baawin Privacy Policy

baawin ("we," "us," or "our") operates the online gaming platform accessible at baawin.app. We are committed to protecting the privacy and personal data of every player who registers and plays on our platform. This Privacy Policy describes how baawin collects, uses, stores, shares, and protects your personal information in connection with your use of the baawin platform.

This Privacy Policy applies to all personal data collected through the baawin website, progressive web application, customer support channels, and any other touchpoints through which you interact with baawin. It should be read together with the baawin Terms & Conditions, which are incorporated herein by reference.

By registering for a baawin account or continuing to use the baawin platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Privacy Policy, you should discontinue use of the baawin platform.

baawin acts as the data controller in respect of the personal data it collects directly from players. Where baawin engages third-party service providers to process data on its behalf, those providers act as data processors and are bound by contractual obligations consistent with this Privacy Policy and applicable Philippine data protection law.

baawin collects the following categories of personal data from players, depending on the nature of your interaction with the platform:

Registration & Account Data:

• Full legal name as it appears on your government-issued ID
• Date of birth (to verify the 21+ age requirement)
• Email address
• Mobile number (used for SMS OTP and account notifications)
• Username and encrypted password
• Residential address (city, province, postal code)

Identity Verification (KYC) Data:

• Scanned copies or photographs of government-issued identification documents (e.g., Philippine passport, driver's license, SSS ID, PhilSys National ID, UMID)
• Proof of address documents (e.g., utility bill, bank statement)
• Selfie photographs for liveness verification where required
• Source of funds declarations where required by compliance procedures

Financial & Transaction Data:

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method references
• GCash account reference numbers, PayMaya account references, or bank account details (BPI, BDO, Metrobank) used for transactions — note that baawin does not store full bank account numbers or card numbers
• Bonus and promotional credit history
• Wagering history and game activity records

Technical & Usage Data:

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser information
• Session timestamps, login history, and platform navigation data
• Cookies and similar tracking technologies (see Section 8)

Communications Data:

• Records of your communications with baawin customer support, including live chat transcripts and email correspondence
• Feedback, survey responses, and complaint records

baawin collects personal data through the following means:

• Directly from you: When you register for a baawin account, complete your profile, submit KYC documents, make a deposit or withdrawal, contact customer support, or respond to a survey or promotion.
• Automatically: When you access and use the baawin platform, we automatically collect technical and usage data through cookies, server logs, and similar technologies. This includes your IP address, device information, and browsing behavior within the platform.
• From third-party payment providers: When you make a deposit or withdrawal via GCash, PayMaya, BPI, BDO, Metrobank, or InstaPay, the relevant payment provider may share transaction confirmation data with baawin to reconcile your account balance.
• From identity verification services: baawin may use third-party KYC and identity verification service providers to assist in verifying the authenticity of documents you submit. These providers process your data on baawin's behalf under strict data processing agreements.
• From fraud prevention and compliance services: baawin may receive data from third-party fraud detection and anti-money laundering screening services as part of its compliance obligations under Philippine law.

baawin uses the personal data it collects for the following purposes:

baawin will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise required by law.

baawin processes your personal data on the following legal bases under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations:

• Contractual necessity: Processing is necessary to perform the contract between you and baawin — specifically, to operate your account, process transactions, and deliver the gaming services you have requested.
• Legal obligation: Processing is required to comply with baawin's obligations under Philippine law, including anti-money laundering regulations, gaming regulations, and tax reporting requirements.
• Legitimate interests: Processing is necessary for baawin's legitimate interests in preventing fraud, ensuring platform security, and improving the quality of its services, provided those interests are not overridden by your rights and interests.
• Consent: For marketing communications and non-essential cookies, baawin relies on your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

baawin does not sell, rent, or trade your personal data to any third party for commercial purposes. baawin may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Privacy Policy:

• Payment service providers: GCash, PayMaya, BPI, BDO, Metrobank, InstaPay, and other payment processors, solely to facilitate deposits and withdrawals from your baawin account.
• Identity verification providers: Third-party KYC and document verification services engaged by baawin to assist in verifying player identities in compliance with applicable regulations.
• Fraud prevention and AML screening services: Third-party providers that assist baawin in detecting and preventing fraudulent activity and money laundering.
• Game software providers: Game developers and content providers whose games are available on the baawin platform may receive limited technical data (such as player session tokens) necessary to deliver their games. These providers do not receive your full personal profile.
• Customer support platforms: Third-party live chat and helpdesk software providers used to deliver baawin's customer support services.
• Regulatory and law enforcement authorities: baawin may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other competent Philippine authorities where required by law, court order, or regulatory directive.
• Professional advisers: Lawyers, auditors, and accountants engaged by baawin in connection with legal proceedings, compliance reviews, or business operations, subject to professional confidentiality obligations.

baawin retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law and regulation. The following general retention periods apply:

• Account data: Retained for the duration of your active account relationship with baawin, plus a minimum of five (5) years following account closure, in accordance with Philippine anti-money laundering record-keeping requirements.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later, as required by applicable AML regulations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer support communications: Retained for a period of three (3) years from the date of the last communication, or longer if the communication relates to an ongoing dispute or legal matter.
• Marketing consent records: Retained for the duration of your consent and for a reasonable period thereafter to demonstrate compliance with consent requirements.
• Technical and usage data: Retained for a period of up to twelve (12) months, after which it is aggregated or anonymized.

