cashwin Privacy Policy

cashwin is the data controller responsible for personal data collected through the cashwin platform at cashwin.bio. As data controller, cashwin determines the purposes and means of processing your personal data and is accountable for ensuring that such processing complies with the Philippine Data Privacy Act of 2012 (Republic Act 10173), its Implementing Rules and Regulations (IRR), and all relevant issuances of the National Privacy Commission (NPC).

cashwin operates as a PAGCOR-regulated online gaming platform serving Filipino players across the Philippines. All personal data processing activities described in this Privacy Policy are carried out in connection with the provision of cashwin's online casino, sports betting, and related gaming services.

cashwin has designated a Data Privacy Officer (DPO) who is responsible for overseeing data protection compliance and handling data subject requests and inquiries. Contact details for the DPO are provided in Section 14 of this Privacy Policy.

cashwin collects personal data that is necessary, adequate, and proportionate to the purposes for which it is collected. The categories of personal data cashwin processes are as follows:

cashwin does not collect sensitive personal information beyond what is strictly necessary for identity verification and regulatory compliance. cashwin does not collect information about your religious beliefs, political affiliations, health records (beyond responsible gaming self-disclosures), or biometric data beyond identity document photographs as required for KYC.

cashwin collects personal data through the following methods:

• Direct collection. Information you provide directly when registering a cashwin account, completing KYC verification, making deposits or withdrawal requests, contacting support, or responding to cashwin surveys and promotions.
• Automated technical collection. When you access and use the cashwin platform, our servers automatically record technical data including your IP address, device identifiers, browser characteristics, pages visited, games played, and session timestamps. This collection is necessary for platform security and fraud prevention.
• Cookies and similar technologies. cashwin uses cookies, web beacons, and similar tracking technologies to maintain session state, remember preferences, and analyze platform performance. See Section 9 for full details on cashwin's cookie practices.
• Third-party verification services. During KYC verification, cashwin may use PAGCOR-compliant third-party identity verification services to validate government-issued IDs. These services operate under data processing agreements with cashwin and are bound by equivalent data protection standards.
• Payment processor data. When you initiate a deposit or withdrawal via GCash, Maya, or a Philippine bank, cashwin receives transaction confirmation data from the payment processor. cashwin does not store your full GCash PIN, Maya PIN, or bank account login credentials.

Under the Philippine Data Privacy Act, cashwin processes your personal data on the following legal bases:

• Contractual necessity. Processing required to fulfill cashwin's obligations under the account agreement with you — including account management, transaction processing, game delivery, and support — is necessary for the performance of the contract between you and cashwin.
• Legal obligation. Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), the Philippine Data Privacy Act, and other applicable Philippine law. This includes KYC verification, AML transaction monitoring, and regulatory reporting obligations. This processing cannot be objected to.
• Legitimate interests. Processing carried out for cashwin's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and business analytics, where such interests are not overridden by your fundamental rights and freedoms.
• Consent. Where cashwin relies on your consent as the legal basis — such as sending you promotional communications or marketing materials — you may withdraw that consent at any time by adjusting your notification preferences in your cashwin account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

cashwin uses personal data collected from you for the following specific purposes:

• Creating, verifying, and managing your cashwin account, including authentication and access control.
• Processing deposits and withdrawals via GCash, Maya, BPI, BDO, Metrobank, InstaPay, and QR Ph.
• Conducting KYC identity verification and ongoing AML transaction monitoring as required by PAGCOR and the AMLA.
• Providing, personalizing, and improving cashwin's games, promotions, and platform features for Filipino players.
• Delivering customer support through live chat and email, including dispute resolution and complaint handling.
• Monitoring gaming activity for responsible gaming purposes, including detection of potential problem gambling indicators.
• Preventing, detecting, and investigating fraud, account compromise, bonus abuse, and prohibited conduct as defined in cashwin's Terms and Conditions.
• Sending transactional notifications (account activity, payment confirmations, security alerts) and, where you have consented, promotional communications about cashwin's games and offers.
• Complying with PAGCOR reporting obligations, NPC requirements, and other applicable Philippine legal and regulatory obligations.
• Conducting internal analytics, audits, and quality assurance to maintain and improve cashwin platform performance and player experience.

