crowdwin Privacy Policy

This Privacy Policy ("Policy") is issued by crowdwin ("crowdwin," "we," "us," "our") and applies to all personal data collected from individuals ("you," "Player," "User") who access the crowdwin website at crowdwin.app, create a Player Account, use any crowdwin game or service, or otherwise interact with the crowdwin platform in any capacity.

This Policy is written in accordance with the Republic of the Philippines Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). By creating a crowdwin Account or continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read in conjunction with crowdwin's Terms & Conditions and Responsible Gaming Policy, both of which are published on this Platform. Where any conflict arises between this Policy and those documents in respect of personal data matters, this Privacy Policy shall prevail.

For the purposes of the Philippine Data Privacy Act of 2012, crowdwin acts as the Personal Information Controller (PIC) in respect of all personal data collected from Players using the Platform. In this capacity, crowdwin determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out in compliance with applicable data protection law.

Certain third-party service providers engaged by crowdwin — including payment processors, identity verification services, and game software providers — may process personal data on crowdwin's behalf. These parties act as Personal Information Processors (PIPs) and are contractually bound to process your data only in accordance with crowdwin's documented instructions and in compliance with applicable Philippine data protection standards.

crowdwin has designated a Data Protection Officer (DPO) responsible for overseeing data protection compliance. The DPO can be contacted through the support contact information provided in Section 16 of this Policy.

crowdwin collects the following categories of personal data from Players in the course of providing its services:

3.1 Account Registration Data

• Full legal name (as it appears on your government-issued ID);
• Date of birth (for age verification purposes — Players must be at least 21 years of age);
• Philippine mobile number (used as your primary login identifier and for OTP delivery);
• Email address (optional at registration, required for certain account features);
• Password (stored in encrypted, hashed form — never in plain text);
• Residential address (required for KYC compliance).

3.2 Identity Verification (KYC) Data

• Government-issued photo identification (e.g., Philippine Passport, LTO Driver's License, UMID, PhilSys National ID, COMELEC Voter's ID, or PRC ID);
• Proof of address documents where requested under enhanced due diligence procedures;
• Facial biometric data (if a selfie or liveness check is required as part of the identity verification process);
• Source of funds documentation where required under anti-money laundering obligations.

3.3 Financial & Transaction Data

• GCash account number associated with your transactions;
• Maya (PayMaya) account number associated with your transactions;
• Bank account details (account name, bank name, and account number) for bank transfer deposits and withdrawals;
• Transaction history (deposit amounts, dates, methods, and reference numbers);
• Withdrawal requests (amounts, dates, receiving account details, and processing status).

3.4 Gaming Activity Data

• Game play history (games accessed, bet amounts, session duration, win/loss records);
• Sports betting activity (markets wagered, odds accepted, outcomes);
• Bonus and promotion participation history;
• Account balance records and wagering requirement progress.

3.5 Technical & Device Data

• IP address at the time of registration and each subsequent login;
• Device type, model, and operating system (e.g., Android 14 on a Samsung Galaxy device);
• Browser type and version;
• Mobile network operator (e.g., Globe, Smart, DITO);
• Session timestamps and duration;
• Geolocation data (at the level of region/city — not precise GPS coordinates unless expressly consented to).

3.6 Communications Data

• Customer support chat transcripts and email correspondence;
• Feedback, complaints, and dispute records;
• Survey responses where voluntarily submitted.

crowdwin collects personal data through the following channels and mechanisms:

crowdwin uses your personal data for the following specific purposes:

• Account creation and management: To register your crowdwin Account, maintain it in an active and secure state, and process any changes to your account settings or contact details;
• Identity and age verification: To confirm that you are at least 21 years of age and are the genuine holder of the identity documents submitted, as required under Philippine gaming regulations;
• Payment processing: To process your GCash, Maya, bank transfer, and other payment method transactions — including deposits, withdrawals, refunds, and adjustments;
• Gaming services: To provide access to casino games, sports betting markets, bingo, fishing games, and all other products available through the crowdwin lobby;
• Bonus and promotion administration: To apply bonus credits, track wagering requirement progress, and administer promotional offers associated with your crowdwin Account;
• Security and fraud prevention: To detect, investigate, and prevent unauthorized account access, fraudulent transactions, money laundering, and other prohibited activities;
• Legal and regulatory compliance: To fulfill obligations under the Philippine Data Privacy Act, Anti-Money Laundering Act (AMLA), applicable gaming regulations, and any other laws or regulations that apply to crowdwin's operations;
• Customer support: To respond to your queries, complaints, and requests via live chat and email in a timely and accurate manner;
• Responsible gaming: To monitor gaming activity patterns that may indicate problem gambling behavior and, where appropriate, to proactively reach out to Players or apply protective measures in accordance with our Responsible Gaming Policy;
• Platform improvement: To analyze aggregated, anonymized usage data to improve the functionality, performance, and user experience of the crowdwin Platform;
• Marketing communications: To send promotional offers, bonus notifications, and platform updates to Players who have opted in to marketing communications — subject to your ability to opt out at any time.

