jilioo Privacy Policy

1. Overview & Scope of This Policy

This Privacy Policy applies to all personal information collected by jilioo through the following channels and touchpoints:

• The jilioo website accessible at jilioo.cam and all sub-pages thereof;
• Account registration, login, and account management processes;
• All games, live dealer sessions, and gaming activity conducted on the platform;
• Deposit, withdrawal, and all other financial transactions processed through jilioo;
• Customer support communications via live chat, email, or any other channel;
• Promotional and marketing communications where you have opted in to receive them;
• Cookies and similar tracking technologies deployed on the jilioo platform.

This Policy applies to all registered players of jilioo regardless of their location, provided that access to jilioo from the user's location is lawful. It does not apply to third-party websites, payment providers, or services that may be linked to or integrated with jilioo — those entities operate under their own privacy policies.

By registering an account on jilioo or by continuing to use the platform after this Policy has been published or updated, you acknowledge that you have read this Privacy Policy and consent to the collection and processing of your personal information as described herein.

2. Data Controller Identity

jilioo is the personal information controller ("Controller") for all personal data collected and processed through the platform. As Controller, jilioo determines the purposes for which and the means by which personal data is processed, and bears responsibility for ensuring that such processing is carried out lawfully, fairly, and transparently.

For all privacy-related inquiries, data subject requests, and formal complaints, players may contact jilioo's designated Data Protection Officer (DPO) through the contact details specified in Section 14 of this Policy.

3. Personal Information We Collect

jilioo collects personal information in three primary ways: information you provide directly, information generated through your use of the platform, and information received from third parties such as payment processors and identity verification services. The categories of personal information we collect include:

jilioo does not collect sensitive personal information — such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information — unless specifically required by applicable law (for example, health information in the context of responsible gaming self-exclusion assessments).

4. How jilioo Uses Your Personal Information

jilioo processes personal information only for specified, explicit, and legitimate purposes. The table below outlines the primary purposes for which your data is processed and the corresponding legal basis under the Data Privacy Act of 2012:

5. Legal Basis for Processing

Under the Data Privacy Act of 2012, jilioo relies on the following legal bases for the processing of personal information:

• Consent (§12(a)): Where you have expressly opted in to receive marketing communications or specific optional features. Consent may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.
• Contract Performance (§12(b)): Where processing is necessary for the performance of the contract between you and jilioo — specifically, providing access to games, processing payments, and managing your account.
• Legal Obligation (§12(c)): Where processing is required to comply with applicable Philippine law, including obligations under the Anti-Money Laundering Act (Republic Act 9160), PAGCOR regulations, the Cybercrime Prevention Act (Republic Act 10175), and tax reporting requirements.
• Vital Interests (§12(e)): Where processing is necessary to protect the vital interests of the data subject — for example, in the context of responsible gaming interventions for players showing signs of gambling harm.
• Legitimate Interests (§12(f)): Where processing is necessary for the legitimate interests of jilioo, provided that such interests are not overridden by the rights and freedoms of the data subject. jilioo conducts a Legitimate Interests Assessment (LIA) before relying on this basis.

6. Data Sharing & Third-Party Disclosure

jilioo does not sell, rent, or trade personal information to third parties for commercial purposes. Personal information may be shared with the following categories of recipients only to the extent necessary and in accordance with a valid legal basis:

• Payment Processors: GCash (Mynt), PayMaya (PayMongo/Voyager), BPI, BDO, Metrobank, UnionBank, and cryptocurrency processing services — for the purpose of facilitating deposits and withdrawals. These processors operate under their own privacy policies and are bound by data processing agreements with jilioo.
• Game Providers: JILI Games, Evolution Gaming, Ezugi, and other game studios — limited to game session data required for game provision, RNG auditing, and player dispute resolution.
• Identity Verification Services: Third-party KYC and age verification providers used to fulfill jilioo's identity verification obligations under PAGCOR and AMLA requirements.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and any other competent Philippine regulatory authority — where required by law or court order.
• Law Enforcement: Philippine law enforcement agencies — where required by lawful order, warrant, or in furtherance of an active investigation involving suspected criminal activity.
• Professional Advisers: Lawyers, accountants, auditors, and insurers — where necessary for the operation of jilioo's business, subject to strict confidentiality obligations.

All third parties with whom jilioo shares personal data are required to maintain adequate data protection standards and are prohibited from using your data for their own commercial purposes beyond the specific purpose for which it was shared.

