999jl Privacy Policy — Your Data, Protected

999jl ("we," "us," or "our") is committed to protecting the privacy and personal data of every user ("you" or "your") who accesses or uses the 999jl online gaming platform at 999jl.club and any associated mobile applications (collectively, the "Platform"). This Privacy Policy describes our practices regarding the collection, use, storage, sharing, and protection of your personal data.

This policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC"). It also reflects our obligations under the Philippine Amusement and Gaming Corporation ("PAGCOR") regulatory framework applicable to online gaming operators.

We encourage you to read this Privacy Policy carefully and in full. If you do not agree with any part of this policy, you should discontinue your use of the 999jl Platform. This Privacy Policy should be read together with our Terms & Conditions.

For the purposes of the Data Privacy Act of 2012, 999jl is the personal information controller responsible for your personal data collected through the Platform. Our designated Data Protection Officer ("DPO") oversees compliance with this policy and applicable data privacy laws.

When you create a 999jl account, we collect:

• Full legal name as it appears on your government-issued ID
• Date of birth (to verify you are 21 years of age or older)
• Residential address (city, province, postal code)
• Email address and mobile phone number
• Username and encrypted password
• Government-issued ID details (for KYC verification purposes)

To process deposits and withdrawals, we collect:

• GCash or PayMaya account number (masked after verification)
• Bank account details for bank transfer transactions (BPI, BDO, Metrobank, UnionBank, etc.)
• Debit card details (card number masked; only last four digits retained)
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment methods

• Game session logs, wager amounts, game outcomes, and win/loss records
• Bonus and promotion usage history
• Responsible gaming tool usage (deposit limits set, self-exclusion requests)

• IP address and approximate geolocation (city/region level)
• Device type, operating system, and browser information
• Session timestamps and platform access logs
• Cookie identifiers and similar tracking technologies (see Section 8)

• Records of your communications with 999jl customer support (live chat transcripts, email correspondence)
• Survey responses and feedback submitted through the Platform

999jl collects personal data through the following means:

• Direct collection: Information you provide when registering, completing KYC verification, making transactions, contacting support, or participating in promotions.
• Automated collection: Technical data collected automatically when you access the Platform, including through cookies, web beacons, and server logs.
• Third-party sources: Identity verification data from KYC service providers; fraud detection signals from payment processors; geolocation data from IP intelligence services.
• Regulatory sources: Information received from PAGCOR or other Philippine regulatory authorities in connection with compliance obligations.

999jl processes your personal data for the following specific, legitimate purposes:

• Account management: Creating, maintaining, and securing your 999jl account.
• Identity verification (KYC): Verifying your age (21+), identity, and eligibility to use the Platform in compliance with PAGCOR requirements.
• Payment processing: Processing deposits, withdrawals, and refunds through GCash, PayMaya, and Philippine bank transfers.
• Anti-money laundering (AML) compliance: Monitoring transactions for suspicious activity as required under the Anti-Money Laundering Act (AMLA) and PAGCOR regulations.
• Game delivery and platform operation: Providing access to casino games, live dealer tables, slots, bingo, and other Platform features.
• Customer support: Responding to your inquiries, complaints, and support requests.
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behavior and administering self-exclusion and limit-setting tools.
• Fraud prevention and security: Detecting and preventing unauthorized access, cheating, bonus abuse, and other fraudulent activity.
• Marketing communications: Sending you promotional offers, bonus notifications, and platform updates — only where you have provided consent or where permitted by applicable law.
• Legal and regulatory compliance: Meeting our obligations under Philippine law, PAGCOR regulations, and court or regulatory orders.

Under the Data Privacy Act of 2012, 999jl processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you (account management, payment processing, game delivery).
• Legal obligation: Processing required to comply with Philippine law, including KYC/AML obligations under PAGCOR regulations and the AMLA.
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where our legitimate interests are not overridden by your rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have given explicit consent. You may withdraw consent at any time.

