satisfies PAGCOR's anti-fraud requirements.

shewin uses cookies and similar browser-based tracking technologies to operate the Platform effectively. The following categories of cookies are used:

shewin does not deploy third-party advertising cookies, retargeting pixels, or social media tracking scripts on the Platform. You may manage or delete cookies through your browser's privacy or settings menu. Note that disabling strictly necessary cookies will prevent you from logging in to and using the shewin Platform.

shewin retains personal data for the period necessary to fulfil the purpose for which it was collected, comply with legal obligations, and resolve disputes. The following retention framework applies:

After the applicable retention period expires, personal data is either securely deleted, anonymised, or aggregated such that it can no longer be associated with any individual player.

shewin implements technical and organisational security measures appropriate to the risk of processing personal data in an online gaming environment. These include, without limitation:

• 256-bit SSL/TLS encryption for all data in transit between player devices and shewin servers.
• Encryption at rest for sensitive data including KYC documents, password hashes, and financial records stored in shewin's databases.
• Role-based access controls ensuring that staff members can only access personal data necessary for their specific function.
• Multi-factor authentication required for all shewin staff accessing internal systems containing personal data.
• Regular security audits and penetration testing of Platform infrastructure.
• Incident response procedures tested and maintained to enable rapid containment and notification in the event of a data breach.
• Staff data protection training for all personnel with access to personal data.

shewin's primary data processing infrastructure is located in the Asia-Pacific region. In certain operational contexts — such as the use of third-party KYC verification tools or game software provided by international game studios — personal data may be transferred to or accessible by entities located outside the Philippines.

Where such international transfers occur, shewin ensures that:

• The recipient country provides an adequate level of data protection, or
• Appropriate safeguards are in place through contractual clauses consistent with NPC guidelines for cross-border data transfers, or
• The transfer is necessary for the performance of your shewin account contract and no other lawful means of data transfer is feasible.

Players may request information about cross-border data transfers affecting their personal data by contacting shewin's Data Protection Officer.

If shewin becomes aware that personal data of a person under 21 years of age has been submitted — whether through fraudulent registration, a failed age verification, or any other means — that data will be immediately and permanently deleted, and the associated account will be terminated. Any balance in the account will be handled in accordance with PAGCOR regulatory guidance on underage account terminations.

If you believe a minor has registered a shewin account, please contact shewin's support team immediately so the matter can be investigated and resolved without delay.

As a data subject under Republic Act No. 10173, you have the following rights in relation to the personal data shewin holds about you:

1. Right to be Informed — to be notified of what personal data shewin collects, the purpose of collection, and your rights as a data subject, which this Policy fulfils.
2. Right of Access — to obtain a copy of your personal data held by shewin upon submitting a verified written request.
3. Right to Dispute / Correction — to dispute the accuracy of personal data and to have inaccurate, outdated, or incomplete data corrected.
4. Right to Erasure or Blocking — to request the removal or blocking of personal data where it is no longer necessary for the purpose it was collected, subject to shewin's legal retention obligations.
5. Right to Object — to object to the processing of your personal data, including for direct marketing purposes.
6. Right to Data Portability — to receive your personal data in a structured, machine-readable format.
7. Right to Damages — to claim compensation for any damage suffered as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of your personal data by shewin.
8. Right to File a Complaint — to lodge a complaint with the National Privacy Commission (NPC) if you believe shewin has violated your rights under the DPA.

To exercise any of these rights, submit a written request to shewin's Data Protection Officer at [email protected] (plain text — not a link) with the subject line "DPA Data Subject Request." shewin will verify your identity before processing any request and will respond within 15 business days.

shewin may send you marketing communications regarding promotions, bonuses, new games, and platform updates, but only if you have provided your explicit consent to receive such communications during account registration or through your account notification settings.

Marketing messages from shewin are sent exclusively through the following official channels:

• SMS to your registered +63 Philippine mobile number.
• In-platform notifications within the shewin dashboard (only visible when logged in).

You may withdraw your consent to receive marketing communications at any time by updating your notification preferences in shewin account settings, or by contacting shewin's support team. Withdrawal of marketing consent does not affect shewin's ability to send service communications (e.g., transaction confirmations, account security alerts) which are sent on the basis of contractual necessity.

The shewin Platform may contain references to or integrations with third-party payment services (GCash, PayMaya, BPI, BDO, Metrobank) and game providers. When you interact with these third-party services — for example, when completing a GCash payment — you are subject to the privacy policy and data practices of that third party, not shewin's.

shewin is not responsible for the privacy practices of third-party services. shewin recommends that you review the privacy policies of any third-party payment provider you use to process transactions at shewin. shewin's contractual agreements with all integrated third-party providers include data protection obligations consistent with the DPA.

shewin reserves the right to update, amend, or replace this Privacy Policy at any time. When material changes are made to this Policy, shewin will notify registered Players through one or more of the following methods: in-platform notification upon login; SMS notification to the registered mobile number; or a prominent notice on the shewin.asia homepage.

The updated Policy will take effect on the date specified in the notification. Continued use of the shewin Platform after the effective date of any amendment constitutes acceptance of the revised Privacy Policy. The "Effective Date" at the top of this document reflects the most recent version.

The current version of this Privacy Policy is always accessible at shewin.asia/privacy-policy. Players are encouraged to review this page periodically.

For all privacy-related enquiries, data subject rights requests, or concerns about shewin's handling of your personal data, please contact shewin's Data Protection Officer through the following channels:

• Email: [email protected] — use subject line "Data Protection Officer" or "DPA Request." This is plain text only — not a clickable link.
• In-Platform Live Chat: Available 24/7 once logged in. Request to be connected with the Data Protection Officer or compliance team for privacy-related matters.
• Response Time: shewin acknowledges DPA-related requests within 3 business days and provides substantive responses within 15 business days, consistent with NPC guidelines.

If you are not satisfied with shewin's response to your data privacy concern, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Philippines, the government body responsible for enforcing the Data Privacy Act of 2012.