Privacy Policy — jl969 Online Gaming Platform

Personal Information Controller

For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, the Personal Information Controller in respect of personal data collected through jl969.app is jl969 ("jl969", "the Company", "We", "Us"), the licensed operator of the online gaming platform accessible at jl969.app.

jl969 operates under a license issued by the Philippine Amusement and Gaming Corporation (PAGCOR) and is subject to the data governance obligations applicable to PAGCOR-licensed online gaming operators, in addition to the general requirements of RA 10173 and the oversight of the National Privacy Commission (NPC).

jl969 has designated a Data Protection Officer (DPO) responsible for ensuring compliance with applicable data privacy laws and for managing data subject rights requests. The DPO may be contacted at the address provided in Section 13 of this Policy.

Personal Data We Collect

jl969 collects the following categories of personal data from players and visitors to jl969.app:

2.1 Registration Data

Collected at the point of account creation:

• Full legal name as it appears on a valid Philippine government-issued ID.
• Date of birth (for age verification — 21+ requirement).
• Philippine mobile number (primary account identifier and 2FA channel).
• Username chosen by the player.
• Account password (stored in encrypted, irreversible hash format — jl969 does not store plaintext passwords).

2.2 Identity Verification (KYC) Data

Collected as part of the mandatory Know Your Customer verification process prior to first withdrawal:

• Scanned or photographed copy of a valid Philippine government-issued photo identification document (Passport, UMID, Driver's License, SSS ID, PhilSys National ID, Voter's ID, or PRC ID).
• Proof of residential address (utility bill, bank statement, or official barangay clearance, issued within 3 months).
• Selfie photograph with ID for liveness verification, where required.
• Source of funds documentation, where requested for high-volume or flagged accounts under AMLA compliance procedures.

2.3 Financial Transaction Data

• Deposit and withdrawal transaction records including amounts, timestamps, payment method identifiers, and transaction reference numbers.
• GCash account identifier, Maya account identifier, or bank account details (account name, account number, bank) used for withdrawals — collected at withdrawal request time.
• Payment instrument verification data as required by jl969's AML procedures.

2.4 Gaming Activity Data

• Game session logs including game type, session start and end times, bet amounts, game outcomes, and win/loss records.
• Bonus and promotional activity records.
• Responsible gaming tool settings and activation history (deposit limits, loss limits, self-exclusion records).

2.5 Technical & Device Data

• IP address and approximate geolocation (city/region level) at the time of login and gameplay.
• Device type, operating system, and browser version.
• Session tokens, login timestamps, and device fingerprint identifiers used for fraud prevention and session management.
• Platform interaction logs used for technical troubleshooting and platform improvement.

2.6 Communications Data

• Content of customer support interactions (live chat transcripts, email correspondence).
• Communication preferences and consent records for marketing messages.

How We Collect Your Data

jl969 collects personal data through the following channels and methods:

• Directly from you: When you register an account on jl969.app, complete KYC verification, make a deposit or withdrawal request, contact customer support, or interact with platform features such as responsible gaming tools or bonus claims.
• Automatically during platform use: Technical and device data, session logs, IP addresses, and platform interaction data are collected automatically when you access jl969.app, including through cookies and similar tracking technologies described in Section 8.
• From payment providers: Transaction confirmation data is received from GCash, Maya, BPI, BDO, Metrobank, InstaPay, and other payment channel providers when you initiate deposit or withdrawal transactions. This data is limited to what is necessary to confirm and reconcile your financial transactions.
• From identity verification services: Where jl969 uses third-party KYC verification technology, identity document verification results and liveness check outcomes may be received from those service providers.
• From PAGCOR and regulatory databases: jl969 may cross-reference player information against PAGCOR exclusion lists and other regulatory compliance databases as required under its operating license.

Purpose of Processing & Legal Basis

The following table summarises the primary purposes for which jl969 processes your personal data and the corresponding legal basis under RA 10173 and PAGCOR requirements:

jl969 will not use your personal data for purposes incompatible with those listed above without providing prior notice and, where required, obtaining your additional consent.