cashwin does not sell your personal data to third parties. cashwin shares personal data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose:

• PAGCOR and regulatory authorities. cashwin is required to share player account information, transaction records, and gaming activity data with PAGCOR and other Philippine regulatory or law enforcement authorities upon lawful request or as part of mandatory reporting obligations.
• Payment processors. cashwin shares transaction-relevant data (name, account reference, amount) with GCash, Maya, BPI, BDO, Metrobank, and other payment processors solely to facilitate deposit and withdrawal processing. These processors operate under their own privacy policies and applicable Philippine financial regulations.
• KYC and identity verification providers. cashwin shares identity document data with PAGCOR-compliant KYC verification service providers under data processing agreements that bind those providers to equivalent data protection standards.
• Game suppliers. Game transaction data (bets, wins, losses, game session data) is shared with cashwin's game content providers for game delivery, RNG auditing, and dispute resolution. Game suppliers do not receive your full identity or financial data.
• Legal proceedings. cashwin may disclose personal data to Philippine courts, law enforcement, or government agencies where required by valid legal process, court order, or applicable law, including the AMLA and its implementing regulations.
• Business transfers. In the event of a merger, acquisition, or sale of cashwin's business or assets, your personal data may be transferred to the acquiring entity, subject to equivalent data protection commitments and notification to you as required by the NPC.

cashwin's primary data processing infrastructure is hosted within data center facilities serving the Asia-Pacific region. However, some of cashwin's technology service providers, game content suppliers, and KYC verification partners may process data on servers located outside the Philippines.

Where personal data is transferred outside the Philippines, cashwin takes steps to ensure that appropriate protections are in place, including:

• Entering into data processing agreements that incorporate the NPC's prescribed standard contractual clauses or equivalent safeguards for cross-border data transfers.
• Transferring data only to jurisdictions or organizations that provide an adequate level of data protection as determined by the NPC.
• Conducting transfer impact assessments where required by NPC guidance to confirm that data transferred abroad is adequately protected against unauthorized access, disclosure, or misuse.

By using cashwin's platform and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data as described in this section, subject to the protections outlined above.

cashwin retains personal data for no longer than is necessary for the purpose for which it was collected, subject to applicable statutory minimum retention periods under Philippine law. The following retention periods apply:

Upon expiry of the applicable retention period, cashwin will securely delete or anonymize your personal data so that it can no longer be associated with you. Where full deletion is not immediately practicable due to backup schedules, data will be isolated from active systems and deleted in the next scheduled secure deletion cycle.

cashwin uses cookies and similar tracking technologies to operate the platform, maintain your session, remember your preferences, and understand how Filipino players use the cashwin platform so we can continue improving it.

The types of cookies cashwin uses are:

• Strictly necessary cookies. These cookies are essential for the cashwin platform to function. They enable you to stay logged in to your cashwin account, maintain your game session, and complete transactions. These cookies cannot be disabled without significantly impairing platform functionality.
• Functional cookies. These cookies remember your preferences — such as your selected language, display settings, and responsible gaming tool configurations — so you do not need to re-enter them on each visit to cashwin.
• Analytics cookies. cashwin uses anonymized analytics data to understand how players navigate the platform, which games are most popular, and where technical issues occur. This helps us optimize the cashwin experience, particularly for mobile users on Philippine networks.
• Security cookies. These cookies assist cashwin's fraud detection and account security systems by identifying unusual access patterns, device fingerprinting for suspicious login detection, and CSRF protection for account transactions.

cashwin does not use third-party advertising or retargeting cookies. You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from accessing your cashwin account.

cashwin implements appropriate technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption in transit. All data transmitted between your device and cashwin's servers is encrypted using TLS 1.2 and TLS 1.3 protocols. This covers account login, payment processing, KYC document uploads, and all platform interactions.
• Encryption at rest. Sensitive personal data stored on cashwin's servers — including identity documents and financial data — is encrypted at rest using industry-standard AES-256 encryption.
• Access controls. Access to personal data within cashwin is restricted to authorized personnel on a strict need-to-know basis. All internal access to player data is logged and subject to periodic audit.
• Intrusion detection and monitoring. cashwin's infrastructure is monitored 24/7 for unauthorized access attempts, anomalous activity, and security incidents. Automated alerting systems are in place to trigger rapid response to detected threats.
• Penetration testing. cashwin's platform undergoes periodic security assessments, including penetration testing, to identify and remediate vulnerabilities before they can be exploited.
• Staff training. All cashwin personnel who handle personal data receive data privacy and security training as part of their onboarding and on an ongoing basis.

