Privacy Policy

1.1 For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations (IRR), hellowin is the Personal Information Controller (PIC) with respect to personal data collected and processed in connection with the hellowin Platform and Services.

1.2 hellowin operates the online casino and sports betting platform accessible at hellowin.win, targeting Filipino players in the Philippines. The Platform operates under the PAGCOR regulatory framework.

1.3 hellowin has designated a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data protection law. Contact details for the DPO are provided in Section 15.

2.1 This Privacy Policy applies to personal data collected by hellowin through the following channels:

• The hellowin website and Progressive Web Application (PWA) at hellowin.win;
• Account registration and Know Your Customer (KYC) processes;
• Deposit, withdrawal, and payment transactions;
• Customer support interactions via live chat and email;
• Promotional and loyalty program participation;
• Cookies and similar tracking technologies used on the Platform.

2.2 This Policy does not apply to third-party websites or services linked to or from the hellowin Platform. hellowin is not responsible for the privacy practices of those third parties.

3.1 hellowin collects the following categories of personal data from Players and Platform users:

3.2 hellowin does not intentionally collect sensitive personal information as defined under RA 10173 (e.g., health data, political views, religious beliefs) unless specifically required by applicable law or regulation.

4.1 hellowin collects personal data through the following means:

• Directly from you — when you register an account, complete KYC, make a deposit or withdrawal request, contact support, or participate in a promotion;
• Automatically — through server logs, cookies, session tokens, and analytics tools as you browse and play on the Platform;
• From payment processors — GCash, PayMaya, and banking partners communicate transaction confirmation data to hellowin's systems;
• From identity verification providers — third-party KYC service providers may return identity verification results to hellowin when you submit government-issued ID documents;
• From fraud prevention services — risk signals and device fingerprint data from fraud prevention partners used to detect prohibited account activity.

5.1 hellowin processes personal data on the following legal bases as recognized under RA 10173 and its IRR:

• Contractual necessity: Processing required to establish and maintain your hellowin account, process transactions, and deliver gaming services as agreed in the Terms & Conditions;
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, Anti-Money Laundering Act (AMLA) obligations, and other applicable Philippine law;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and business analytics, where such interests are not overridden by your rights and freedoms;
• Consent: Processing for direct marketing communications, non-essential cookies, and personalised promotions, where you have provided clear, informed, and voluntary consent that may be withdrawn at any time.

6.1 hellowin uses your personal data for the following specific purposes:

• Creating and managing your hellowin account and verifying your identity and age (21+ requirement);
• Processing deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, 7-Eleven, and Cebuana;
• Operating, securing, and improving the hellowin Platform and gaming services;
• Delivering OTP authentication codes to your registered Philippine mobile number;
• Monitoring gameplay for responsible gaming indicators and applying protective measures as applicable;
• Investigating and resolving disputes, complaints, and suspected fraud or prohibited conduct;
• Fulfilling PAGCOR reporting obligations and Anti-Money Laundering Act (AMLA) compliance requirements;
• Sending transactional communications (deposit confirmations, withdrawal notices, security alerts) — these are not marketing and cannot be opted out of while your account is active;
• Sending promotional and bonus communications, where you have provided marketing consent.

7.1 hellowin does not sell, rent, or otherwise trade your personal data for commercial gain. We share personal data only in the following limited circumstances:

7.2 All third-party service providers who receive personal data from hellowin are subject to contractual data processing agreements that restrict use to the specified purpose and require equivalent security standards.

8.1 hellowin retains personal data for no longer than is necessary for the purpose for which it was collected, subject to minimum retention requirements imposed by applicable Philippine law and PAGCOR regulations.

8.2 The following indicative retention periods apply:

• Account and identity data: Retained for the duration of the account and for a minimum of five (5) years following permanent account closure, in compliance with AMLA record-keeping requirements;
• Transaction and financial records: Minimum ten (10) years from the date of transaction, as required under the AMLA Implementing Rules and Regulations;
• Game logs and betting history: Minimum five (5) years from the date of the bet for dispute resolution and regulatory audit purposes;
• Customer support communications: Three (3) years from the date of the interaction;
• Marketing consent records: Three (3) years from the date consent was given or last confirmed, or until consent is withdrawn (whichever is earlier);
• Technical and session logs: Twelve (12) months from the date of collection, unless required for an ongoing investigation.

