lawinplay Privacy Policy

1. Data Controller

lawinplay ("we," "us," or "our") operates the online gaming platform accessible at lawinplay.asia (the "Platform"). For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations, lawinplay is the personal information controller responsible for the personal data processed in connection with your use of the Platform.

Our designated Data Protection Officer ("DPO") can be contacted at the email address listed in Section 13 of this Policy. All data subject requests must be submitted in writing to the DPO.

2. Personal Data We Collect

lawinplay collects personal data through the following means: information you provide directly when registering or using the Platform; information generated automatically through your use of the Platform; and information obtained from third-party verification and payment service providers.

The categories of personal data lawinplay may collect include:

Category	Examples	Source
Identity Data	Full legal name, date of birth, nationality, government-issued ID number (UMID, passport, driver's licence, PhilSys ID)	Provided by you; identity verification provider
Contact Data	Email address, Philippine mobile number, residential address	Provided by you
Financial Data	GCash number, Maya wallet details, bank account details (BPI, BDO, Metrobank), transaction history, deposit and withdrawal records	Provided by you; payment processors
Technical Data	IP address, device type, browser type and version, operating system, session tokens, login timestamps	Collected automatically
Usage Data	Games played, wagers placed, session durations, bet history, promotional offer interactions	Collected automatically
Communications Data	Live chat transcripts, email correspondence, support ticket content	Provided by you

lawinplay does not knowingly collect sensitive personal information beyond what is strictly required for regulatory compliance (such as identity verification documents required under PAGCOR and anti-money-laundering obligations).

3. How We Use Your Personal Data

lawinplay uses the personal data it collects for the following purposes:

• Account management: Creating and maintaining your lawinplay account, verifying your identity and age, and managing your account settings and preferences.
• Service delivery: Processing deposits and withdrawals, providing access to games, crediting bonuses and promotional awards, and delivering customer support.
• Regulatory compliance: Fulfilling obligations under applicable Philippine gaming regulations administered by PAGCOR, anti-money-laundering and counter-terrorism financing laws, and know-your-customer requirements.
• Fraud prevention and security: Detecting and preventing unauthorised access, fraudulent transactions, collusion, and other prohibited conduct on the Platform.
• Responsible gaming: Monitoring gameplay patterns to identify players who may be exhibiting signs of problem gambling, and administering self-exclusion requests and deposit limit controls.
• Platform improvement: Analysing aggregated usage data to improve Platform performance, user experience, and game selection.
• Marketing communications: Sending promotional offers and updates to players who have consented to receive such communications. You may withdraw consent at any time by updating your communication preferences in account settings.

4. Legal Bases for Processing

lawinplay processes your personal data on the following legal bases as provided under the DPA and its Implementing Rules and Regulations:

• Contract performance: Processing necessary to provide the Platform services you have registered for and to fulfil the obligations of lawinplay's Terms and Conditions.
• Legal obligation: Processing required to comply with applicable laws and regulations, including PAGCOR licensing conditions, anti-money-laundering legislation, and tax reporting requirements.
• Legitimate interests: Processing necessary for fraud prevention, Platform security, and the responsible gaming obligations of a licensed operator, where these interests are not overridden by your fundamental rights.
• Consent: Processing for direct marketing communications and non-essential cookies, where you have provided your express consent. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5. Sharing Your Personal Data

lawinplay does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only in the following circumstances and only to the extent strictly necessary:

• Payment service providers: GCash, Maya, GrabPay, BPI, BDO, Metrobank, InstaPay, PesoNet, and 7-Eleven CLiQQ — for the purpose of processing transactions. These providers act as data processors under agreements with lawinplay and are prohibited from using your data for any other purpose.
• Identity verification providers: Third-party KYC and anti-money-laundering screening services engaged to verify your identity and assess regulatory risk.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and any other competent Philippine authority, where disclosure is required by law or regulatory direction.
• Technology service providers: Cloud hosting, analytics, and cybersecurity providers engaged by lawinplay under strict data processing agreements that prohibit independent use of your data.
• Legal proceedings: Where disclosure is required by court order, subpoena, or other binding legal process in any applicable jurisdiction.

