Privacy Policy — cowins

1.1   This Policy applies to all personal data processed by cowins in connection with the operation of the cowins platform, including data collected through account registration, gameplay activity, financial transactions, customer support interactions, and your general use of the cowins website and any associated features.

1.2   This Policy covers data belonging to all registered Players of cowins, as well as individuals who interact with the cowins platform without completing registration, such as visitors to the cowins website whose browsing activity may be tracked through cookies and similar technologies.

1.3   This Policy does not apply to third-party websites, services, or platforms that may be referenced on the cowins website. cowins is not responsible for the privacy practices of any external services, and Players should review the privacy policies of such third parties independently.

1.4   All capitalized terms used in this Policy that are not defined herein carry the meanings ascribed to them in the cowins Terms & Conditions.

2.1   For the purposes of the Philippine Data Privacy Act of 2012 and applicable data protection frameworks, cowins acts as the Personal Information Controller ("PIC") with respect to all personal data collected and processed through the cowins platform.

2.2   As the Personal Information Controller, cowins determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is conducted lawfully, fairly, and transparently in accordance with this Policy and applicable law.

2.3   For all data privacy matters, inquiries, and the exercise of data subject rights, you may contact cowins at: [email protected], with the subject line "DATA PRIVACY REQUEST".

3.1   cowins collects the following categories of personal data in the course of operating the platform and fulfilling its regulatory obligations:

3.1 Identity & Registration Data

• Full legal name as appearing on a government-issued identification document;
• Date of birth (for age verification — must be 21 years or older);
• Nationality and country of residence;
• Username chosen during cowins account registration;
• Profile photograph, where voluntarily provided.

3.2 Contact Data

• Email address registered to the cowins account;
• Philippine mobile number registered to the cowins account;
• Residential address (province, city, barangay, postal code).

3.3 Identity Verification (KYC) Data

• Government-issued photo identification (UMID, PhilSys National ID, driver's license, passport, or equivalent);
• Proof of address documents where required by compliance protocols;
• Selfie photographs submitted for facial verification purposes.

3.4 Financial & Transaction Data

• Payment method details (GCash account number, Maya account, BPI/BDO/Metrobank account identifiers, Coins.ph wallet) — cowins does not store full card numbers or passwords;
• Deposit history, withdrawal history, and transaction timestamps;
• Account balance data at all points in time;
• Source of funds declarations where required for compliance purposes.

3.5 Gameplay & Activity Data

• Game participation records (game title, date, time, wager amount, outcome);
• Bonus and promotion usage history;
• Session duration and frequency data;
• Responsible gaming tool settings and self-imposed limits configured by the Player.

3.6 Technical & Device Data

• IP address at time of access;
• Device type, operating system, and browser version;
• Geolocation data (country and region level only, derived from IP address);
• Login timestamps and session identifiers.

3.7 Communications Data

• Content of customer support communications submitted via email or live chat;
• Feedback and survey responses submitted voluntarily to cowins;
• Complaint records and their resolution status.

4.1   cowins collects personal data through the following means:

5.1   cowins processes personal data on the following legal bases as recognized under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations:

• Contractual Necessity — processing required to fulfill the Terms & Conditions agreement between cowins and the Player, including account management, payment processing, and the provision of gaming services;
• Legal Obligation — processing required to comply with applicable Philippine gaming regulations, anti-money laundering (AML) obligations, PAGCOR reporting requirements, and other mandatory regulatory frameworks;
• Legitimate Interests — processing conducted for fraud prevention, platform security, responsible gaming enforcement, and the improvement of cowins services, where such processing is proportionate and does not override the fundamental rights of data subjects;
• Consent — processing conducted for optional purposes such as marketing communications and promotional notifications, where the Player has provided explicit, freely given, and informed consent that may be withdrawn at any time.

6.1   cowins uses the personal data it collects for the following specific and lawful purposes:

• To create, manage, and maintain your cowins account and provide access to all platform features;
• To verify your identity and age (21+) in compliance with Philippine gaming and KYC requirements prior to processing withdrawals;
• To process deposits, withdrawals, and all other financial transactions conducted through the cowins platform;
• To detect, prevent, and investigate fraud, money laundering, unauthorized account access, and other prohibited activities;
• To enforce the cowins Terms & Conditions and take appropriate action in cases of breach;
• To operate and improve the cowins responsible gaming tools including deposit limits, loss limits, and self-exclusion features;
• To provide customer support, resolve complaints, and respond to account inquiries submitted to the cowins support team;
• To communicate service-related notices, security alerts, account updates, and policy changes to registered Players;
• To send marketing communications and promotional offers, where the Player has provided consent and has not subsequently opted out;
• To analyze platform usage patterns and improve the cowins product experience for Filipino players;
• To comply with applicable regulatory reporting obligations, including those imposed by PAGCOR and relevant Philippine financial intelligence authorities.