Under the Philippine Data Privacy Act, crowdwin processes your personal data on the following legal bases:

• Contract performance: Processing necessary to enter into and perform the agreement between you and crowdwin — including operating your Account, processing transactions, and delivering gaming services;
• Legal obligation: Processing required to comply with crowdwin's legal obligations under Philippine law — including KYC verification, AML screening, age verification, and regulatory reporting;
• Legitimate interests: Processing carried out for crowdwin's legitimate business interests — including fraud prevention, security monitoring, platform analytics, and responsible gaming oversight — where such interests are not overridden by your own rights and interests;
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — including marketing communications and, where applicable, the collection of sensitive personal information not strictly required by law. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.

crowdwin uses cookies and similar tracking technologies to ensure the Platform functions correctly, to maintain your login session, and to gather analytics data that helps us improve the Platform experience. The following types of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function — including session authentication tokens that keep you logged in during a session, CSRF protection tokens, and load balancing identifiers. These cannot be disabled without breaking core Platform functionality;
• Functional cookies: Store your preferences such as language settings, game layout preferences, and notification settings so that they persist between sessions without requiring re-entry;
• Analytics cookies: Collect anonymized data about how Players navigate the Platform — including pages visited, time spent on each page, and features used. This data is aggregated and used solely to improve the crowdwin Platform experience for Filipino players;
• Security cookies: Assist in detecting and preventing fraudulent or unauthorized access attempts, including bot detection and IP reputation monitoring.

crowdwin does not use cookies for the purpose of serving advertisements on third-party websites, and does not share cookie data with advertising networks. You may configure your browser to reject non-essential cookies, though doing so may affect certain Platform features including auto-login functionality.

crowdwin does not sell, rent, or trade your personal data. We may share your personal data with third parties only in the following limited and controlled circumstances:

• Payment processors: GCash, Maya, BPI, BDO, Metrobank, UnionBank, and other payment providers receive the personal data strictly necessary to process your financial transactions — typically your account identifier, transaction amount, and mobile number or account reference;
• Identity verification providers: Third-party KYC and AML screening services receive your submitted identity documents and personal details to perform verification checks on crowdwin's behalf, subject to data processing agreements;
• Game software providers: Your Account identifier and relevant gaming session data may be shared with licensed game studios (such as those whose titles appear in the crowdwin lobby) to the extent necessary to deliver game functionality and resolve disputes;
• Regulatory and law enforcement authorities: crowdwin will disclose personal data to the National Privacy Commission, PAGCOR, the Anti-Money Laundering Council (AMLC), or other Philippine law enforcement or regulatory authorities when required to do so by applicable law, court order, or regulatory direction;
• Professional advisers: Legal counsel, auditors, and compliance consultants engaged by crowdwin may access personal data to the limited extent necessary to provide their professional services, subject to professional confidentiality obligations;
• Business succession: In the event of a merger, acquisition, or sale of all or substantially all of crowdwin's business, personal data may be transferred to the successor entity, subject to the same data protection standards as those applied by crowdwin under this Policy.

crowdwin's primary data infrastructure is located in secure data centers serving the Asia-Pacific region. In the course of providing Platform services, certain personal data may be transferred to or accessed by service providers located outside the Philippines — for example, certain game providers or technology infrastructure partners.

Where such international transfers occur, crowdwin ensures that they are conducted in compliance with the Philippine Data Privacy Act. Specifically, crowdwin implements one or more of the following safeguards for international data transfers:

• Transfer to a jurisdiction that the National Privacy Commission (NPC) has determined provides an adequate level of data protection;
• Execution of a Data Processing Agreement containing standard contractual clauses ensuring that the recipient provides data protection standards equivalent to those applicable under Philippine law;
• The transfer is necessary for the performance of the contract between you and crowdwin, or for the implementation of pre-contractual measures taken at your request.

You may request information about the specific safeguards applied to any international transfer of your personal data by contacting crowdwin's Data Protection Officer as described in Section 16 of this Policy.

crowdwin retains your personal data for as long as is necessary for the purposes for which it was collected, subject to the following specific retention periods:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Anonymized data (from which you cannot be identified) may be retained indefinitely for statistical and analytical purposes.