6. Cookies and Tracking Technologies

lawinplay uses cookies and similar tracking technologies on the Platform. The categories of cookies we use are:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens and security cookies. These cannot be disabled without disrupting core Platform functionality.
• Functional cookies: Used to remember your preferences, such as language settings, game display preferences, and deposit method defaults.
• Analytics cookies: Used to understand how players use the Platform — which games are most popular, where players encounter friction, and how promotional offers perform. Analytics data is aggregated and does not identify individual players.
• Marketing cookies: Used to deliver relevant promotional messages within the Platform. These are set only with your consent.

You can manage cookie settings through your browser preferences. Please note that disabling non-essential cookies does not affect your ability to play games or process transactions on lawinplay.

7. Data Retention

lawinplay retains personal data for as long as your account remains active and for a minimum period of five (5) years following account closure. This retention period is required to satisfy PAGCOR record-keeping conditions, anti-money-laundering obligations under the Anti-Money Laundering Act of 2001 (as amended), and applicable tax regulations.

Financial transaction records are retained for a minimum of five (5) years from the date of the transaction, regardless of account status. Communications data is retained for a period of two (2) years unless a longer period is required for an ongoing regulatory inquiry or legal proceeding.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with lawinplay's data destruction procedures.

8. Your Rights as a Data Subject

Under the Philippine Data Privacy Act of 2012, you are entitled to exercise the following rights in relation to your personal data held by lawinplay:

• Right to be informed: The right to be told how your personal data is collected and used, as provided in this Privacy Policy.
• Right of access: The right to obtain a copy of the personal data lawinplay holds about you and information about how it is processed.
• Right to rectification: The right to have inaccurate or incomplete personal data corrected. You may update most account information directly through your lawinplay account settings.
• Right to erasure: The right to request deletion of your personal data, subject to lawinplay's legal and regulatory retention obligations. Requests that would require deletion of data held to comply with PAGCOR or anti-money-laundering obligations cannot be fulfilled during the mandatory retention period.
• Right to data portability: The right to receive a copy of your personal data in a structured, commonly used, and machine-readable format.
• Right to object: The right to object to processing based on legitimate interests or for direct marketing purposes.
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe lawinplay has processed your personal data in violation of the DPA.

To exercise any of these rights, submit a written request to lawinplay's Data Protection Officer using the contact details in Section 13. lawinplay will respond within thirty (30) calendar days of receipt of a valid request.

9. Security Measures

lawinplay implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and lawinplay's servers.
• Encryption of personal data and financial records stored in lawinplay's databases.
• Role-based access controls limiting data access to authorised personnel whose job functions require it.
• Multi-factor authentication for all lawinplay staff accessing systems that process personal data.
• Regular third-party security audits and penetration testing of Platform infrastructure.
• An incident response plan covering notification procedures in the event of a personal data breach, including notification to the NPC and affected players in accordance with DPA requirements.

While lawinplay takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying lawinplay immediately if you suspect unauthorised account access.

10. Children's and Minors' Privacy

lawinplay does not knowingly collect personal data from persons under the age of 21 years. The Platform is strictly for adults who meet the minimum age requirement under applicable Philippine gaming regulations. If lawinplay becomes aware that personal data has been collected from an underage individual, the relevant account will be closed immediately and all associated personal data deleted, subject to any mandatory regulatory reporting obligations.

If you have reason to believe that a minor has registered on the Platform, please contact lawinplay's support team or Data Protection Officer immediately using the details in Section 13.

11. Cross-Border Data Transfers

lawinplay may transfer personal data to service providers located outside the Philippines where necessary to operate the Platform — for example, where cloud infrastructure or analytics services are hosted in data centres in other jurisdictions. Any such transfer is conducted only where the recipient country provides an adequate level of data protection, or where appropriate contractual safeguards (such as standard contractual clauses) are in place to protect your rights.

12. Changes to This Privacy Policy

lawinplay reserves the right to update this Privacy Policy at any time. Amendments will be published on this page with an updated "Last Updated" date. Material changes affecting how we process your personal data will be communicated to registered players via the email address on file at least fourteen (14) days before the change takes effect. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgment of the updated Policy.

13. Contact and Data Protection Officer

For questions, concerns, or data subject requests relating to this Privacy Policy or lawinplay's data processing practices, contact lawinplay's Data Protection Officer in writing. Our support team is available 24/7 via live chat on the Platform. You may also reach us by email using the address displayed in the footer of this page. Written requests submitted to the DPO will be acknowledged within five (5) business days and substantively addressed within thirty (30) calendar days.

If you are not satisfied with lawinplay's response to a data subject request or complaint, you have the right to escalate your complaint to the National Privacy Commission of the Philippines.