w500 Privacy Policy

1. Who We Are / Data Controller

This Privacy Policy is issued by w500, the operator of the online gaming platform accessible at w500.asia (the "Platform"). w500 acts as the Personal Information Controller with respect to the personal data of Players and visitors as defined under Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), and its Implementing Rules and Regulations.

w500 operates under a licence issued by the Philippine Amusement and Gaming Corporation (PAGCOR) and is subject to the regulatory requirements of PAGCOR in addition to the DPA. Where PAGCOR regulations impose obligations regarding data collection or retention that are more stringent than the general requirements of the DPA, w500 complies with the more stringent standard.

For all data privacy enquiries, please contact our Data Protection Officer at the details provided in Section 14 of this Policy.

2. Personal Data We Collect

w500 collects the following categories of personal data from Players and, where applicable, from visitors to the Platform:

• Identity Data: Full legal name, date of birth, nationality, and government-issued identification details (e.g., passport number, driver's licence number, UMID, SSS ID, or PhilSys National ID number).
• Contact Data: Email address, Philippine mobile number, and residential address.
• Financial Data: Payment method details (GCash account number, PayMaya account, bank account details for BPI, BDO, Metrobank, UnionBank, or other accepted methods), transaction history, deposit and withdrawal records.
• KYC Documentation: Photographs and scanned copies of government-issued identification documents and selfie images submitted for identity and age verification purposes.
• Account Data: Username, Account creation date, login history, session data, preferences, bonus and promotion history, and responsible gaming settings.
• Gaming Data: Game participation history, wagering records, game outcomes, and session duration records. This data is maintained for regulatory compliance with PAGCOR.
• Technical Data: IP address, device type, operating system, browser type and version, time zone, and platform access logs.
• Communications Data: Records of your correspondence with w500 support, including live chat transcripts and email communications.

w500 does not collect any Special Categories of Personal Data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) except where voluntarily disclosed by a Player in connection with a responsible gaming request (e.g., self-exclusion on medical grounds), in which case such data is handled with the highest level of care and processed solely for the purpose for which it was disclosed.

3. How We Collect Your Data

w500 collects personal data through the following means:

• Direct interactions: Data you provide when registering an Account, completing KYC, making a deposit or withdrawal, contacting support, or setting responsible gaming preferences.
• Automated technologies: Technical data collected automatically when you visit or use the Platform, including cookies, server logs, and similar tracking technologies (see Section 7).
• Third parties: Identity verification and KYC data from PAGCOR-accredited verification service providers; fraud prevention data from anti-fraud and AML service providers; payment data from payment processors (GCash, PayMaya, BancNet, etc.).

4. Legal Basis for Processing

w500 processes your personal data on one or more of the following legal bases as recognised under the DPA:

• Performance of a contract: Processing necessary to provide you with the gaming services you have requested, including Account management, payment processing, and customer support.
• Compliance with a legal obligation: Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160, as amended), the DPA, and other applicable Philippine laws and regulations.
• Legitimate interests: Processing necessary for w500's legitimate business interests, including fraud prevention, platform security, abuse detection, and improving the quality of our services — provided such interests are not overridden by your fundamental rights.
• Consent: Where w500 relies on your consent as the legal basis for a particular processing activity (e.g., sending promotional communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5. How We Use Your Personal Data

w500 uses the personal data we collect for the following purposes:

• To create, verify, and manage your w500 Account.
• To verify your identity and age (21+) as required by PAGCOR and the DPA.
• To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and other accepted payment methods.
• To operate and provide access to casino games, including RNG-based games and live dealer tables.
• To administer bonuses, promotions, and loyalty programmes in accordance with applicable terms.
• To comply with our anti-money laundering obligations under RA 9160 and PAGCOR reporting requirements.
• To detect, investigate, and prevent fraud, cheating, abuse, and other prohibited activities.
• To enforce our Terms and Conditions and responsible gaming policies, including processing self-exclusion requests.
• To respond to your queries, complaints, and support requests.
• To send service-related communications (e.g., Account alerts, transaction confirmations, security notifications). These communications are not optional as they are necessary to deliver the service.
• To send promotional and marketing communications, where you have consented to receive them. You may opt out at any time.
• To improve the Platform, including through analysis of usage data and player feedback.
• To maintain records required by PAGCOR and Philippine law.

6. Disclosure of Your Personal Data

w500 may disclose your personal data to the following categories of recipients, strictly on a need-to-know basis:

• PAGCOR: As required by our gaming licence, including player registration data, gaming records, and financial transaction data.
• Payment processors: GCash (G-Xchange Inc.), PayMaya (Maya Bank), BancNet, and other Philippine payment service providers — solely to the extent necessary to process your transactions.
• KYC and identity verification providers: PAGCOR-accredited third-party verification services used to confirm your identity and age.
• Anti-money laundering and fraud prevention services: Third-party providers that help w500 detect and prevent financial crime, in compliance with RA 9160.
• IT infrastructure and security providers: Cloud hosting, security monitoring, and platform maintenance providers who process data on w500's behalf under data processing agreements.
• Legal and regulatory authorities: Philippine law enforcement agencies, courts, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other government bodies where disclosure is required by law or court order.
• Professional advisers: Lawyers, auditors, and accountants under obligations of confidentiality.

w500 does not sell, rent, or license your personal data to third-party marketing or advertising companies.

