This Privacy Policy describes how bullwin collects, uses, stores, shares, and protects your personal information in connection with your use of the bullwin Platform. It is prepared in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations, as enforced by the National Privacy Commission ("NPC") of the Philippines. By registering an account on bullwin, you consent to the processing of your personal data as described in this Policy.
Summary: bullwin collects only the personal data necessary to operate a PAGCOR-licensed gaming platform, verify player identity as required by law, process payments, and provide customer support. We do not sell your personal data to third parties for marketing purposes. Your data is held securely in the Philippines and processed in accordance with the Data Privacy Act of 2012. You have the right to access, correct, and delete your personal data, subject to legal retention obligations.
The data controller responsible for your personal information is bullwin, a PAGCOR-licensed online gaming platform operating in the Republic of the Philippines and accessible at bullwin.co. As data controller, bullwin determines the purposes and means by which your personal data is processed in connection with your use of the Platform. bullwin has appointed a Data Protection Officer ("DPO") as required under the Data Privacy Act of 2012 and has registered its data processing systems with the National Privacy Commission.
All references to "bullwin," "we," "us," or "our" in this Policy refer to the bullwin data controller entity. References to "you," "your," or "Player" refer to any individual whose personal data is processed in connection with their use of or inquiry about the bullwin Platform.
bullwin collects personal data through multiple channels, including account registration, KYC verification, payment processing, customer support interactions, and automated technical collection during Platform use. The categories of personal data we collect are set out below.
When you create a bullwin Account, we collect:
To comply with PAGCOR regulations and Philippine anti-money laundering (AML) requirements, bullwin collects and processes identity verification documents, which constitute sensitive personal information under the DPA. This includes:
We automatically collect the following when you access the bullwin Platform:
| Data Type | Purpose |
|---|---|
| IP address | Geolocation verification, fraud detection, security logging |
| Device fingerprint | Multi-account detection, session security |
| Browser type and version | Platform compatibility and performance optimization |
| Operating system | Technical support and performance diagnostics |
| Session timestamps and duration | Responsible gaming monitoring, security audit |
| Pages visited and features accessed | Platform improvement, personalization |
| Referral source | Marketing attribution |
When you contact bullwin through live chat, email, or any other support channel, we collect and retain records of those communications, including their content, timestamps, and any attachments or documentation provided. This data is used for quality assurance, dispute resolution, and regulatory compliance purposes.
Under the Data Privacy Act of 2012, bullwin processes your personal data on the following legal bases:
Sensitive Personal Information: KYC identity documents constitute sensitive personal information under Section 3(l) of the DPA. bullwin processes this data under the explicit consent you provide during KYC submission and under the legal obligation to comply with PAGCOR identity verification requirements. This data is subject to additional security controls described in Section 7.
bullwin uses the personal data we collect for the following specific purposes:
bullwin does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. Your data is shared only as described in this Section.
bullwin shares personal data with third-party service providers who process data on our behalf under written data processing agreements that comply with the DPA. These providers include:
bullwin discloses personal data to regulatory authorities and law enforcement agencies where required by Philippine law or PAGCOR regulatory obligations, including:
bullwin retains personal data for the periods necessary to fulfill the purposes described in this Policy, subject to the following minimum retention requirements:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of Account + 5 years after closure | PAGCOR regulatory requirement |
| KYC identity documents | 5 years after Account closure | AMLA / PAGCOR compliance |
| Financial transaction records | 10 years from transaction date | AMLA Section 9 requirement |
| Betting history | 5 years from transaction date | PAGCOR audit requirements |
| Customer support records | 3 years from interaction date | Legitimate interest / dispute resolution |
| Technical and usage logs | 12 months from collection | Security and fraud prevention |
| Marketing consent records | Until consent is withdrawn + 1 year | DPA consent management |
Upon expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymized in accordance with NPC-approved data disposal procedures.
bullwin implements technical and organizational security measures appropriate to the sensitivity of the personal data we process, including:
🔒 Despite these measures, no digital platform can guarantee absolute security. You are responsible for maintaining the security of your own Account credentials. If you believe your bullwin Account has been compromised, contact support at [email protected] immediately and change your password.
