Privacy Policy

01 Introduction & Scope

jlluck is a PAGCOR-regulated online casino and sports betting platform operated for the benefit of Filipino players aged 21 and above. As a licensed operator, jlluck is legally obligated to collect certain personal data from registered players to comply with PAGCOR's Know Your Customer (KYC) requirements, Anti-Money Laundering (AML) obligations under Republic Act No. 9160 (as amended), and the data protection standards prescribed by Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA).

This Policy applies to all personal information collected through:

• The jlluck website at jlluck.org and all associated subdomains and mobile-optimised interfaces;
• Account registration and KYC verification processes;
• Financial transactions including deposits and withdrawals;
• Customer support interactions via live chat and email;
• Promotional and loyalty programme participation;
• Automated data collection technologies including cookies and server logs.

This Policy does not apply to third-party websites, applications, or services that may be linked from the jlluck platform. jlluck is not responsible for the privacy practices of such third parties.

02 Personal Data We Collect

jlluck collects the following categories of personal data, depending on the nature of your interaction with the platform:

2.1 Identity & Registration Data

This data is collected during account registration and KYC verification. Providing accurate identity data is a mandatory requirement under PAGCOR regulations. Players who fail to complete KYC will not be permitted to deposit, wager, or withdraw funds.

2.2 Financial & Transaction Data

Financial data is collected to process your deposits and withdrawals and to fulfil AML reporting obligations. jlluck does not store full debit or credit card numbers. All payment data is tokenised and handled by PAGCOR-approved payment processors operating under their own data security standards.

2.3 Gaming & Behavioural Data

Gaming activity data is collected to fulfil our PAGCOR reporting obligations, to administer bonuses and promotions, to operate responsible gaming tools (such as deposit limits and loss limits), and to detect and prevent fraud or bonus abuse.

2.4 Technical & Device Data

Technical data is collected automatically whenever you access the jlluck platform and is used primarily for security purposes — including detecting account takeover attempts, verifying that you are accessing the platform from within the Philippines, and preventing VPN-based circumvention of geographic restrictions.

03 How We Collect Your Data

jlluck collects personal data through the following methods:

• Direct submission: Information you voluntarily provide when completing the registration form, KYC verification upload, payment processing forms, or customer support contact requests.
• Automated collection: Data generated automatically by your use of the platform, including cookies, session tokens, server access logs, and device fingerprinting signals.
• Third-party verification partners: Identity verification data obtained from government-accredited ID verification services that jlluck uses to cross-check the authenticity of KYC documents submitted by players.
• Payment processors: Confirmation and reference data returned by PAGCOR-approved payment gateways following successful deposit or withdrawal transactions.
• PAGCOR and regulatory sources: In certain circumstances, jlluck may receive data from PAGCOR or Philippine law enforcement authorities in connection with ongoing regulatory reviews or investigations.

04 Legal Basis for Processing

Under Republic Act No. 10173, jlluck processes your personal data on the following legal grounds:

• Contractual necessity: Processing your identity, financial, and gaming activity data is necessary to fulfil our contractual obligations to you as a registered player — including account management, payment processing, and game delivery.
• Legal obligation: jlluck is legally required to collect and retain certain data under PAGCOR regulations, the Anti-Money Laundering Act (RA 9160 as amended), and NPC-issued compliance circulars. This includes KYC data, transaction records, and gaming activity logs.
• Legitimate interests: jlluck processes technical and behavioural data on the basis of legitimate interests — specifically the prevention of fraud, detection of bonus abuse, and ensuring platform security — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where jlluck processes your data for optional purposes — such as sending you promotional communications about new bonuses or game releases — we will first obtain your explicit consent. You may withdraw consent for marketing communications at any time by updating your notification preferences in account settings.

