bullwin Privacy Policy

bullwin ("we," "us," or "our") is committed to protecting the privacy and personal data of all players and visitors who use the bullwin online gaming platform. This Privacy Policy describes our practices regarding the collection, use, storage, sharing, and protection of your personal data in connection with your use of the bullwin website and services.

This policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). It also reflects our obligations under PAGCOR's regulatory framework for licensed online gaming operators in the Philippines.

We encourage you to read this Privacy Policy carefully and in full. If you have questions about any part of this policy, you may contact our Data Protection Officer using the details provided in Section 15.

For the purposes of the Philippine Data Privacy Act of 2012, bullwin is the personal information controller in respect of the personal data collected through the bullwin platform. This means bullwin determines the purposes and means of processing your personal data.

Where bullwin engages third-party service providers to process personal data on its behalf — such as payment processors, KYC verification providers, and cloud infrastructure providers — those parties act as personal information processors and are bound by data processing agreements that require them to process your data only on bullwin's documented instructions and in accordance with applicable data protection law.

bullwin collects the following categories of personal data from players and platform visitors:

bullwin does not intentionally collect sensitive personal information beyond what is strictly necessary for identity verification and regulatory compliance. We do not collect data relating to racial or ethnic origin, political opinions, religious beliefs, or health information unless specifically required by law.

bullwin collects personal data through the following means:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated technologies: Technical and usage data collected automatically when you access the bullwin platform, including through cookies, web beacons, and server logs. See Section 7 for more details on cookies.
• Third-party sources: Identity and fraud-screening data received from KYC verification providers, payment processors, and fraud prevention services. bullwin only receives data from third parties where you have consented to that sharing or where we have a legitimate legal basis to do so.
• Regulatory sources: In certain circumstances, bullwin may receive data from PAGCOR or other regulatory authorities in connection with its licensing obligations.

bullwin processes your personal data only where we have a lawful basis to do so under the Philippine Data Privacy Act. The following table sets out the primary purposes for which we process your data and the corresponding legal basis:

bullwin does not sell, rent, or trade your personal data. We share your data only in the following limited circumstances:

• Service providers: We share data with carefully selected third-party providers who assist us in operating the bullwin platform, including payment processors (GCash, Maya, banks), KYC verification providers, cloud hosting providers, and customer support software vendors. All such providers are bound by data processing agreements.
• Regulatory authorities: We are required to share certain data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other competent Philippine government authorities where required by law or regulation.
• Law enforcement: We may disclose personal data to law enforcement agencies where required by a valid court order, subpoena, or other legal process, or where we believe disclosure is necessary to prevent fraud, money laundering, or other criminal activity.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of bullwin's business, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.
• With your consent: We may share your data with third parties where you have given us explicit consent to do so.

In all cases of data sharing, bullwin takes reasonable steps to ensure that recipient parties maintain appropriate data protection standards consistent with the Philippine Data Privacy Act.

bullwin uses cookies and similar tracking technologies to enhance your experience on the platform, analyze usage patterns, and support security functions. The following types of cookies are used:

• Strictly necessary cookies: Essential for the platform to function. These include session authentication cookies and security tokens. These cannot be disabled without affecting platform functionality.
• Functional cookies: Remember your preferences such as language settings, display options, and responsible gaming limits you have set.
• Analytics cookies: Help us understand how players use the bullwin platform so we can improve it. Data collected is aggregated and anonymized where possible.
• Security cookies: Used to detect and prevent fraudulent activity, bot access, and unauthorized login attempts.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the bullwin platform. bullwin does not use third-party advertising cookies or behavioral tracking cookies for the purpose of serving advertisements on other websites.

bullwin retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law and regulation. Our general retention periods are as follows:

• Account and identity data: Retained for the duration of your active account plus a minimum of 5 years after account closure, as required by PAGCOR regulations and the Anti-Money Laundering Act.
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction, in compliance with AMLC requirements.
• KYC documents: Retained for the duration of your account plus 5 years after closure.
• Gaming history: Retained for 3 years from the date of each gaming session, or longer if required for dispute resolution or regulatory purposes.
• Customer support records: Retained for 2 years from the date of the last interaction.
• Marketing consent records: Retained until consent is withdrawn, plus 1 year thereafter as evidence of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with bullwin's data disposal procedures.

bullwin implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption of sensitive data fields at rest within our database infrastructure.
• Multi-factor authentication (MFA) for all internal staff access to systems containing personal data.
• Role-based access controls ensuring that only authorized personnel can access personal data, and only to the extent necessary for their role.
• 24/7 automated security monitoring and intrusion detection systems.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Secure data centers with physical access controls, CCTV monitoring, and environmental protections.
• Regular staff training on data protection and information security best practices.

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by bullwin:

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 15. bullwin will respond to all verified data rights requests within 15 business days. We may need to verify your identity before processing your request. There is no fee for exercising your data rights, except in cases of manifestly unfounded or excessive requests.

If you are not satisfied with bullwin's response to a data rights request, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

The bullwin platform is strictly intended for individuals who are 21 years of age or older, as required by Philippine law and PAGCOR regulations governing online gaming. bullwin does not knowingly collect personal data from individuals under the age of 21.

If bullwin becomes aware that personal data has been collected from a person under 21 years of age, we will take immediate steps to delete that data and close the associated account. If you believe that a minor has registered on the bullwin platform, please contact us immediately at the details provided in Section 15.

bullwin may send you promotional communications about new games, bonuses, tournaments, and special offers — but only where you have given us your explicit consent to do so during registration or at a later point through your account settings.

You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email from bullwin.
• Updating your communication preferences in your bullwin account settings.
• Contacting our support team and requesting removal from marketing lists.

Please note that opting out of marketing communications does not affect transactional communications that are necessary for the operation of your account, such as deposit confirmations, withdrawal notifications, security alerts, and important policy updates.

In certain circumstances, bullwin may transfer your personal data to service providers or infrastructure partners located outside the Philippines — for example, cloud hosting providers or international fraud screening services. Where such transfers occur, bullwin ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses that require the recipient to protect your data to a standard equivalent to the Philippine Data Privacy Act.
• Transfers only to countries or organizations that the National Privacy Commission has recognized as providing an adequate level of data protection.
• Binding corporate rules where transfers occur within a corporate group.

You may request information about the specific safeguards in place for any cross-border transfer of your personal data by contacting our Data Protection Officer.

bullwin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. When material changes are made, we will notify registered players via email and/or a prominent notice on the bullwin platform prior to the changes taking effect.

The "Last Updated" date at the top of this policy indicates when the most recent revision was made. We encourage you to review this Privacy Policy periodically to stay informed about how bullwin protects your personal data. Your continued use of the bullwin platform after the effective date of any amendment constitutes your acknowledgment of the updated policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by bullwin, please contact our Data Protection Officer:

• Data Protection Officer Email: [email protected]
• General Support Email: [email protected]
• Live Chat: Available 24/7 via the bullwin platform
• Response Time: Data rights requests are responded to within 15 business days

If you are not satisfied with our response, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. Information about how to file a complaint with the NPC is available through official Philippine government channels.