goodwin8 Privacy Policy

This Privacy Policy ("Policy") is issued by goodwin8 ("goodwin8," "we," "us," "our") and applies to all personal data processed in connection with the goodwin8 website at goodwin8.club, its associated mobile-accessible interfaces, and all services, features, promotions, and communications provided through those channels (collectively, the "Platform").

This Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). goodwin8 recognizes that the privacy of its players — the vast majority of whom are Filipino nationals transacting in Philippine Peso using GCash, Maya, and Philippine bank accounts — is a matter of legal obligation and earned trust, not a compliance formality.

By registering a goodwin8 account, making a deposit, or otherwise accessing the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described herein, you should discontinue use of the Platform and contact support to close your account.

For the purposes of the Philippine Data Privacy Act and this Policy, the Data Controller responsible for your personal information is goodwin8, operating the Platform at goodwin8.club.

goodwin8 determines the purposes and means of processing personal data collected through the Platform. Where goodwin8 engages third-party processors — such as KYC verification providers, payment gateways, or game studios — those parties act as Data Processors under goodwin8's instruction and are bound by data processing agreements that require compliance with applicable Philippine data protection law.

Questions relating to this Policy, data subject rights requests, and data breach notifications should be directed to goodwin8's designated Data Protection Officer (DPO) using the contact details in Section 15 of this Policy.

goodwin8 collects the following categories of personal data from registered Players and, where relevant, from visitors to the Platform who have not registered an account:

goodwin8 does not intentionally collect sensitive personal information as defined under Section 3(l) of RA 10173 — such as race, ethnicity, health data, religious beliefs, or sexual orientation — through the normal course of Platform operation. Where such information is incidentally disclosed in a support communication, it is treated with heightened protection and not used for any secondary purpose.

goodwin8 collects personal data through the following channels and mechanisms:

4.1 Directly from You

The primary source of your personal data is information you provide directly when registering a goodwin8 account, completing KYC verification, making a payment, contacting customer support, participating in promotions, or configuring your account settings. This includes data entered into web forms, documents uploaded for verification, and messages sent through live chat or email.

4.2 Automated Technical Collection

When you access goodwin8.club, certain technical data is collected automatically by our servers and analytics systems — including your IP address, browser type, device identifiers, page visit logs, and session activity. This collection occurs whether or not you are logged into an account and is a standard feature of secure web platform operation.

4.3 Payment Processors

When you conduct a financial transaction through GCash, Maya, InstaPay, PesoNet, BPI, BDO, Metrobank, or another supported Philippine payment method, goodwin8 receives transaction confirmation data from the relevant payment processor. goodwin8 does not receive your full GCash PIN, banking password, or complete card number — only the information necessary to match and confirm the transaction.

4.4 Game Providers and Platform Logs

goodwin8 receives gameplay logs from its certified game studio partners, including session data, wager records, and outcome logs. This data is used for account statement generation, bonus tracking, responsible gaming monitoring, and dispute resolution. Game studios do not receive your identity documents or financial data.

goodwin8 processes your personal data only for specified, explicit, and legitimate purposes. The principal purposes are:

• Account Creation and Management: Registering your account, authenticating your identity at login, maintaining your account settings, and providing you with access to Platform features;
• Payment Processing: Processing deposits, settling withdrawals to your GCash or bank account, maintaining transaction records, and reconciling financial accounts;
• KYC and Age Verification: Verifying that you meet the 21-years-and-above age requirement mandated by PAGCOR regulations, and confirming your identity in compliance with AML obligations;
• Fraud Prevention and AML Compliance: Detecting and investigating suspicious transactions, preventing account misuse, fulfilling obligatory reports to relevant Philippine authorities where required by law;
• Customer Support: Responding to your inquiries, processing complaints, resolving disputes, and maintaining records of your interactions with the goodwin8 support team;
• Responsible Gaming Monitoring: Monitoring gaming activity patterns to identify potential problem gambling behavior, administering deposit limits and self-exclusion requests, and fulfilling platform obligations under applicable responsible gaming standards;
• Platform Improvement and Analytics: Analyzing aggregated usage data to improve platform performance, game library selection, and user experience — this processing uses anonymized or pseudonymized data wherever feasible;
• Marketing and Promotions: Sending promotional communications, bonus notifications, and VIP updates to Players who have provided explicit consent — subject always to the opt-out mechanism described in Section 11.

