jilig Privacy Policy – Your Data, Your Rights

1. Data Controller

jilig ("jilig", "we", "us") is the data controller responsible for the personal information collected through the jilig platform at jilig.one. As data controller, jilig determines the purposes and means of processing your personal data and is accountable for ensuring that such processing complies with the Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations, and all applicable issuances of the National Privacy Commission ("NPC") of the Philippines.

jilig operates under PAGCOR authorization and is therefore also subject to data handling requirements applicable to PAGCOR-licensed gaming operators, including Anti-Money Laundering Act (AMLA) compliance obligations that require retention and reporting of certain player records.

2. Data We Collect

jilig collects the following categories of personal data from players and platform users:

jilig does not collect sensitive personal information as defined under Section 3(l) of the DPA (such as race, ethnicity, religious beliefs, health data, or sexual orientation) unless specifically required by applicable law or regulation.

3. How We Collect Data

jilig collects personal data through the following means:

• Direct collection — information you provide when registering a jilig account, completing KYC verification, making deposits or withdrawal requests, or contacting jilig support;
• Automated collection — technical data collected automatically when you access and use the jilig platform, through server logs, session tracking, and cookies (see Section 9);
• Third-party sources — identity verification providers, payment processors (GCash, Maya, banks), fraud detection services, and PAGCOR where required for regulatory compliance;
• Public sources — publicly available government records where required for KYC or AML compliance purposes.

4. Purposes & Legal Bases

jilig processes your personal data for the following purposes, each grounded in a lawful basis under the DPA:

Where jilig relies on consent as the legal basis for processing, you have the right to withdraw that consent at any time by updating your communication preferences in your jilig account settings or by contacting the jilig Data Protection Officer.

5. Sharing Your Data

jilig does not sell your personal data to third parties. jilig shares personal data only in the following circumstances:

• Regulatory authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies where disclosure is required by law or regulation;
• Payment processors — GCash (GXI), Maya (Voyager Innovations), BPI, BDO, Metrobank, and other payment service providers, solely to the extent necessary to process transactions;
• Identity verification providers — third-party KYC service providers engaged to verify identity documents and perform age checks, operating under data processing agreements with jilig;
• Game providers — third-party game software providers may receive minimal technical session data required to operate games within the jilig platform;
• Law enforcement — Philippine law enforcement authorities where disclosure is required by court order, subpoena, or applicable law;
• Professional advisers — lawyers, auditors, and compliance consultants bound by confidentiality obligations.

All third parties with whom jilig shares personal data are required to process that data only for the specified purpose and in compliance with applicable privacy law. jilig does not permit third parties to use your data for their own independent marketing purposes.

6. Data Retention

jilig retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods mandated by Philippine law:

• Account and identity data: retained for a minimum of five (5) years following account closure, as required by AMLA and PAGCOR regulations;
• Financial transaction records: retained for a minimum of five (5) years from the date of each transaction;
• Gaming activity data: retained for a minimum of three (3) years, or longer where required for dispute resolution or regulatory inquiry;
• Communications and support records: retained for two (2) years following resolution of the relevant matter;
• Marketing consent records: retained for the duration of the consent period plus one (1) year for compliance purposes.

After the applicable retention period, jilig will securely delete or anonymize personal data in accordance with its data disposal procedures. Anonymized and aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and analytical purposes.

7. Security

jilig implements industry-standard technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• TLS/SSL encryption for all data transmitted between your device and jilig servers;
• Encryption at rest for sensitive personal data stored in jilig's systems;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Regular security assessments and penetration testing of the jilig platform;
• Two-factor authentication options available to all jilig account holders;
• Incident response procedures aligned with NPC breach notification requirements under the DPA.

In the event of a personal data breach that is likely to result in harm to your rights and freedoms, jilig will notify affected players and the National Privacy Commission in accordance with the timeframes prescribed by the DPA and NPC Circular No. 16-03.

8. Your Rights

jilig will respond to data subject rights requests within thirty (30) calendar days of receipt. Where the request is complex or involves a large volume of data, jilig may extend this period by a further 30 days with notification to you.

9. Cookies & Tracking

jilig uses cookies and similar tracking technologies to operate and improve the platform. The following types of cookies are used:

• Strictly necessary cookies — required for platform functionality including session management, login state, and security. These cannot be disabled.
• Functional cookies — remember your preferences such as language settings and lobby filter selections.
• Analytics cookies — collect anonymized data about platform usage to help jilig understand how players interact with the site and improve the experience. No personally identifiable information is transmitted through analytics cookies.
• Security cookies — used for fraud detection, bot identification, and multi-accounting prevention.

jilig does not use third-party advertising or retargeting cookies. You can manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent the jilig platform from functioning correctly.

10. Minors

jilig does not knowingly collect personal data from individuals under the age of 21. The jilig platform is strictly for adults aged 21 and above, in accordance with PAGCOR regulations. If jilig becomes aware that personal data has been collected from an individual under 21, it will take immediate steps to delete that data and close the associated account.

If you believe that jilig has inadvertently collected personal data from an individual under the age of 21, please contact jilig immediately via the contact details in Section 13.

11. Third-Party Services

The jilig platform integrates with third-party services — including GCash, Maya, game providers, and identity verification tools — that operate under their own privacy policies. jilig is not responsible for the privacy practices of these third parties beyond the scope of data processing agreements entered into between jilig and such parties. Players are encouraged to review the privacy policies of third-party payment and game providers they interact with through jilig.

12. Changes to This Policy

jilig reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or jilig's data processing practices. Where changes are material, jilig will notify registered players through the platform (via notification banner or in-account message) at least 14 days before the changes take effect.

The effective date of the current version is displayed at the top of this page. Continued use of jilig after the effective date of a revised Privacy Policy constitutes acceptance of the updated terms. If you do not accept the revised policy, you must stop using jilig and may close your account in accordance with the Terms and Conditions.

13. Contact & DPO

For data subject rights requests, privacy-related questions, or to contact jilig's designated Data Protection Officer (DPO), please use the following contact channels:

jilig's DPO will respond to all privacy inquiries within the timeframes prescribed by the Data Privacy Act of 2012 and NPC regulations.