jilluu Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below:

• "jilluu," "we," "us," "our" — the operator of the jilluu online gaming platform at jilluu.app, regulated under PAGCOR's licensing framework.
• "Platform" — the jilluu website at jilluu.app, including all game lobbies, account management interfaces, and mobile-responsive environments accessible under that domain.
• "User," "you," "your" — any individual who accesses the Platform, whether as a registered account holder or unregistered visitor.
• "Personal Data" — any information relating to an identified or identifiable natural person, as defined under Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations.
• "Processing" — any operation performed on Personal Data, including collection, recording, organization, storage, updating, retrieval, use, disclosure, erasure, or destruction.
• "Data Privacy Act" — Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines, together with its Implementing Rules and Regulations.
• "NPC" — the National Privacy Commission of the Philippines, the government body responsible for administering and enforcing the Data Privacy Act.
• "PAGCOR" — the Philippine Amusement and Gaming Corporation.
• "KYC" — Know Your Customer, the identity and document verification process required for regulatory compliance.
• "DPO" — Data Protection Officer, the designated individual within jilluu responsible for overseeing compliance with the Data Privacy Act and this Policy.

This Privacy Policy applies to all Personal Data collected by jilluu in connection with the operation of the Platform, including data collected when you:

• Visit jilluu.app, whether or not you hold a registered Account;
• Create, access, or manage a jilluu Account;
• Make a deposit or request a withdrawal;
• Participate in any game, betting market, bingo session, or promotion;
• Contact jilluu's customer support team;
• Respond to any survey, feedback request, or marketing communication from jilluu.

This Policy does not apply to the privacy practices of third-party game providers, payment processors, or any other third parties whose services may be accessed through or in connection with the Platform. Those entities maintain their own independent privacy policies.

jilluu collects Personal Data through multiple channels. The categories of data collected, and the context in which they are gathered, are set out below.

• Identity Data: Full legal name, date of birth, nationality, and copies of government-issued identification documents (e.g., PhilSys ID, Philippine Passport, Driver's License, UMID) provided during registration and KYC verification;
• Contact Data: Email address, Philippine mobile number, and residential address;
• Financial Data: Payment method details (GCash account number, PayMaya account, bank account details for BDO, BPI, Metrobank, or UnionBank) provided for deposit and withdrawal processing. jilluu does not store full card numbers or CVV codes — these are processed directly by certified payment processors;
• Account Credentials: Username and hashed password (jilluu never stores passwords in plain text);
• Communications Data: Records of support interactions, live chat transcripts, email correspondence, and any documents or screenshots you share with jilluu's support team.

• Technical Data: IP address, device type, operating system, browser type and version, screen resolution, and unique device identifiers;
• Usage Data: Pages visited, game sessions played, bet history, session duration, navigation paths, and features accessed on the Platform;
• Location Data: General geographic location inferred from IP address, used for fraud detection and regulatory compliance (not precise GPS location);
• Cookie Data: Session tokens, preference settings, and analytics identifiers — see Section 7 for full details.

• KYC Verification Providers: Results and risk scores from identity verification services used to fulfill jilluu's PAGCOR-mandated KYC obligations;
• Payment Processors: Transaction confirmation data from GCash, PayMaya, BDO, BPI, Metrobank, and UnionBank;
• Fraud and AML Screening: Sanctions list screening results and fraud risk indicators from compliance screening providers.

jilluu processes your Personal Data on the following legal grounds as permitted under the Data Privacy Act of 2012:

• Contractual Necessity: Processing is necessary to fulfill our contractual obligations to you under the jilluu Terms & Conditions — including account creation, game access, deposit processing, and withdrawal execution;
• Legal Obligation: Processing is required to comply with applicable Philippine law and PAGCOR regulations, including KYC identity verification, Anti-Money Laundering Act (AMLA) obligations, and age verification requirements;
• Legitimate Interests: Processing is carried out for jilluu's legitimate business interests — including fraud detection, platform security, responsible gaming monitoring, and service improvement — where these interests are not overridden by your rights and freedoms;
• Consent: Where jilluu processes your data for purposes not covered by the above grounds — such as direct marketing communications — we rely on your explicit consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

jilluu uses your Personal Data for the following specific purposes:

• Account Management: Creating and maintaining your jilluu Account, verifying your login credentials, processing password resets, and enabling two-factor authentication;
• KYC & Identity Verification: Verifying your identity, age, and eligibility to use the Platform in compliance with PAGCOR regulations and Philippine gaming law;
• Transaction Processing: Processing deposits via GCash, PayMaya, BDO, BPI, Metrobank, and UnionBank, and executing withdrawal requests to your verified payment method;
• Regulatory Compliance: Fulfilling jilluu's obligations under PAGCOR's licensing requirements, the Anti-Money Laundering Act (Republic Act No. 9160, as amended), and related regulations — including transaction monitoring and suspicious activity reporting;
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, collusion, multi-accounting, unauthorized access, and other prohibited conduct on the Platform;
• Responsible Gaming: Monitoring gameplay patterns to identify potential problem gambling behavior and administering deposit limits, cooling-off periods, and self-exclusion requests;
• Customer Support: Responding to your inquiries, investigating complaints, and resolving disputes in relation to your jilluu Account or gameplay;
• Platform Improvement: Analyzing anonymized usage data to improve Platform performance, game selection, and user experience;
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to you via email or SMS — only where you have provided consent or where permitted under applicable law.

jilluu does not sell, rent, or trade your Personal Data to any third party for marketing or commercial purposes. Your data may be shared in the following limited circumstances:

• Payment Processors: GCash (Mynt — Globe Fintech Innovations), PayMaya (Voyager Innovations), and banking partners (BDO, BPI, Metrobank, UnionBank) receive transaction data necessary to process deposits and withdrawals. These entities are independently regulated financial institutions bound by their own data protection obligations;
• KYC and Identity Verification Providers: Third-party identity verification services receive copies of your submitted identification documents and personal details solely for the purpose of verifying your identity and age as required by PAGCOR;
• AML and Compliance Screening Providers: Compliance screening partners receive limited data to conduct sanctions screening, politically exposed person (PEP) checks, and fraud risk assessments required under the Anti-Money Laundering Act;
• Game Providers: Third-party game studios and live casino operators may receive anonymized session identifiers necessary for game delivery and fairness certification purposes. Full identity data is not shared with game providers;
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities may receive your data where required by law, court order, or regulatory directive;
• Professional Advisers: jilluu's legal counsel, auditors, and insurance providers may access limited Personal Data under strict confidentiality obligations where necessary for jilluu to obtain professional advice or manage legal proceedings.

jilluu uses cookies and similar technologies on the Platform. These are small data files stored on your device that allow the Platform to recognize you and remember your preferences. The types of cookies jilluu uses are:

• Essential / Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, security cookies, and load-balancing identifiers. You cannot opt out of essential cookies while using the Platform;
• Functional Cookies: Store your preferences such as language settings, game lobby layout, and notification preferences to personalize your experience;
• Analytics Cookies: Used to collect anonymized data about how users interact with the Platform — pages visited, session duration, navigation patterns — to improve Platform design and performance. Analytics data is aggregated and does not identify individual users;
• Security and Fraud Prevention Cookies: Help jilluu detect and prevent unauthorized access, bot activity, and fraudulent transactions by fingerprinting device characteristics and session behavior.

jilluu does not use third-party advertising or tracking cookies for cross-site behavioral advertising. You can manage cookie preferences through your browser settings. Note that blocking or deleting essential cookies will prevent you from logging in to your jilluu Account.

jilluu retains your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including compliance with legal retention obligations. The specific retention periods applicable to different categories of data are:

• Account and Identity Data: Retained for the duration of your Account plus a minimum of five (5) years following Account closure, as required by PAGCOR regulations and the Anti-Money Laundering Act;
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLC record-keeping requirements;
• KYC Documents: Retained for a minimum of five (5) years from Account closure or the date of the last transaction, whichever is later;
• Customer Support Records: Retained for three (3) years from the date of the interaction, or longer where a dispute is unresolved;
• Technical and Usage Data: Retained for up to twelve (12) months for platform performance and fraud analysis purposes, then anonymized or deleted;
• Marketing Consent Records: Retained for the duration of your consent plus three (3) years to evidence compliance.

Upon expiry of the applicable retention period, jilluu will securely delete or anonymize your Personal Data in accordance with its data disposal procedures.

jilluu implements appropriate technical and organizational measures to protect your Personal Data against unauthorized access, accidental loss, destruction, or disclosure. These measures include:

• Encryption in Transit: All data transmitted between your device and the jilluu Platform is encrypted using TLS 1.3 with 256-bit AES encryption — the same standard used by Philippine commercial banks;
• Encryption at Rest: Sensitive data stored on jilluu's servers — including identity documents, financial data, and hashed passwords — is encrypted using AES-256;
• Access Controls: Access to Personal Data is restricted to jilluu employees who require it for their specific role. Access permissions are governed by role-based access control and reviewed regularly;
• Password Security: User passwords are salted and hashed using industry-standard algorithms. jilluu never stores passwords in plain text, and jilluu staff cannot retrieve your password;
• Two-Factor Authentication: SMS OTP-based 2FA is available to all Users and strongly recommended to protect Account access;
• Regular Security Audits: jilluu conducts periodic security assessments and penetration testing of the Platform infrastructure;
• Incident Response: jilluu maintains a documented data breach incident response plan. In the event of a personal data breach that poses a risk to your rights, jilluu will notify the NPC and affected Users in accordance with the Data Privacy Act's notification requirements.

jilluu primarily stores and processes your Personal Data within the Republic of the Philippines. In certain circumstances, your data may be transferred to or accessed from servers or service providers located outside the Philippines — for example, where a KYC verification provider or game server infrastructure is hosted internationally.

Where such international transfers occur, jilluu ensures that appropriate safeguards are in place to protect your Personal Data to a standard equivalent to that required under the Data Privacy Act of 2012. These safeguards may include:

• Contractual data processing agreements incorporating the NPC's standard data transfer clauses;
• Transfers to jurisdictions recognized by the NPC as providing adequate data protection standards;
• Certification or binding corporate rules held by the recipient entity.

You may request information about the specific safeguards applicable to any international transfer of your data by contacting jilluu's Data Protection Officer at the address set out in Section 16.

As a data subject under Republic Act No. 10173, you have the following rights in relation to your Personal Data held by jilluu:

To exercise any of your rights, submit a written request to jilluu's Data Protection Officer at the contact details in Section 16. jilluu will respond within 15 business days of receiving a complete and valid request. Identity verification will be required before fulfilling any data subject request to protect against unauthorized access.

Where you are not satisfied with jilluu's response to a data subject request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC).

The jilluu Platform is strictly intended for persons aged 21 years and older, in compliance with PAGCOR regulations governing online gaming in the Philippines. jilluu does not knowingly collect Personal Data from individuals under the age of 21.

If jilluu discovers that Personal Data has been collected from a person under 21 years of age, the associated Account will be immediately and permanently closed, all data will be securely deleted or returned to the extent legally permissible, and the matter will be reported to PAGCOR in accordance with regulatory obligations.

jilluu may send you promotional communications about bonuses, new games, platform features, and special events. Marketing communications are sent only:

• Where you have provided explicit consent during registration or through your Account settings; or
• Where permitted under the Data Privacy Act based on the existing customer relationship, in relation to products and services similar to those you have previously used.

You may withdraw your consent to receive marketing communications at any time by:

• Using the "unsubscribe" link included in every marketing email from jilluu;
• Adjusting your notification preferences in your jilluu Account settings; or
• Contacting jilluu's support team or Data Protection Officer with an opt-out request.

Withdrawal of marketing consent does not affect transactional communications — jilluu will continue to send you account-related notifications (such as deposit confirmations, withdrawal updates, and security alerts) regardless of your marketing preferences, as these are necessary for the operation of your Account.

jilluu will not send marketing communications to any User who has activated a self-exclusion period under the responsible gaming program.

The jilluu Platform may contain links to or integrations with third-party game providers, payment gateways, and other service partners. This Privacy Policy applies solely to data processed by jilluu directly.

When you interact with a third-party interface accessed through or in connection with the Platform — for example, a GCash payment gateway or a third-party game studio's live dealer environment — that interaction is governed by the third party's own privacy policy, over which jilluu has no control.

jilluu recommends that you review the privacy policies of any third-party services you interact with. jilluu accepts no liability for the data practices of independent third parties.

jilluu reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. When material changes are made:

• Registered Users will be notified by email to the address on file at least 7 days before the changes take effect;
• A prominent notice will be displayed on the jilluu Platform;
• The "Last Updated" date at the top of this Policy will be revised to reflect the date of the most recent amendment.

Your continued use of the jilluu Platform following the effective date of any revision constitutes acceptance of the updated Privacy Policy. If you do not agree with any amendment, you must cease using the Platform before the effective date and may request Account closure in accordance with the Terms & Conditions.

jilluu has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. For any data privacy-related inquiries, requests to exercise your rights, complaints, or concerns regarding jilluu's handling of your Personal Data, please contact:

If you remain unsatisfied with jilluu's response to your data privacy concern, you have the right to lodge a complaint directly with the National Privacy Commission of the Philippines (NPC). The NPC is the independent government authority responsible for administering and enforcing the Data Privacy Act of 2012.