jlj6 Privacy Policy – How We Protect Your Personal Data

1 Who We Are

jlj6 (accessible at jlj6.app) is an online casino and sports betting platform operated by its licensed entity (the "Operator") under a licence issued by the Philippine Amusement and Gaming Corporation (PAGCOR). The Operator is the personal information controller responsible for your personal data under the Data Privacy Act of 2012 (Republic Act No. 10173, hereinafter "the DPA") and its Implementing Rules and Regulations.

For all privacy-related inquiries, please contact our Data Protection Officer (DPO) using the contact details provided in Section 15 of this Policy.

2 Scope of This Policy

This Privacy Policy applies to all personal data collected by jlj6 in connection with:

• Registration for and use of a jlj6 player account.
• Deposits, withdrawals, and all other financial transactions conducted through the jlj6 platform.
• Participation in casino games, live dealer tables, sports betting, bingo, and sabong on jlj6.
• Communications with jlj6's customer support team via live chat or email.
• Your browsing and interaction with the jlj6 website at jlj6.app.
• Your participation in jlj6 promotions, tournaments, loyalty programmes, and surveys.

This Policy does not apply to third-party websites or services linked to or integrated with jlj6 (such as payment processors' own websites). jlj6 is not responsible for the privacy practices of those third parties and encourages you to review their respective privacy policies.

3 Personal Data We Collect

jlj6 collects personal data in the following categories. We collect only what is necessary for the stated purposes:

We do not intentionally collect sensitive personal information beyond what is required for KYC compliance (specifically government ID data) and responsible gaming purposes. Where sensitive personal information is collected, it is handled with the heightened protections required by the DPA.

4 How We Use Your Personal Data

jlj6 uses the personal data collected for the following specific and legitimate purposes:

• Account Management: Creating and maintaining your jlj6 account, verifying your identity and age (21+), managing your login credentials, and processing account changes or closures.
• KYC and AML Compliance: Fulfilling identity verification obligations imposed by PAGCOR and Republic Act No. 9160 (Anti-Money Laundering Act) as amended. This includes verifying government IDs, screening against sanctions and watchlists, and reporting suspicious transactions to the Anti-Money Laundering Council (AMLC) where legally required.
• Transaction Processing: Processing deposits and withdrawals via GCash, Maya, BDO, BPI, Metrobank, Coins.ph, 7-Eleven, and USDT; reconciling transaction records; and investigating transaction disputes.
• Game Service Delivery: Enabling gameplay across all jlj6 categories — slots, live dealer, sports betting, bingo, and sabong — and maintaining accurate records of all gaming activity.
• Responsible Gaming: Monitoring gaming patterns to identify potential problem gambling behaviour, administering deposit limits, wagering limits, session alerts, cooling-off periods, and self-exclusion requests.
• Customer Support: Responding to your inquiries, resolving account or technical issues, and maintaining records of support interactions for quality assurance and dispute resolution purposes.
• Security and Fraud Prevention: Detecting, investigating, and preventing fraudulent activity, multi-accounting, bonus abuse, money laundering, and other prohibited conduct.
• Legal and Regulatory Obligations: Complying with applicable Philippine laws, PAGCOR conditions, court orders, and regulatory directives.
• Marketing Communications: Sending you promotional offers, bonus notifications, and product updates where you have given consent or where jlj6 has a legitimate interest — subject always to your right to opt out as described in Section 12.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve jlj6's games, features, and user experience. Aggregated analytics data does not identify individual players.

5 Lawful Bases for Processing

Under the DPA and its Implementing Rules and Regulations, jlj6 relies on the following lawful bases for processing personal data:

• Contractual Necessity: Processing is necessary for jlj6 to perform its obligations under the jlj6 Terms & Conditions — the contract between you and the Operator. Without this processing, jlj6 cannot create or maintain your account, process transactions, or deliver gaming services.
• Legal Obligation: Processing is required for jlj6 to comply with applicable Philippine laws, including PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160 as amended), the Data Privacy Act (RA 10173), and any lawful orders from Philippine regulatory or law enforcement authorities.
• Legitimate Interests: jlj6 processes certain data based on its legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and general business analytics — provided that those interests are not overridden by your rights and interests as a data subject.
• Consent: Where jlj6 relies on your consent as the lawful basis for processing — primarily for optional marketing communications — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6 Cookies & Tracking Technologies

jlj6 uses cookies and similar tracking technologies on the jlj6.app website and platform. Cookies are small text files placed on your device that help jlj6 operate efficiently, remember your preferences, and understand how you use the platform.