Under Section 12 of the Philippine Data Privacy Act, goodwin8 processes personal data on the following legal bases:

• Contractual Necessity (Section 12[b]): Processing required to deliver the services you have contracted for by accepting the goodwin8 Terms & Conditions — including account management, gameplay, payments, and support;
• Legal Obligation (Section 12[c]): Processing required for goodwin8 to comply with applicable Philippine laws — including RA 10173, the Anti-Money Laundering Act (RA 9160 as amended), PAGCOR regulations, and tax reporting obligations;
• Legitimate Interests (Section 12[f]): Processing for fraud prevention, platform security, and anonymized analytics — in each case subject to a proportionality assessment confirming that goodwin8's legitimate interest is not overridden by your privacy rights;
• Consent (Section 12[a]): Processing for direct marketing and promotional communications — valid only where you have provided free, specific, informed, and unambiguous consent, and revocable at any time.

goodwin8 does not sell, rent, or commercially license your personal data to any third party. Data is disclosed only in the following circumstances:

7.1 Service Providers (Data Processors)

goodwin8 engages trusted third-party service providers to perform functions on its behalf, including: identity and age verification (KYC) providers; payment gateway operators; cloud hosting and infrastructure providers; fraud detection and AML screening services; and customer support platform operators. These providers act under goodwin8's instructions pursuant to written data processing agreements, and are prohibited from using your personal data for their own commercial purposes.

7.2 Game Studio Partners

Certified game studios (such as JILI, PG Soft, Evolution Gaming, and Pragmatic Play) receive session-level gameplay data — bet records, game outcomes — for the purpose of operating and auditing their games. Game studios do not receive your full name, identity documents, mobile number, or financial account details.

7.3 Regulatory and Law Enforcement Authorities

goodwin8 will disclose personal data to the National Privacy Commission, PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue, or law enforcement agencies where required to do so by a lawful request, court order, or mandatory regulatory reporting obligation. Where permitted by law, goodwin8 will notify affected Players of such disclosure in advance.

7.4 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or part of goodwin8's business, personal data may be transferred to the acquiring entity as part of the transaction, subject to confidentiality obligations and the requirement that the receiving entity maintains privacy standards at least equivalent to this Policy.

goodwin8 uses cookies, local storage, and similar technologies on the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential to Platform operation — session management, authentication tokens, fraud prevention signals, and load-balancing identifiers. These cookies cannot be disabled without making the Platform inoperable. No consent is required for strictly necessary cookies under applicable law;
• Functional Cookies: Store your preferences — such as language settings, notification preferences, and responsible gaming configuration — so they persist across sessions without requiring re-entry;
• Analytical Cookies: Used in aggregated, pseudonymized form to understand how players navigate the Platform — which game categories are most visited, where users encounter friction, session duration metrics. goodwin8 uses analytics data to improve the product, not to build individual behavioral profiles for commercial exploitation;
• Third-Party Advertising Cookies: goodwin8 does not load third-party advertising or retargeting cookies by default. If any promotional integration in future were to involve such technologies, players will be presented with an explicit opt-in consent mechanism before such cookies are set.

You may manage cookie preferences through your browser settings. Note that disabling functional or analytical cookies will not prevent you from accessing goodwin8, but may result in loss of preference persistence between sessions.

goodwin8 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, to comply with AML record-keeping obligations under RA 9160;
• KYC Documents: Retained for five (5) years following account closure, as required by the Anti-Money Laundering Act and PAGCOR reporting standards;
• Financial Transaction Records: Retained for five (5) years from the date of each transaction for AML and tax compliance;
• Gaming Activity Logs: Retained for three (3) years to support dispute resolution, responsible gaming monitoring, and regulatory audits;
• Customer Support Communications: Retained for two (2) years from the date of the last interaction;
• Marketing Consent Records: Retained for the duration of the consent and for one (1) year following withdrawal of consent, as evidence of lawful processing.

On expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where deletion is not technically feasible immediately — for example, data contained within encrypted backup archives — goodwin8 will isolate such data from active processing and ensure it is purged on the next scheduled backup cycle.

goodwin8 implements organizational and technical security measures appropriate to the sensitivity of the data processed and the risks presented by the gaming platform context. Key security controls include:

• Encryption in Transit: All data transmitted between your device and goodwin8's servers is protected by TLS 1.2 or higher encryption — the same standard used by Philippine commercial banks;
• Encryption at Rest: Sensitive data at rest, including KYC documents and payment account references, is stored in encrypted form using industry-standard algorithms;
• Password Security: Account passwords are hashed using a modern one-way cryptographic function before storage. goodwin8 cannot retrieve your plain-text password under any circumstances;
• Access Controls: goodwin8 staff access to personal data is role-based and granted on a need-to-know basis. Access logs are maintained and audited regularly;
• Two-Factor Authentication: goodwin8 supports two-factor authentication via Philippine mobile SMS for all Player accounts and enforces 2FA for all internal staff accessing production data systems;
• Incident Response: goodwin8 maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to Player rights, goodwin8 will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will inform affected Players without undue delay where required by Section 20(f) of RA 10173.

Under Chapter IV of the Philippine Data Privacy Act, you have the following rights with respect to your personal data held by goodwin8. These rights can be exercised by contacting the goodwin8 Data Protection Officer through the contact details in Section 15. goodwin8 will respond to verified requests within fifteen (15) business days.

You also have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe goodwin8 has failed to process your personal data in accordance with RA 10173. Information on how to file an NPC complaint is available through the NPC's official channels.

goodwin8 does not knowingly collect personal data from individuals under the age of 21 years, consistent with the minimum age requirement for online gambling under PAGCOR regulations. Registration on goodwin8 is prohibited for any person below this age.

Where goodwin8 discovers that personal data has been collected from a minor — whether through a false age declaration at registration or any other means — goodwin8 will immediately suspend the account, delete the associated personal data to the extent not required for compliance reporting, and may notify the relevant regulatory authority where required by law.

Parents or guardians who believe their child has registered a goodwin8 account should contact support immediately via live chat to initiate an account review and closure process.

goodwin8's primary servers and data processing infrastructure are located within or near the Philippine region to minimize data transfer latency for Filipino players and reduce regulatory exposure. However, certain service providers engaged by goodwin8 — including cloud infrastructure providers, game studio partners, and specialized KYC technology vendors — may process data in locations outside the Philippines.

Where personal data is transferred outside the Philippines, goodwin8 takes the following measures to ensure an equivalent level of protection is maintained:

• Contractual clauses in data processing agreements requiring the recipient to apply data protection standards at least equivalent to those mandated by RA 10173;
• Transfers only to jurisdictions or entities that the National Privacy Commission has recognized as providing an adequate level of data protection, or where the specific transfer is covered by an approved binding corporate rule or standard contractual clause;
• Minimum data principle — only data strictly necessary for the third party's function is transferred cross-border; full identity documents and Philippine financial account details are not transmitted to overseas processors unless technically unavoidable for the specific service.

goodwin8 reviews this Privacy Policy periodically and updates it as necessary to reflect changes in data processing practices, regulatory requirements, or platform functionality. The "Last Updated" date at the top of this Policy indicates when the most recent revision was made.

When material changes are made to this Policy — particularly changes that expand the categories of data collected, introduce new processing purposes, or affect your rights — goodwin8 will notify registered Players via the email address or mobile number on file at least seven (7) days before the changes take effect. A prominent notice will also be displayed on the goodwin8 login page during the notice period.

Your continued use of goodwin8 following the effective date of a revised Policy constitutes your acknowledgment of the updated terms. If you do not accept the revised Policy, you may close your account and request a withdrawal of your remaining balance through the standard withdrawal process.

goodwin8 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with RA 10173 and this Privacy Policy. To exercise your data subject rights, submit a privacy-related complaint, or ask a question about how goodwin8 processes your personal data, please contact us through any of the following channels:

• Live Chat: Available 24/7 on the goodwin8 platform — the fastest channel for urgent privacy matters including suspected unauthorized account access;
• Support Email (plain text — not a clickable link): support at goodwin8.club — prefix your subject line with "Privacy Request:" to ensure routing to the DPO team;

goodwin8 acknowledges all privacy requests within two (2) business days and completes verified requests within fifteen (15) business days, or notifies you of the reason for any extension where the matter requires additional time to process.

If you are dissatisfied with goodwin8's response to a privacy concern, you have the right to escalate the matter to the National Privacy Commission (NPC) of the Philippines. The NPC accepts complaints from Philippine data subjects at no charge. NPC contact information is publicly available through government channels.