jiji1 Privacy Policy

1Overview and Data Controller Identity

This Privacy Policy ("Policy") describes how jiji1 ("jiji1," "we," "us," "the Company"), operator of the online gaming platform at jiji1.org (the "Platform"), collects, uses, stores, processes, shares, and protects the personal data of registered users, visitors, and prospective players ("you," "Data Subject") in connection with the use of jiji1's services.

jiji1 is the Personal Information Controller (PIC) as defined under Republic Act No. 10173, the Philippine Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations issued by the National Privacy Commission ("NPC"). jiji1 is registered with the NPC and has designated a Data Protection Officer ("DPO") whose contact details are set out in Section 15.

jiji1 operates under a license issued by the Philippine Amusement and Gaming Corporation (PAGCOR). Compliance with PAGCOR licensing conditions — including Anti-Money Laundering Act (AMLA) reporting obligations and Know Your Customer (KYC) requirements — necessarily involves collecting and processing personal data. This Policy explains how that data is handled.

2Categories of Personal Data We Collect

jiji1 collects the following categories of personal data, depending on how you interact with the Platform:

jiji1 does not intentionally collect sensitive personal information (as defined under Section 3(l) of the DPA) such as racial or ethnic origin, political affiliation, religious beliefs, health data, or sexual life. If you voluntarily disclose such information in a support interaction, it will be handled with heightened care and not used for any purpose beyond resolving the immediate matter.

3How We Collect Your Personal Data

jiji1 collects personal data through the following channels:

• Directly from you: When you register an account, complete the KYC verification process, make a deposit or withdrawal, contact customer support, or respond to promotions.
• Automatically: When you visit and interact with jiji1.org, our servers and analytics tools automatically collect technical data including your IP address, device information, and browsing behavior on the Platform.
• Through cookies and similar technologies: As described in Section 10, jiji1 uses session cookies, persistent cookies, and pixel tags to support Platform functionality, analyze user behavior, and — where you have opted in — deliver relevant promotional content.
• From payment service providers: GCash, Maya, and banking institutions transmit transaction confirmation data to jiji1 when you make a deposit or withdrawal. jiji1 receives only the data necessary to record the transaction — we do not receive your full GCash PIN, banking password, or card CVV.
• From identity verification partners: jiji1 may use PAGCOR-approved third-party KYC service providers to assist with document verification. These providers process only the data required for identity confirmation and are bound by data processing agreements with jiji1.

4Purposes of Processing and Legal Basis

Under the DPA, jiji1 must have a lawful basis for every processing activity. The following table summarizes jiji1's primary processing purposes and the applicable legal basis under Section 12 and 13 of the DPA:

5Sharing and Disclosure of Your Personal Data

jiji1 does not sell, rent, lease, or trade your personal data. We share data only in the following limited circumstances:

5.1 Service Providers and Personal Information Processors (PIPs)

jiji1 engages third-party vendors to support Platform operations. These vendors act as Personal Information Processors under the DPA and are bound by written data processing agreements that restrict them from using your data for any purpose beyond the specific service they provide. Categories of PIPs include: KYC and identity verification providers, payment gateway and e-wallet operators (GCash, Maya, acquiring banks), cloud infrastructure providers, customer support platform operators, and fraud detection and analytics tools.

5.2 Regulatory and Law Enforcement Authorities

jiji1 is required to disclose personal data and transaction records to PAGCOR, the Anti-Money Laundering Council (AMLC), the Bangko Sentral ng Pilipinas (BSP), the National Privacy Commission (NPC), and other competent Philippine government authorities when required by law, court order, or regulatory direction. Such mandatory disclosures are not subject to prior player consent and do not constitute a breach of this Policy.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of jiji1's assets, personal data held by jiji1 may be transferred to the acquiring entity. jiji1 will notify affected players via email and a prominent Platform notice at least 30 days before any such transfer takes effect, and the acquirer will be required to honor this Privacy Policy or provide players with the option to close their accounts.

