tapwi Privacy
Policy

tapwi ("we", "us", "our") is a Philippines-focused online gaming platform operating at tapwi.net. We are committed to protecting the privacy and personal data of every player who registers and uses the tapwi platform. This Privacy Policy is issued in accordance with the Data Privacy Act of the Philippines (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations ("IRR"), and the guidelines issued by the National Privacy Commission ("NPC").

tapwi acts as the Personal Information Controller ("PIC") for all personal data collected through the tapwi platform. This means tapwi determines the purposes and means by which your personal data is collected and processed. Where tapwi engages third-party service providers to process personal data on its behalf, those parties act as Personal Information Processors ("PIP") and are bound by data processing agreements consistent with the DPA.

This Privacy Policy should be read alongside tapwi's Terms & Conditions and Responsible Gaming policy, both of which form part of your overall agreement with tapwi. If you have questions about this Policy at any time, you may contact our Data Protection Officer at the details set out in Section 14.

tapwi collects the following categories of personal data in connection with your registration and use of the platform:

tapwi does not knowingly collect sensitive personal information beyond what is strictly required for identity verification and regulatory compliance (e.g., government ID details for KYC). We do not collect information about your race, religion, health status, or political affiliation.

tapwi collects your personal data through the following means:

Direct Collection. You provide data directly to tapwi when you register for an account, complete KYC verification, make a deposit or withdrawal, place bets, use responsible gaming tools, contact our support team, or respond to a survey or promotion.

Automated Collection. When you access tapwi.net, our servers and analytics systems automatically record technical and usage data including your IP address, device identifiers, browser type, session start and end times, pages visited, and in-game actions. This data is collected through server logs, cookies, and similar tracking technologies. See Section 9 for full details on our cookie practices.

Third-Party Sources. tapwi may receive personal data about you from third-party sources in the following circumstances:

• Payment processors (e.g., GCash, Maya, BPI, BDO) confirming deposit or withdrawal transaction details
• Identity verification service providers used to assist with KYC validation
• Fraud detection and anti-money laundering screening services
• PAGCOR or other regulatory bodies where legally required

tapwi only receives from third parties the minimum personal data necessary for the stated purpose, and all third-party data providers are required to confirm that they have a lawful basis for sharing your data with us.

tapwi processes your personal data for the following purposes:

• Account Management: Creating, maintaining, securing, and closing your tapwi player account
• Identity Verification (KYC): Verifying your identity in compliance with PAGCOR requirements and the Anti-Money Laundering Act of the Philippines
• Gaming Services: Enabling you to place bets, play games, participate in promotions, and access all tapwi platform features
• Payment Processing: Processing your deposits and withdrawals via GCash, Maya, bank transfer, Coins.ph, 7-Eleven Cliqq, USDT TRC20, and other accepted payment channels
• Regulatory Compliance: Meeting our obligations under PAGCOR regulation, the Anti-Money Laundering Act (AMLA), the Data Privacy Act, and other applicable Philippine laws
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, account takeovers, money laundering, and other unlawful conduct
• Responsible Gaming: Monitoring gaming patterns to identify potential problem gambling indicators and administering responsible gaming tools (deposit limits, self-exclusion, cooling-off periods)
• Customer Support: Responding to your support requests, complaints, and account enquiries
• Platform Improvement: Analysing usage data to improve tapwi's features, game selection, and overall user experience
• Marketing Communications: Sending you promotional offers and updates about tapwi, where you have consented to receive such communications and subject to your right to opt out at any time

Under the Data Privacy Act of the Philippines, tapwi processes your personal data on one or more of the following legal grounds:

• Contractual Necessity: Processing is necessary to perform the contract between you and tapwi — specifically, to operate your account and provide the gaming services you have registered to use
• Legal Obligation: Processing is required for tapwi to comply with applicable laws, including PAGCOR regulations, AMLA obligations, and NPC guidelines
• Legitimate Interests: Processing is necessary for tapwi's legitimate interests in fraud prevention, platform security, and service improvement, provided those interests are not overridden by your rights and interests
• Consent: For marketing communications and non-essential cookies and tracking technologies, tapwi relies on your freely given, specific, and informed consent, which you may withdraw at any time