7.1   cowins does not sell, rent, or trade your personal data to third parties for their own commercial or marketing purposes. Data is shared only in the following circumstances and with the following categories of recipient:

7.1 Service Providers & Processors

cowins engages third-party service providers who process personal data on its behalf as Personal Information Processors under written data processing agreements. These include:

• Payment processing partners (GCash, Maya, BPI, BDO, Metrobank, Coins.ph) — for the purpose of processing deposits and withdrawals;
• Identity verification and KYC solution providers — for the purpose of verifying Player identity and age;
• Fraud detection and security monitoring services — for the purpose of protecting the cowins platform and its Players;
• Customer support platform providers — for the purpose of facilitating Player support communications;
• Cloud infrastructure and hosting providers — for the purpose of operating and maintaining the cowins platform.

7.2 Regulatory & Law Enforcement Authorities

cowins may be required to disclose personal data and Account information to Philippine regulatory authorities, law enforcement agencies, financial intelligence units, or courts of law where cowins is legally obligated to do so under applicable Philippine law, PAGCOR requirements, or a valid legal order.

7.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of all or part of cowins's business assets, personal data held by cowins may be transferred to the acquiring entity as part of that transaction, subject to the same privacy protections described in this Policy.

8.1   The cowins website uses cookies and similar tracking technologies to enhance platform functionality, maintain session continuity, analyze usage patterns, and support fraud prevention. The following categories of cookies are used by cowins:

8.2   You may manage cookie preferences through your browser settings. Most modern browsers allow you to view, block, or delete cookies stored by websites. Please note that disabling certain cookies may impair your ability to use some features of the cowins platform.

9.1   cowins retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or for such longer period as is required or permitted by applicable Philippine law, including regulatory retention obligations. The following general retention periods apply:

• Account and KYC data — retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, in compliance with applicable AML and regulatory record-keeping requirements;
• Financial transaction data — retained for a minimum of five (5) years from the date of the transaction, as required under Philippine financial and gaming regulations;
• Gameplay activity data — retained for the duration of the active account and for a period of three (3) years following account closure or last activity;
• Customer support records — retained for a period of three (3) years from the date of the interaction;
• Technical and device data — retained for a maximum of twelve (12) months from the date of collection, unless retention is required for an active security investigation.

9.2   Upon the expiry of applicable retention periods, personal data will be securely deleted or anonymized in accordance with cowins's internal data disposal procedures.

10.1   cowins implements industry-standard technical and organizational security measures to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit Transport Layer Security (TLS/SSL) encryption for all data transmitted between Players and the cowins platform;
• Encryption at rest for sensitive data fields including identity documents and financial identifiers stored in cowins systems;
• Multi-factor authentication requirements for administrative access to cowins systems containing personal data;
• Regular third-party penetration testing and security audits of the cowins platform infrastructure;
• Role-based access controls limiting internal access to personal data to authorized personnel on a strict need-to-know basis;
• Incident response procedures for prompt detection, containment, and notification of personal data breaches.

10.2   In the event of a personal data breach that poses a risk to the rights and freedoms of affected Players, cowins will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected Players without undue delay, in accordance with the requirements of the Philippine Data Privacy Act of 2012.

11.1   As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by cowins. All rights may be exercised by contacting [email protected] with the subject line "DATA RIGHTS REQUEST":

11.2   cowins will respond to all verified data rights requests within thirty (30) calendar days of receipt. Where a request is complex or involves a large volume of data, this period may be extended by an additional sixty (60) days with prior notification to the requesting Player.

11.3   cowins may decline to fulfill a data rights request where doing so would conflict with a legal obligation, prejudice an ongoing fraud or compliance investigation, or where the request is manifestly unfounded or excessive. cowins will provide written reasons for any such refusal.

12.1   If a parent or guardian believes that their child under the age of 21 has submitted personal data to cowins, they should contact cowins immediately at [email protected] so that the data can be identified and removed from cowins systems without delay.

13.1   In the course of providing its services, cowins may transfer personal data to service providers and infrastructure partners located outside the Philippines. Any such cross-border transfer of personal data is conducted only to countries or organizations that provide an adequate level of data protection, or under appropriate contractual safeguards such as standard data processing agreements, in compliance with the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations.

13.2   Where personal data is transferred internationally, cowins requires all receiving parties to maintain data protection standards consistent with those applied within the Philippines and to process the data only for the specific authorized purposes for which it was transferred.

14.1   cowins may update this Privacy Policy from time to time to reflect changes in our data practices, applicable Philippine law, regulatory requirements, or the services we provide. Where changes are material, cowins will notify registered Players via the email address associated with their Account or through a prominent notice on the cowins platform before the updated Policy takes effect.

14.2   The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. Your continued use of the cowins platform following the effective date of any updated Policy constitutes your acceptance of the changes. If you do not accept the updated Policy, you must stop using the platform and may request account closure in accordance with the cowins Terms & Conditions.

14.3   All previous versions of the cowins Privacy Policy are retained in our internal records and are available upon written request to [email protected].

15.1   For all privacy-related inquiries, data subject rights requests, or complaints regarding cowins's data handling practices, please contact our Data Privacy team using the details below:

15.2   If you believe that cowins has handled your personal data in a manner inconsistent with this Policy or the Philippine Data Privacy Act of 2012, and your concern has not been adequately resolved by the cowins Data Privacy Team, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the government body responsible for overseeing compliance with Philippine data privacy law.

15.3   cowins takes all privacy complaints seriously and will investigate and respond to all complaints received through the proper channels in a timely, fair, and transparent manner.