topwin Privacy Policy

Last Updated: January 15, 2026  |  Effective Date: February 1, 2026

1. Data Controller Information

topwin acts as the data controller for personal information collected through the topwin platform. As data controller, topwin determines the purposes and means by which personal data is processed and is responsible for ensuring that all data processing activities comply with applicable Philippine data privacy laws, including Republic Act No. 10173 (the Data Privacy Act of 2012) and its implementing rules and regulations issued by the National Privacy Commission (NPC).

topwin is licensed and regulated by the Philippine Amusement and Gaming Corporation (PAGCOR) and operates in full compliance with PAGCOR's Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements, which impose certain mandatory data collection obligations.

2. Personal Data We Collect

topwin collects the following categories of personal data in the course of providing our services to Filipino players:

2.1 Identity and Account Data

• Full legal name as appearing on government-issued identification
• Date of birth and proof of age (to confirm you are 21 years of age or older)
• Nationality and country of residence (Philippines)
• Government-issued identification numbers (Philippine ID types: driver's license, UMID, passport, etc.)
• Photographs of identification documents and selfie verification images
• Username and encrypted account credentials

2.2 Contact and Communication Data

• Mobile phone number registered in the Philippines
• Email address
• Physical mailing address or residential address in the Philippines
• Records of communications with topwin customer support (live chat transcripts, email correspondence)

2.3 Financial and Transaction Data

• GCash account number or PayMaya account details
• Philippine bank account details (bank name, account number, account name)
• Transaction history (deposits, withdrawals, amounts, dates, payment methods)
• Source of funds documentation submitted for AML compliance
• Credit and debit card information (where applicable — stored only in tokenized form)
• Cryptocurrency wallet addresses (where applicable)

2.4 Gaming and Behavioral Data

• Game play history (games played, wagers placed, results, winnings)
• Sports betting activity (events wagered on, stake amounts, outcomes)
• Bonus and promotion activity (bonuses claimed, wagering progress)
• Session duration and frequency of play
• Game preferences and personalization settings
• Responsible gaming settings and limits configured

2.5 Technical and Device Data

• IP address and geolocation data (to verify Philippines-based access)
• Device type, operating system, and browser information
• Cookie identifiers and session tokens
• Pages visited and features used within the topwin platform
• Login timestamps and access logs

3. How We Collect Your Data

topwin collects personal data through the following channels:

• Directly from you: When you register an account, complete identity verification, make deposits or withdrawals, contact customer support, respond to surveys, or set responsible gaming preferences.
• Automatically: Through cookies, web beacons, pixels, and server logs when you browse or interact with the topwin platform.
• From third parties: From payment processors (GCash, PayMaya, Philippine banks), identity verification service providers, fraud detection agencies, and PAGCOR where required by regulation.
• From publicly available sources: Information from Philippine government databases for identity verification purposes, as permitted by law.

4. Purposes of Data Processing

topwin processes your personal data for the following specific purposes:

4.1 Account Management and Service Delivery

We use your identity, contact, and account data to create and manage your topwin account, authenticate your identity during topwin Login, provide access to casino games and sports betting, process deposits and withdrawals, and deliver customer support.

4.2 Regulatory Compliance (KYC and AML)

PAGCOR licensing requires topwin to verify the identity of all players, confirm players are aged 21 or older, monitor transactions for suspicious activity, and report certain transactions to relevant Philippine regulatory authorities. These obligations are non-negotiable — we cannot provide services to players who decline to provide information required for KYC compliance.

4.3 Fraud Prevention and Security

We analyze account activity, transaction patterns, and technical data to detect and prevent fraud, money laundering, account takeovers, cheating, and abuse of topwin services. This analysis is performed by both automated systems and human review teams.

4.4 Responsible Gaming

We use gaming behavior data to identify potentially problematic gambling patterns, enforce responsible gaming limits and self-exclusion requests, and provide appropriate support and resources to players showing signs of gambling-related harm.

4.5 Marketing and Personalization

With your consent, we use gaming preferences and behavior data to send personalized bonus offers, promotional emails, and SMS notifications. You may withdraw marketing consent at any time through account settings.

4.6 Platform Improvement

Aggregated and anonymized usage data helps us understand how players use topwin, which games are most popular, where players encounter difficulties, and how we can improve the platform experience. This processing uses data in a form that cannot identify you individually.

5. Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012 and its implementing rules, topwin processes your personal data on the following legal grounds:

Processing Activity	Legal Basis
Account registration and service delivery	Performance of contract (your topwin account agreement)
Identity verification (KYC)	Legal obligation (PAGCOR regulations, AML laws)
Transaction processing	Performance of contract
Fraud detection and security	Legitimate interests (protecting topwin and its players)
Responsible gaming monitoring	Legal obligation (PAGCOR regulations) and legitimate interests
Marketing communications	Your explicit consent (withdrawable at any time)
Platform analytics and improvement	Legitimate interests (improving services)
Regulatory reporting	Legal obligation (PAGCOR, AMLC reporting requirements)

6. Data Sharing and Disclosure

topwin does not sell your personal information to third parties. We share your data only in the following limited circumstances:

6.1 Service Providers

We engage trusted third-party service providers who process data on our behalf under strict confidentiality agreements and data processing agreements. These include:

• Payment processors: GCash (Globe Telecom), PayMaya (Voyager Innovations), Philippine banks
• Identity verification providers: Third-party KYC platforms operating under Philippine law
• Fraud detection and security analytics providers
• Game software providers (game results and wager data)
• Cloud hosting providers operating data centers in the Philippines
• Customer support technology providers

6.2 Regulatory Authorities

topwin is legally required to share certain player data with Philippine regulatory authorities, including:

• PAGCOR: Player account information, activity reports, and compliance documentation as required by PAGCOR licensing conditions.
• Anti-Money Laundering Council (AMLC): Covered transaction reports (CTRs) and suspicious transaction reports (STRs) as required by Republic Act No. 9160 (Anti-Money Laundering Act) and its amendments.
• National Privacy Commission (NPC): In response to lawful investigations, orders, or data breach notifications.
• Law enforcement agencies: In response to lawful court orders, subpoenas, or requests from Philippine law enforcement agencies.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of topwin's assets, your personal data may be transferred to the acquiring entity. We will notify you of such a transfer and your options via email and prominent notice on the topwin platform at least 30 days prior to any transfer.

7. International Data Transfers

topwin primarily stores and processes player data within the Philippines. In limited cases, data may be transferred to and processed in other jurisdictions where our service providers operate. Any such transfers are subject to contractual safeguards ensuring data protection standards equivalent to those required under the Philippine Data Privacy Act. We will not transfer your data to jurisdictions without adequate data protection laws unless appropriate contractual safeguards are in place.

8. Data Retention Periods

topwin retains personal data for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods are as follows:

Data Category	Retention Period	Basis
Account and identity data	5 years after account closure	PAGCOR and AML regulatory requirements
Transaction records	5 years after transaction date	Anti-money laundering law requirements
KYC documents (ID copies)	5 years after account closure	PAGCOR KYC compliance requirements
Game play history	3 years after last game activity	Dispute resolution and regulatory audit
Customer support records	3 years after ticket closure	Legitimate interests (dispute resolution)
Technical and access logs	12 months	Security and fraud detection
Marketing preferences and consent	Until withdrawn, then 1 year	Consent documentation

After the applicable retention period expires, personal data is securely deleted or anonymized such that it can no longer be linked to an identifiable individual.

9. Security Measures

topwin implements comprehensive technical and organizational security measures to protect your personal data from unauthorized access, loss, alteration, or disclosure:

Technical Safeguards

• 256-bit SSL/TLS encryption for all data transmitted between your device and topwin servers
• Advanced encryption for data at rest (AES-256)
• Salted cryptographic hashing for account passwords (we cannot retrieve your password)
• Two-factor authentication (2FA) available for all accounts
• Intrusion detection systems and 24/7 security monitoring
• Regular third-party penetration testing and security audits
• Tokenization of payment card data — raw card numbers are never stored

Organizational Safeguards

• Role-based access controls limiting staff access to personal data on a need-to-know basis
• Mandatory data privacy training for all topwin employees handling personal data
• Data processing agreements with all third-party service providers
• Incident response procedures and data breach notification protocols compliant with NPC requirements
• Regular privacy impact assessments for new data processing activities

10. Your Data Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by topwin:

10.1 Right to be Informed

You have the right to be informed about how topwin collects, uses, and processes your personal data. This Privacy Policy fulfils topwin's obligation to provide that information. If our practices change materially, we will notify you promptly.

10.2 Right to Access

You may request a copy of the personal data topwin holds about you. Requests will be fulfilled within 15 business days. You may exercise this right by contacting our Data Protection Officer using the contact information in Section 16 of this Policy.

10.3 Right to Correction

If any personal data topwin holds about you is inaccurate, incomplete, or outdated, you have the right to request correction. Identity data corrections require supporting documentation to verify the updated information.

10.4 Right to Erasure or Blocking

You may request deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected. Please note that this right is limited where topwin is required to retain data under PAGCOR regulations, AML laws, or other legal obligations. In such cases, we will explain why full deletion is not possible.

