phweek Privacy Policy

1. Data Controller Information

phweek is the data controller responsible for the personal information processed through the Platform. phweek operates the Platform under PAGCOR's regulatory framework and in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations ("IRR"), as administered by the National Privacy Commission of the Philippines ("NPC").

phweek has designated a Data Protection Officer ("DPO") responsible for overseeing compliance with the DPA. If you have any privacy-related queries or wish to exercise any right under the DPA, please contact the phweek DPO as described in Section 12 of this Policy.

2. Information We Collect

2.1 Information You Provide Directly

When you register for a phweek account or use the Platform, we collect personal information that you submit directly, including:

• Identity Information: Full legal name, date of birth, nationality, and government-issued identification number (as required for KYC/AML compliance under PAGCOR regulations and the Anti-Money Laundering Act);
• Contact Information: Email address, Philippine mobile number, and residential address;
• Financial Information: Details of the payment instruments you use to deposit and withdraw funds (e.g., GCash account number, bank account details), transaction history, and source-of-funds documentation where required;
• Identity Verification Documents: Scanned copies or photographs of government-issued identification documents (e.g., PhilSys National ID, UMID, passport, driver's licence) submitted for KYC verification;
• Communications: Records of your communications with phweek's customer support team, including chat transcripts, email correspondence, and support ticket histories.

2.2 Information Collected Automatically

When you access the Platform, phweek's systems automatically collect certain technical and usage data, including:

• IP address, device type, operating system, browser type and version, and screen resolution;
• Geolocation data (at the country/region level) derived from your IP address;
• Session data, including login timestamps, session duration, pages visited, and in-Platform navigation patterns;
• Game activity data, including game sessions played, wagers placed, game outcomes, and RTP tracking data;
• Cookie and tracking technology data as described in Section 6.

2.3 Information from Third Parties

phweek may receive personal information about you from third parties in the following circumstances:

• Identity verification service providers engaged to conduct KYC and age verification checks on phweek's behalf;
• Payment processors and e-wallet providers (such as GCash and PayMaya) processing transactions on your phweek account;
• PAGCOR's Self-Exclusion Registry, to verify whether a player is subject to a self-exclusion order before allowing account registration or continued access;
• Anti-fraud and anti-money laundering screening services used to detect suspicious account activity.

3. How We Use Your Information

phweek uses personal information collected through the Platform for the following purposes:

phweek does not use your personal information to make fully automated decisions that produce legal or similarly significant effects on you, except where required by applicable law or PAGCOR regulation.

4. Legal Bases for Processing

Under the Data Privacy Act of 2012, phweek processes your personal information on the following legal bases:

• Performance of a contract: Processing necessary to fulfil our obligations under the phweek Terms & Conditions, including account creation, payment processing, and delivery of gaming services;
• Compliance with a legal obligation: Processing required by PAGCOR regulations, the Anti-Money Laundering Act, the DPA, and other applicable Philippine law — including KYC verification, AML monitoring, and PAGCOR reporting obligations;
• Legitimate interests: Processing for fraud prevention, Platform security, responsible gaming monitoring, and Platform improvement, where these interests are not overridden by your privacy rights;
• Consent: Processing for direct marketing and promotional communications, where your prior consent has been obtained. You may withdraw this consent at any time by updating your communication preferences in your account settings or by contacting phweek support.

5. Sharing Your Personal Information

phweek does not sell your personal information to third parties. phweek shares personal information only as described below:

5.1 Service Providers

phweek engages third-party service providers who process personal information on phweek's behalf under data processing agreements that require them to maintain appropriate security standards and use your data only for the purposes for which it was provided. These include identity verification providers, payment processors (GCash, PayMaya, BPI, BDO, Metrobank, and cryptocurrency payment infrastructure), cloud infrastructure providers, fraud detection and AML screening services, and customer support platform providers.

5.2 Regulatory Disclosures

phweek is legally required to disclose personal information to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other Philippine regulatory authorities upon valid legal request or as part of ongoing regulatory compliance obligations. Such disclosures are made only to the extent required by applicable law and phweek's PAGCOR licence conditions.

5.3 Game Providers

Game studios and live casino operators whose games are available on the phweek Platform may receive technical session data (such as anonymous player session identifiers and game result data) for the purpose of delivering game services and resolving game disputes. These providers do not receive directly identifying personal information such as your name, address, or payment details.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving phweek, personal information held by phweek may be transferred to the relevant successor entity, subject to confidentiality obligations and the rights described in Section 9 of this Policy. phweek will notify affected players of any such transfer via email prior to completion where reasonably practicable.