Data Sharing & Disclosure

jl969 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Personal data is shared with third parties only in the following circumstances and only to the extent necessary for the stated purpose:

5.1 Payment Service Providers

Transaction data is shared with GCash, Maya, BPI, BDO, Metrobank, InstaPay, PesoNet, and other payment channel providers solely to process your deposit and withdrawal requests. These providers act as processors under documented agreements and are required to handle your data in accordance with applicable Philippine data privacy standards.

5.2 KYC and Identity Verification Partners

Where jl969 uses third-party identity verification services to process KYC documents, your KYC data is shared with those providers solely for the purpose of verifying your identity and age. These services are subject to contractual data processing obligations consistent with RA 10173.

5.3 Game Content Providers

Limited game session data (session identifiers, bet amounts, and game outcomes) is shared with jl969's licensed game content providers as necessary for game operation, result settlement, and RTP auditing. Game providers do not receive your full personal profile.

5.4 PAGCOR and Regulatory Authorities

jl969 is legally required to submit player data, transaction records, and gaming activity reports to PAGCOR in accordance with its operating license conditions. jl969 is also required to file Suspicious Transaction Reports (STRs) and Currency Transaction Reports (CTRs) with the Anti-Money Laundering Council (AMLC) as required under RA 9160 as amended. These disclosures are mandatory legal obligations and occur regardless of your consent.

5.5 Law Enforcement and Courts

jl969 will disclose personal data to law enforcement agencies, courts, or other governmental authorities where required to do so by a valid legal process, court order, or other lawful authority under Philippine law. Where permitted by law, jl969 will notify you of such disclosures.

5.6 Professional Advisers

jl969 may share relevant personal data with its legal advisers, auditors, and accountants on a confidential basis where necessary for the conduct of professional services. These parties are bound by professional confidentiality obligations.

Data Retention

jl969 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to the minimum retention periods mandated by Philippine law and PAGCOR requirements. The following retention schedule applies:

• Account registration and KYC records: Retained for a minimum of five (5) years after account closure, in compliance with PAGCOR KYC record-keeping requirements and the AMLA's record retention mandate under RA 9160.
• Financial transaction records: Retained for a minimum of five (5) years after the transaction date, as required by AMLA and applicable tax regulations.
• Gaming activity logs: Retained for a minimum of three (3) years for dispute resolution purposes and PAGCOR operational reporting, and up to five (5) years where records are relevant to ongoing AML monitoring.
• Customer support communications: Retained for two (2) years after the close of the relevant support interaction, unless the content is relevant to an ongoing legal matter or dispute, in which case it is retained until final resolution.
• Self-exclusion and responsible gaming records: Retained for the duration of the exclusion period plus five (5) years to prevent circumvention of exclusion requests through re-registration.
• Technical and device logs: Retained for a rolling twelve (12) months for security and fraud prevention purposes, after which they are automatically purged or anonymised.
• Marketing consent records: Retained for the period during which consent is active, plus three (3) years after consent is withdrawn, as evidence of the consent history.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with jl969's data disposal procedures. Anonymised data may be retained indefinitely for statistical and analytical purposes where it can no longer be used to identify an individual.

Security Measures

jl969 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, and disclosure. These measures include, but are not limited to:

• Transport Layer Security (TLS): All data transmitted between your device and jl969.app is protected by 256-bit TLS encryption. The jl969 login page, cashier pages, and all authenticated platform areas operate exclusively over HTTPS.
• Password hashing: Account passwords are stored as salted cryptographic hashes using industry-standard algorithms. jl969 does not store, view, or transmit plaintext passwords.
• Access controls: Access to jl969 systems containing personal data is restricted to authorised personnel through role-based access controls, multi-factor authentication for internal systems, and audit logging of all data access events.
• Server infrastructure security: jl969's servers are hosted in secure data centre facilities with physical access controls, redundant systems, and regular security patching and vulnerability management.
• Fraud and anomaly detection: Automated systems monitor account activity for unusual patterns including multiple failed login attempts, rapid successive transactions, and login from unrecognised devices or locations, triggering security reviews or temporary account holds as appropriate.
• Staff training: jl969 personnel who have access to personal data receive mandatory data privacy and security training, and are bound by confidentiality obligations in their employment contracts.
• Incident response: jl969 maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in harm to data subjects, jl969 will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected data subjects without undue delay.

