windreama – Privacy Policy

1. Introduction

windreama ("windreama," "we," "us," "our") operates the online casino, sportsbook, and gaming platform accessible at windreama.net and its associated mobile-optimized interfaces (the "Platform"). As the data controller, windreama is responsible for the collection, use, storage, and protection of personal information relating to players and visitors who access the Platform.

This Privacy Policy applies to all personal data processed by windreama in connection with the Platform and is addressed to current and prospective players located in the Philippines. By registering a windreama Account, you acknowledge that you have read this Privacy Policy and consent to the collection and use of your personal information as described herein.

This Privacy Policy should be read alongside the windreama Terms and Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

2. Definitions

For the purposes of this Privacy Policy:

• "Personal Data" means any information that directly or indirectly identifies a living individual, including name, mobile number, email address, government ID details, financial account information, device identifiers, and IP addresses.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, combination, restriction, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this case, windreama.
• "Data Processor" means a third party that processes personal data on behalf of windreama under a written agreement.
• "KYC" means Know Your Customer — the identity and age verification process required before windreama processes withdrawal requests.
• "NPC" means the National Privacy Commission of the Philippines, the competent supervisory authority for data protection matters in the Philippines.
• "DPA" means Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines, and its implementing rules and regulations.
• "Sensitive Personal Information" has the meaning assigned by the DPA and includes government-issued ID numbers, financial information, and health data.

3. Personal Data We Collect

3.1 Registration and Account Data

When you register a windreama Account, we collect:

• Full legal name (as it appears on your government-issued ID);
• Date of birth (to verify the 21+ age requirement);
• Philippine mobile number (09XX format);
• Email address;
• Province and city of residence;
• Username and encrypted password.

3.2 Identity Verification (KYC) Data

To comply with PAGCOR requirements and anti-money laundering obligations, windreama collects:

• Government-issued ID type and number (PhilSys National ID, UMID, Driver's License, Passport, SSS ID, or GSIS ID);
• ID document image (front and back where applicable);
• Selfie photograph for liveness verification where requested;
• Proof of residential address documents where required.

3.3 Financial and Transaction Data

For deposit and withdrawal processing, windreama collects:

• GCash mobile number, Maya account reference, bank account details (account name and number for BPI, BDO, UnionBank), or other payment method identifiers;
• Transaction amounts, dates, times, and reference numbers;
• Deposit and withdrawal history;
• Cryptocurrency wallet addresses where applicable (USDT TRC20, Coins.ph).

3.4 Gaming and Activity Data

windreama automatically records:

• Game history including game type, wager amounts, outcomes, and timestamps;
• Session start and end times;
• Bonus activation and wagering progress;
• Sports betting selections, stakes, and results;
• Responsible gaming tool settings and changes.

3.5 Technical and Device Data

windreama collects the following technical data automatically when you access the Platform:

• IP address and approximate geographic location derived therefrom;
• Device type, operating system, and browser or app version;
• Device identifier and advertising identifier where applicable;
• Pages viewed, features accessed, and navigation paths within the Platform;
• Session duration and interaction timestamps.

3.6 Communications Data

windreama retains records of:

• Live chat transcripts and email correspondence with customer support;
• Complaint submissions and their resolution records;
• Responses to surveys or feedback requests (where voluntarily provided).

4. How We Collect Personal Data

windreama collects personal data through the following means:

• Direct collection: Information you voluntarily provide during registration, KYC submission, payment processing, customer support interactions, and responsible gaming tool configuration;
• Automated collection: Technical and device data collected automatically through cookies, log files, and similar tracking technologies when you access the Platform;
• Third-party providers: Identity verification data from KYC service providers; payment confirmation data from GCash, Maya, BPI, BDO, UnionBank, and other payment processors; fraud screening data from risk management service providers;
• Publicly available sources: Where permitted by law, publicly available information used to supplement identity verification or detect fraudulent activity.

5. Purposes of Processing

6. Legal Basis for Processing

windreama processes your personal data on the following legal bases under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations:

• Contract performance: Processing necessary to create and manage your windreama Account, deliver gaming services, and process deposits and withdrawals;
• Legal obligation: Processing required to comply with PAGCOR regulatory requirements, anti-money laundering obligations under the AMLA (Republic Act No. 9160, as amended), KYC obligations, and other applicable Philippine law;
• Legitimate interest: Processing necessary for fraud prevention, platform security, service improvement, and responsible gaming monitoring, where such interests are not overridden by your fundamental rights;
• Consent: Processing for optional purposes such as marketing communications and optional analytics, where you have given explicit opt-in consent. You may withdraw consent for consent-based processing at any time through your Account settings or by contacting windreama support, without affecting the lawfulness of processing prior to withdrawal.

7. Sharing of Personal Data

windreama does not sell your personal data. We share your personal data with third parties only in the following circumstances and categories:

7.1 Payment Service Providers

windreama shares transaction data and payment method identifiers with payment processors including GCash (G-Xchange, Inc.), Maya (Voyager Innovations, Inc.), and partner banking institutions (BPI, BDO, UnionBank) to process deposits and withdrawals. These providers operate under their own privacy policies and regulatory frameworks. windreama shares only the minimum data necessary to complete each transaction.

7.2 KYC and Identity Verification Providers

windreama engages third-party KYC service providers to assist with document verification and liveness checks. These providers process your identity documents as Data Processors under written agreements that restrict their use of your data to the specific verification purpose.

7.3 Game Technology Providers

Live casino studio operators and RNG game providers receive account session tokens and wager data necessary to deliver game content and settle bets. These providers do not receive your full personal profile or payment details.

7.4 Regulatory Authorities

windreama discloses personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), law enforcement agencies, and other competent Philippine authorities where required by law, court order, or regulatory instruction. windreama will notify affected players of such disclosures where permitted by law.

7.5 Professional Advisers

windreama may share personal data with legal counsel, auditors, and compliance consultants where necessary for the provision of professional services, subject to professional confidentiality obligations.

7.6 Business Transfers

In the event of a merger, acquisition, asset sale, or corporate restructuring involving windreama, personal data may be transferred to the acquiring entity as part of that transaction. windreama will provide notice of such a transfer and ensure that the receiving entity is bound by data protection obligations consistent with this Privacy Policy.

8. International Data Transfers

windreama is a Philippines-focused platform. Where personal data is transferred to or processed by service providers located outside the Philippines — including cloud infrastructure providers or international game studio operators — windreama ensures that adequate safeguards are in place in accordance with the DPA and NPC guidelines on cross-border data flows.

Such safeguards may include: contractual data transfer agreements incorporating standard data protection clauses; transfers to countries with an adequate level of data protection as recognized by the NPC; or transfers covered by the explicit consent of the data subject where other safeguards are unavailable. Players may request information about specific international transfer safeguards by contacting windreama's Data Protection Officer.

9. Data Retention

windreama retains personal data for as long as necessary to fulfil the purposes described in this Privacy Policy and to comply with applicable legal and regulatory obligations. The following general retention periods apply:

• Account and KYC records: Retained for a minimum of 5 years after Account closure, in compliance with PAGCOR regulatory requirements and AMLA obligations;
• Transaction records: Retained for a minimum of 5 years from the date of each transaction;
• Gaming records: Retained for a minimum of 3 years from the date of each game session;
• Customer support communications: Retained for 3 years from the date of last correspondence;
• Technical and device logs: Retained for up to 12 months for security and fraud prevention purposes, then anonymized or deleted;
• Marketing consent records: Retained for the duration of your opt-in and for 3 years thereafter as evidence of consent.

Upon expiry of applicable retention periods, windreama will securely delete or anonymize personal data in accordance with its data disposal procedures. Anonymized data may be retained indefinitely for statistical and analytical purposes.

10. Cookies and Tracking Technologies

windreama uses cookies and similar tracking technologies to operate the Platform, maintain user sessions, detect fraud, and analyze Platform performance. The following categories of cookies are deployed:

• Essential cookies: Required for Platform functionality including session management, login authentication, and security. These cookies cannot be disabled without affecting core Platform functionality;
• Functional cookies: Remember your preferences such as language settings, responsible gaming limits, and display preferences;
• Analytical cookies: Collect aggregated data about Platform usage patterns to help windreama improve performance and user experience. Data collected is anonymized prior to analysis;
• Security cookies: Detect and prevent fraudulent activity, including multiple account registrations and unauthorized login attempts.

windreama does not deploy third-party advertising or cross-site tracking cookies. You may configure your browser to block or delete cookies; however, disabling essential cookies will impair your ability to use the Platform. windreama's cookie banner provides granular consent controls for non-essential cookies on first visit and at any subsequent time through your browser settings.

11. Security Measures

windreama's security measures include, without limitation:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the windreama Platform;
• Encryption at rest for sensitive personal data including passwords and government ID details;
• Role-based access controls limiting internal staff access to personal data to those with a documented business need;
• Two-factor authentication for administrative access to production systems;
• Regular penetration testing and vulnerability assessments by independent security professionals;
• Automated anomaly detection and login monitoring to identify unauthorized access attempts;
• Physical and logical security controls for data processing infrastructure;
• Staff training on data protection obligations and information security procedures;
• Incident response procedures including mandatory breach notification protocols in accordance with DPA requirements.

In the event of a personal data breach that poses a risk to your rights and freedoms, windreama will notify the NPC within 72 hours of becoming aware of the breach, and will notify affected players within a reasonable period in accordance with NPC guidelines.

12. Your Data Privacy Rights

Under the Data Privacy Act of 2012 and applicable NPC regulations, Philippine residents have the following rights with respect to their personal data held by windreama:

• Right to be informed: The right to be informed of the existence, nature, and purpose of the processing of your personal data — fulfilled through this Privacy Policy and our communications with you;
• Right of access: The right to obtain a copy of the personal data windreama holds about you, together with information about how it is used;
• Right to rectification: The right to correct inaccurate or incomplete personal data held about you;
• Right to erasure / blocking: The right to request deletion or blocking of personal data where processing is no longer necessary, where consent has been withdrawn, or where processing violates the DPA — subject to windreama's legal retention obligations;
• Right to object: The right to object to processing based on legitimate interest, including processing for direct marketing purposes;
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format where technically feasible;
• Right to damages: The right to claim compensation for damages suffered as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data by windreama;
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe windreama has violated your data privacy rights.

To exercise any of these rights, submit a written request to windreama's Data Protection Officer at the contact details provided in Section 16. windreama will respond to verified requests within 15 business days. We may require identity verification before processing access or erasure requests to prevent unauthorized disclosure or deletion.

13. Children's Privacy

Parents and guardians who believe their child may have accessed the windreama Platform or provided personal data to windreama should contact our Data Protection Officer immediately using the contact details in Section 16. windreama takes underage access seriously and cooperates fully with concerned parents and guardians in addressing any such incidents.

14. Responsible Gaming and Personal Data

windreama's responsible gaming commitment includes the processing of personal data in ways that directly support player welfare. The following data processing activities are conducted specifically to promote responsible gaming:

• Behavioural monitoring: windreama analyzes gaming activity data to identify patterns that may indicate problem gambling behaviour — including escalating session lengths, increased deposit frequency, and loss-chasing patterns. This monitoring is conducted in windreama's legitimate interest and the direct interest of player welfare;
• Deposit limit enforcement: windreama stores and enforces the deposit limits, loss limits, and session time limits set by players in their responsible gaming settings;
• Self-exclusion records: windreama maintains records of self-exclusion elections to prevent re-registration during the exclusion period. These records may be shared with industry exclusion registers where applicable;
• Cooling-off period enforcement: Temporary account suspension data is retained and applied to prevent access during the elected cooling-off period.

Personal data processed for responsible gaming purposes is retained for the duration specified in Section 9 and is not used for marketing or commercial purposes. Access to responsible gaming monitoring data is restricted to windreama's dedicated player protection team.

15. Updates to This Privacy Policy

windreama reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, Platform features, applicable law, or regulatory requirements. The revised Privacy Policy will be published on the windreama Platform with an updated effective date. Where changes are material — affecting your rights or windreama's key processing activities — windreama will notify registered players via email or Platform notification prior to the changes taking effect.

Continued use of the windreama Platform after the effective date of any revised Privacy Policy constitutes acceptance of the revised policy. If you do not accept the revised terms, you must cease use of the Platform and may request voluntary Account closure.

16. Contact and Data Protection Officer

windreama has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with data protection obligations and handling data subject rights requests. Players may contact windreama's DPO through the following channels:

windreama maintains a Data Processing Agreement Register and records of processing activities as required by the DPA and applicable NPC regulations. These records are available to the NPC upon request and to data subjects upon verified request for relevant entries pertaining to their own personal data.