6. Cookies & Tracking Technologies

The phweek Platform uses cookies and similar tracking technologies to enable Platform functionality, improve user experience, and support analytics. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function correctly, including session management, login authentication, and security controls. These cannot be disabled without preventing Platform use.
• Functional Cookies: Enable the Platform to remember your preferences, such as language settings, account display options, and recently played games.
• Analytics Cookies: Collect aggregated, anonymised data about how players use the Platform (e.g., which games are most visited, typical session durations) to help phweek improve the Platform. No individually identifying data is used for analytics purposes.
• Marketing Cookies: Used only with your prior consent to deliver phweek promotional content relevant to your gaming preferences. You may withdraw consent at any time via your browser settings or account preferences.

You can control cookie preferences through your browser settings. Blocking strictly necessary cookies will impair Platform functionality. Detailed information on the specific cookies deployed on the Platform is available in phweek's Cookie Notice, accessible from your account settings.

7. Data Retention

phweek retains personal information for the periods set out below, after which data is securely deleted or anonymised:

• Account and identity data: Retained for the duration of your active phweek account, and for a minimum of five (5) years after account closure, as required by PAGCOR licence conditions and the Anti-Money Laundering Act;
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction, in compliance with AMLC record-keeping requirements;
• KYC documents: Retained for five (5) years after account closure or the conclusion of any AML investigation, whichever is later;
• Customer support records: Retained for two (2) years from the date of the relevant interaction, unless subject to a longer retention requirement in connection with a dispute or regulatory matter;
• Technical and usage logs: Retained for thirteen (13) months for analytics purposes, after which they are anonymised or deleted.

Where retention beyond these periods is required by a specific regulatory obligation, court order, or ongoing dispute, phweek will retain the relevant data for as long as necessary to fulfil that obligation and will inform you where reasonably practicable.

8. Data Security

phweek implements technical and organisational security measures appropriate to the sensitivity of the personal information it holds, including:

• Transport Layer Security (TLS) encryption for all data transmitted between your browser and phweek's servers;
• Encryption at rest for sensitive personal and financial data held on phweek's infrastructure;
• Role-based access controls limiting phweek staff access to personal data on a strict need-to-know basis;
• Multi-factor authentication requirements for phweek staff systems handling personal data;
• Regular security assessments, penetration testing, and vulnerability management programmes;
• Incident response procedures compliant with NPC data breach notification requirements under the DPA.

9. Your Rights Under Philippine Law

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal information held by phweek:

• Right to be Informed: The right to be informed of how phweek collects and processes your personal information, as set out in this Policy;
• Right of Access: The right to request a copy of the personal information phweek holds about you;
• Right to Rectification: The right to request correction of inaccurate or incomplete personal information in your phweek account;
• Right to Erasure: The right to request deletion of your personal information where phweek no longer has a legal basis to retain it, subject to applicable retention obligations (see Section 7);
• Right to Object: The right to object to processing of your personal information based on legitimate interests, including direct marketing;
• Right to Data Portability: The right to receive a copy of your personal information in a structured, commonly used format where technically feasible;
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines if you believe phweek has violated your rights under the DPA.

To exercise any of the rights above, please contact phweek's Data Protection Officer as described in Section 12. phweek will respond to verified rights requests within 30 calendar days. Where phweek cannot fulfil a request due to a competing legal obligation, phweek will notify you of the reason in writing.

10. Children & Minors

11. Policy Amendments

phweek reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, PAGCOR regulatory requirements, or phweek's data processing practices. Material amendments will be communicated to registered players via email at least 7 days before the amended Policy takes effect. The current version of this Policy, with its effective date, is always available on this page. Your continued use of the Platform after the effective date of any amendment constitutes acknowledgement of the revised Policy. If you do not agree with a material amendment, you may close your account before the effective date by contacting phweek support.

12. Contact & Complaints

If you have questions about this Privacy Policy, wish to exercise your rights under the DPA, or wish to raise a privacy concern, please contact phweek's Data Protection Officer:

• Email: [email protected] (mark the subject line "DPO — Privacy Request")
• Live Chat: Available 24/7 from your phweek account dashboard

phweek will acknowledge all DPA rights requests within 5 business days and provide a substantive response within 30 calendar days. If you are dissatisfied with phweek's response, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC) via the NPC's official complaint process.

The phweek Privacy Policy is governed by and construed in accordance with the laws of the Republic of the Philippines. The Data Privacy Act of 2012 (RA 10173) and its IRR are the primary applicable legislation governing phweek's data protection obligations.