7. Cookies and Tracking Technologies

w500 uses cookies and similar tracking technologies on the Platform to ensure functionality, analyse usage, and improve the player experience. The types of cookies we use include:

• Strictly necessary cookies: Essential to the operation of the Platform. These cannot be disabled without affecting core functionality, including maintaining your login session and securing transactions.
• Performance/analytics cookies: Used to understand how Players interact with the Platform — which pages are visited most frequently, session durations, and error occurrences. This data is aggregated and anonymised where possible.
• Functional cookies: Used to remember your preferences, such as preferred language or display settings.

You may control cookie settings through your browser preferences. Disabling strictly necessary cookies will affect the functionality of the Platform. w500 does not use cookies for the purpose of serving third-party behavioural advertising.

8. Data Retention

w500 retains your personal data for the following periods, unless a longer retention period is required by applicable law:

• Account and KYC data: For the duration of your Account plus five (5) years following Account closure, in accordance with PAGCOR record-keeping requirements and the Anti-Money Laundering Act.
• Financial transaction records: Five (5) years from the date of each transaction, as required by RA 9160.
• Gaming records: Five (5) years from the date of each gaming session, as required by PAGCOR.
• Support communications: Two (2) years from the date of resolution, unless the matter is subject to ongoing legal proceedings.
• Marketing consent records: For as long as your consent is active, plus a reasonable period thereafter to demonstrate compliance.

At the end of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

9. Data Security

w500 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• TLS/SSL encryption (256-bit) for all data transmitted between your device and the w500 Platform.
• Encryption of sensitive data at rest, including identity documents and financial data.
• Access controls restricting personal data access to authorised w500 staff on a strictly need-to-know basis.
• Regular security assessments, penetration testing, and vulnerability scanning of the Platform.
• Two-factor authentication (SMS OTP) for Player Account access.
• Automated monitoring systems for detection of suspicious access patterns and potential security incidents.

While w500 takes data security seriously, no method of electronic transmission or storage is 100% secure. You are also responsible for maintaining the confidentiality of your Account credentials. If you suspect your Account has been compromised, contact support at [email protected] immediately.

10. Cross-Border Data Transfers

Where personal data is transferred outside the Philippines — for example, to cloud infrastructure providers or KYC service providers with operations in other countries — w500 ensures that such transfers are conducted in accordance with the DPA and NPC regulations. This includes implementing contractual safeguards (such as standard contractual clauses) or confirming that the recipient country offers an adequate level of data protection as recognised by the NPC.

11. Your Rights Under RA 10173

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights with respect to your personal data held by w500:

• Right to be Informed: The right to know whether w500 is processing your personal data, the purposes for which it is processed, and to whom it may be disclosed.
• Right of Access: The right to request a copy of the personal data w500 holds about you.
• Right to Rectification: The right to request correction of any inaccurate or incomplete personal data.
• Right to Erasure / Right to be Forgotten: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to w500's legal retention obligations.
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes, or where processing is based on w500's legitimate interests.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

To exercise any of these rights, please contact our Data Protection Officer as described in Section 14. w500 will respond to verified requests within 30 calendar days. We may need to verify your identity before processing your request.

12. Children and Minors

The w500 Platform is strictly intended for adults aged 21 years and older, in accordance with PAGCOR regulations. w500 does not knowingly collect or process personal data from individuals under the age of 21. If we become aware that personal data has been collected from a minor, we will take immediate steps to delete such data and close the associated Account. If you believe a minor has registered on w500, please notify us immediately at [email protected].

13. Changes to This Privacy Policy

w500 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Material changes will be communicated to registered Players via email and/or a notice displayed prominently on the Platform at least seven (7) days before the changes take effect. The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision.

Your continued use of the w500 Platform after the effective date of any updated Privacy Policy constitutes your acknowledgment and acceptance of the revised terms. If you do not agree with any changes, you should cease using the Platform and may request Account closure.

14. How to Contact Us / Data Protection Officer

For all data privacy matters — including exercising your rights under RA 10173, raising a concern about our data practices, or reporting a suspected breach of your personal data — please contact the w500 Data Protection Officer:

• Email: [email protected]
• Subject line: "Data Privacy Request – [Your Name]"
• Live Support: Available 24/7 via the w500 Platform (accessible after login)

If you are not satisfied with w500's response to your data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC) through NPC's official channels.