While jl969 takes all reasonable and commercially practicable steps to secure your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the security of your own account credentials and for reporting any suspected unauthorised access to jl969 support promptly.

Cookies & Similar Tracking Technologies

jl969.app uses cookies and similar tracking technologies to enable platform functionality, maintain your session, prevent fraud, and improve the player experience. The following categories of cookies are used on jl969.app:

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary or fraud prevention cookies will prevent you from accessing your jl969 account and using platform features. Instructions for managing cookies in common browsers are available in the help documentation for Chrome, Firefox, Safari, and Samsung Internet.

jl969 does not use third-party advertising cookies, remarketing pixels, or social media tracking scripts on jl969.app.

Your Data Subject Rights

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to the personal data jl969 holds about you. To exercise any of these rights, contact jl969's Data Protection Officer as described in Section 13.

All rights requests will be responded to within 15 business days of receipt of a verified request. jl969 may request additional identification verification before processing rights requests to prevent unauthorised access to another person's data.

Children's Privacy

jl969 does not knowingly collect personal data from persons under 21 years of age. The jl969 platform is intended exclusively for adults who are at least 21 years of age, in compliance with PAGCOR age restriction requirements for real-money online gaming in the Philippines.

jl969 implements age verification procedures during the registration and KYC process to prevent underage access. If jl969 becomes aware that personal data has been collected from a person under 21 years of age, it will take immediate steps to delete that data and close the associated account in accordance with its underage access procedures.

If you are a parent or guardian and believe your child has registered for a jl969 account, please contact jl969 support immediately. jl969 will investigate and take appropriate action, including account closure and data deletion, without delay.

Cross-Border Data Transfers

jl969 processes and stores your personal data primarily within the Republic of the Philippines. Where it is necessary to transfer personal data to service providers or partners located outside the Philippines — for example, where a game technology provider or cloud infrastructure component is based abroad — jl969 ensures that adequate safeguards are in place for the protection of your personal data consistent with RA 10173 requirements.

Safeguards for cross-border data transfers include:

• Data processing agreements that impose data protection standards equivalent to those required under RA 10173 on recipient organisations.
• Where applicable, reliance on adequacy determinations or other approved transfer mechanisms recognised by the National Privacy Commission.
• Restrictions on the use of transferred data to the specific processing purpose for which the transfer was made.

jl969 does not transfer your financial transaction data, KYC documents, or complete personal profiles to entities outside the Philippines except where strictly necessary for the processing purposes described in this Policy and under the safeguard arrangements described above.

Updates to This Privacy Policy

jl969 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in applicable law, PAGCOR regulatory requirements, our data processing practices, or platform features. The current version of this Policy is always accessible at jl969.app/privacy-policy.

Where changes are material — meaning they significantly affect how we collect, use, or share your personal data — jl969 will provide advance notice to registered players via the mobile number or email address on file, or through a prominent notice on jl969.app, at least seven (7) days before the changes take effect.

The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. Your continued use of jl969.app after the effective date of any update constitutes your acknowledgement of the revised Policy. If you do not accept the updated Policy, you must cease using jl969 and contact support to initiate account closure.

Contact, Complaints & NPC Referral

If you have questions about this Privacy Policy, wish to exercise your data subject rights, or have a concern about how jl969 handles your personal data, please contact jl969's Data Protection Officer through the following channels:

jl969 will investigate all privacy complaints and endeavour to resolve them directly. If you are not satisfied with jl969's response to your complaint, you have the right to escalate your concern to the National Privacy Commission (NPC) of the Philippines. The NPC is the government agency responsible for administering and enforcing the Data Privacy Act of 2012. Information on filing a complaint with the NPC is available through official Philippine government channels.

For matters related to PAGCOR licensing compliance, you may also contact the Philippine Amusement and Gaming Corporation directly through official PAGCOR government channels.