phweek Privacy
Policy

This Privacy Policy ("Policy") describes how phweek ("phweek," "we," "us," or "our") collects, uses, processes, discloses, and safeguards personal data in connection with your use of the phweek online gaming platform accessible at phweek.org and all associated services (collectively, the "Platform").

phweek operates in the Philippines and is subject to Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (the "DPA"), and its Implementing Rules and Regulations (the "IRR"), as administered by the National Privacy Commission ("NPC"). phweek is also subject to data handling obligations under PAGCOR's online gaming regulatory framework.

This Policy applies to all personal data processed in connection with the phweek Platform, including data provided during account registration, gaming activity, financial transactions, customer support interactions, and site visits. By registering a phweek account or using the Platform, you acknowledge that you have read and understood this Policy.

For the purposes of the Data Privacy Act of 2012, phweek acts as the Personal Information Controller (PIC) in respect of all personal data collected and processed through the Platform. As PIC, phweek determines the purposes for which and the manner in which personal data is processed.

Certain service providers engaged by phweek — including payment processors, game content providers, and identity verification services — may process personal data on phweek's behalf as Personal Information Processors (PIPs). phweek ensures, through contractual data processing agreements, that all PIPs process personal data only in accordance with phweek's documented instructions and in compliance with the DPA.

phweek collects the following categories of personal data, as applicable to your use of the Platform:

3.1 Identity and Registration Data

• Full legal name (as appearing on your government-issued ID)
• Date of birth (for age verification — 21+ requirement)
• Nationality and country of residence
• Username chosen at registration
• Gender (optional)

3.2 Contact Data

• Email address (primary contact and account notifications)
• Philippine mobile number (SMS verification and support)
• Residential address (required for KYC at applicable thresholds)

3.3 Identity Verification (KYC) Data

• Government-issued photo ID (passport, driver's licence, SSS/UMID card, or equivalent)
• Proof of address document (utility bill, bank statement — where required)
• Selfie or facial image (for liveness verification, where applicable)

3.4 Financial Data

• Deposit transaction records (amount, payment method, timestamp)
• Withdrawal records (amount, destination account type, timestamp)
• GCash or Maya account reference numbers (not full wallet credentials)
• Bank account details (BPI, BDO, Metrobank — for bank transfer users)
• Account balance and transaction history within the Platform

3.5 Gaming Activity Data

• Games played, bet amounts, win/loss outcomes, and session durations
• Responsible gaming tool usage (deposit limits set, self-exclusion requests)
• Promotional offer interactions and bonus redemption history

3.6 Technical and Device Data

• IP address and approximate geographic location (for regulatory compliance)
• Device type, operating system, browser type and version
• Login timestamps, session identifiers, and authentication logs
• Cookie identifiers and session data (see Section 10)

3.7 Communications Data

• Customer support chat, email, and ticket records
• Feedback submitted through the Platform
• Marketing preference settings and email/SMS opt-in/out records

phweek collects personal data through the following channels:

• Directly from you: when you complete registration, submit KYC documents, make a deposit or withdrawal, contact customer support, or update your account settings.
• Automatically through Platform use: technical data such as IP addresses, device identifiers, and session logs are collected automatically when you access the Platform.
• From third-party providers: phweek may receive identity verification results from accredited KYC service providers, fraud signals from payment processors, and geographic compliance checks from IP validation services. Such data is received only to the extent necessary for regulatory compliance and account security.
• Through cookies and similar technologies: phweek uses first-party cookies for session management and Platform functionality. See Section 10 for full cookie details.

phweek processes your personal data for the following specific, legitimate, and declared purposes:

Under the Data Privacy Act of 2012, phweek relies on the following lawful bases for processing personal data:

• Contractual necessity: Processing required to perform the phweek service you have requested — including account management, payment processing, and game delivery.
• Legal obligation: Processing required by Philippine law, including PAGCOR compliance, Anti-Money Laundering Act (AMLA) obligations, age verification requirements, and NPC reporting duties.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and aggregated analytics — where these interests are not overridden by your rights and interests.
• Consent: Processing for optional marketing communications, optional survey participation, and non-essential cookies — where you have provided specific, informed, and freely given consent. You may withdraw marketing consent at any time through your phweek account settings without affecting your account functionality.

phweek does not sell, rent, or trade your personal data to any third party for their own commercial purposes. phweek shares personal data only in the following circumstances:

7.1 Service Providers (Personal Information Processors)

phweek engages third-party service providers who process data on our behalf, bound by written data processing agreements that prohibit them from using the data for any purpose other than providing the contracted service to phweek. These include:

• Payment processors (GCash API, Maya API, bank partners) — for transaction processing;
• Identity verification providers — for KYC document validation;
• Game content providers — for game delivery and RNG audit logs;
• Customer support platform providers — for ticketing and chat functionality;
• Cloud infrastructure and security providers — for Platform hosting and DDoS protection;
• Analytics tools — limited to aggregated, anonymised usage data only.

7.2 Regulatory and Law Enforcement Disclosures

phweek will disclose personal data to PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), or other competent Philippine authorities where: (a) required by law; (b) in response to a valid legal order or court process; or (c) where phweek has reasonable grounds to believe disclosure is necessary to prevent fraud, money laundering, or a risk to the safety of any person.