While cashwin takes all reasonable steps to protect your personal data, no internet transmission or electronic storage system is 100% secure. cashwin encourages you to use a strong, unique password for your cashwin account and to notify support immediately if you suspect unauthorized access.

The cashwin platform is strictly intended for persons aged 21 years and above, as required by PAGCOR regulations for online gambling in the Philippines. cashwin does not knowingly collect personal data from any person under the age of 21.

cashwin's registration process includes mandatory age verification steps to prevent minors from opening cashwin accounts. Where cashwin discovers — through KYC verification, parental complaint, or any other means — that a person under 21 has provided personal data to cashwin, we will:

• Immediately suspend and close the relevant cashwin account.
• Delete or anonymize all personal data collected from the underage person as promptly as practicable, subject to any statutory retention obligations under PAGCOR or AMLA regulations.
• Report the incident to PAGCOR as required by cashwin's licensing obligations.
• Refund any deposits made by the underage account, at cashwin's discretion and after completing applicable regulatory reporting.

To exercise any of your rights under the Philippine Data Privacy Act as described in the Data Subject Rights section above, you may submit a request to cashwin's Data Privacy Officer through any of the following channels:

• Live chat. The fastest way to reach cashwin's support team — available 24/7 directly on the cashwin platform. For data subject requests, ask to be connected to the Data Privacy Officer or the compliance team.
• Email. Send your request to cashwin's support address: [email protected]. Please include your registered cashwin account email address, the specific right you wish to exercise, and sufficient detail for cashwin to identify and process your request.

cashwin will acknowledge receipt of your data subject request within 3 business days and will respond substantively within 15 business days of receiving a verified request. In complex cases, cashwin may extend this period by an additional 15 business days, with notification to you of the extension and the reason for it.

cashwin will not charge a fee for handling data subject requests unless the request is manifestly unfounded, excessive, or repetitive — in which case cashwin may charge a reasonable administrative fee or decline to act on the request, with written explanation provided to you.

cashwin may need to verify your identity before processing a data subject request to ensure that personal data is not disclosed to or actioned by an unauthorized party. You may be asked to provide a copy of a government-issued ID or to confirm certain account details as part of identity verification for data subject requests.

cashwin reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable Philippine law or NPC guidance, changes in PAGCOR licensing requirements, or other operational changes affecting how cashwin handles personal data.

When cashwin makes material changes to this Privacy Policy, we will notify registered cashwin players through one or more of the following methods:

• A notice posted prominently on the cashwin platform homepage and login page.
• An in-platform notification sent to your cashwin account notification center.
• An email notification sent to your registered cashwin account email address, for changes that materially affect your rights or how cashwin uses your data.

The updated Privacy Policy will indicate the effective date of the new version at the top of the document. Your continued use of the cashwin platform after the effective date of a revised Privacy Policy constitutes your acknowledgment of, and where applicable consent to, the updated terms.

cashwin maintains an archive of previous versions of this Privacy Policy. If you wish to review a prior version, contact cashwin's Data Privacy Officer via the channels listed in Section 14.

For all data privacy-related inquiries, data subject requests, privacy complaints, or questions about this Privacy Policy, please contact cashwin's designated Data Privacy Officer:

When contacting cashwin's DPO, please include your registered cashwin account email address, a clear description of your inquiry or request, and any relevant details that will help cashwin locate and process your data efficiently. cashwin's support team is available 24 hours a day, 7 days a week, with peak staffing during Philippine Standard Time (PST) business hours.

cashwin is committed to resolving all data privacy concerns promptly and transparently. If you remain dissatisfied after engaging with cashwin's DPO, you may escalate to the National Privacy Commission (NPC) of the Philippines, which has jurisdiction over data privacy complaints involving personal data of Filipino data subjects.