TAPWIN PRIVACY POLICY

1. Introduction & Scope

This Privacy Policy applies to all personal data collected, processed, and stored by tapwin in connection with the operation of the tapwin online gaming platform accessible at tapwin.cam (the "Platform"). It covers data collected through the Platform's website, mobile-optimised interface, customer support channels, and any other touchpoints through which you interact with tapwin.

This Policy should be read together with tapwin's Terms & Conditions and Responsible Gaming Policy. Terms not defined in this Policy carry the meanings assigned to them in the Terms & Conditions. For the purposes of this Policy, "personal data" means any information that identifies or could reasonably be used to identify you as an individual, consistent with the definition under Republic Act No. 10173 (the "Data Privacy Act") and its Implementing Rules and Regulations.

This Policy applies to all registered and prospective tapwin players located in the Philippines, as well as to any individuals whose personal data tapwin processes in connection with its operations, including support interactions and compliance activities.

2. Data Controller Identity

tapwin operates as the data controller for personal data processed through the tapwin Platform. As data controller, tapwin determines the purposes and means by which your personal data is processed, and bears primary responsibility for ensuring that processing is carried out lawfully, fairly, and transparently in accordance with applicable Philippine data privacy law.

tapwin has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and with the Data Privacy Act. The DPO can be contacted at the details set out in Section 15 of this Policy. All data subject rights requests, privacy complaints, and data processing enquiries should be directed to the DPO in the first instance.

3. Personal Data We Collect

tapwin collects personal data through several channels and for several distinct purposes. The categories of personal data collected are described in the table below.

3.1 Data You Provide Directly

The majority of personal data tapwin holds about you is data you provide directly during account registration, KYC verification, deposit and withdrawal requests, and support interactions. tapwin relies on the accuracy of self-provided data and, per the Terms & Conditions, players must keep their registration information current and accurate.

3.2 Data Collected Automatically

When you access the tapwin Platform, certain technical data is collected automatically through standard web technologies including cookies, server logs, and session management systems. This data is used for security purposes, fraud detection, platform performance optimisation, and to maintain the integrity of your login session. See Section 7 for full details on tapwin's cookie use.

3.3 Data from Third Parties

tapwin may receive personal data about you from third-party sources including payment processors (such as GCash and Maya), identity verification service providers, fraud detection services, and regulatory bodies where required by applicable Philippine law. Such data is processed in accordance with this Policy and only for the specific purposes for which it was received.

4. How We Use Your Personal Data

tapwin processes your personal data for the following documented purposes:

• Account creation and management: To register, maintain, and administer your tapwin account, including login authentication and account settings management
• Identity verification (KYC): To verify your identity and age as required under applicable Philippine gaming and anti-money laundering regulations
• Payment processing: To process deposits and withdrawals through your chosen payment method (GCash, Maya, bank transfer, or other supported channels)
• Gaming service delivery: To provide access to tapwin's casino games, sports betting, bingo, and other gaming services
• Responsible gaming: To monitor gaming activity for patterns associated with problem gambling and to administer self-imposed limits, cooling-off periods, and self-exclusion requests
• Regulatory compliance: To meet tapwin's obligations under PAGCOR guidelines, the Data Privacy Act, the Anti-Money Laundering Act, and other applicable Philippine laws
• Fraud prevention and security: To detect, prevent, and investigate fraudulent activity, account compromise, bot activity, and other security threats
• Customer support: To respond to your enquiries, resolve complaints, and provide technical assistance
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates – where you have provided consent and not subsequently withdrawn it
• Platform improvement: To analyse aggregated, anonymised usage data to improve the tapwin platform's performance, user experience, and game library

5. Legal Basis for Processing

tapwin processes your personal data only where a lawful basis exists under the Data Privacy Act and its Implementing Rules. The primary legal bases tapwin relies on are as follows:

5.1 Contractual Necessity

Processing that is necessary to perform tapwin's obligations under the contract formed with you when you create a tapwin account – including account management, payment processing, game delivery, and support services – is carried out on the basis of contractual necessity.

5.2 Legal Obligation

Certain processing activities are carried out because tapwin is required to do so under applicable Philippine law, including KYC verification, AML transaction monitoring, and regulatory reporting to PAGCOR and the AMLC.

5.3 Legitimate Interests

tapwin processes some data – including fraud detection, security monitoring, and gaming pattern analysis for responsible gaming purposes – on the basis of its legitimate interests in operating a secure, compliant, and fair gaming platform. tapwin has assessed that these legitimate interests are not overridden by your privacy interests or fundamental rights.

