jilwin Privacy Policy

1 Scope & Data Controller Identity

This Privacy Policy applies to the personal data of:

• Registered jilwin account holders (players);
• Visitors to jilwin.club who have not yet registered an account;
• Individuals who contact jilwin support through any channel;
• Any person whose personal data is provided to jilwin in connection with an account registration or KYC process.

The data controller responsible for the personal data collected through jilwin.club is the jilwin operating entity. As required under the Philippine Data Privacy Act of 2012, jilwin has designated a Data Protection Officer (DPO) to oversee compliance with RA 10173 and to serve as the primary point of contact for data privacy inquiries from players and regulators.

For DPO contact details, refer to Section 15 of this Policy.

2 Personal Data We Collect

jilwin collects the following categories of personal data from players and platform users:

• Full legal name as it appears on your government-issued ID;
• Date of birth;
• Residential address in the Philippines;
• Philippine mobile number (Smart, Globe, or DITO);
• Email address.

• Copies or photographs of government-issued Philippine IDs (e.g., PhilSys National ID, passport, driver's license, SSS ID, UMID, PRC ID);
• Proof of address documents (utility bills, bank statements, government correspondence);
• Photographs or selfies submitted for identity confirmation purposes;
• Source of funds declarations where applicable.

• Username and encrypted password hash;
• Account balance and transaction history (deposits, withdrawals, wagers, bonuses);
• Payment method details (e-wallet identifiers such as GCash or PayMaya account references, bank account details, or crypto wallet addresses used for transactions);
• Bet history, game session data, and gameplay records.

• IP address and approximate geographic location derived from IP;
• Device type, operating system, browser type and version;
• Session timestamps, pages visited, and interaction data on jilwin.club;
• Cookies and similar tracking technology data (see Section 6).

• Records of live chat conversations with jilwin support staff;
• Email correspondence with jilwin;
• Any other communications you send to jilwin through any channel.

jilwin does not intentionally collect sensitive personal information as defined under RA 10173 (such as information regarding race, religion, political opinions, health, or sexual orientation) unless specifically required for a legally mandated purpose, in which case your explicit consent will be sought.

3 How We Collect Your Data

jilwin collects personal data through the following means:

• Direct provision by you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, participate in promotions, or otherwise interact with the jilwin platform.
• Automated collection: Through cookies, session tracking technologies, and server logs that record technical data about your interactions with jilwin.club. See Section 6 for details on cookies.
• Payment processors: Where your payment method provider (e.g., GCash, PayMaya, BPI, BDO) shares transaction confirmation data with jilwin as part of processing your deposit or withdrawal.
• Identity verification providers: Where jilwin uses a third-party KYC service to verify the authenticity of submitted ID documents. These providers process your submitted documents on jilwin's behalf and under jilwin's instructions.
• Fraud detection systems: Automated risk assessment tools that analyze account behavior patterns for the purpose of detecting fraud, money laundering, or prohibited conduct as defined in the jilwin Terms & Conditions.

4 Purposes & Legal Bases for Processing

jilwin processes personal data for the following purposes and on the following legal bases under RA 10173:

5 Sharing Your Personal Data

jilwin does not sell or rent your personal data to third parties. We may share your data with the following categories of recipients only to the extent necessary for the stated purpose:

• Payment processors and e-wallet providers (e.g., GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, crypto payment processors): to process your deposits and withdrawals.
• KYC and identity verification providers: third-party services engaged by jilwin to verify the authenticity of documents submitted during account verification. These providers act as data processors under contract with jilwin.
• Game content providers: licensed game studios (e.g., Pragmatic Play, PG Soft, Evolution) whose games run on the jilwin platform may receive limited technical session data to operate game functionality. These providers are contractually prohibited from using this data for their own independent purposes.
• Fraud prevention and security services: third-party risk analytics providers engaged to detect fraudulent account behavior and protect platform integrity.
• Regulatory and law enforcement authorities: government agencies, courts, PAGCOR, the National Privacy Commission, or law enforcement bodies where disclosure is required by applicable law or by a valid legal order.
• Professional advisors: lawyers, auditors, and accountants engaged by jilwin in connection with legal proceedings, compliance audits, or corporate transactions, subject to professional confidentiality obligations.