6Cross-Border Data Transfers

jiji1's primary data infrastructure is hosted within the Philippines. Some third-party service providers (including cloud infrastructure and game platform providers such as JILI Games) may process data in jurisdictions outside the Philippines, including but not limited to Singapore and other Southeast Asian data centers.

jiji1 ensures that any cross-border transfer of personal data is carried out in compliance with Section 21 of the DPA and applicable NPC regulations, including through: (a) contractual clauses requiring the overseas recipient to uphold privacy standards equivalent to the DPA; or (b) confirming that the destination jurisdiction has been assessed to have adequate data protection laws. jiji1 will not transfer personal data to a jurisdiction with materially inadequate data protection without implementing appropriate safeguards.

7Data Retention Periods

jiji1 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Account and identity data (KYC documents): Retained for a minimum of 10 years following account closure, as mandated by the AMLA (RA 9160 as amended) and PAGCOR licensing conditions.
• Financial transaction records: Retained for a minimum of 10 years from the date of the transaction, consistent with AMLC record-keeping requirements.
• Gaming session logs: Retained for 5 years from the date of the session, for dispute resolution and regulatory audit purposes.
• Customer support communications: Retained for 3 years from the date of the last interaction.
• Technical logs and server data: Retained for 12 months on a rolling basis, unless longer retention is required for a specific security investigation.
• Marketing consent records: Retained for 3 years from the date of consent, or until withdrawn, whichever is earlier.

At the expiry of applicable retention periods, personal data is securely deleted or anonymized in accordance with NPC-approved data disposal procedures.

8Security Measures

jiji1 implements organizational, technical, and physical security measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. Key measures include:

• Encryption: All data in transit is protected by TLS 1.2/1.3 (256-bit SSL). Passwords are stored as salted bcrypt hashes — plain text passwords are never stored or transmitted by jiji1's systems.
• Access controls: Internal access to personal data is restricted on a need-to-know basis. Administrative access requires multi-factor authentication and is logged and audited.
• KYC document security: Identity documents submitted for KYC are stored in encrypted, access-controlled storage repositories separate from general account data.
• Penetration testing: jiji1 engages independent security firms to conduct regular penetration testing and vulnerability assessments of the Platform.
• Payment data: jiji1 does not store GCash PINs, bank card numbers, or banking passwords. Payment processing is handled by PCI-DSS compliant payment service providers.
• Incident response: jiji1 maintains a data breach response plan consistent with NPC Circular 16-03. In the event of a personal data breach, jiji1 will notify affected players and the NPC as described in Section 13.

9Your Privacy Rights Under the Philippine Data Privacy Act

As a Data Subject under the Philippine DPA, you have the following rights in relation to your personal data held by jiji1. You may exercise these rights by contacting our DPO as set out in Section 15.

10Cookies and Tracking Technologies

10.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for basic Platform functionality — session authentication, security tokens, and load balancing. These cannot be disabled without breaking the Platform. No consent is required for these.
• Functional Cookies: Remember your preferences — language, preferred game categories, responsible gaming settings. These improve your experience but are not essential.
• Analytics Cookies: Collect anonymized or pseudonymized usage data (pages visited, session duration, click paths) to help jiji1 understand how the Platform is used and improve it. These require your consent.
• Marketing Cookies: Used to deliver promotional content relevant to your gaming preferences within the jiji1 Platform. jiji1 does not serve third-party advertising through cookies. These require explicit opt-in consent.

10.2 Cookie Management

You may manage cookie preferences through the cookie consent banner displayed on your first visit to jiji1.org, or through your browser's settings. Disabling analytics and marketing cookies will not affect your ability to use the core Platform. Disabling strictly necessary cookies will impair Platform functionality.

10.3 Do Not Track

jiji1 recognizes and respects browser-level Do Not Track (DNT) signals for analytics and marketing tracking. When a DNT signal is detected, jiji1 disables non-essential tracking for that session.