5.4 Consent

Where tapwin relies on your consent as a legal basis – primarily for marketing communications and for non-essential cookies – such consent is obtained explicitly and can be withdrawn at any time without affecting the lawfulness of processing that occurred prior to withdrawal. Withdrawal of consent for marketing does not affect your ability to continue using tapwin's gaming services.

6. Data Sharing & Disclosure

tapwin does not sell your personal data to any third party for any purpose. tapwin shares your personal data only in the following circumstances and only to the extent strictly necessary for the stated purpose:

6.1 Payment Service Providers

To process deposits and withdrawals, tapwin shares relevant financial data with payment processors including GCash (G-Xchange Inc.), Maya (Voyager Innovations), and partnered Philippine banking institutions. These processors act as independent data controllers for their own KYC and transaction processing activities, and their own privacy policies apply to data they independently hold.

6.2 Identity Verification Providers

tapwin engages third-party identity verification services to conduct KYC checks and document authentication. These providers receive identity document data and biometric verification data solely for the purpose of verifying your identity and will not use it for any other purpose.

6.3 Regulatory Authorities

tapwin is obligated by Philippine law to disclose personal data and transaction records to regulatory bodies including PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent government authorities when lawfully required to do so. tapwin does not notify players of such disclosures where doing so would prejudice a law enforcement or regulatory investigation.

6.4 Fraud Detection & Security Services

tapwin uses third-party fraud detection and cybersecurity services that may process technical data (IP addresses, device fingerprints, login patterns) to identify and prevent fraudulent account activity. These services are contractually bound to process data only on tapwin's instructions and in accordance with applicable data protection law.

7. Cookies & Tracking Technologies

tapwin uses cookies and similar tracking technologies to operate the Platform, maintain your login session, remember your preferences, and gather aggregated analytics data. Cookies are small data files stored on your device by your web browser when you access tapwin.cam.

7.1 Essential Cookies

Essential cookies are strictly necessary for the tapwin Platform to function. They maintain your authenticated session, prevent cross-site request forgery attacks, and enable core Platform features. Essential cookies cannot be disabled without impairing Platform functionality. They do not require your consent as they are processed on the basis of contractual necessity.

7.2 Analytics Cookies

tapwin uses analytics cookies to collect aggregated, anonymised data about how players use the Platform – including pages visited, time spent on each section, and features used. This data is used solely to improve Platform performance and user experience. Analytics cookies are deployed only where you have provided consent during your initial visit to tapwin.cam.

7.3 Marketing Cookies

If you have consented to marketing communications, tapwin may use cookies to track which promotional offers you have engaged with in order to improve the relevance of future promotions shown to you. Marketing cookies are not deployed without your explicit prior consent and can be disabled at any time through your browser settings or by updating your communication preferences in your tapwin account.

7.4 Managing Cookies

You can control and delete cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the tapwin Platform, including the ability to maintain a login session. For instructions on managing cookies in commonly used browsers, refer to your browser's help documentation.

8. Data Retention

tapwin retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your tapwin account plus a minimum of 5 years following account closure, as required by AML regulations
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction, consistent with Philippine AML reporting obligations
• Gaming activity records: Retained for 3 years from the date of the activity, or longer where required for ongoing regulatory compliance or dispute resolution
• KYC documents: Retained for the duration of account relationship plus 5 years post-closure
• Customer support communications: Retained for 2 years from the date of the interaction
• Technical / log data: Retained for 12 months unless required longer for security investigations
• Marketing consent records: Retained until consent is withdrawn, plus 1 year as evidence of prior consent

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with tapwin's data disposal procedures. Anonymised data (which can no longer identify you) may be retained indefinitely for aggregated analytics and business intelligence purposes.

9. Data Security

tapwin implements technical and organisational security measures appropriate to the sensitivity of the personal data it holds and the risks associated with its processing. Key security measures currently in place include:

• 256-bit SSL/TLS encryption for all data in transit between your device and tapwin's servers
• Encryption at rest for sensitive personal and financial data stored on tapwin's servers
• Role-based access controls ensuring that tapwin employees access only the data necessary for their specific function
• Multi-factor authentication required for all tapwin internal systems access
• Comprehensive audit logging of all access to personal data within tapwin's internal systems
• Regular penetration testing and vulnerability assessments conducted by qualified third-party security professionals
• A formal incident response plan covering detection, containment, notification, and post-incident review procedures

Notwithstanding these measures, no internet-based system can guarantee absolute security. tapwin encourages players to use strong, unique passwords for their tapwin accounts, to enable two-factor authentication, and to log out of the Platform when using shared devices.

10. Your Data Subject Rights

Under the Data Privacy Act of 2012 and its Implementing Rules, you hold the following rights with respect to your personal data held by tapwin. To exercise any of these rights, please contact tapwin's Data Protection Officer as described in Section 15.