7.3 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets involving phweek, personal data may be transferred as part of that transaction. phweek will notify affected players in advance of any such transfer, and data will remain subject to the protections in this Policy.

phweek retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. Key retention periods are as follows:

• Account and identity data: Retained for the duration of the active phweek account, plus five (5) years following account closure, in accordance with PAGCOR and AMLA record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required by AMLA regulations.
• KYC documents: Retained for five (5) years from account closure or from the date of the last transaction, whichever is later.
• Customer support records: Retained for three (3) years from the date of the support interaction.
• Gaming activity logs: Retained for three (3) years for platform improvement and responsible gaming analysis; anonymised and aggregated thereafter.
• Marketing consent records: Retained for the duration of the phweek account plus three (3) years, to demonstrate compliance with consent requirements.

Upon expiry of applicable retention periods, phweek will securely delete or anonymise personal data so that it can no longer be attributed to any individual. Anonymised, aggregated data may be retained indefinitely for statistical and research purposes.

phweek implements technical and organisational measures appropriate to the risk presented by the processing activities, to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and phweek's servers;
• AES-256 encryption at rest for sensitive stored data including KYC documents and financial records;
• Role-based access controls limiting phweek staff access to personal data on a strict need-to-know basis;
• Two-Factor Authentication (2FA) available to all players for account login, strongly recommended;
• Automated anomaly detection monitoring for unusual login patterns, suspicious transactions, and access from atypical locations;
• Regular security testing including penetration testing and vulnerability assessments of the phweek Platform;
• Staff training on data protection obligations and secure data handling practices.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, phweek will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with the requirements of the Data Privacy Act of 2012.

phweek uses cookies — small data files stored on your device — to operate the Platform effectively, maintain your session, and improve your experience. phweek uses the following categories of cookies:

You can manage your cookie preferences through the phweek cookie settings panel, accessible from the footer of the Platform. Most browsers also allow you to refuse or delete cookies through browser settings; however, disabling strictly necessary cookies will affect your ability to log in and use core Platform features.

Under the Data Privacy Act of 2012, as a phweek player and data subject you have the following rights with respect to your personal data:

• Right to be Informed: You have the right to know that your personal data is being collected, the purposes for which it is being used, and your rights as a data subject — as set out in this Policy.
• Right to Access: You may request a copy of the personal data phweek holds about you, along with information about how it is processed. phweek will respond to access requests within fifteen (15) business days.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data phweek holds about you. Many fields can be updated directly in your phweek account settings; others may require a support request and supporting documentation.
• Right to Erasure: You may request deletion of your personal data in circumstances where: (a) the data is no longer needed for the purpose it was collected; (b) you withdraw consent and no other legal basis applies; or (c) the data was processed unlawfully. Note that phweek may be required to retain certain data for statutory periods under PAGCOR and AMLA regulations notwithstanding an erasure request.
• Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time — free of charge — by adjusting your marketing preferences in your phweek account settings or by contacting our Data Protection Officer.
• Right to Data Portability: You may request a copy of the personal data you have provided to phweek in a structured, commonly used, machine-readable format.
• Right to Lodge a Complaint: If you believe phweek has processed your data in violation of the Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any of the above rights, please contact phweek's Data Protection Officer using the contact details in Section 14. phweek will not charge a fee for data subject rights requests unless the request is manifestly unfounded or excessive, in which case phweek reserves the right to charge a reasonable administrative fee.

If phweek becomes aware that personal data has been collected from an individual who is under 21 years of age, phweek will: (a) immediately suspend the associated account; (b) void any gaming activity or financial transactions associated with that account; and (c) securely delete the underage individual's personal data from our systems, subject to any retention obligations that may apply under applicable law.

If you are a parent or guardian and believe your child has registered an account with phweek, please contact our Data Protection Officer immediately at the contact details provided in Section 14.

phweek may update this Privacy Policy periodically to reflect changes in Philippine law, NPC guidelines, PAGCOR regulatory requirements, or phweek's data processing practices. Material changes — those that meaningfully affect your rights or the way phweek handles your personal data — will be communicated to registered players by email and/or by a prominent notice on the Platform at least fourteen (14) days before taking effect.

The effective date of the current version of this Policy is displayed at the top of this page. Continued use of the phweek Platform after the notified effective date of any updated Policy constitutes your acknowledgement of the revised terms. If you do not agree with the changes, you may close your phweek account by contacting customer support before the effective date.

Minor, non-material updates — such as typographical corrections or clearer explanations that do not change the substance of this Policy — may be made at any time without prior notice.

phweek has designated a Data Protection Officer (DPO) in accordance with Section 21 of the Data Privacy Act of 2012. The DPO is responsible for overseeing phweek's compliance with this Policy and the DPA, and serves as the primary point of contact for data subject rights requests and privacy inquiries.

When submitting a data subject rights request, please include: your full name as registered on your phweek account, your phweek username, a description of your request, and, where applicable, a copy of a valid Philippine government-issued ID to enable us to verify your identity before processing the request. phweek will not process requests where the identity of the requesting individual cannot be verified.