jlj6 uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without preventing you from using jlj6.
• Functional Cookies: Remember your preferences such as language settings, preferred game categories, and responsible gaming settings between sessions.
• Analytics Cookies: Collect anonymised data about how players use jlj6 — which features are most used, typical navigation paths, and session duration. This data helps jlj6 improve the platform. Analytics data is aggregated and does not identify individual players.
• Security and Fraud Prevention Cookies: Help jlj6 identify and block suspicious login attempts, bot traffic, and fraudulent activity by tracking device fingerprint patterns and IP consistency.

You may configure your browser to block or delete cookies. However, blocking strictly necessary cookies will prevent you from logging in to jlj6 or using core platform features. jlj6 does not use third-party advertising or cross-site tracking cookies.

7 Third-Party Disclosure

jlj6 does not sell, rent, or trade your personal data to third parties for their own commercial or marketing purposes. Personal data is shared with third parties only in the following limited circumstances, and only to the extent strictly necessary:

• Payment Processors: GCash (GXchange Inc.), Maya (PayMaya Philippines Inc.), BDO, BPI, Metrobank, Coins.ph, and other payment partners receive transaction data necessary to process deposits and withdrawals. These partners are independent data controllers bound by their own privacy policies and applicable Philippine financial regulation.
• Game Providers: Third-party game providers (including live dealer studios) may receive anonymised session and wagering data necessary to deliver game content and settle game outcomes. No personally identifiable information beyond a session token is shared with game providers for gameplay purposes.
• Regulatory and Law Enforcement Authorities: jlj6 is required by PAGCOR licensing conditions and Philippine law to share player information with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent authorities when lawfully required to do so.
• KYC and Identity Verification Service Providers: Third-party KYC technology providers who assist jlj6 in processing and verifying government ID documents. These providers operate as data processors under written data processing agreements that require them to process data only on jlj6's instructions and in compliance with the DPA.
• IT Infrastructure and Cloud Service Providers: Hosting, cloud storage, and cybersecurity service providers who provide infrastructure on which jlj6's platform operates. These providers act as data processors bound by data processing agreements and may not use personal data for any purpose other than providing the contracted service to jlj6.
• Legal and Professional Advisers: Lawyers, auditors, and other professional advisers engaged by jlj6 who may need access to personal data in connection with their advisory services, subject to professional confidentiality obligations.

8 Data Retention

jlj6 retains personal data for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, accounting, and reporting obligations. The following general retention periods apply:

• Account Data (active accounts): Retained for the duration of your jlj6 account and for a period of five (5) years following account closure, as required by PAGCOR licensing conditions and AML record-keeping obligations under RA 9160.
• KYC Documents: Retained for a minimum of five (5) years following the end of the business relationship, consistent with AML obligations under RA 9160 as amended by RA 10365.
• Transaction Records: Retained for a minimum of five (5) years following each transaction, as required by applicable Philippine financial regulation.
• Gaming History: Retained for a minimum of three (3) years for operational and dispute resolution purposes, and for longer periods where required by PAGCOR or applicable law.
• Customer Support Records: Retained for three (3) years following the resolution of the support interaction, unless a longer period is required in connection with an ongoing dispute or regulatory investigation.
• Marketing Consent Records: Retained for the duration of your account plus three (3) years, to demonstrate compliance with consent requirements under the DPA.

Where retention beyond these periods is necessary for the establishment, exercise, or defence of legal claims, or where required by a specific regulatory directive or court order, jlj6 will retain the relevant data for such longer period as is necessary.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with jlj6's internal data disposal procedures.

9 Your Data Subject Rights Under RA 10173

As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by jlj6. You may exercise any of these rights by contacting the jlj6 DPO using the details in Section 15:

To exercise any of the above rights, please contact jlj6's DPO as described in Section 15. jlj6 will respond to all verified data subject requests within thirty (30) calendar days. In complex cases, this period may be extended by a further thirty (30) days with notice to you.