Where tapwi relies on consent as the legal basis for any processing activity, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

tapwi does not sell, rent, or trade your personal data. We share your personal data only in the following limited circumstances:

Service Providers (Personal Information Processors). tapwi engages carefully selected third-party service providers who process personal data on tapwi's behalf, including:

• Payment processors (GCash, Maya, BPI, BDO, Metrobank, UnionBank, Coins.ph) for transaction processing
• Identity verification and KYC service providers
• Cloud hosting and data storage providers
• Customer support software providers
• Fraud detection and cybersecurity service providers
• Analytics service providers for platform improvement purposes

All service providers are required to enter into data processing agreements with tapwi, restricting their use of your personal data to the specific purposes for which it was shared and obligating them to implement appropriate security measures.

Regulatory and Law Enforcement Authorities. tapwi may disclose your personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other government authorities where we are legally required or compelled to do so, including in connection with AML investigations, regulatory audits, or court orders.

Business Transfers. In the event of a merger, acquisition, or sale of all or part of tapwi's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the applicable privacy terms of the new entity prior to any change taking effect.

tapwi retains your personal data only for as long as is necessary for the purposes set out in this Privacy Policy, and in accordance with our legal and regulatory retention obligations under Philippine law.

The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your account plus a minimum of five (5) years following account closure, in accordance with PAGCOR and AMLA record-keeping requirements
• Transaction and Betting Records: Retained for a minimum of five (5) years from the date of each transaction, as required by AMLA implementing rules
• KYC Documents: Retained for five (5) years following the end of the customer relationship, or longer where required by applicable law or an ongoing regulatory investigation
• Customer Support Communications: Retained for three (3) years from the date of the last interaction, or longer if the matter relates to an unresolved dispute or legal proceeding
• Marketing Consent Records: Retained for the duration of your account and for three (3) years after your last interaction with tapwi, to demonstrate compliance with consent requirements
• Technical and Usage Data (Logs): Retained for twelve (12) months from the date of collection for security and debugging purposes

When your personal data is no longer required for any lawful purpose, tapwi will securely delete or anonymise it in accordance with our internal data disposal procedures. Anonymised data (which can no longer be used to identify you) may be retained indefinitely for statistical and platform improvement purposes.

tapwi implements a multi-layered approach to data security, combining technical, organisational, and physical safeguards to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction.

Technical Measures include:

• TLS 1.2 / 1.3 encryption for all data in transit between your device and tapwi's servers
• AES-256 encryption for sensitive data at rest in tapwi's databases
• Secure, salted hashing of all account passwords — tapwi staff cannot view your password in plaintext
• OTP (one-time password) two-factor authentication for login and high-value withdrawal transactions
• Web application firewall (WAF) and DDoS protection
• Automated intrusion detection and anomaly monitoring systems
• Regular vulnerability assessments and penetration testing by qualified security professionals

Organisational Measures include:

• Role-based access controls limiting staff access to personal data strictly on a need-to-know basis
• Mandatory privacy and data security training for all tapwi personnel
• Formal incident response procedures for personal data breaches
• Data processing agreements with all third-party service providers handling personal data

While tapwi takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the security of your account credentials and for notifying tapwi immediately if you suspect unauthorised access to your account.

tapwi uses cookies and similar tracking technologies (such as web beacons and local storage) on tapwi.net to ensure the platform functions correctly, to keep your session active while you are logged in, and to understand how players use the site so we can improve it.

Types of Cookies We Use:

• Strictly Necessary Cookies: Essential for the tapwi platform to function. These include session authentication cookies that keep you logged in during your visit. You cannot opt out of these without disabling the platform entirely.
• Functional Cookies: Remember your preferences (e.g., language settings, game lobby layout) to provide a more personalised experience.
• Analytics Cookies: Collect anonymised data about how players navigate tapwi.net to help us identify usability issues and improve site performance. Used only with your consent.
• Security Cookies: Help us detect and prevent fraudulent activity, bot traffic, and account takeover attempts.

You can control non-essential cookies through the cookie preference panel accessible in the footer of tapwi.net, or through your browser's privacy settings. Please note that disabling certain cookies may affect the functionality of the tapwi platform.