8.3 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

9.1 hellowin implements industry-standard technical and organisational security measures to protect personal data against accidental loss, unauthorized access, disclosure, alteration, or destruction. Key measures include:

• 256-bit SSL/TLS encryption of all data in transit between your device and hellowin's servers;
• AES-256 encryption of sensitive data fields at rest in hellowin's databases;
• Payment card and GCash/PayMaya data handled through PCI-DSS compliant payment processors — raw payment credentials are never stored on hellowin's infrastructure;
• OTP-based two-step verification for account logins from unrecognised devices or locations;
• Role-based access controls limiting internal staff access to personal data to those with a documented operational need;
• Regular security audits and penetration testing conducted by qualified third-party assessors;
• Data breach detection and incident response procedures aligned with NPC (National Privacy Commission) breach notification requirements.

10.1 hellowin uses cookies and similar technologies (local storage, session tokens, pixel tags) on the Platform. Cookies are small data files placed on your device that help the Platform function correctly, remember your preferences, and generate analytics.

10.2 hellowin uses the following categories of cookies:

10.3 You may manage cookie preferences through your browser settings. Blocking all cookies may affect Platform functionality. You can withdraw consent for analytics cookies at any time through the cookie preference panel accessible in the Platform footer.

11.1 As a data subject under RA 10173, you have the following rights with respect to your personal data held by hellowin. These rights may be exercised by contacting the hellowin DPO as described in Section 15:

11.2 hellowin will respond to data subject rights requests within fifteen (15) business days of receipt. Complex requests may be extended by a further ten (10) business days where hellowin notifies you of the extension and the reason. Some requests may not be fulfillable where retention is mandated by PAGCOR or AMLA regulations.

12.1 If hellowin discovers that personal data has been collected from an individual under 21 years of age, the associated account will be immediately suspended, all real-money balances will be returned via the deposit payment method, and the personal data will be deleted from hellowin's systems within 10 business days of discovery.

12.2 Parents or guardians who believe a minor has accessed the hellowin Platform should contact the DPO immediately using the contact details in Section 15. hellowin will investigate and take appropriate action promptly.

13.1 hellowin may send promotional communications — including bonus offers, loyalty program updates, and new game announcements — to Players who have opted in to marketing at registration or subsequently through Account Settings.

13.2 Marketing communications are delivered via SMS to your registered Philippine mobile number and/or email. Frequency is generally no more than four (4) promotional messages per week per channel.

13.3 You may withdraw your marketing consent at any time by:

• Updating your notification preferences in Account Settings;
• Replying STOP to any promotional SMS received from hellowin;
• Contacting the DPO as described in Section 15.

13.4 Withdrawal of marketing consent will be processed within 48 hours. Transactional communications (deposit and withdrawal confirmations, security alerts, account notifications) are not marketing and will continue regardless of your marketing preferences.

14.1 hellowin reserves the right to update this Privacy Policy at any time to reflect changes in data processing practices, applicable law, or Platform functionality. The "Last updated" date at the top of this Policy will be revised to reflect the most recent amendment.

14.2 Where material changes are made to this Policy — particularly changes that affect the legal basis for processing, the categories of data collected, or the rights of Players — hellowin will notify registered Players via in-Platform notification or SMS at least seven (7) calendar days before the change takes effect.

14.3 Continued use of the hellowin Platform following the effective date of any Policy amendment constitutes acceptance of the revised terms. If you do not accept the revised Policy, you should cease using the Platform and request account closure.

15.1 For any questions, concerns, or requests relating to this Privacy Policy or hellowin's data processing activities — including the exercise of your data subject rights — please contact hellowin's Data Protection Officer through the following channels:

15.2 If you believe hellowin has failed to handle your personal data in accordance with this Policy or RA 10173, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). Information on how to file an NPC complaint is available on the NPC's official website.