Privacy Policy

1Data Controller

66win operates as the data controller for all personal information processed through the 66win platform. As data controller, 66win determines the purposes and means by which your personal data is processed. For all privacy-related inquiries, requests, and concerns, you may contact us using the support email address published in the footer of this website.

66win has designated a Data Protection Officer (DPO) in accordance with the requirements of the Data Privacy Act of 2012. The DPO is responsible for ensuring that 66win's data processing activities comply with applicable privacy laws and for responding to player data subject requests.

2Personal Data We Collect

66win collects the following categories of personal data from players and platform visitors:

Identity Data:

• Full legal name as appearing on a government-issued identification document;
• Date of birth (for mandatory age verification — players must be 21 or older);
• Government-issued identification number (e.g., PhilSys ID, passport, driver's licence, SSS/GSIS);
• Profile photograph or selfie submitted during KYC verification.

Contact Data:

• Email address;
• Philippine mobile number (for SMS verification and two-factor authentication);
• Residential address (province, city/municipality, barangay).

Financial Data:

• GCash account number or registered mobile number;
• PayMaya / Maya account details;
• Bank account details for BPI, BDO, or Metrobank where used for deposits or withdrawals;
• Transaction history, deposit amounts, withdrawal records, and gaming activity logs.

Technical & Usage Data:

• IP address and approximate geographic location;
• Device type, operating system, browser type and version;
• Session timestamps, login history, and platform activity logs;
• Referral source and marketing attribution data.

3How Personal Data Is Collected

66win collects personal data through the following means:

• Direct provision by you: when you register an account, complete KYC verification, make a deposit or withdrawal request, contact support, or respond to a survey or promotion;
• Automated technical collection: through cookies, web beacons, server logs, and similar tracking technologies as you browse and use the 66win platform (see Section 9 – Cookies & Tracking);
• Third-party payment processors: when you complete a transaction through GCash, PayMaya, or a Philippine bank, 66win receives a confirmation record of the transaction which may include limited account identifiers;
• KYC and identity verification providers: 66win may use approved third-party identity verification services to cross-check the documents you submit during account verification.

4Purpose of Processing Your Data

66win processes your personal data for the following specific, legitimate purposes:

• Account creation and management: to register your 66win account, verify your identity and age, and maintain your player profile;
• Service delivery: to provide access to games, process deposits, execute withdrawals, and deliver promotional bonuses;
• Regulatory compliance: to meet KYC, anti-money laundering (AML), and counter-terrorism financing (CTF) obligations required by PAGCOR and applicable Philippine law;
• Fraud prevention and platform security: to detect, investigate, and prevent fraudulent activity, account abuse, and security breaches;
• Responsible gaming: to monitor for signs of problem gambling and to apply self-exclusion or account restriction requests made by players or required by regulation;
• Customer support: to respond to your inquiries, resolve disputes, and improve the quality of our support service;
• Marketing communications: to send you promotional offers, bonus notifications, and platform updates — only where you have consented to receive such communications and only for 66win's own services;
• Platform improvement: to analyse aggregated usage data to improve the 66win platform, fix technical issues, and enhance the player experience.

5Legal Basis for Processing

66win processes your personal data under the following lawful bases as recognised by the Data Privacy Act of 2012:

• Contractual necessity: processing required to perform the contract between you and 66win (i.e., providing you with gaming services, processing transactions);
• Legal obligation: processing required to comply with applicable Philippine laws, PAGCOR regulations, AML/CTF obligations, and court or regulatory orders;
• Legitimate interests: processing for fraud prevention, platform security, and responsible gaming monitoring, where such interests are not overridden by your fundamental rights;
• Consent: processing for marketing communications and non-essential cookies, where you have given explicit, freely given, and informed consent. You may withdraw this consent at any time.

6Data Sharing & Third Parties

66win does not sell, rent, or trade your personal data to any third party for their own marketing purposes. Your personal data may be shared only in the following circumstances:

• Payment processors: GCash, PayMaya, BPI, BDO, and Metrobank receive transaction-level data necessary to process your deposits and withdrawals;
• Identity verification providers: approved KYC and AML screening partners who process identity documents solely for account verification purposes;
• Game software providers: licensed game providers (e.g., Pragmatic Play, PG Soft, Jili) may receive anonymised player session data for game performance and fairness auditing purposes;
• Regulatory authorities: PAGCOR, the National Privacy Commission (NPC), law enforcement agencies, and courts — where 66win is legally required to disclose your information;
• Professional advisors: legal, compliance, audit, and IT security service providers engaged by 66win under binding confidentiality obligations.

