wy2 Privacy Policy

1. Data Controller

The data controller responsible for your personal information is wy2, operating the online gaming platform accessible at wy2.biz. wy2 is licensed and regulated by the Philippine Amusement and Gaming Corporation (PAGCOR) and is subject to the requirements of the Philippine Data Privacy Act of 2012 (R.A. 10173) and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC).

By registering for a wy2 account or using any part of the wy2 platform, you consent to the collection and processing of your personal data as described in this Privacy Policy. If you do not agree, you should not use the wy2 platform.

2. Personal Data We Collect

wy2 collects the following categories of personal data in connection with your registration and use of the Platform:

wy2 does not collect sensitive personal information (as defined under R.A. 10173) beyond what is strictly necessary for identity verification and PAGCOR/AMLC compliance purposes.

3. How We Collect Your Data

wy2 collects personal data through the following means:

• Direct provision: Information you provide when registering your wy2 account, completing KYC verification, making deposits or withdrawals, or contacting wy2 support.
• Automated collection: Technical and usage data collected automatically when you access and use the wy2 Platform, including via cookies, server logs, and device fingerprinting.
• Third-party sources: Identity verification data from PAGCOR-approved identity verification service providers; payment confirmation data from GCash, PayMaya, and banking partners; fraud prevention data from licensed third-party risk management providers.

4. Purposes of Processing Your Data

wy2 processes your personal data for the following purposes:

• To create and manage your wy2 player account and verify your identity and eligibility.
• To process deposits, withdrawals, and other financial transactions on the Platform.
• To comply with PAGCOR licensing obligations, including Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements under R.A. 9160 as amended.
• To detect, investigate, and prevent fraud, unauthorised account access, and Platform abuse.
• To administer bonuses, promotions, and loyalty programmes for eligible players.
• To provide customer support and respond to your queries and complaints.
• To enforce responsible gaming measures including deposit limits, cooling-off periods, and self-exclusion.
• To improve the wy2 Platform's functionality, game offering, and user experience through anonymised analytics.
• To send you service communications relating to your account (e.g. transaction confirmations, security alerts). Marketing communications are only sent with your express consent and you may opt out at any time.

5. Legal Bases for Processing

wy2 processes your personal data on the following legal bases under the Philippine Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform the contract between you and wy2 (i.e. operating your account and providing gaming services).
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, the AMLA, the Data Privacy Act, and other applicable Philippine laws and regulations.
• Legitimate interests: Processing necessary for fraud prevention, platform security, and responsible gaming enforcement, where such interests are not overridden by your rights.
• Consent: Processing for marketing communications and certain analytics, where your specific consent has been obtained.

6. Data Sharing and Disclosure

wy2 does not sell your personal data to third parties. wy2 may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• PAGCOR: As required under wy2's operating licence, including player registration data and suspicious activity reports.
• Anti-Money Laundering Council (AMLC): Covered transaction reports and suspicious transaction reports as required under R.A. 9160.
• National Privacy Commission (NPC): In response to lawful orders or as required by the Data Privacy Act.
• Payment service providers: GCash, PayMaya, BPI, BDO, Metrobank, and other licensed payment partners, to the extent necessary to process financial transactions on your account.
• Identity verification providers: PAGCOR-approved KYC/AML service providers who assist wy2 in verifying player identities.
• IT and platform service providers: Trusted technology partners who support the operation of the wy2 platform under strict data processing agreements that require GDPR/DPA-equivalent protection standards.
• Law enforcement and courts: Where disclosure is required by a court order, subpoena, or other lawful demand from Philippine law enforcement authorities.

7. International Data Transfers

Some of wy2's service providers and game technology partners operate servers located outside the Philippines. Where personal data is transferred to a jurisdiction outside the Philippines, wy2 ensures that such transfers are subject to appropriate safeguards, including contractual data processing agreements that impose data protection standards equivalent to those required under the Philippine Data Privacy Act and the NPC's rules on cross-border data flows.

wy2 will not transfer personal data to a jurisdiction that does not offer adequate data protection standards without the implementation of appropriate contractual or technical safeguards.

