one win Privacy Policy — How We Protect Your Data

1.1 one win is committed to protecting the privacy and personal data of all players who use our platform. We understand that trust is the foundation of a great gaming experience, and that trust begins with being transparent about how we handle your information.

1.2 This Policy applies to all personal data collected through the one win website at https://one-win.app, any associated mobile applications, and all related services offered under the one win brand to players in the Philippines and other permitted jurisdictions.

1.3 This Policy should be read alongside our Terms & Conditions, which govern your use of the one win platform. In the event of any conflict between this Policy and the Terms & Conditions regarding data privacy matters, this Policy shall prevail.

1.4 We may update this Policy from time to time to reflect changes in our data practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this document indicates when the Policy was most recently revised. Continued use of the one win platform after any update constitutes your acceptance of the revised Policy.

2.1 For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations, one win acts as the data controller responsible for the personal data collected through the one win platform.

2.2 As data controller, one win determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out in accordance with applicable data protection laws.

2.3 one win has designated a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data protection legislation. You may contact the DPO through our support team using the contact details provided in Section 15 of this Policy.

3.1 one win collects the following categories of personal data from players:

3.2 one win does not intentionally collect sensitive personal information beyond what is strictly necessary for identity verification and regulatory compliance. Where sensitive data is collected (such as government ID numbers), it is handled with enhanced security measures and access controls.

4.1 one win collects personal data through the following means:

• Direct Collection: Information you provide when registering your one win account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated Collection: Technical and usage data collected automatically when you access and use the one win platform, including through cookies, web beacons, and similar tracking technologies.
• Third-Party Sources: Identity verification data from KYC service providers, fraud prevention data from security partners, and payment verification data from payment processors such as GCash and PayMaya.
• Publicly Available Sources: In limited circumstances, one win may supplement your profile with information from publicly available sources for fraud prevention and compliance purposes.

4.2 You are not obligated to provide all requested personal data; however, failure to provide certain mandatory information (such as identity verification documents) may prevent one win from providing you with full access to the platform's services, including the processing of withdrawal requests.

5.1 one win uses the personal data we collect for the following purposes:

• To create, verify, and manage your one win player account.
• To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and other supported payment methods.
• To verify your identity and age (21+) in compliance with applicable gaming regulations.
• To comply with anti-money laundering (AML) and counter-terrorism financing (CTF) obligations under Philippine law.
• To detect, investigate, and prevent fraudulent activity, cheating, and other prohibited conduct on the platform.
• To provide customer support and resolve disputes or complaints.
• To send you transactional communications, including deposit confirmations, withdrawal notifications, and account security alerts.
• To send you promotional communications about one win bonuses, offers, and new games — where you have consented to receive such communications.
• To monitor your gaming activity for responsible gaming purposes and to apply any self-imposed limits or restrictions.
• To analyze platform usage and improve the one win gaming experience.
• To comply with legal obligations, regulatory requirements, and court orders.

6.1 one win processes your personal data on the following legal bases under the Philippine Data Privacy Act of 2012:

• Contractual Necessity: Processing is necessary to perform our contract with you — specifically, to operate your one win account, process transactions, and provide gaming services.
• Legal Obligation: Processing is required to comply with applicable laws, including KYC/AML regulations, gaming licensing requirements, and tax reporting obligations.
• Legitimate Interests: Processing is necessary for one win's legitimate interests, including fraud prevention, platform security, and service improvement, provided these interests are not overridden by your data protection rights.
• Consent: For certain processing activities — such as sending marketing communications or using non-essential cookies — we rely on your explicit consent, which you may withdraw at any time.

6.2 Where one win relies on your consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

7.1 one win does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your personal data only in the following limited circumstances:

• Payment Processors: We share necessary financial data with payment service providers (including GCash, PayMaya, BPI, BDO, and Metrobank) to process your deposits and withdrawals.
• KYC & Identity Verification Providers: We share identity documents and personal data with accredited KYC service providers to verify your identity and age in compliance with regulatory requirements.
• Fraud Prevention & Security Partners: We share technical and usage data with fraud detection and cybersecurity service providers to protect the integrity of the one win platform.
• Regulatory Authorities: We disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine authorities when required by law or regulatory obligation.
• Legal Proceedings: We may disclose personal data in response to valid court orders, subpoenas, or other legal processes issued by competent Philippine courts or authorities.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of one win's business, your personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

7.2 All third parties with whom one win shares personal data are required to process that data in accordance with applicable data protection laws and are prohibited from using it for any purpose other than those specified by one win.