In each case, jilwin requires third-party processors to maintain appropriate data security standards and to process personal data only on jilwin's instructions and in accordance with applicable privacy law.

6 Cookies & Tracking Technologies

jilwin uses cookies and similar technologies on jilwin.club for the following purposes:

• Essential cookies: Required for the platform to function — these maintain your login session, remember your preferences, and enable secure access to your account. These cookies cannot be disabled without impairing platform functionality.
• Functional cookies: Remember choices you make (such as language preference or display settings) to provide a more personalized experience on subsequent visits.
• Analytics cookies: Collect anonymized or pseudonymized data about how players use jilwin.club — which pages are visited, how long sessions last, and where players navigate. This data is used to improve the platform and is not linked to individual player identities in reports.
• Security cookies: Used to detect and prevent fraudulent activity, including session hijacking attempts and credential stuffing attacks.

jilwin does not use third-party advertising or retargeting cookies that track your behavior across external websites.

7 Data Retention

jilwin retains personal data for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law, whichever is longer. The following retention periods apply as general guidance:

• Account and KYC data: Retained for the duration of the account relationship and for a minimum of 5 years following account closure, in compliance with Philippine anti-money laundering record-keeping requirements under RA 9160 (Anti-Money Laundering Act) as amended.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction.
• Support communications: Retained for 2 years from the date of the interaction, unless the communication relates to an unresolved dispute or regulatory inquiry.
• Technical and usage data: Aggregated analytics data is retained indefinitely in anonymized form. Raw session logs are retained for a maximum of 12 months.
• Marketing consent records: Retained for the duration of the consent and for 1 year following withdrawal of consent, to demonstrate compliance.

Following the applicable retention period, personal data is securely deleted or anonymized such that it can no longer be attributed to an identifiable individual.

8 Data Security

jilwin implements appropriate technical and organizational security measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• TLS 1.3 encryption for all data in transit between player devices and jilwin servers;
• Encryption of sensitive data at rest, including KYC documents and payment method identifiers;
• Salted cryptographic hashing for all stored passwords;
• Role-based access controls ensuring that jilwin staff can access personal data only to the extent required by their specific job function;
• Two-factor authentication requirements for internal staff access to systems containing personal data;
• Regular security vulnerability assessments and penetration testing of platform infrastructure;
• Documented incident response procedures including breach notification protocols.

While jilwin takes these measures seriously, no data transmission over the internet or electronic storage system is completely secure. Players are responsible for maintaining the security of their own account credentials — see the jilwin Terms & Conditions, Section 5 for account security obligations.

9 Cross-Border Data Transfers

Some of jilwin's third-party service providers — including game content studios, payment processors, and cloud infrastructure providers — may process personal data outside the Philippines. Where personal data is transferred internationally, jilwin ensures that appropriate safeguards are in place, which may include:

• Contractual data transfer agreements incorporating standard contractual clauses approved by or consistent with guidance from the National Privacy Commission;
• Processor agreements requiring the recipient to maintain privacy and security standards at least equivalent to those required under RA 10173;
• Transfer to countries recognized by the NPC as providing adequate data protection standards.

You may request information about the specific safeguards in place for any particular cross-border transfer by contacting jilwin's Data Protection Officer at the details provided in Section 15.

10 Your Rights Under RA 10173

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by jilwin:

You have the right to request confirmation of whether jilwin holds personal data about you and to obtain a copy of that data. Access requests will be responded to within 15 calendar days. Where the volume of data requires extended processing, jilwin will notify you and provide the data within a reasonable extended timeframe not exceeding 30 days.

You have the right to request that inaccurate or incomplete personal data held by jilwin be corrected. Standard account details (name, address, mobile number, email) can be updated via your jilwin account settings or by contacting support. Changes to KYC-verified information require re-verification.