The bullwin Platform uses cookies and similar tracking technologies to support platform functionality, security, and analytics. The categories of cookies we use are:
You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair or prevent Platform access. bullwin does not use cookies to serve advertising on third-party websites or share cookie data with advertising networks.
Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by bullwin. To exercise any of these rights, contact our Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request."
You have the right to request a copy of the personal data bullwin holds about you, including the categories of data held, the purposes for which it is processed, and the recipients with whom it has been shared. bullwin will respond within 15 business days.
You may request correction of inaccurate or incomplete personal data in your bullwin Account. Some corrections may require re-verification through the KYC process to ensure continued regulatory compliance.
You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. Note that mandatory retention periods under PAGCOR and AMLA regulations may prevent immediate deletion of certain data categories.
You may object to processing of your personal data based on legitimate interests, including processing for direct marketing purposes. An objection to marketing will be actioned immediately. Objections to other processing bases will be evaluated and actioned within 15 business days.
You may request a copy of the personal data you provided to bullwin in a structured, commonly used, machine-readable format (JSON or CSV), where technically feasible and where the processing was based on your consent or a contract with you.
If you believe bullwin has handled your personal data in a manner inconsistent with the Data Privacy Act of 2012, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. bullwin cooperates fully with NPC investigations.
The bullwin Platform is strictly intended for individuals aged 21 years and above, in accordance with PAGCOR regulations. bullwin does not knowingly collect personal data from individuals under 21 years of age. Age verification is a mandatory step in the bullwin KYC process, and Accounts where the 21-year minimum cannot be verified are closed and associated data deleted.
If you believe a person under 21 has registered an Account on bullwin, please notify us immediately at [email protected]. We will investigate and take appropriate action, including Account closure and data deletion, within 72 hours of notification.
bullwin may update this Privacy Policy from time to time to reflect changes in our data processing practices, Philippine law, PAGCOR requirements, or National Privacy Commission guidance. Material changes will be communicated to registered Players by email to the address on file, no less than 14 days before the changes take effect.
The current version of this Policy is always accessible at bullwin.co/privacy-policy and is dated at the top of this document. Continued use of the bullwin Platform following the effective date of an update constitutes your acknowledgment of the revised Policy. If you do not agree to a material change, you may close your Account and withdraw your balance before the effective date.
bullwin has appointed a Data Protection Officer as required under Section 21 of the Data Privacy Act of 2012 and NPC Circular No. 16-03. All data subject rights requests, privacy complaints, and DPA-related inquiries should be directed to the DPO through the following channels:
Data Protection Officer — bullwin
Email: [email protected] (subject line: "DPO / Data Privacy Request")
Response Time: Within 15 business days for formal data subject rights requests; within 4 hours for general privacy inquiries via live chat
NPC Complaints: The National Privacy Commission of the Philippines handles complaints regarding DPA violations at privacy.gov.ph
Six concrete commitments bullwin makes to every player registered on the Platform.
bullwin's data processing practices are designed to comply with Republic Act No. 10173, the Data Privacy Act of 2012, and NPC implementing regulations. Our DPO is registered with the National Privacy Commission as required under NPC Circular No. 16-03.
bullwin does not sell, rent, or trade your personal data to third parties for advertising or marketing purposes. Your data is used only to operate the Platform and comply with Philippine regulatory obligations — nothing else.
All data transmitted to and from bullwin is encrypted with TLS 1.3 / AES-256 — the same standard used by BDO and BPI online banking. KYC documents and payment credentials are encrypted at rest with additional security controls beyond standard account data.
This Privacy Policy documents every category of data we collect, why we collect it, who we share it with, and how long we keep it. There are no hidden data practices at bullwin — what you read here is the complete picture of how your personal information is handled.
Your data subject rights under the DPA are real rights with real enforcement. The National Privacy Commission can investigate complaints and impose sanctions. bullwin cooperates fully with NPC processes — and Filipino players have the option of domestic regulatory recourse, not just a company complaints process.
If a data breach occurs that is likely to result in harm to your personal data, bullwin's incident response plan requires notification to affected players and the National Privacy Commission within 72 hours of discovery — consistent with NPC Circular No. 16-03 breach notification requirements.
bullwin handles your personal data with the same seriousness we apply to game fairness and payment security. PAGCOR-regulated, DPA-compliant, and built for Filipino players who deserve transparency about how their data is used.