All third parties with whom 66win shares personal data are required to handle such data in accordance with applicable privacy laws and are prohibited from using it for any purpose other than that for which it was shared.

7Data Retention

66win retains your personal data for as long as necessary to fulfil the purposes described in this Policy and to meet applicable legal retention obligations. Specific retention periods include:

• Account and KYC records: retained for a minimum of five (5) years following account closure, in compliance with AML/CTF record-keeping requirements;
• Transaction records: retained for a minimum of five (5) years following the date of each transaction;
• Support and communication records: retained for three (3) years following the resolution of each inquiry or dispute;
• Marketing consent records: retained until consent is withdrawn and for two (2) years thereafter as proof of consent;
• Technical and usage logs: retained for ninety (90) days for security monitoring purposes, then deleted or anonymised.

Upon expiry of the applicable retention period, 66win will securely delete or anonymise your personal data in a manner that prevents reconstruction or identification.

8Data Security Measures

66win implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS/SSL) encryption for all data transmitted between your device and the 66win platform;
• AES-256 encryption for sensitive data stored in 66win databases;
• Multi-factor authentication requirements for administrative access to systems holding personal data;
• Regular penetration testing and vulnerability assessments by independent security professionals;
• Strict role-based access controls limiting staff access to personal data on a need-to-know basis;
• Documented incident response and data breach notification procedures in accordance with NPC requirements.

In the event of a personal data breach that poses a real risk to your rights and freedoms, 66win will notify the National Privacy Commission and, where required, affected data subjects within the timeframes prescribed by the Data Privacy Act of 2012.

9Cookies & Tracking Technologies

66win uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyse usage patterns. The categories of cookies used are:

• Strictly necessary cookies: essential for platform functionality, including session management, login authentication, and security features. These cannot be disabled without severely impairing your use of the platform;
• Functional cookies: store your preferences such as language settings, display preferences, and recently played games to improve your experience;
• Analytics cookies: collect anonymised information about how visitors interact with the 66win platform, used to identify and fix technical issues and improve platform performance;
• Marketing cookies: used — with your consent only — to track which promotions you have seen and to avoid showing you the same offer repeatedly.

You may manage your cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using core 66win services but may affect certain personalisation features.

10Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 66win:

• Right to be informed: the right to know what personal data 66win holds about you and how it is processed;
• Right to access: the right to request a copy of the personal data 66win holds about you;
• Right to rectification: the right to have inaccurate or incomplete personal data corrected;
• Right to erasure: the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention obligations;
• Right to object: the right to object to the processing of your personal data for direct marketing purposes or on grounds relating to your particular situation;
• Right to data portability: the right to receive your personal data in a structured, commonly used format for transfer to another controller;
• Right to lodge a complaint: the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated.

To exercise any of these rights, please contact 66win's Data Protection Officer using the support email address in the footer of this page. We will respond to verified requests within thirty (30) days of receipt, in accordance with applicable law.

11Minors & Age Restriction

The 66win platform is strictly for individuals who are 21 years of age or older. 66win does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step before any gaming activity or withdrawal is permitted on the platform.

If 66win becomes aware that personal data has been collected from an individual under the age of 21, such data will be deleted immediately and the associated account will be permanently closed. If you are a parent or guardian and believe that your minor child has accessed or registered on the 66win platform, please contact our support team immediately.

12Changes to This Privacy Policy

66win reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. The "Last Updated" date at the top of this Policy indicates when the most recent revision was made.

Where changes are material, 66win will notify registered players by email or through an in-platform notification prior to the changes taking effect. Your continued use of the 66win platform after the effective date of any revised Policy constitutes your acceptance of the updated terms.

For questions about this Privacy Policy or to exercise your data subject rights, please contact us using the email address in the footer of this page. Our Data Protection Officer and support team are available to assist you.