05 How We Use Your Personal Data

jlluck uses your personal data strictly for the following purposes:

• Account creation and management: Creating, verifying, and maintaining your Player Account on the jlluck platform, including processing login authentication and managing account security settings.
• KYC and age verification: Verifying that you are at least 21 years of age and a resident of the Philippines, as required by PAGCOR and Philippine law. jlluck takes its age verification obligations seriously — protecting minors from exposure to gambling is a core compliance priority.
• Payment processing: Facilitating your deposits and withdrawal requests through PAGCOR-approved payment channels including GCash, PayMaya, BPI, BDO, and Metrobank.
• Fraud prevention and platform security: Detecting and investigating suspicious activity, unauthorised account access, bonus abuse, money laundering attempts, and VPN usage in violation of geographic restrictions.
• Responsible gaming: Monitoring your gaming activity to power responsible gaming tools — including deposit limits, loss limits, session reminders, and self-exclusion — and to flag potential problem gambling patterns for proactive intervention.
• Regulatory reporting: Submitting required data and reports to PAGCOR, the Anti-Money Laundering Council (AMLC), and the National Privacy Commission (NPC) as required by applicable Philippine law.
• Customer support: Providing assistance through our live chat and email support channels, maintaining records of your support interactions for quality assurance and dispute resolution purposes.
• Marketing communications (with your consent): Sending you personalised communications about promotions, bonuses, new game releases, and platform updates — only where you have opted in to receive such communications.
• Platform improvement: Analysing aggregated, anonymised usage data to improve the design, performance, and functionality of the jlluck platform.

06 Data Sharing & Disclosure

jlluck does not sell, rent, or commercially trade your personal data. We share your data only in the following circumstances and only to the extent strictly necessary:

6.1 Regulatory Authorities

jlluck shares player data with PAGCOR and other Philippine government agencies — including the AMLC and the NPC — where required by law or pursuant to a valid regulatory order, court order, or law enforcement request. jlluck will notify you of such disclosures where legally permitted to do so.

6.2 Payment Processors

Transaction reference data is shared with PAGCOR-approved payment service providers (including GCash, PayMaya, and partner banks) solely to process your financial transactions. All payment processors engaged by jlluck are contractually obligated to process your data only on jlluck's instructions and in compliance with RA 10173.

6.3 KYC and Identity Verification Providers

Identity document data submitted during KYC verification is processed by jlluck's contracted identity verification partner to confirm the authenticity of your government-issued ID. This partner operates under a data processing agreement that meets the NPC's requirements for personal information processors.

6.4 Game Content Providers

jlluck's game library is powered by third-party game providers including JILI Games and other licensed studios. These providers receive only the minimum data necessary to deliver game sessions — typically a session token and anonymised player identifier — and do not receive your full identity or financial data.

6.5 Corporate Transactions

In the event of a merger, acquisition, or restructuring involving jlluck, your personal data may be transferred to the successor entity, subject to the same data protection commitments set out in this Policy. Affected players will be notified of any such transfer before it takes effect.

07 Cookies & Tracking Technologies

7.1 Types of Cookies Used

The jlluck platform uses the following categories of cookies and similar tracking technologies:

• Strictly Necessary Cookies: These cookies are essential for the platform to function and cannot be disabled. They include session authentication tokens, CSRF protection cookies, and load balancing identifiers. No personally identifiable information is stored in these cookies beyond what is necessary for secure session management.
• Functional Cookies: These cookies remember your preferences — such as your chosen language setting and notification preferences — to provide a more personalised experience across sessions.
• Analytics Cookies: jlluck uses first-party analytics cookies to understand how players navigate and use the platform. This data is aggregated and anonymised; it is used solely for internal platform improvement and is never shared with third-party analytics vendors.

7.2 Third-Party Advertising Cookies

jlluck does not deploy third-party advertising cookies, retargeting pixels, or any tracking technology that enables external advertisers to serve targeted ads to you based on your jlluck activity. This is a firm policy commitment.

7.3 Managing Cookies

You can manage or block non-essential cookies at any time through your browser's built-in cookie management settings. Please note that disabling strictly necessary cookies will impair your ability to log in and use the jlluck platform. For instructions on managing cookies in your specific browser, refer to your browser's official help documentation.

08 Data Retention

jlluck retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• KYC and identity documents: Retained for a minimum of five (5) years following account closure, as required by PAGCOR regulations and the Anti-Money Laundering Act.
• Transaction and financial records: Retained for a minimum of five (5) years following the date of the transaction, in compliance with AMLC record-keeping obligations.
• Gaming activity logs: Retained for three (3) years following account closure for dispute resolution, regulatory audit, and responsible gaming review purposes.
• Customer support records: Retained for two (2) years following the resolution of the relevant support interaction or complaint.
• Marketing consent records: Retained for as long as you remain a registered player, and for one (1) year following account closure, to demonstrate compliance with consent-based marketing obligations.
• Technical and access logs: Retained for ninety (90) days from the date of generation, after which they are securely deleted unless retained for an ongoing security investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with NPC-recommended data disposal standards. Anonymised, aggregated data that can no longer be linked to an individual player may be retained indefinitely for statistical and platform improvement purposes.

09 Data Security

jlluck implements a comprehensive set of technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction:

• Encryption: All data at rest is encrypted using AES-256. All data in transit is protected by TLS 1.3. Sensitive fields such as passwords are stored as salted hashes and are never stored in recoverable plain text.
• Access controls: Access to personal data within jlluck's systems is restricted on a strict need-to-know basis. Staff access is governed by role-based access controls, mandatory multi-factor authentication, and comprehensive access audit logging.
• Infrastructure security: The jlluck platform is hosted on a secured, PAGCOR-compliant infrastructure with continuous intrusion detection monitoring, automated vulnerability scanning, and regular penetration testing by independent security assessors.
• Payment security: jlluck's payment processing environment meets PCI DSS standards applicable to our level of card data interaction. Full card numbers are never stored on jlluck's servers.
• Staff training: All jlluck personnel with access to personal data receive mandatory privacy and data security training as part of their onboarding process and annually thereafter.

10 Your Data Rights Under RA 10173

As a data subject protected by the Philippine Data Privacy Act of 2012, you are entitled to exercise the following rights with respect to your personal data held by jlluck:

To exercise any of the above rights, please contact jlluck's Data Protection Officer via live chat or email at [email protected]. jlluck will respond to all verified data rights requests within fifteen (15) business days, as required by the DPA's implementing rules and regulations.

11 Children & Minors

The jlluck platform is strictly intended for individuals who are at least twenty-one (21) years of age. This age restriction is mandated by PAGCOR regulations governing online gambling in the Republic of the Philippines. jlluck does not knowingly collect personal data from individuals under the age of 21.

If jlluck discovers or is notified that a minor has registered a Player Account or provided personal data through the platform, jlluck will immediately suspend the account, delete the associated personal data, and refer the matter to PAGCOR as required by our operating licence conditions.

Parents and guardians who believe that a minor may have accessed the jlluck platform using their credentials or created an account without authorisation are encouraged to contact jlluck customer support immediately via live chat so the matter can be investigated and remedied without delay.

12 International Data Transfers

jlluck's primary data infrastructure is hosted within the Philippines. However, certain technical service providers — including cloud infrastructure vendors and identity verification partners — may process or store data in data centres located outside the Philippines.

Where such international transfers occur, jlluck ensures that appropriate safeguards are in place as required by the NPC's implementing rules and regulations, including the use of standard contractual clauses, data processing agreements, or transfers to jurisdictions recognised by the NPC as providing an adequate level of data protection.

jlluck does not transfer your personal data to jurisdictions that lack adequate data protection frameworks without first implementing contractual safeguards that afford your data a level of protection equivalent to that provided under RA 10173. You may request information about the specific safeguards in place for any international transfer of your data by contacting our Data Protection Officer.

13 Amendments to This Policy

jlluck reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, PAGCOR regulatory requirements, NPC guidance, or our internal data processing practices. All amendments will be published on this page with an updated effective date clearly displayed at the top of the Policy.

Where a proposed amendment materially affects your rights or the way we process your personal data, jlluck will provide advance notice of the change via your registered email address and through a prominent in-platform notification at least fourteen (14) days before the amendment takes effect.

Your continued use of the jlluck platform following the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not accept the amended terms, you must cease using the platform and may request account closure by contacting customer support.

14 Contact & Data Protection Officer

jlluck has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with RA 10173 and this Privacy Policy. If you have any questions, concerns, or requests relating to this Policy or the way jlluck handles your personal data, you may contact the DPO through the following channels:

• Email: [email protected] — please include "Data Privacy Request" in the subject line.
• Live Chat: Available 24/7 through the jlluck platform. Our support team will escalate data rights requests to the DPO within one (1) business day.

If you are not satisfied with jlluck's response to your data rights request or privacy concern, you have the right to lodge a formal complaint with the National Privacy Commission of the Philippines at [email protected] or through the NPC's official website at privacy.gov.ph.