8.1 one win retains your personal data for as long as is necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

8.2 The following general retention periods apply to the main categories of personal data held by one win:

• Account and Identity Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements.
• Financial Transaction Data: Retained for a minimum of five (5) years from the date of each transaction, in accordance with Philippine AML regulations.
• KYC Verification Documents: Retained for a minimum of five (5) years following account closure or the completion of the relevant transaction, whichever is later.
• Technical and Usage Data: Retained for up to two (2) years from collection, unless required for longer retention for fraud investigation or legal proceedings.
• Customer Support Communications: Retained for up to three (3) years from the date of the last communication, for dispute resolution and service improvement purposes.

8.3 Upon expiry of the applicable retention period, one win will securely delete or anonymize your personal data in accordance with our data disposal procedures.

9.1 one win uses cookies and similar tracking technologies on the platform to enhance your user experience, maintain session security, and analyze platform performance. The following types of cookies are used:

• Strictly Necessary Cookies: Essential for the operation of the one win platform, including maintaining your login session and ensuring platform security. These cookies cannot be disabled.
• Performance Cookies: Used to collect anonymized data about how players use the one win platform, helping us identify and fix performance issues and improve the overall experience.
• Functionality Cookies: Used to remember your preferences and settings on the one win platform, such as your preferred language and display settings.
• Analytics Cookies: Used to understand aggregate player behavior on the platform, enabling one win to make data-driven improvements to the gaming experience.

9.2 one win does not use cookies to track your browsing activity on websites outside of the one win platform, and does not share cookie data with third-party advertisers.

9.3 You may control cookie settings through your browser preferences. Please note that disabling certain cookies may affect the functionality of the one win platform. Strictly necessary cookies cannot be disabled as they are essential for platform operation.

10.1 one win implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the one win platform.
• Encryption of sensitive data at rest, including financial data and identity verification documents.
• Strict access controls ensuring that personal data is accessible only to authorized one win personnel who require it to perform their job functions.
• Regular security audits, vulnerability assessments, and penetration testing of the one win platform.
• Multi-factor authentication requirements for access to systems containing personal data.
• Comprehensive employee training on data protection and information security practices.
• Incident response procedures for detecting, reporting, and managing personal data breaches.

10.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, one win will notify the National Privacy Commission (NPC) and affected players in accordance with the requirements of the Philippine Data Privacy Act and its implementing rules.

11.1 Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by one win:

• Right to Be Informed: You have the right to be informed about how one win collects and processes your personal data, as described in this Policy.
• Right of Access: You have the right to request a copy of the personal data one win holds about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data one win holds about you.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to one win's legal retention obligations.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes or where processing is based on one win's legitimate interests.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe one win has processed your personal data in violation of applicable data protection law.

11.2 To exercise any of the above rights, please contact the one win Data Protection Officer through our customer support team using the contact details in Section 15. one win will respond to all valid data rights requests within thirty (30) days of receipt, in accordance with the requirements of the Philippine Data Privacy Act.

11.3 Please note that certain data rights may be subject to limitations where one win is required to retain or process your data to comply with legal obligations, including AML record-keeping requirements.

12.1 The one win platform is strictly intended for adults aged 21 years and above, in accordance with Philippine gaming regulations. one win does not knowingly collect personal data from individuals under the age of 21.

12.2 If one win becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. Any funds deposited to such an account may be forfeited in accordance with our Terms & Conditions and applicable regulations.

12.3 If you are a parent or guardian and believe that your child has registered an account on the one win platform, please contact our support team immediately so that we can take appropriate action.

13.1 The one win platform may contain links to third-party websites or services for informational purposes. This Privacy Policy applies solely to the one win platform and does not cover the privacy practices of any third-party websites or services that may be linked from our platform.

13.2 one win is not responsible for the privacy practices, content, or data security of any third-party websites. We encourage you to review the privacy policies of any third-party websites you visit before providing them with your personal information.

13.3 The inclusion of any link on the one win platform does not imply endorsement of the linked website or service by one win.

14.1 one win reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. When material changes are made to this Policy, one win will notify registered players via email or a prominent notice on the platform prior to the changes taking effect.

14.2 The "Last Updated" date at the top of this Policy indicates when it was most recently revised. We encourage you to review this Policy periodically to stay informed about how one win protects your personal data.

14.3 Your continued use of the one win platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised Policy. If you do not agree with the updated Policy, you must cease using the platform and may request account closure in accordance with our Terms & Conditions.

14.4 The most current version of this Privacy Policy will always be available at https://one-win.app/privacy-policy.

15.1 If you have any questions, concerns, or requests regarding this Privacy Policy or the way one win handles your personal data, please contact our Data Protection Officer through our customer support team. We are available 24 hours a day, 7 days a week.

15.2 You may reach the one win Data Protection Officer and support team via the following channel:

15.3 If you are not satisfied with one win's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for enforcing the Philippine Data Privacy Act of 2012.

15.4 For responsible gaming concerns, self-exclusion requests, or account limit adjustments, please contact our dedicated responsible gaming team through the same support channel and indicate the nature of your request. You may also visit our Responsible Gaming page for more information.