Privacy Policy

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, the data controller responsible for the personal information collected through jl20.vip is:

jl20 has appointed a Data Protection Officer (DPO) in accordance with NPC requirements applicable to personal information controllers processing sensitive personal information. The DPO is responsible for overseeing jl20's data privacy compliance program and serving as the primary point of contact for data subject rights requests.

jl20 collects the following categories of personal data in connection with operating the platform and meeting our regulatory obligations:

Identity and KYC Data: Full legal name, date of birth, nationality, gender, and a copy of your Philippine government-issued photo ID (such as PhilSys National ID, UMID, Driver's License, Passport, or PRC ID). This data is collected to comply with PAGCOR's mandatory Know Your Customer (KYC) requirements and Republic Act No. 9160 (Anti-Money Laundering Act).

Contact Data: Philippine mobile number, email address, and residential address. These are used for account authentication, transactional communications (deposits, withdrawals, bonuses), and regulatory reporting.

Financial Data: Payment account identifiers (GCash number, Maya account, bank account numbers) associated with your jl20 account for deposit and withdrawal processing. jl20 does not store full credit or debit card numbers. Payment processing is handled through certified payment processors subject to their own security standards.

Gaming Activity Data: Bet history, game session logs, wager amounts, win and loss records, bonus activity, and responsible gaming tool usage. This data is required for PAGCOR regulatory reporting, dispute resolution, and responsible gaming monitoring.

Technical Data: IP address, device type, operating system, browser type, session timestamps, and geolocation data (country and region level). This data is collected to maintain platform security, detect fraud, verify jurisdictional eligibility, and optimize platform performance.

Communications Data: Records of your interactions with jl20 customer support, including live chat transcripts and support ticket history. These are retained for dispute resolution, quality assurance, and regulatory audit purposes.

jl20 collects personal data through the following channels:

• Direct submission: Information you provide directly when registering an account, completing KYC verification, making deposits or withdrawal requests, contacting customer support, or using responsible gaming tools.
• Automated collection: Technical data collected automatically as you browse and use the jl20 platform, including through server logs, cookies, session tracking, and device fingerprinting technology.
• Payment processors: Transaction confirmation data received from GCash, Maya, BPI, BDO, UnionBank, and other payment processors when you make a deposit or receive a withdrawal. The payment processors' own privacy policies govern their handling of your data within their systems.
• Identity verification services: Data received from third-party identity verification providers used to assist in the KYC review process for government ID authentication.
• PAGCOR and regulatory sources: In limited circumstances, jl20 may receive information from PAGCOR or law enforcement agencies in connection with regulatory compliance, responsible gaming enforcement (such as self-exclusion list cross-referencing), or investigations into prohibited conduct.

Under the Philippine Data Privacy Act, jl20 processes personal data on the following lawful bases:

jl20 uses the personal data we collect for the following specific purposes:

• Account operation: Creating and maintaining your jl20 account, authenticating your identity at login, processing transactions, and managing your account balance and bonus credits.
• Regulatory compliance: Meeting jl20's obligations under PAGCOR licensing conditions, including KYC verification, anti-money laundering (AML) monitoring, transaction reporting, and responsible gaming program enforcement.
• Payment processing: Processing deposits to and withdrawals from your jl20 account via GCash, Maya, Philippine bank transfers, and other accepted payment methods.
• Fraud and security: Detecting and preventing fraudulent activity, account takeover attempts, money laundering, and other prohibited conduct. This includes automated risk scoring, device fingerprinting, and IP address analysis.
• Responsible gaming: Monitoring gaming patterns to identify indicators of problem gambling behavior, enforcing player-set limits and self-exclusion restrictions, and conducting outreach to players who may benefit from responsible gaming support.
• Platform improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, and user experience. Individual player data is not used for this purpose without anonymisation.
• Marketing (opt-in only): Sending promotional offers, bonus notifications, and platform updates to players who have specifically opted in to marketing communications. You can withdraw consent at any time through your account notification settings or by contacting support.
• Customer support: Responding to your enquiries, resolving disputes, and maintaining records of your support interactions for quality assurance and audit purposes.

jl20 uses cookies and similar tracking technologies on the jl20.vip platform for the following purposes:

• Essential cookies: Required for the platform to function correctly. These include session authentication cookies, security tokens, and load-balancing identifiers. Essential cookies cannot be disabled without significantly impairing platform functionality.
• Functional cookies: Store your platform preferences such as language settings, game lobby sorting preferences, and notification settings so they persist between sessions.
• Analytics cookies: Collect anonymised information about how players navigate the jl20 platform, which pages are visited, and how long sessions last. This data is used to improve platform design and performance. Analytics data is aggregated and does not identify individual players.
• Security cookies: Used by jl20's fraud detection systems to identify returning devices, flag suspicious login patterns, and maintain session integrity.

jl20 does not deploy third-party advertising cookies or tracking pixels that allow external companies to observe your behaviour across other websites.

jl20 shares personal data with third parties only in the following circumstances, and only to the extent necessary for the specified purpose:

• Payment processors: GCash, Maya, BPI, BDO, UnionBank, Metrobank, Coins.ph, and 7-Eleven Cliqq receive the minimum transaction data necessary to process deposits and withdrawals. Each payment processor is responsible for data it holds within its own systems under its own privacy policy.
• KYC and identity verification providers: Third-party identity verification services engaged by jl20 receive copies of submitted KYC documents solely for the purpose of verifying authenticity and confirming identity data against government records.
• PAGCOR: jl20 is legally obligated to submit specified player and transaction data to PAGCOR as part of its licensing obligations. The scope and format of this reporting is defined by PAGCOR regulations.
• Anti-Money Laundering Council (AMLC): jl20 is a covered institution under Republic Act No. 9160. We are required to file suspicious transaction reports (STRs) and covered transaction reports (CTRs) with the AMLC as mandated by Philippine law.
• Law enforcement and government authorities: jl20 will disclose personal data to Philippine law enforcement agencies, courts, or government bodies when required by a valid legal process, court order, or statutory obligation.
• Technology service providers: Cloud hosting, security monitoring, and platform infrastructure providers who process data on jl20's behalf under data processing agreements that require them to maintain confidentiality and security standards equivalent to those in this policy.
• Game providers: Game providers (such as JILI, PG Soft, and Evolution) receive session tokens and bet transaction data necessary to operate game rounds. Game providers do not receive your full KYC identity data or payment account details.

jl20 does not sell personal data to any third party. All third-party data sharing described above is either legally required, operationally necessary for contract performance, or conducted under confidentiality and data processing agreements with appropriate security requirements.

As an online platform with technology infrastructure and game provider relationships that may involve servers and services outside the Philippines, jl20 may transfer certain personal data to countries other than the Philippines. Where such transfers occur, jl20 takes appropriate safeguards to ensure that your data receives a level of protection equivalent to that provided under the Philippine Data Privacy Act.

Safeguards applied to international transfers include:

• Contractual clauses in data processing agreements requiring recipient parties to apply security and privacy standards consistent with Philippine DPA requirements.
• Transfer of data only to third parties whose data protection practices have been assessed and found adequate for the intended processing purpose.
• Encryption of data in transit using TLS 1.3 protocol for all transfers between jl20 systems and third-party processors.

The primary data processing infrastructure for jl20 player data is located within the Philippines or in jurisdictions with equivalent data protection frameworks. KYC documents and financial records are stored in compliance with PAGCOR data residency requirements.

jl20 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to applicable legal and regulatory retention requirements. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. Data that has been anonymised (such that it can no longer be linked to an identifiable individual) may be retained indefinitely for statistical and analytical purposes.

jl20 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, and destruction:

• Encryption in transit: All data transmitted between your device and jl20 servers is encrypted using TLS 1.3 protocol with AES-256-GCM cipher. The platform enforces HTTPS exclusively — unencrypted HTTP connections are rejected.
• Encryption at rest: Stored personal data — including KYC documents and financial records — is encrypted using AES-256 encryption. Encryption keys are managed through a dedicated key management service with strict access controls.
• Access controls: Access to personal data within jl20's internal systems is restricted on a need-to-know basis using role-based access control (RBAC). All internal access is logged and audited.
• Staff training: jl20 personnel with access to personal data undergo data privacy training covering their obligations under the Philippine Data Privacy Act, jl20's internal data handling policies, and incident response procedures.
• Penetration testing: jl20's platform undergoes periodic independent security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response: jl20 maintains a documented incident response plan. In the event of a data breach, jl20 will follow NPC notification requirements and communicate with affected players as specified in Section 5 of this policy.