Under the Data Privacy Act of the Philippines, you have the following rights with respect to your personal data held by tapwi:

• Right to Be Informed: The right to be told what personal data tapwi collects about you and how it is used — which this Privacy Policy fulfils.
• Right of Access: The right to request a copy of the personal data tapwi holds about you, along with information about how it is being processed.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected. You can update most of your account details directly within your tapwi profile, or contact support for changes requiring documentation.
• Right to Erasure (Right to be Forgotten): The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to tapwi's legal retention obligations under PAGCOR regulation and AMLA.
• Right to Data Portability: The right to receive a copy of your personal data in a structured, commonly used, machine-readable format, where technically feasible.
• Right to Object: The right to object to certain types of processing, including direct marketing communications. You can opt out of marketing emails at any time via your account settings.
• Right to Withdraw Consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting prior processing.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe tapwi has violated your data privacy rights.

To exercise any of the above rights, please contact tapwi's Data Protection Officer using the contact details in Section 14 of this Policy. tapwi will respond to all verifiable data subject requests within fifteen (15) business days of receipt, in accordance with NPC guidelines.

The tapwi platform is strictly intended for adults. Under Philippine law, individuals must be at least twenty-one (21) years of age to participate in casino-style gaming. tapwi does not knowingly collect personal data from individuals under the age of 21.

If tapwi discovers or has reason to believe that an account has been created by or on behalf of a person under 21 years of age, the account will be immediately suspended, any balances will be returned to the payment source used for deposit, any winnings will be forfeited, and all associated personal data will be securely deleted to the extent permitted by our legal obligations.

If you are a parent or guardian and believe that a minor has registered on tapwi without your consent, please contact tapwi's support team immediately at the details provided in Section 14. We will investigate and take appropriate action without delay.

tapwi primarily stores and processes your personal data on servers located within or accessible from the Philippines. In some cases, tapwi's third-party service providers (including cloud infrastructure providers and certain analytics or security tools) may process data in data centres located outside the Philippines.

Where personal data is transferred outside the Philippines, tapwi ensures that appropriate safeguards are in place to protect your data in accordance with the Data Privacy Act and NPC guidelines. These safeguards include:

• Entering into data transfer agreements with recipient entities that impose data protection standards equivalent to Philippine DPA requirements
• Transferring data only to countries or organisations that have been assessed as providing adequate levels of data protection
• Implementing standard contractual clauses as approved by the NPC where required

You may request information about the specific safeguards applicable to any cross-border transfer of your personal data by contacting our Data Protection Officer.

tapwi may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or the services we offer. When we make material changes — those that significantly affect your rights or how your personal data is used — we will notify you by sending a notice to your registered email address and/or displaying a prominent notification on the tapwi platform at least seven (7) days before the changes take effect.

Non-material changes (such as minor clarifications, formatting updates, or corrections that do not alter the substance of your rights or our obligations) may be made without advance notice. The "Last Updated" date at the top of this Policy reflects when it was most recently revised.

Your continued use of the tapwi platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated Policy. If you do not agree with the revised Policy, you should stop using tapwi and may request account closure in accordance with the Terms & Conditions.

Data Protection Officer. tapwi has appointed a Data Protection Officer ("DPO") responsible for overseeing compliance with the Data Privacy Act and this Privacy Policy. You may contact tapwi's DPO for any privacy-related enquiry, data subject rights request, or complaint using the following channels:

• Email: [email protected] — include "Privacy / DPO Request" in the subject line
• Live Chat: Available 24/7 from your logged-in tapwi account dashboard
• FAQ: Visit our FAQ page for answers to common privacy questions

tapwi will acknowledge receipt of your request within three (3) business days and will provide a full response within fifteen (15) business days, in accordance with NPC guidelines. Where a request is complex or involves a large volume of data, tapwi may extend the response period by a further fifteen (15) business days, with notice to you explaining the reason for the extension.

National Privacy Commission. If you are not satisfied with tapwi's response to a privacy complaint, you have the right to escalate your complaint to the National Privacy Commission of the Philippines. The NPC's complaint procedures are published on the NPC's official website.