999jl does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only in the following limited circumstances:

• Service providers: KYC/identity verification providers, payment processors (GCash , PayMaya, BPI, BDO, Metrobank, UnionBank), fraud detection services, customer support platform providers, and cloud hosting providers — all bound by strict data processing agreements and confidentiality obligations.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies where required by law or regulatory directive.
• Law enforcement: Philippine law enforcement agencies where we are legally compelled to disclose data by court order, subpoena, or other lawful process.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to equivalent privacy protections.
• With your consent: Any other sharing not described above will only occur with your explicit prior consent.

All third-party service providers who process personal data on behalf of 999jl are required to implement appropriate technical and organizational security measures and are prohibited from using your data for any purpose other than providing services to 999jl.

Cookies are small text files placed on your device when you visit the 999jl Platform. We also use similar technologies such as web beacons, pixel tags, and local storage objects. These technologies help us operate the Platform, remember your preferences, analyze usage patterns, and deliver relevant content.

• Strictly necessary cookies: Essential for the Platform to function — session management, login authentication, and security. These cannot be disabled.
• Functional cookies: Remember your preferences such as language settings and display options to improve your experience.
• Analytics cookies: Collect anonymized data about how users interact with the Platform to help us improve performance and usability.
• Marketing cookies: Used to deliver relevant promotional content within the 999jl Platform. Only placed with your consent.

You can manage non-essential cookies through the cookie preference center accessible on the Platform. You may also configure your browser to block or delete cookies; however, disabling strictly necessary cookies may impair Platform functionality, including your ability to log in and play games.

999jl retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years after account closure, as required by PAGCOR and AMLA regulations.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLA record-keeping requirements.
• Gaming activity logs: Retained for three (3) years from the date of each session.
• Customer support records: Retained for two (2) years from the date of the last interaction.
• Marketing consent records: Retained until you withdraw consent, plus one (1) year thereafter as evidence of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with NPC guidelines. Where data must be retained beyond these periods due to ongoing legal proceedings or regulatory investigations, it will be retained until those matters are resolved.

999jl implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption: All data in transit is protected by TLS 1.2/1.3 (256-bit SSL encryption). Sensitive data at rest, including passwords and payment details, is encrypted using AES-256.
• Access controls: Personal data is accessible only to authorized 999jl personnel and service providers on a strict need-to-know basis. All access is logged and audited.
• Two-factor authentication: Available for all 999jl accounts to add an additional layer of login security.
• Penetration testing: Regular third-party security assessments and penetration tests are conducted to identify and remediate vulnerabilities.
• Incident response: 999jl maintains a documented data breach response plan. In the event of a personal data breach affecting your rights, we will notify you and the NPC within 72 hours of discovery, as required by NPC Circular 16-03.
• Staff training: All 999jl personnel with access to personal data receive regular data privacy and security training.

While 999jl takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us immediately if you suspect unauthorized access to your account.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 999jl. To exercise any of these rights, contact our Data Protection Officer at [email protected].

999jl will respond to all data subject rights requests within fifteen (15) business days of receipt. We may request proof of identity before processing your request to protect against unauthorized access to your data.

If you are a parent or guardian and believe that a person under 21 in your care has registered on the 999jl Platform, please contact us immediately at [email protected]. We will investigate and take appropriate action, including account closure and data deletion, within 48 hours of receiving your report.

Some of 999jl's service providers — including cloud hosting, KYC verification, and fraud detection providers — may process personal data outside the Philippines. Where such cross-border transfers occur, 999jl ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under the Data Privacy Act of 2012.

These safeguards include contractual data processing agreements incorporating standard data protection clauses, and verification that recipient countries or organizations provide an adequate level of data protection. 999jl will not transfer your personal data to jurisdictions that do not provide adequate protection without your explicit consent or a lawful basis under the DPA.

999jl reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. When material changes are made, we will notify registered users via email or an in-platform notification at least seven (7) days before the changes take effect.

The "Last Updated" date at the top of this page indicates when the policy was most recently revised. Your continued use of the 999jl Platform after the effective date of any revised Privacy Policy constitutes your acknowledgment of the changes. We encourage you to review this policy periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way 999jl handles your personal data, please contact our Data Protection Officer. Our DPO is your dedicated point of contact for all data privacy matters and is committed to resolving your concerns promptly and confidentially.

If you are not satisfied with our response, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC) through its official channels.