10.1 Right to Be Informed

You have the right to be informed about how your personal data is collected and processed. This Privacy Policy serves as tapwin's primary mechanism for fulfilling this obligation. tapwin will also provide specific processing notices at the point of data collection where the purpose is not adequately described in this Policy.

10.2 Right to Access

You have the right to request a copy of the personal data tapwin holds about you, together with information about the purposes for which it is processed, the categories of data held, and the recipients to whom it has been disclosed. tapwin will respond to access requests within 30 calendar days of receipt. A reasonable fee may be charged for manifestly unfounded or excessive requests.

10.3 Right to Rectification

If any personal data tapwin holds about you is inaccurate or incomplete, you have the right to request correction. For standard account information (name, contact details), you may be able to update this directly through your tapwin account settings. For KYC document corrections, please contact the DPO directly with supporting evidence.

10.4 Right to Erasure

You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and there is no other lawful basis for processing), or where the data has been unlawfully processed. This right is not absolute – tapwin may be required by Philippine law to retain certain data notwithstanding a valid erasure request, and will communicate any applicable retention obligations when responding to such requests.

10.5 Right to Object and Restrict Processing

You have the right to object to tapwin's processing of your personal data where that processing is based on legitimate interests, and to request that processing be restricted pending resolution of an accuracy dispute or an objection. You may always object to direct marketing communications, and tapwin will honour such objections immediately.

10.6 Right to Data Portability

Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to request that it be transferred directly to another data controller where technically feasible.

10.7 Right to Lodge a Complaint

If you believe tapwin has processed your personal data in violation of the Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. tapwin encourages players to contact the DPO first to attempt resolution, but this does not affect your right to contact the NPC directly.

11. Children's Privacy

The tapwin Platform is strictly for persons aged 21 years and above, consistent with Philippine gaming law. tapwin does not knowingly collect or process personal data from individuals below 21 years of age. tapwin employs age verification measures during account registration to enforce this requirement.

If tapwin becomes aware that personal data has been collected from a person below the minimum age, such data will be deleted immediately and the associated account will be closed. If you believe that a minor has registered a tapwin account, please notify tapwin support or the DPO immediately.

12. International Data Transfers

tapwin's primary data processing infrastructure is hosted within or in accordance with standards compatible with Philippine data protection requirements. Where personal data is processed by third-party service providers whose infrastructure may be located outside the Philippines – such as certain cloud services, fraud detection providers, or game content suppliers – tapwin ensures that appropriate safeguards are in place before transferring data. Such safeguards may include contractual clauses that impose data protection obligations on the recipient equivalent to those required under Philippine law.

tapwin does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate safeguards and, where required, obtaining your consent.

13. Third-Party Services & Links

The tapwin Platform may contain references to third-party services such as payment processors and game content providers. These third parties operate their own privacy policies and are independent data controllers for the personal data they independently collect and process. tapwin is not responsible for the privacy practices of third-party services. Players are encouraged to review the privacy policies of any third-party service with which they interact in connection with their use of the tapwin Platform.

tapwin does not include third-party advertising networks or social media tracking pixels on the Platform that would allow third parties to collect your personal data without your knowledge or consent.

14. Policy Amendments

tapwin reviews and updates this Privacy Policy periodically to reflect changes in data processing practices, applicable law, regulatory guidance, or Platform features. Where changes are material – meaning they affect your rights or the way tapwin processes your personal data in a significant way – tapwin will notify you by email to your registered address and post a prominent notice on the Platform at least 14 days prior to the amended Policy taking effect.

Non-material amendments, including typographical corrections, clarifications that do not change the substance of the Policy, or updates to reflect minor operational changes, may be made without prior notice. The "Last Updated" date at the top of this page will always reflect when the Policy was most recently revised. Your continued use of the tapwin Platform after any amendment takes effect constitutes acceptance of the revised Privacy Policy.

15. Contact & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or tapwin's processing of your personal data, please contact tapwin's Data Protection Officer through the following channels:

• Data Protection Officer (DPO): tapwin Data Protection Team
• Email: [email protected] (plain text – not a clickable link; please include "Privacy / DPO Request" in your subject line)
• Live Chat: Available 24/7 on the tapwin Platform – please specify that your query is a data privacy matter
• Response Time: tapwin commits to acknowledging all privacy-related requests within 3 business days and providing a substantive response within 30 calendar days
• Language: Privacy requests may be submitted in English or Filipino (Tagalog)

For complaints that cannot be resolved through tapwin's internal process, you may escalate to the National Privacy Commission of the Philippines through official NPC channels. tapwin cooperates fully with NPC investigations and will provide all information required by law.