Upon expiry of the applicable retention period, baawin will securely delete or anonymize your personal data in accordance with its data disposal procedures. Where data cannot be immediately deleted due to technical constraints, it will be isolated from further processing until deletion is possible.

baawin uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device when you visit a website. The following types of cookies are used on the baawin platform:

• Strictly necessary cookies: These cookies are essential for the baawin platform to function. They enable core features such as session management, authentication, and security. These cookies cannot be disabled without affecting platform functionality.
• Functional cookies: These cookies remember your preferences — such as your preferred language, display settings, and notification preferences — to provide a more personalized experience on the baawin platform.
• Analytics cookies: baawin uses first-party analytics cookies to understand how players navigate and use the platform. This data is used in aggregate form to identify areas for improvement and to optimize the player experience. baawin does not use third-party advertising analytics networks.

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when a new cookie is set. Please note that disabling strictly necessary cookies may impair your ability to use the baawin platform.

baawin implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the baawin platform.
• Encryption at rest for sensitive data stored in baawin's databases, including KYC documents and financial records.
• Role-based access controls ensuring that only authorized personnel can access personal data, and only to the extent required for their specific job function.
• Multi-factor authentication for all baawin staff accessing systems that contain personal data.
• Regular security audits and penetration testing conducted by independent security professionals.
• Intrusion detection and monitoring systems that continuously monitor the baawin platform for suspicious activity.
• Secure data disposal procedures for the destruction of physical and digital records containing personal data.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, baawin will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with the requirements of the Data Privacy Act of 2012 and its Implementing Rules and Regulations.

While baawin takes all reasonable steps to protect your personal data, no method of transmission over the internet or method of electronic storage is completely secure. You are responsible for keeping your baawin account credentials confidential and for notifying baawin immediately if you suspect any unauthorized access to your account.

Under the Data Privacy Act of 2012 (Republic Act No. 10173), you have the following rights in relation to your personal data held by baawin:

• Right to be informed: You have the right to be informed about how your personal data is collected, used, and processed. This Privacy Policy fulfills that obligation.
• Right of access: You have the right to request a copy of the personal data baawin holds about you, along with information about how it is being processed.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data baawin holds about you. You can update most account information directly through your baawin account settings.
• Right to erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to baawin's legal retention obligations.
• Right to object: You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, subject to baawin's overriding legitimate grounds.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe that baawin has processed your personal data in violation of the Data Privacy Act of 2012.

To exercise any of the above rights, please contact baawin's Data Protection Officer through the contact details provided in Section 14 of this Privacy Policy. baawin will respond to all verified data subject requests within thirty (30) days of receipt. Complex requests may require additional time, in which case baawin will inform you of the expected timeline.

The baawin platform is strictly intended for individuals who are at least 21 years of age, in accordance with Philippine gaming regulations. baawin does not knowingly collect personal data from individuals under the age of 21.

If baawin becomes aware that it has inadvertently collected personal data from a person under the age of 21, it will take immediate steps to delete that data and close the associated account. Any winnings generated by an underage player will be forfeited, and deposits will be returned to the original payment method subject to verification.

If you are a parent or guardian and believe that your child has registered on the baawin platform, please contact baawin's support team immediately using the contact details in Section 14 so that appropriate action can be taken without delay.

The baawin platform may contain links to third-party websites or services, such as payment provider portals. baawin is not responsible for the privacy practices of any third-party website or service. This Privacy Policy applies solely to data collected by baawin through the baawin platform.

We encourage you to review the privacy policies of any third-party services you access in connection with your use of the baawin platform, including the privacy policies of GCash, PayMaya, BPI, BDO, and Metrobank, before providing your personal data to those services.

baawin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The most current version of this Privacy Policy will always be available at baawin.app/privacy-policy, and the "Last Updated" date at the top of this page will reflect the date of the most recent revision.

For material changes to this Privacy Policy, baawin will make reasonable efforts to notify registered players via the email address associated with their account or through a prominent notice on the platform prior to the changes taking effect. Your continued use of the baawin platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms.

If you do not agree with any changes to this Privacy Policy, you should discontinue use of the baawin platform and may request the closure of your account in accordance with the baawin Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or baawin's data processing practices, please contact baawin's Data Protection Officer (DPO). The DPO is responsible for overseeing baawin's compliance with the Data Privacy Act of 2012 and for handling all data subject requests.

You may reach the baawin Data Protection Officer through the following channels:

baawin aims to acknowledge all privacy-related inquiries within 24 hours and to provide a substantive response within thirty (30) days. If your request is complex or involves a large volume of data, baawin will inform you of the expected timeline and keep you updated on progress.

If you are not satisfied with baawin's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act of 2012.