🔏 hellowin Privacy Policy

1. Introduction

1.1 This Privacy Policy ("Policy") describes how hellowin (the "Platform", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals who access or use the hellowin online casino platform at hellowin.one.

1.2 hellowin is committed to protecting the privacy and personal data of all registered players, particularly Filipino players whose data is protected under Republic Act No. 10173, also known as the Data Privacy Act of 2012, and its Implementing Rules and Regulations as administered by the National Privacy Commission (NPC).

1.3 This Policy applies to all personal data collected through the hellowin website, mobile platform, customer support interactions, and all other touchpoints through which hellowin interacts with its players.

2. Data Controller

2.1 For the purposes of the Data Privacy Act of 2012 and applicable Philippine data protection regulations, hellowin acts as the Personal Information Controller in respect of the personal data of its players.

2.2 hellowin operates under a valid PAGCOR licence and maintains full regulatory compliance with the Philippine Amusement and Gaming Corporation's data governance requirements.

2.3 hellowin has appointed a designated Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data protection laws. The DPO may be contacted via the details set out in Section 14 of this Policy.

3. Categories of Personal Data We Collect

3.1 Identity & Contact Data. Full legal name, date of birth, nationality, residential address (including city — e.g. Manila, Cebu, Davao, Quezon City, Makati), email address, and Philippine mobile number.

3.2 Identity Verification (KYC) Data. Government-issued identification documents, including PhilSys National ID, UMID, SSS/GSIS ID, Driver's Licence, or Passport number and images; selfie photographs for liveness verification.

3.3 Financial Data. GCash account details, PayMaya account details, bank account numbers (BPI, BDO, Metrobank, UnionBank), transaction history, deposit and withdrawal records, and wallet balance.

3.4 Gaming Activity Data. Game session logs, bet history, win/loss records, game preferences, bonus utilisation, and responsible gaming tool settings.

3.5 Technical & Device Data. IP address, device type, browser type and version, operating system, screen resolution, cookies and session tokens, and geolocation data (where permitted).

3.6 Communications Data. Records of correspondence with hellowin customer support, live chat transcripts, and feedback submissions.

4. How We Collect Your Data

hellowin collects personal data through the following channels:

• Direct provision — data you submit during account registration, KYC verification, deposit/withdrawal requests, and support interactions;
• Automated technologies — cookies, web beacons, and server logs that capture technical and device data as you use the Platform;
• Third-party verification providers — identity verification and KYC service providers authorised by hellowin to conduct identity checks on its behalf;
• Payment service providers — GCash, PayMaya, and Philippine banking institutions that process transactions on the Platform;
• Regulatory authorities — PAGCOR and AMLC, which may share information relevant to your account under their regulatory mandates.

5. Purposes of Processing

hellowin processes your personal data for the following specific, legitimate purposes:

• Account registration, authentication, and management;
• Identity and age verification (KYC) as required by PAGCOR regulations — including enforcement of the 21+ minimum age requirement;
• Processing deposits and withdrawals via GCash, PayMaya, and Philippine bank accounts;
• Detecting, investigating, and preventing fraud, money laundering, and other prohibited activities;
• Providing customer support and responding to player queries and complaints;
• Delivering promotional offers, bonuses, and personalised game recommendations — where you have not opted out;
• Ensuring compliance with PAGCOR licensing conditions, AMLA obligations, and all applicable Philippine laws;
• Administering responsible gaming tools, including self-exclusion programmes and deposit limit monitoring;
• Improving Platform performance, user experience, and game content based on aggregated usage analytics.

6. Legal Basis for Processing

6.1 hellowin processes personal data on the following legal grounds under the Data Privacy Act of 2012:

• Contractual necessity — processing required to fulfil the player account agreement, including KYC verification and payment processing;
• Legal obligation — processing mandated by PAGCOR regulations, AMLA, and other Philippine laws;
• Legitimate interests — fraud prevention, platform security, and responsible gaming compliance where these interests are not overridden by your data subject rights;
• Consent — marketing communications and optional data analytics, which you may withdraw at any time by updating your account preferences or contacting hellowin's DPO.