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights regarding your personal data held by jl20:

• Right to be informed: You have the right to be informed of how your personal data is collected and used, as set out in this Privacy Policy.
• Right of access: You have the right to obtain a copy of the personal data jl20 holds about you and information about how it is processed. Access requests are fulfilled within 30 calendar days.
• Right to rectification: You have the right to request correction of inaccurate or incomplete personal data. Minor corrections (such as contact details) can be made directly through your account settings. Corrections to KYC identity data require re-submission of supporting documentation.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent (for consent-based processing), or where you have objected to processing and jl20 has no overriding legitimate interest. Note that jl20 is legally required to retain certain data (particularly KYC and transaction records) for defined periods under PAGCOR and AMLA regulations, which may limit erasure rights in those specific categories.
• Right to object: You have the right to object to the processing of your personal data for direct marketing purposes at any time. You also have the right to object to processing based on legitimate interest, subject to jl20 demonstrating compelling legitimate grounds.
• Right to data portability: Where technically feasible, you have the right to receive a copy of personal data you have provided to jl20 in a structured, commonly used, machine-readable format.
• Right to lodge a complaint: If you believe jl20 has not handled your personal data in accordance with the Philippine Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission (NPC) at www.privacy.gov.ph.

To exercise any of the above rights, contact jl20's Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request — [Your Account Username]". jl20 will acknowledge receipt within 5 business days and fulfill the request within 30 calendar days. Identity verification may be required before processing the request.

The jl20 platform is strictly restricted to individuals aged 21 and above. jl20 does not knowingly collect personal data from individuals under 21 years of age. The KYC verification process is specifically designed to confirm that all account holders meet this age requirement before real-money game access is granted.

In the event that jl20 becomes aware that personal data has been collected from an individual under the age of 21, jl20 will immediately:

• Close the associated account.
• Void any wagering activity conducted through the account.
• Return deposited funds to the verified payment source.
• Delete all personal data associated with the account as soon as any applicable regulatory reporting obligations are satisfied.
• Report the incident to PAGCOR as required by licensing conditions.

If you believe that a minor has registered an account on jl20, please contact [email protected] immediately with the relevant details so the matter can be investigated and resolved promptly.

jl20's responsible gaming program involves the collection and processing of gaming activity data to monitor for indicators of problem gambling behavior. This processing is conducted in the legitimate interest of player welfare and is a condition of jl20's PAGCOR operating license.

Responsible gaming data processing at jl20 includes:

• Analysis of betting frequency, session duration, bet size escalation, and loss-chasing patterns to identify accounts that may benefit from responsible gaming outreach.
• Enforcement of player-set deposit limits, loss limits, cooling-off periods, and self-exclusion restrictions. Records of these tool activations are retained as described in Section 9.
• Cross-referencing of self-excluded accounts against registration attempts to prevent self-excluded players from creating new accounts on jl20.
• Sharing of self-exclusion data with PAGCOR's centralised responsible gaming register where required by licensing conditions.

jl20 may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, our data processing practices, or platform features. When material changes are made to this policy, jl20 will:

• Update the "Last updated" date and version number at the top of this document.
• Notify registered account holders by email to their registered address at least seven (7) calendar days before the updated policy takes effect.
• Display a prominent notice on the jl20 platform during the notice period.

Your continued use of the jl20 platform after the effective date of a revised Privacy Policy constitutes your acknowledgement of the revised policy. If you do not agree with the changes, you may close your account by contacting jl20 support before the effective date. Your rights under the Philippine Data Privacy Act are not affected by any changes to this policy.

For all data privacy enquiries, data subject rights requests, or concerns about how jl20 handles your personal information, please contact jl20's designated Data Protection Officer:

When contacting the DPO, please include your jl20 account username, a clear description of your request or concern, and any relevant transaction references or dates. Identity verification will be required before any personal data access request is fulfilled to ensure your data is not disclosed to an unauthorised party.