10 Data Security Measures

jlj6 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption in Transit: All data exchanged between your device and jlj6 is encrypted using TLS 1.2 or higher (256-bit SSL). This protects your login credentials, payment details, and all other data during transmission.
• Encryption at Rest: Sensitive personal data — including KYC document images, government ID numbers, and payment references — is encrypted at rest on jlj6's servers using AES-256 encryption.
• Access Controls: Access to personal data within jlj6 is restricted on a strict need-to-know basis. Employee access is governed by role-based access controls, and all access to sensitive data is logged and audited.
• Password Security: Player passwords are stored as salted cryptographic hashes — never in plain text. jlj6 does not have the ability to retrieve your original password, only to verify it at login.
• OTP and Two-Factor Authentication: Login from unrecognised devices triggers an SMS OTP verification to your registered Philippine mobile number. Two-factor authentication via authenticator app is optionally available to all players.
• Penetration Testing and Vulnerability Management: jlj6 conducts regular security assessments of its platform infrastructure and addresses identified vulnerabilities in accordance with a risk-based remediation schedule.
• Incident Response: jlj6 maintains a documented data breach incident response procedure consistent with the NPC's personal data breach management regulations.

11 Children and Minors

jlj6 is strictly prohibited from accepting registrations from persons under twenty-one (21) years of age, consistent with PAGCOR's minimum age requirements for casino-style gambling in the Philippines. jlj6 does not knowingly collect personal data from individuals under the age of 21.

Where jlj6 discovers that personal data has been collected from a person under 21 — whether discovered through KYC review, player self-disclosure, third-party report, or any other means — jlj6 will immediately:

• Suspend the affected account.
• Void all wagers placed while the account was active.
• Return any net deposits remaining in the account balance.
• Permanently delete the personal data associated with the under-age registration, subject to any mandatory regulatory reporting obligations.

If you believe a person under 21 has accessed jlj6 using your details or created an account, please contact jlj6 immediately via live chat so we can investigate and take appropriate action.

12 Marketing Communications

Where you have consented during registration or via your Account settings, jlj6 may send you promotional offers, bonus notifications, new game announcements, and jlj6 news via SMS to your registered Philippine mobile number and/or to your registered email address.

You may opt out of marketing communications at any time by:

• Updating your communication preferences in your jlj6 Account settings (under Profile → Notifications).
• Contacting jlj6 live chat support and requesting removal from marketing communications.

Opt-out requests are processed within five (5) business days. Following opt-out, you will continue to receive transactional communications that are necessary for your account — such as deposit confirmations, withdrawal notifications, and security alerts — as these are not marketing communications and cannot be disabled without closing your account.

13 Cross-Border Data Transfers

jlj6's primary operations and data storage are based in the Philippines. Some of jlj6's third-party service providers — including certain cloud infrastructure, KYC verification, and game provider technology partners — may be located or may process data outside of the Philippines.

Where personal data is transferred outside the Philippines, jlj6 ensures that such transfers are carried out in compliance with Section 21 of the DPA and the National Privacy Commission's regulations on cross-border data transfers, including by implementing appropriate safeguards such as:

• Binding contractual clauses with receiving entities that impose data protection standards equivalent to those required under the DPA.
• Transferring only to jurisdictions that have been assessed as providing an adequate level of protection for personal data, or to specific entities within those jurisdictions that have provided appropriate safeguards.

You may request information about specific cross-border transfers affecting your personal data by contacting jlj6's DPO.

14 Changes to This Privacy Policy

jlj6 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR requirements, or NPC guidance. When material changes are made, jlj6 will notify you by:

• Sending a notification to your registered email address at least seven (7) calendar days before the change takes effect.
• Displaying a prominent notice on the jlj6 platform upon your next login.
• Updating the "Last Updated" date at the top of this Policy.

Your continued use of jlj6 following the effective date of a revised Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with the revised Policy, you should close your jlj6 account before the changes take effect and contact our DPO to exercise any applicable data rights.

The current version of this Privacy Policy is always available at jlj6.app/privacy-policy.

15 Contact Information & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or jlj6's handling of your personal data — including requests to exercise your data subject rights under RA 10173 — please contact jlj6 through the following channels:

• Live Chat (fastest): Available 24 hours a day, 7 days a week, via the chat widget on the jlj6 platform. Suitable for general privacy inquiries, marketing opt-out requests, and account data queries.
• Email (plain text — not a link): [email protected] — Please include "Data Privacy Request" in the subject line for all DPA-related inquiries. Response time: within twenty-four (24) hours on business days.

When submitting a data subject rights request, please provide: your full registered name, your registered Philippine mobile number, a description of the right you wish to exercise, and a copy of a valid Philippine government-issued ID for identity verification purposes. jlj6 cannot process data subject requests from unverified individuals.