jl36 Privacy Policy

jl36 respects your right to privacy and is committed to protecting your personal data in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (the "DPA"), and its implementing rules and regulations as overseen by the National Privacy Commission of the Philippines ("NPC"). This Privacy Policy applies to all personal data processed by jl36 in connection with your registration and use of the jl36 Platform at jl36.one.

By registering a jl36 account or continuing to use the jl36 Platform after this Privacy Policy has been made available to you, you acknowledge that you have read, understood, and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Privacy Policy, you should not use the jl36 Platform.

This Privacy Policy is supplementary to jl36's Terms & Conditions, which govern the overall relationship between jl36 and its Members. In the event of any inconsistency between this Privacy Policy and the Terms & Conditions in relation to the processing of personal data, this Privacy Policy shall prevail.

For the purposes of the Data Privacy Act of 2012 and its implementing rules, jl36 is the Personal Information Controller in respect of all personal data collected through the jl36 Platform. jl36 operates under a licence issued by the Philippine Amusement and Gaming Corporation ("PAGCOR") and is established and operates within the Republic of the Philippines.

jl36 has designated a Data Protection Officer ("DPO") responsible for overseeing compliance with the DPA and for handling data subject rights requests. Contact details for the jl36 DPO are set out in Section 15 of this Privacy Policy.

jl36 processes your personal data on the following legal grounds as recognised under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform the contract between you and jl36 — including account registration, identity verification, processing deposits and withdrawals, and operating your game sessions.
• Legal obligation: Processing required to comply with PAGCOR regulations, the Anti-Money Laundering Act (RA 9160 as amended), and other applicable Philippine laws.
• Legitimate interests: Processing necessary for jl36's legitimate interests, including fraud prevention, platform security, responsible gaming compliance, and improving platform features, provided such interests are not overridden by your fundamental rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — in particular for direct marketing communications and for the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing already carried out.

4.1 Data You Provide Directly

4.2 Data Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, language settings;
• Session data: Login timestamps, session duration, pages visited on jl36.one, features accessed, game rounds played;
• Transaction logs: Deposit and withdrawal amounts, timestamps, payment method references, and game transaction records;
• Geolocation data: Country and region-level geolocation derived from IP address for regulatory compliance and fraud detection purposes — jl36 does not collect precise GPS coordinates.

jl36 uses the personal data described in Section 4 for the following specific purposes:

• Account management: Creating, maintaining, and administering your jl36 Member account, including processing login requests and OTP verification;
• Identity and age verification: Confirming that you meet the 21+ age requirement and that the identity you have provided is accurate, as required by PAGCOR regulations;
• Payment processing: Executing deposit and withdrawal transactions via GCash, PayMaya, and Philippine bank transfer channels;
• Game provision: Delivering jl36 game content, recording game outcomes, settling wagers, and maintaining accurate Wallet balances;
• Regulatory compliance: Meeting jl36's obligations under PAGCOR licence conditions, the Anti-Money Laundering Act, and other applicable Philippine law — including filing Suspicious Transaction Reports with the Anti-Money Laundering Council where required;
• Fraud prevention and security: Detecting and preventing fraudulent activity, account takeover attempts, and prohibited conduct as defined in the Terms & Conditions;
• Responsible gaming: Monitoring player behaviour for signs of problem gambling and administering self-exclusion, deposit limit, and cooling-off period requests;
• Customer support: Responding to your queries, resolving disputes, and improving service quality;
• Marketing communications: Sending you information about jl36 promotions, new games, and platform updates — only where you have given consent or where jl36 has a legitimate interest, and always with an unsubscribe option;
• Platform improvement: Analysing aggregated, anonymised usage data to improve jl36's features, game selection, and user experience.

6.1 Authorised Third-Party Service Providers (Personal Information Processors)

jl36 engages third-party service providers to assist in delivering the Platform. These providers act as Personal Information Processors under the DPA — they process your data only on jl36's instructions, are bound by data processing agreements, and may not use your data for their own purposes. Categories of processors include:

• Payment processors and e-wallet operators (GCash / Maya / partner banks) — for deposit and withdrawal execution;
• KYC and identity verification technology providers;
• Cloud hosting and data centre operators within or serving the Philippines;
• Fraud detection and cybersecurity service providers;
• Customer support platform operators;
• Game content providers and RNG audit laboratories (anonymised game log data only).

6.2 Regulatory and Law Enforcement Disclosure

jl36 may disclose your personal data to PAGCOR, the Anti-Money Laundering Council, the National Privacy Commission, the National Bureau of Investigation, or other Philippine government authorities where required to do so by law, court order, or valid legal process. jl36 will not disclose more information than is strictly required by the applicable legal instrument.