7. Data Sharing & Disclosure

7.1 hellowin does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes.

7.2 hellowin may share your personal data with the following categories of recipients solely as necessary for the purposes described in this Policy:

• PAGCOR — as required under hellowin's operating licence and Philippine gaming regulations;
• Anti-Money Laundering Council (AMLC) — for mandatory suspicious transaction reporting under Republic Act No. 9160 (AMLA);
• Payment service providers — GCash (G-Xchange, Inc.), PayMaya (Maya Philippines, Inc.), BPI, BDO, Metrobank, and UnionBank, solely to process transactions;
• KYC verification providers — third-party identity verification services acting as Personal Information Processors under data processing agreements with hellowin;
• IT infrastructure providers — cloud hosting, cybersecurity, and analytics service providers operating under binding data processing agreements;
• Philippine law enforcement and judicial authorities — where disclosure is required by a valid court order, subpoena, or lawful government request.

7.3 All third-party processors engaged by hellowin are bound by contractual data protection obligations consistent with the Data Privacy Act of 2012.

8. Cookies & Tracking Technologies

8.1 hellowin uses cookies and similar tracking technologies to operate the Platform, authenticate users, maintain session security, and analyse usage patterns. The following cookie categories are used:

• Strictly Necessary Cookies — required for Platform operation and cannot be disabled (e.g. session authentication, CSRF protection);
• Functional Cookies — remember your preferences, such as language and game display settings;
• Analytics Cookies — aggregate, anonymised data used to understand Platform usage and improve the Filipino player experience (e.g. pages visited, session duration);
• Marketing Cookies — used only where you have provided explicit consent to receive personalised promotional communications from hellowin.

8.2 You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will affect Platform functionality. Withdrawal of marketing cookie consent may be made via your hellowin account settings at any time.

9. Data Security

9.1 hellowin implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmission;
• AES-256 encryption for sensitive data at rest, including KYC documents and payment credentials;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Multi-factor authentication for all administrative system access;
• Regular penetration testing and vulnerability assessments by independent cybersecurity firms;
• Intrusion detection systems and real-time security monitoring.

9.2 In the event of a personal data breach affecting Filipino players, hellowin will notify affected individuals and the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular 16-03.

10. Data Retention Periods

10.1 hellowin retains personal data for no longer than is necessary for the purposes set out in this Policy or as required by applicable Philippine law:

• Account data — retained for the duration of the player relationship and for five (5) years following account closure;
• KYC and identity verification records — retained for a minimum of five (5) years as required by PAGCOR and AMLA regulations;
• Transaction records — retained for a minimum of five (5) years in compliance with AMLA record-keeping obligations;
• Customer support communications — retained for three (3) years from the date of the last interaction;
• Analytics and technical logs — retained for up to twelve (12) months in anonymised or pseudonymised form.

10.2 Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents re-identification.

11. Your Data Subject Rights

As a data subject under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by hellowin:

To exercise any of the above rights, contact hellowin's Data Protection Officer at [email protected]. hellowin will respond to verified data subject requests within thirty (30) days.

12. Children's & Minors' Privacy

12.1 The hellowin Platform is strictly for individuals aged 21 years and above in accordance with Philippine law and PAGCOR regulations governing online gambling. hellowin does not knowingly collect personal data from individuals under the age of 21.

12.2 If hellowin discovers that personal data has been collected from an individual below the minimum age, the account will be immediately suspended, the personal data deleted, and the matter reported to PAGCOR as required by hellowin's operating licence.

13. Changes to This Privacy Policy

13.1 hellowin reserves the right to update this Privacy Policy at any time to reflect changes in its data processing practices, regulatory requirements, or Platform features. Material changes will be communicated to registered hellowin players by email or Platform notification at least seven (7) days before taking effect.

13.2 The effective date of the current version of this Policy is noted at the top of the page. We encourage hellowin players to review this Policy periodically to stay informed of how their personal data is being handled.

14. Contact & Data Protection Officer

For all privacy-related enquiries, data subject rights requests, or complaints, please contact hellowin's Data Protection Officer: