lawinplay Privacy Policy

lawinplay is the data controller for personal information collected through the lawinplay platform at lawinplay.biz and all associated interfaces. As data controller, lawinplay determines the purposes and means by which your personal data is processed.

By registering an Account, depositing funds, or otherwise using the lawinplay Platform, you acknowledge that your personal data will be processed in accordance with this Privacy Policy. If you have questions about how your data is handled, please contact the lawinplay Data Protection Officer (DPO) using the details in Section 14.

lawinplay collects the following categories of personal data, depending on how you interact with the Platform:

lawinplay does not knowingly collect sensitive personal information — such as health data, religious beliefs, or political affiliations — unless specifically required by applicable law or regulatory obligation.

lawinplay collects personal data through the following means:

• Direct collection: Information you provide during Account registration, KYC submission, deposit or withdrawal requests, and communications with support.
• Automated collection: Technical and device data collected automatically when you access the lawinplay Platform, including cookies, session data, IP address logging, and analytics data.
• Third-party payment processors: Transaction confirmation data received from payment providers including GCash, Maya, BPI, BDO, and Metrobank when you initiate deposit or withdrawal transactions.
• Identity verification providers: Data received from third-party KYC and identity verification services used to validate government-issued Philippine IDs during the verification process.
• Fraud prevention services: Risk-scoring and fraud detection signals from third-party services used to protect the Platform and its users from unauthorised activity.

lawinplay processes your personal data for the following purposes:

1. Account management: Creating, maintaining, and administering your lawinplay Account, including authentication, security verification, and Account settings management.
2. Service delivery: Enabling access to games, processing wagers, managing balances, and delivering the core gaming and entertainment services of the Platform.
3. Payment processing: Processing deposits and withdrawals via your selected payment methods, including reconciliation and the prevention of payment fraud.
4. Identity verification (KYC): Verifying your identity and age in compliance with anti-money laundering obligations and the 21+ age requirement under Philippine gaming regulations.
5. Regulatory compliance: Meeting lawinplay's obligations under Philippine law, including the Data Privacy Act of 2012, Anti-Money Laundering Act, and applicable gaming regulations.
6. Customer support: Responding to your inquiries, resolving complaints, and maintaining records of support interactions.
7. Fraud prevention and security: Monitoring for suspicious activity, preventing unauthorized Account access, and protecting the integrity of the Platform.
8. Responsible gaming: Monitoring gaming patterns to identify potentially problematic behaviour and applying appropriate responsible gaming interventions where necessary.
9. Marketing communications: Sending promotional offers and Platform updates where you have provided consent. You may opt out at any time via your Account settings.
10. Platform improvement: Analysing aggregated usage data to improve Platform functionality, game offerings, and the overall user experience.

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, lawinplay processes personal data on the following legal bases:

• Contract performance: Processing necessary to execute the user agreement between you and lawinplay, including Account management, game delivery, and payment processing.
• Legal obligation: Processing required to comply with Philippine law, including KYC requirements, anti-money laundering obligations, and regulatory reporting.
• Legitimate interests: Processing necessary for lawinplay's legitimate business interests, including fraud prevention, Platform security, and responsible gaming monitoring, where such interests are not overridden by your rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have given freely given, specific, informed consent. You may withdraw consent at any time.

lawinplay does not sell your personal data. We may share your data with the following categories of third parties only to the extent necessary for the stated purpose:

• Payment processors: GCash, Maya, BPI, BDO, Metrobank, and other payment service providers, for the purpose of processing your transactions.
• KYC and identity verification providers: Third-party services used to validate your identity and age documents during the verification process.
• Game content providers: Software providers such as Evolution Gaming, Pragmatic Play, PG Soft, and JILI Games receive anonymised gaming session data as required to deliver their games through the lawinplay Platform.
• Fraud prevention and security providers: Third-party risk management services that assist lawinplay in detecting and preventing fraudulent or unauthorised activity.
• Regulatory and law enforcement authorities: lawinplay will disclose personal data to competent Philippine government authorities, including the National Privacy Commission, when required to do so by law or valid legal process.
• Professional advisers: Lawyers, accountants, and auditors bound by confidentiality obligations, where disclosure is necessary for legitimate business or legal purposes.

All third-party data processors engaged by lawinplay are contractually required to implement appropriate technical and organisational security measures and to process personal data only in accordance with lawinplay's documented instructions.

lawinplay retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised. Anonymised data that can no longer identify you may be retained for analytical purposes without time limit.

The lawinplay Platform uses cookies and similar tracking technologies to operate certain Platform functions and to improve your experience. Cookies are small text files stored on your device when you visit the Platform.

lawinplay uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function correctly — including session management, login authentication, and security. These cannot be disabled.
• Functional cookies: Used to remember your preferences, such as language settings and game lobby configuration. These enhance your experience but are not essential to Platform operation.
• Analytics cookies: Used to collect anonymised data about how visitors use the Platform — including page visits, session duration, and navigation paths. This data is used to improve Platform performance.
• Marketing cookies: Used, with your consent, to show you relevant promotional content based on your activity on the Platform. You may opt out of marketing cookies at any time via your browser settings.

You can manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the lawinplay Platform.

Under the Philippine Data Privacy Act of 2012 and lawinplay's Privacy Policy, you have the following rights with respect to your personal data:

• Right to be Informed: You have the right to be informed of how your personal data is being collected, used, and processed — as documented in this Privacy Policy.
• Right to Access: You may request a copy of the personal data lawinplay holds about you. Requests will be fulfilled within 30 days, subject to identity verification.
• Right to Correction: You have the right to request correction of inaccurate or outdated personal data. Many fields can be updated directly from your Account settings.
• Right to Erasure: You may request deletion of your personal data where lawinplay no longer has a lawful basis for processing it, subject to legal retention obligations.
• Right to Object: You may object to the processing of your data for marketing purposes or where processing is based on legitimate interests.
• Right to Data Portability: You may request a structured, machine-readable copy of personal data you have provided to lawinplay.
• Right to Complain: If you believe lawinplay has mishandled your personal data, you have the right to lodge a complaint with the Philippine National Privacy Commission (NPC).

To exercise any of the above rights, contact the lawinplay Data Protection Officer at the email address provided in Section 14. lawinplay will respond within 30 days. Complex requests may require an extension, of which you will be notified.

lawinplay implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• SSL/TLS encryption for all data in transit between your device and the lawinplay servers.
• Encryption at rest for sensitive stored data including financial records and identity documents.
• Hashing of all user passwords using industry-standard one-way cryptographic algorithms. lawinplay staff cannot view or recover your password.
• Access controls limiting internal access to personal data on a strict need-to-know basis.
• Regular security assessments and penetration testing of Platform infrastructure.
• Multi-factor authentication and OTP verification for sensitive Account actions, including login from new devices and withdrawal requests.
• Incident response procedures providing for prompt containment, investigation, and notification in the event of a confirmed data breach.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, lawinplay will notify you and the National Privacy Commission within 72 hours of becoming aware of the breach, as required by the Data Privacy Act of 2012.

The lawinplay Platform is strictly intended for individuals aged 21 and above. lawinplay does not knowingly collect personal data from persons under the age of 21.

If lawinplay becomes aware that an Account has been registered by or personal data collected from a person under 21 years of age, the Account will be immediately suspended, all associated data will be deleted, and any funds deposited will be returned to the originating payment source after deducting applicable processing costs.

If you have reason to believe that a minor has registered an Account on the lawinplay Platform, please contact support immediately so that we may take appropriate action.

In the course of providing the lawinplay Platform, some personal data may be transferred to or processed by service providers located outside the Philippines — for example, international game content providers and cloud infrastructure operators.

Where such transfers occur, lawinplay ensures that appropriate safeguards are in place as required by the Data Privacy Act of 2012, including contractual obligations on the recipient to apply data protection standards equivalent to those applicable in the Philippines.

lawinplay will not transfer your personal data to any jurisdiction that the National Privacy Commission has identified as providing inadequate levels of data protection without implementing appropriate additional safeguards.

lawinplay may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or Platform functionality. The current version, including the effective date, is always available on this page.

When material changes are made to this Policy, lawinplay will notify registered users via the Platform notification system or by direct communication to your registered email address or mobile number, providing reasonable advance notice before the updated Policy takes effect.

Your continued use of the lawinplay Platform following notification of Policy updates constitutes acceptance of the revised Privacy Policy. If you do not agree with any update, you may request Account closure in accordance with the Terms & Conditions.

If you have questions about this Privacy Policy, wish to exercise any of your data rights, or want to report a privacy concern, please contact the lawinplay Data Protection Officer:

• Email: [email protected] (subject line: "Privacy / DPO Request")
• Response time: Within 5 business days for general inquiries; within 30 days for formal data subject requests
• Live Chat: Available 24/7 through the lawinplay Platform for urgent matters

If you are not satisfied with lawinplay's response to your privacy concern, you have the right to lodge a complaint with the Philippine National Privacy Commission:

• National Privacy Commission (NPC) — 5th Floor, Delegation Building, PICC Complex, Pasay City, Metro Manila, Philippines