10.5 Right to Object to Processing

You may object to topwin processing your personal data for direct marketing purposes at any time (see Section 13). You may also object to processing based on legitimate interests where you believe your fundamental rights override those interests.

10.6 Right to Data Portability

You may request a copy of your personal data in a structured, commonly used, and machine-readable format for transfer to another data controller. This right applies to data you provided to topwin and that we process on the basis of your consent or contract performance.

10.7 Right to Lodge a Complaint

If you believe topwin has violated your data privacy rights, you have the right to lodge a complaint with the Philippine National Privacy Commission (NPC) through the NPC's official complaint portal. topwin encourages you to contact us first to allow us to address your concerns directly before escalating to the NPC.

11. Cookies and Tracking Technologies

topwin uses cookies and similar tracking technologies (web beacons, pixels, local storage) to provide, improve, and secure the platform experience. The following types of cookies are used:

Cookie Type	Purpose	Duration
Essential / Session Cookies	Maintain your login session, enable topwin platform functionality, prevent CSRF attacks	Session duration
Preference Cookies	Remember language settings, game display preferences, and responsible gaming limits	Up to 1 year
Security Cookies	Detect fraud, bot activity, and unauthorized login attempts	Up to 6 months
Analytics Cookies	Understand how the topwin platform is used to improve performance and user experience	Up to 2 years
Marketing Cookies	Deliver personalized bonus offers and relevant promotional content (with consent only)	Up to 1 year

You can control non-essential cookie settings through our Cookie Preference Centre accessible from any page on the topwin platform. Note that disabling essential cookies will prevent topwin from functioning correctly and will log you out of your account.

12. Protection of Minors

topwin services are strictly intended for adults aged 21 years and above, in compliance with PAGCOR regulations and Philippine gambling laws. topwin does not knowingly collect personal data from individuals under the age of 21.

If topwin discovers that personal data belonging to an individual under 21 years of age has been collected, that account will be immediately suspended, all personal data will be deleted from our systems, all balances and winnings will be forfeited, and PAGCOR will be notified of the underage account in accordance with our regulatory obligations.

Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gambling platforms. If you believe a minor is using a topwin account, please contact our Data Protection Officer immediately.

13. Marketing Communications

topwin sends marketing communications — including promotional bonuses, new game announcements, and special offers — only to players who have opted in to receive them. You can manage your communication preferences at any time:

• Email marketing: Unsubscribe via the link in any topwin promotional email or update preferences in your account settings.
• SMS marketing: Reply STOP to any topwin SMS message or update preferences in your account settings.
• Push notifications: Manage notification settings in your browser or mobile device settings.

Opting out of marketing communications does not affect our ability to send you service-related communications (transaction confirmations, security alerts, account notices, and regulatory notices).

14. PAGCOR Regulatory Compliance

As a PAGCOR-licensed operator, topwin is subject to extensive regulatory requirements that directly affect how we process player data. PAGCOR regulations require topwin to:

• Verify the identity and age of all players before allowing real-money gaming
• Maintain complete transaction records for all player accounts
• Monitor gaming activity for signs of money laundering and suspicious transactions
• Submit regular compliance reports to PAGCOR including player activity data
• Cooperate fully with PAGCOR investigations and provide player information upon lawful request
• Implement and enforce responsible gaming policies including self-exclusion programs

topwin's compliance with PAGCOR regulations takes precedence over individual privacy preferences in cases where regulatory requirements mandate data collection, retention, or disclosure. Players who do not wish to provide the data required for PAGCOR compliance cannot use topwin's real-money gaming services.

15. Changes to This Privacy Policy

topwin may update this Privacy Policy from time to time to reflect changes in our data practices, technology, regulatory requirements, or legal landscape. When we make material changes, we will:

• Post the updated Privacy Policy on this page with a new "Last Updated" date
• Send an email notification to all registered topwin account holders
• Display a prominent notice on the topwin platform for at least 30 days

Your continued use of topwin after the effective date of changes constitutes your acceptance of the revised Privacy Policy. If you do not agree with the changes, you should close your topwin account before the effective date.

16. Contact Our Data Protection Officer

topwin has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data privacy laws. To exercise your data rights, ask questions about this Policy, report a suspected privacy violation, or report underage account use, contact our DPO:

• Email: [email protected]
• General Support Email: [email protected]
• Live Chat: Available 24/7 via the topwin platform
• Postal Address: topwin Data Protection Officer, Legal & Compliance Department, Metro Manila, Philippines

We will acknowledge your data rights request within 5 business days and provide a substantive response within 15 business days. If your request is complex or we are handling a large volume of requests, we may extend the response period by a further 30 days — we will notify you of any such extension.