8. Data Retention

wy2 retains your personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account and identity data: Retained for a minimum of 5 years from account closure, as required by PAGCOR and AMLC regulations.
• Transaction and gaming records: Retained for a minimum of 5 years from the date of each transaction, in compliance with AML recordkeeping obligations.
• KYC verification documents: Retained for 5 years from the date of submission or account closure, whichever is later.
• Support communications: Retained for 2 years from the date of the interaction, unless the matter is subject to ongoing legal proceedings.
• Marketing consent records: Retained for as long as the consent remains valid, plus 1 year thereafter.

Upon expiry of the applicable retention period, wy2 will securely delete or anonymise personal data in accordance with its data disposal procedures.

9. Cookies and Tracking Technologies

wy2 uses cookies and similar technologies on the Platform for the following purposes:

• Strictly necessary cookies: Required for the Platform to function, including maintaining your login session, storing your language preferences, and enabling secure financial transactions. These cannot be disabled.
• Performance/analytics cookies: Used to collect aggregated, anonymised data about how players use the Platform, to identify and fix technical issues and improve the user experience. Enabled by default; you may opt out.
• Functionality cookies: Used to remember your preferences such as game view settings and notification preferences. Enabled by default.
• Security cookies: Used to detect and prevent fraudulent activity, bot access, and multiple account creation. These cannot be disabled.

You may manage non-essential cookie preferences through your browser settings. Disabling strictly necessary or security cookies may impair your ability to use the wy2 Platform.

10. Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by wy2:

• Right to be informed: The right to know whether wy2 processes your personal data and to receive a copy of this Privacy Policy.
• Right of access: The right to request a copy of the personal data wy2 holds about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure or blocking: The right to request deletion or blocking of personal data that is unlawfully processed, no longer necessary, or processed on the basis of withdrawn consent, subject to wy2's legal retention obligations.
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to object: The right to object to processing carried out on the basis of legitimate interests, including profiling for direct marketing purposes.
• Right to file a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe wy2 has violated your data privacy rights.

To exercise any of the above rights, contact wy2's Data Protection Officer using the details in Section 14. wy2 will respond to verified data subject requests within 30 calendar days as required by the NPC.

11. Children's Privacy

The wy2 Platform is strictly prohibited for individuals under 21 years of age in accordance with PAGCOR regulations. wy2 does not knowingly collect or process personal data from anyone under 21 years of age. If wy2 discovers that personal data has been collected from an individual under the age of 21, wy2 will immediately suspend the relevant account, delete the personal data, and report the matter to PAGCOR in accordance with its underage access obligations.

If you are a parent or guardian and believe a minor has accessed or registered on the wy2 Platform, please contact wy2 immediately at [email protected] (displayed as plain text — not a clickable link).

12. Data Security

wy2 implements technical and organisational security measures appropriate to the risk level of the personal data it processes, including:

• TLS/SSL encryption for all data transmitted between your device and the wy2 Platform.
• AES-256 encryption for sensitive data at rest, including identity documents and financial records.
• Bcrypt hashing for all stored account passwords — wy2 never stores your password in plaintext.
• Multi-factor authentication options for player accounts.
• Role-based access controls limiting internal access to personal data to authorised personnel only.
• Regular penetration testing and security audits by independent cybersecurity firms.
• 24/7 intrusion detection and anomaly monitoring on Platform infrastructure.

In the event of a personal data breach that poses a risk to your rights and freedoms, wy2 will notify the National Privacy Commission within 72 hours of becoming aware of the breach and will inform affected players as required by the Data Privacy Act.

13. Changes to This Privacy Policy

wy2 reserves the right to update this Privacy Policy at any time. The current version will always be available on this page with the "Last Updated" date clearly shown. Where changes are material — for example, changes to the categories of data collected or the purposes of processing — wy2 will provide advance notice via the Platform or by email to your registered address before the changes take effect.

Your continued use of the wy2 Platform following the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes. We encourage you to review this page periodically.

14. Contact and Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by wy2, please contact our Data Protection Officer:

You also have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated. The NPC is the independent regulatory body responsible for administering and enforcing the Data Privacy Act of 2012 in the Philippines.