7. Data Retention Periods

jilioo retains personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of the active account relationship, plus a minimum of five (5) years following account closure — in compliance with AMLA record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, as required under AMLA and PAGCOR regulations.
• Gaming history and session logs: Retained for a minimum of three (3) years for dispute resolution, compliance, and responsible gaming monitoring purposes.
• Customer support communications: Retained for three (3) years from the date of the last communication, or longer where the subject matter relates to an unresolved dispute or regulatory matter.
• Marketing preferences and consent records: Retained for the duration of the account relationship, plus two (2) years following account closure or withdrawal of consent.
• Cookie and technical data: Session cookies are deleted when your browser session ends. Persistent cookies are retained for up to 12 months. Server-side technical logs are retained for up to 90 days unless required for active investigations.

Upon expiry of the applicable retention period, personal information is securely deleted or anonymised in accordance with jilioo's data disposal procedures.

8. Data Security Measures

jilioo implements and maintains a comprehensive set of technical and organisational security measures designed to protect personal information against unauthorised access, disclosure, alteration, and destruction. Key measures include:

• Encryption in Transit: All data transmitted between your device and jilioo's servers is encrypted using TLS 1.2 or higher. Plain-text transmission of personal data is not permitted at any point in jilioo's infrastructure.
• Encryption at Rest: Sensitive personal data stored on jilioo's servers is encrypted at rest using AES-256 encryption or equivalent.
• Access Controls: Access to personal data by jilioo staff is governed by a strict need-to-know principle. Role-based access controls are enforced, and all access events are logged and auditable.
• Two-Factor Authentication: jilioo supports two-factor authentication for Player accounts and enforces it for all internal administrative access to systems containing personal data.
• Security Monitoring: jilioo operates continuous security monitoring for intrusion detection, anomalous activity, and known vulnerability exploitation patterns.
• Penetration Testing: Regular third-party penetration testing is conducted on jilioo's platform infrastructure and web application layer.
• Incident Response: jilioo maintains a documented Personal Data Breach Management Policy. In the event of a breach likely to cause harm to affected individuals, jilioo will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected data subjects without undue delay, in accordance with NPC Circular No. 16-03.

9. Cookies & Tracking Technologies

jilioo uses cookies and similar technologies to operate, analyse, and improve the platform. The following categories of cookies are deployed:

• Strictly Necessary Cookies: Required for core platform functionality including user authentication, session management, and security features. These cannot be disabled without rendering the platform inoperable.
• Functional Cookies: Store your preferences such as language settings, game display preferences, and responsible gaming limit configurations to personalise your experience across sessions.
• Analytics Cookies: Collect anonymised or pseudonymised usage data to help jilioo understand how players interact with the platform — which pages are visited most, where players experience difficulty, and how features are used. This data informs product improvement decisions.
• Marketing Cookies: Used only where you have provided explicit consent, to track engagement with promotional content and measure the effectiveness of jilioo's marketing activity.

You may manage cookie preferences through your browser settings. Blocking all cookies will impair platform functionality. Strictly necessary cookies cannot be blocked without disabling core platform features.

10. Minors — Strict 21+ Policy

jilioo strictly prohibits access by individuals under 21 years of age, in compliance with PAGCOR's minimum age requirements for online casino gaming in the Philippines. jilioo does not knowingly collect personal information from persons under 21 years of age.

Age verification is conducted on all jilioo accounts. Where jilioo discovers or has reasonable grounds to believe that a registered account is operated by a person under 21 years of age, the following actions will be taken without delay:

• The account will be immediately suspended and access blocked;
• All personal information associated with the account will be reviewed and, where appropriate, deleted or anonymised in accordance with jilioo's data disposal procedures;
• Any wallet balance in the account will be dealt with in accordance with jilioo's underage gaming policy, which may involve return of genuine deposited funds to the originating payment method after appropriate due diligence;
• The matter will be escalated to jilioo's compliance team for further review.

If you are a parent or guardian and believe that your child under 21 has registered an account with jilioo, please contact our support team or DPO immediately. We will investigate and take appropriate action, including deletion of the minor's personal data, without undue delay.

11. Your Data Subject Rights

As a data subject under the Data Privacy Act of 2012, you have the following rights in relation to your personal information held by jilioo. These rights may be exercised by contacting jilioo's DPO using the contact details in Section 14.

jilioo will acknowledge receipt of data subject requests within 3 business days and will respond substantively within 15 business days, extendable by a further 15 days where the request is complex or voluminous (with notice to you).