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by crowdwin. These rights can be exercised free of charge by contacting crowdwin as described in Section 16:

• Right to Access: You may request a copy of the personal data that crowdwin holds about you, along with information about how it is processed;
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you. You may also update certain account details directly via your Account Settings page;
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to crowdwin's overriding legal obligations to retain certain data as outlined in Section 10;
• Right to Object: You may object to processing of your personal data for direct marketing purposes or where processing is based on legitimate interests, where your particular circumstances justify an objection;
• Right to Block or Restrict Processing: You may request a restriction on the processing of your personal data in certain circumstances — for example, while a rectification request is under review;
• Right to Data Portability: Where processing is based on your consent or on contract performance and is carried out by automated means, you may request that your data be provided to you in a structured, commonly used, machine-readable format;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place prior to withdrawal;
• Right to Lodge a Complaint: If you believe that crowdwin has not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

crowdwin will respond to all valid rights requests within thirty (30) days of receipt. In complex cases, this may be extended by a further thirty (30) days, in which case you will be notified of the extension and its reason within the initial thirty-day period.

The crowdwin Platform is strictly intended for persons aged 21 years and over, in accordance with Philippine gaming regulations. crowdwin does not knowingly collect personal data from persons under the age of 21. Age verification is a mandatory step in the KYC process, and crowdwin implements age-gating measures at the point of registration.

If crowdwin becomes aware that personal data has been collected from a person under 21 years of age — whether through a false declaration at registration or any other means — it will immediately suspend the associated Account, void any pending transactions or balances in accordance with its Terms & Conditions, and delete all personal data associated with the underage individual's Account as soon as is practically possible.

crowdwin may send you promotional communications — including bonus offers, new game announcements, and platform updates — via SMS to your registered Philippine mobile number and/or email, provided that you have given your consent to receive such communications. Consent to marketing is collected during Account registration and can be updated at any time via your Account Settings.

You may opt out of marketing communications at any time by:

• Updating your communication preferences in Account Settings;
• Replying "STOP" to any SMS message received from crowdwin;
• Clicking the unsubscribe link in any promotional email; or
• Contacting crowdwin's customer support team and requesting removal from marketing lists.

Opting out of marketing communications will not affect your ability to receive transactional messages — such as deposit confirmations, withdrawal notifications, OTP codes, or security alerts — which are operational in nature and essential to the management of your Account.

crowdwin implements a range of technical and organizational security measures designed to protect your personal data from unauthorized access, loss, alteration, disclosure, or destruction. These measures include, without limitation:

• TLS/SSL encryption for all data in transit between your device and crowdwin's servers;
• AES-256 encryption for sensitive data at rest, including financial records and identity documents;
• Password hashing using industry-standard algorithms — your actual password is never stored in plain text by crowdwin;
• Multi-factor authentication options for Player Accounts, including OTP delivery via registered Philippine mobile numbers;
• Access controls ensuring that internal staff can only access personal data on a strict need-to-know basis with audit logging of all access events;
• Regular penetration testing and vulnerability assessments conducted by qualified information security professionals;
• Incident response procedures ensuring that any data security incident is contained, investigated, and reported to the NPC and affected Players within legally required timeframes.

While crowdwin takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the security of your Account credentials and for notifying crowdwin immediately of any suspected unauthorized account access.

crowdwin may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or Platform operations. The "Effective Date" displayed at the top of this Policy indicates when the current version took effect.

Where changes to this Policy are material — meaning they significantly affect your rights or the way we process your personal data — crowdwin will provide at least fourteen (14) days' advance notice before the revised Policy takes effect, by posting a prominent notice on the Platform and, where practicable, by contacting you via your registered mobile number or email address.

For minor or administrative changes that do not materially affect your rights, the updated Policy will take effect upon publication on the Platform. Continued use of the crowdwin Platform after a revised Policy takes effect constitutes acceptance of the revised terms. If you do not accept a revised Policy, you should close your Account and discontinue use of the Platform.

If you have any questions, concerns, or requests relating to this Privacy Policy or crowdwin's handling of your personal data, please contact our Data Protection Officer through the following channels:

• Live Chat: Available 24/7 on the crowdwin Platform — identify your query as a "Privacy / Data Protection" matter at the start of the chat to be directed to the appropriate team;
• Email: The support email address is displayed in the footer of every page on crowdwin.app. Please include "Privacy Policy" or "Data Request" in the subject line of any email relating to this Policy. Include your registered mobile number in your email for faster account identification.

crowdwin will acknowledge all privacy-related requests within 72 hours and will respond fully within 30 days, or as otherwise required by applicable law.

If you are not satisfied with crowdwin's response to a privacy complaint, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, the regulatory authority responsible for enforcing the Data Privacy Act of 2012. The NPC's contact details and online complaint portal are available through Philippine government information channels.