ditowin Privacy Policy

1. Who We Are

ditowin ("we," "us," "our," or "ditowin") operates the online gaming platform accessible at ditowin.one (the "Platform"), serving Filipino players across the Philippines including Metro Manila, Cebu, Davao, Quezon City, Makati, and nationwide. ditowin is the data controller responsible for the personal data you provide when you register for, access, or use the Platform.

This Privacy Policy is issued in compliance with the Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR), as enforced by the National Privacy Commission (NPC) of the Philippines. It supplements, and is to be read alongside, our Terms & Conditions.

2. Personal Data We Collect

ditowin collects different categories of personal data depending on your interaction with the Platform. These categories include:

• Identity Data: Full legal name, date of birth, nationality, gender, and government-issued identification numbers (e.g., SSS, GSIS, PhilHealth ID, Passport, Driver's License).
• Contact Data: Philippine mobile number, email address, and residential address.
• Financial Data: GCash mobile number, PayMaya account details, bank account information (BDO, BPI, Metrobank), transaction history, deposit and withdrawal records, and account balance history.
• Verification Data: Copies of government-issued ID documents, selfie photographs submitted for KYC verification, and proof of payment method ownership.
• Gaming Data: Game history, bet amounts, win/loss records, session duration, favorite games, and bonus utilization data.
• Technical Data: IP address, device type and model, operating system, browser type and version, screen resolution, and time zone.
• Usage Data: Pages visited, features accessed, search queries within the Platform, click patterns, and session logs.
• Communications Data: Records of your interactions with ditowin's customer support team, including live chat transcripts, email correspondence, and any feedback or complaints submitted.

ditowin does not intentionally collect special categories of sensitive personal data (such as health information, political opinions, or biometric data for identification purposes) unless specifically required for responsible gaming interventions or legal compliance.

3. How We Collect Your Data

ditowin collects your personal data through the following means:

• Direct provision: Data you provide when creating your account, completing KYC verification, making deposits or withdrawal requests, or contacting our support team.
• Automated technologies: Cookies, web beacons, pixel tags, and session tracking tools that collect technical and usage data as you navigate the Platform.
• Third-party sources: Identity verification service providers (for KYC/AML purposes), payment processors, and fraud prevention partners may share relevant data with ditowin where permitted by law.
• PAGCOR and regulatory bodies: Where required for licensing compliance, ditowin may receive data from or share data with PAGCOR and other Philippine regulatory authorities.

4. How We Use Your Personal Data

ditowin uses your personal data for the following purposes:

• Account management: To create, verify, maintain, and administer your ditowin account and profile.
• Service delivery: To provide access to games, process deposits and withdrawals, credit bonuses, and deliver all other Platform features.
• Identity verification (KYC): To comply with PAGCOR requirements and Philippine Anti-Money Laundering Act (AMLA) obligations by verifying your identity before processing withdrawals or high-value transactions.
• Fraud prevention and security: To detect, investigate, and prevent fraud, money laundering, account takeover, and other prohibited activities on the Platform.
• Responsible gaming: To monitor gaming behavior, identify signs of problem gambling, and administer voluntary deposit limits, cooling-off periods, and self-exclusion requests.
• Customer support: To respond to your queries, resolve complaints, and improve the quality of our support services.
• Marketing and promotions: To send you ditowin promotional offers, bonus notifications, and platform updates — subject to your marketing preferences. You may opt out at any time via your account settings.
• Analytics and platform improvement: To analyze usage patterns, improve game recommendations, optimize platform performance, and develop new features.
• Legal and regulatory compliance: To fulfill ditowin's obligations under Philippine law, including the DPA, AMLA, and PAGCOR regulatory requirements, and to respond to lawful requests from government authorities.

5. Legal Basis for Processing

Under the Data Privacy Act of 2012, ditowin processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to perform the contract between you and ditowin (i.e., providing the gaming Platform and related services).
• Legal obligation: Processing required to comply with applicable Philippine laws including AMLA, PAGCOR regulations, and NPC requirements.
• Legitimate interests: Processing necessary for ditowin's legitimate business interests in fraud prevention, platform security, and service improvement — provided these do not override your data rights.
• Consent: For direct marketing communications and non-essential cookies, where we rely on your freely given, specific, and informed consent, which you may withdraw at any time.