11Protection of Minors' Data

jiji1 strictly prohibits the use of its Platform by individuals under the age of 21, in accordance with Philippine gambling law and PAGCOR regulations. jiji1 does not knowingly collect personal data from persons under 21.

Where jiji1 discovers or has reasonable grounds to believe that personal data has been collected from an individual who is under 21, jiji1 will: (a) immediately suspend and permanently close the associated account; (b) delete all personal data associated with the account as quickly as technically practicable, subject to any mandatory retention obligations under the AMLA and PAGCOR; and (c) refund any remaining verified account balance to the payment method of origin where possible.

jiji1 enforces age restrictions through the mandatory collection of date of birth at registration and KYC document verification (which includes government-issued photo ID). If you believe a person under 21 has registered a jiji1 account, please contact [email protected] immediately.

12Marketing Communications

jiji1 sends marketing communications — including promotional offers, bonus notifications, and game release announcements — only to players who have explicitly opted in to receive such communications during registration or through account settings. Marketing emails and SMS are sent to your registered email address or Philippine mobile number.

You may withdraw your consent to marketing communications at any time by: (a) clicking the unsubscribe link in any marketing email from jiji1; (b) updating your notification preferences in your jiji1 account settings; or (c) contacting [email protected]. Withdrawal of marketing consent does not affect your ability to use the Platform or receive transactional communications (account alerts, deposit confirmations, withdrawal notifications, OTPs).

13Data Breach Notification and Response

jiji1 maintains a Personal Data Breach Response Policy consistent with NPC Circular No. 16-03 (Security of Personal Data in Government Agencies) and applicable NPC guidelines for private sector entities.

In the event of a personal data breach that is likely to result in serious harm to affected individuals (as defined under the DPA), jiji1 will:

1. Internal containment: Activate the breach response team within 1 hour of confirmed breach detection. Isolate affected systems and preserve forensic evidence.
2. NPC notification: Notify the National Privacy Commission within 72 hours of the breach being confirmed, as required by NPC Circular 16-03. The notification will include the nature of the breach, categories and approximate volume of data subjects affected, likely consequences, and measures taken.
3. Player notification: Notify affected players by email within 5 business days of confirming the breach. Notification will include a plain-language description of what happened, what data was affected, steps jiji1 has taken, and guidance on protective action players should take (e.g., password change).
4. PAGCOR notification: Report any breach involving gaming transaction or financial data to PAGCOR in accordance with licensing conditions.
5. Post-incident review: Conduct a root cause analysis and implement remedial security measures within 30 days of breach resolution.

14Changes to This Privacy Policy

jiji1 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. The "Effective date" and "Last reviewed" dates at the top of this page will be updated with each revision.

Where amendments are material — affecting how we use your data, your rights, or the categories of data we collect — jiji1 will provide at least 14 days' prior notice via email to your registered address and a prominent banner on the Platform, before the revised Policy takes effect. For minor editorial or clarificatory changes, jiji1 may update the Policy without advance notice.

Your continued use of the jiji1 Platform after the effective date of any revised Policy constitutes your acceptance of the revised terms. If you do not agree with a material change, you may close your account before the revision takes effect by contacting [email protected].

15Contact Us and Data Protection Officer

For any questions, requests to exercise your privacy rights, or concerns about how jiji1 handles your personal data, please contact us through the following channels:

• General Privacy Inquiries: [email protected]
• Data Protection Officer: [email protected]
• Live Chat Support: Available 24/7 via the jiji1 Platform in English and Filipino

jiji1's designated Data Protection Officer is registered with the National Privacy Commission of the Philippines. The DPO is responsible for overseeing compliance with the DPA and this Privacy Policy, and for serving as the primary point of contact for Data Subjects and the NPC.

If you are not satisfied with jiji1's response to a privacy concern, you may escalate your complaint to the National Privacy Commission of the Philippines ([email protected]). The NPC is the government authority responsible for enforcing the Data Privacy Act in the Philippines.