You may request deletion of your personal data where: (a) the data is no longer necessary for the purpose it was collected; (b) you withdraw consent and no other legal basis exists for continued processing; or (c) the data has been unlawfully processed. Note that jilwin may be required to retain certain data for legal compliance purposes (see Section 7) even following an erasure request, in which case we will inform you of the specific legal basis for continued retention.

You may object to processing of your personal data based on jilwin's legitimate interests, or request restriction of processing pending resolution of a dispute about accuracy or the legal basis for processing. Objection to marketing communications is addressed in Section 11.

Where processing is based on your consent or contract performance and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format. Requests for data portability should be directed to jilwin's DPO.

To exercise any of the rights above, contact jilwin's Data Protection Officer (see Section 15). jilwin will not charge a fee for responding to routine rights requests. In the event of excessive, repetitive, or manifestly unfounded requests, jilwin reserves the right to charge a reasonable administrative fee or decline to act on the request, with written explanation.

If you believe jilwin has handled your personal data in violation of RA 10173, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. We encourage you to contact jilwin's DPO first so that we have the opportunity to address your concern directly. The NPC's complaint procedure is available on the NPC's official government website.

11 Marketing Communications

jilwin may send you promotional and marketing communications — including bonus offers, game announcements, tournament invitations, and platform updates — via email or SMS if you have opted in to receive such communications during account registration or at a later point in your account settings.

You may withdraw your consent to marketing communications at any time by:

• Updating your communication preferences in your jilwin account settings;
• Clicking the "unsubscribe" link in any marketing email sent by jilwin;
• Contacting jilwin support via live chat and requesting removal from marketing lists.

Withdrawal of marketing consent will not affect your ability to receive transactional communications about your account — such as deposit confirmations, withdrawal notifications, security alerts, and support responses — which are sent regardless of marketing preferences as they are necessary for account management.

12 Minors and Age Restrictions

The jilwin platform is strictly for persons aged 21 years and older. jilwin does not knowingly collect personal data from individuals under 21 years of age. If you believe a person under 21 has registered an account or provided personal data to jilwin, please notify us immediately via live chat or at [email protected].

Upon receiving credible notification that an account holder is under 21, jilwin will immediately suspend the account, securely delete or anonymize the personal data of the underage individual to the extent permissible by applicable record-keeping obligations, and return deposited funds as required under the jilwin Terms & Conditions.

13 Third-Party Links

The jilwin platform does not contain links to third-party external websites for general browsing purposes. In the limited cases where technical integrations with third-party game providers or payment processors involve redirects or embedded interfaces, those third parties operate under their own privacy policies. jilwin is not responsible for the data practices of third-party platforms beyond the contractual data processor obligations described in Section 5.

14 Amendments to This Privacy Policy

jilwin may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law, or improvements to how we communicate our privacy commitments. Material amendments — those that significantly affect your rights or how we use your personal data — will be communicated to you via email to your registered address and/or a prominent notice on jilwin.club at least 14 days before the amendment takes effect.

The current version of this Privacy Policy is always available at jilwin.club/privacy-policy. The "Effective Date" shown at the top of this document reflects the most recent revision date. Continued use of the jilwin platform after the effective date of an amendment constitutes your acknowledgment of the updated policy.

15 Contact & Data Protection Officer

For privacy-related inquiries, requests to exercise your data rights, concerns about jilwin's data practices, or to contact the jilwin Data Protection Officer, please use the following channels:

• Live Chat: Available 24/7 via jilwin.club. Ask the support agent to escalate your query to the Data Protection team.
• Email: [email protected] — include "Privacy / DPO Request" in the subject line. Responses to DPO matters are provided within 5 business days for routine inquiries and within 15 calendar days for formal data subject access requests.

When contacting jilwin for privacy matters, please provide your registered account email address and a description of your request. jilwin may need to verify your identity before fulfilling certain rights requests to ensure that personal data is not disclosed to unauthorized individuals.