6.3 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of all or substantially all of jl36's assets, your personal data may be transferred to the successor entity. jl36 will notify affected Members prior to any such transfer taking effect and will ensure the successor entity is bound by data protection obligations no less stringent than those in this Privacy Policy.

jl36.one uses cookies and similar tracking technologies to deliver and improve the Platform. A cookie is a small text file stored on your device by your browser. jl36 uses the following categories of cookies:

You can manage non-essential cookie preferences via the cookie settings panel accessible from the jl36.one footer. You can also configure your browser to block or delete cookies at any time; note that disabling strictly necessary cookies will prevent the Platform from functioning correctly.

jl36 retains your personal data for no longer than is necessary for the purposes for which it was collected, subject to the minimum retention periods required by Philippine law. The following retention schedule applies:

• Account and KYC data: Retained for the duration of your account's active status plus five (5) years following account closure, in accordance with PAGCOR record-keeping requirements and anti-money laundering obligations;
• Transaction and financial records: Retained for ten (10) years from the date of the transaction, in compliance with the Anti-Money Laundering Act;
• Game logs and session records: Retained for five (5) years for dispute resolution and regulatory audit purposes;
• Support communications: Retained for three (3) years from the date of the last communication;
• Marketing consent records: Retained for three (3) years from the date of consent, or until consent is withdrawn — whichever is earlier.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that renders individual identification permanently impossible. Where anonymisation is not technically feasible, data will be securely destroyed by methods compliant with NPC-issued guidelines.

jl36 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption in transit: All data transmitted between your browser or device and jl36.one is encrypted using TLS 1.2 or higher (256-bit SSL);
• Encryption at rest: Sensitive data — including identity document images, financial account references, and password hashes — is stored in encrypted form on jl36's servers;
• Access controls: Personal data is accessible only to jl36 personnel whose roles require access for legitimate operational purposes. Access is controlled by role-based permissions and monitored via audit logs;
• Two-factor authentication: jl36 enforces OTP verification for Member login on new devices and for all administrative access to systems holding personal data;
• Penetration testing: jl36's platform undergoes regular third-party penetration testing and vulnerability assessments;
• Incident response: jl36 maintains a documented data breach response plan. In the event of a personal data breach that is likely to result in risk to your rights, jl36 will notify the NPC and affected Members within seventy-two (72) hours of becoming aware of the breach, as required by the DPA.

jl36's primary data processing infrastructure is located within the Republic of the Philippines. In limited circumstances, personal data may be transferred to or processed by servers or third-party processors located in other jurisdictions — for example, where jl36 uses a game provider's platform infrastructure hosted outside the Philippines.

In all such cases, jl36 ensures that cross-border transfers comply with Section 21 of the Data Privacy Act of 2012, which requires that the recipient country provides adequate data protection standards, or that appropriate contractual safeguards (such as standard contractual clauses approved by the NPC) are in place with the receiving party.

Members may request information about the specific jurisdictions to which their data may be transferred by contacting jl36's Data Protection Officer at the contact details in Section 15.

As a data subject under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by jl36. To exercise any of these rights, please contact jl36's Data Protection Officer as described in Section 15.

jl36 will respond to data subject rights requests within ten (10) business days of receipt. Complex requests may require up to thirty (30) calendar days. jl36 will not charge a fee for processing rights requests except in cases of manifestly unfounded or excessive repetitive requests.

If you are a parent or guardian and believe that your child or a minor in your care may have registered on jl36, please contact jl36 support via Live Chat or at [email protected] immediately. jl36 will investigate and take prompt action to close the Account and delete the associated personal data upon verification of the minor's age.

The jl36 Platform does not contain links to third-party websites that operate independently of jl36. Should any reference to an external resource appear in game content provided by a third-party game studio, jl36 is not responsible for the privacy practices of that third party. You are encouraged to review the privacy policies of any third-party services you access independently.

jl36 reviews this Privacy Policy periodically and may update it to reflect changes in applicable Philippine law, NPC guidance, PAGCOR regulatory requirements, or jl36's data processing practices. The effective date displayed in the page header will be updated on each revision.

Where an amendment materially changes how jl36 processes your personal data or affects your rights as a data subject, jl36 will provide at least fourteen (14) days' advance notice via in-platform notification or SMS to your registered mobile number before the amendment takes effect. Your continued use of the jl36 Platform after the effective date of any amendment constitutes acceptance of the updated Privacy Policy.

For any questions, requests, or concerns regarding this Privacy Policy or jl36's personal data processing practices, you may contact jl36's Data Protection Officer through the following channels:

• Email (DPO): [email protected] — mark the subject line "Data Privacy Request" or "DPO Enquiry"
• Live Chat: Available 24/7 on the jl36 Platform — ask to be transferred to a Data Privacy specialist
• Postal Address: jl36 Data Protection Officer, Republic of the Philippines (full address available upon written request)

If you are not satisfied with jl36's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. The NPC's complaint procedures and contact information are available on the NPC's official website. Philippine residents may also seek assistance from the Department of Information and Communications Technology (DICT) for guidance on exercising rights under the Data Privacy Act.