6. Data Sharing and Third Parties

ditowin does not sell your personal data to third parties. We may share your data with the following categories of recipients, strictly as necessary and under appropriate data processing agreements:

• Game providers: JILI and other authorized game studios may receive anonymized session data for game performance monitoring and fair play auditing purposes.
• Payment processors: GCash (G-Xchange Inc.), PayMaya (Maya Philippines Inc.), BDO, BPI, and Metrobank receive transaction data as required to process your deposits and withdrawals.
• KYC and identity verification providers: Third-party identity verification platforms receive identity documents to support our KYC and AML compliance obligations.
• Fraud prevention and security partners: Security analytics providers may receive technical and behavioral data to help detect and prevent fraudulent activity.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities may receive data when legally required.
• Legal and professional advisors: Lawyers, auditors, and compliance consultants may access data under strict confidentiality obligations where required for ditowin's legal and regulatory compliance.

All third-party service providers engaged by ditowin are contractually required to process your personal data only on ditowin's documented instructions and to maintain appropriate technical and organizational security measures.

7. Cookies and Tracking Technologies

The ditowin Platform uses cookies and similar tracking technologies to enhance your experience and support Platform operations. The types of cookies we use include:

• Strictly necessary cookies: Required for the Platform to function, including session authentication and security tokens. These cannot be disabled.
• Performance cookies: Collect anonymized data about how players navigate the Platform to help us identify areas for improvement.
• Functional cookies: Remember your preferences (such as language settings and deposit method defaults) to personalize your experience.
• Analytics cookies: Help ditowin understand aggregate usage patterns and player journeys across the Platform.

You may manage non-essential cookie preferences through your browser settings. Note that disabling certain cookies may limit the functionality of some Platform features.

8. Data Security

ditowin implements comprehensive technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the ditowin Platform.
• Encrypted storage for sensitive personal data including identity documents and financial records.
• Role-based access controls ensuring only authorized ditowin personnel can access personal data for defined business purposes.
• Regular security audits, penetration testing, and vulnerability assessments of Platform infrastructure.
• Two-factor authentication (OTP via SMS) for player login from new or unrecognized devices.

While ditowin takes all reasonable precautions, no data transmission or storage system is completely impenetrable. In the event of a personal data breach that poses risk to your rights and freedoms, ditowin will notify affected players and the NPC in accordance with DPA requirements.

9. Data Retention

ditowin retains personal data for the period necessary to fulfill the purposes for which it was collected and to comply with legal obligations. Specific retention periods include:

• Active account data: Retained for the duration of your account's active status on the Platform.
• KYC and identity documents: Retained for a minimum of 5 years following account closure, in compliance with AMLA requirements.
• Financial transaction records: Retained for a minimum of 5 years in compliance with Philippine tax and AMLA regulations.
• Customer support communications: Retained for 2 years following the closure of each support interaction.
• Marketing data: Retained until you withdraw consent or for 3 years following your last interaction with ditowin marketing communications, whichever comes first.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymized so that it can no longer be attributed to any individual.

10. Your Data Rights

Under the Data Privacy Act of 2012, you have the following rights regarding your personal data held by ditowin:

• Right to be informed: The right to know how your personal data is being collected and processed — as described in this Privacy Policy.
• Right of access: The right to request a copy of the personal data ditowin holds about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure or blocking: The right to request deletion or blocking of your personal data where processing is no longer necessary or lawful — subject to ditowin's legal retention obligations.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes at any time.
• Right to data portability: The right to receive your personal data in a structured, commonly used format where processing is based on consent or contractual necessity.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data rights have been violated.

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 14.

11. Children's Privacy

The ditowin Platform is strictly intended for players who are 21 years of age or older as required by PAGCOR regulations. ditowin does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated account.

If you have reason to believe that a minor has registered on the ditowin Platform, please contact our support team immediately.

12. Cross-border Data Transfers

Some of ditowin's third-party service providers — including game platform infrastructure providers and security analytics vendors — may process data outside the Philippines. Where such cross-border transfers occur, ditowin ensures that appropriate safeguards are in place to protect your personal data at a standard equivalent to Philippine DPA requirements. This may include contractual data transfer agreements, binding corporate rules, or reliance on adequacy decisions where applicable.

13. Changes to This Privacy Policy

ditowin reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, Platform operations, or applicable law. Material changes will be communicated to registered players via email or in-platform notification at least 7 days before the updated policy takes effect.

We encourage you to review this Privacy Policy periodically. Your continued use of the ditowin Platform after the effective date of any update constitutes your acceptance of the revised Privacy Policy.

14. Contact Us & Data Protection Officer

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a data privacy concern, please contact the ditowin Data Protection Officer:

ditowin aims to respond to all data rights requests within 15 business days in accordance with NPC guidelines. Complex requests may require up to 30 calendar days, in which case we will inform you of the extended timeline.

You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you believe your data rights have been violated.