Privacy Policy — 90jl Casino Philippines

01 Data Controller

For the purposes of Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations, the data controller responsible for your personal data collected through the 90jl platform is 90jl Casino, operating the website at 90jl.asia under PAGCOR regulatory oversight in the Philippines.

90jl has designated a Data Privacy Officer ("DPO") responsible for overseeing compliance with applicable data protection laws. The DPO may be contacted via the details provided in Section 14 of this policy. Any queries, complaints, or requests relating to the processing of your personal data should be directed to the DPO in the first instance.

02 Personal Data We Collect

90jl collects the following categories of personal data from users of the platform:

90jl does not collect sensitive personal information as defined under the Data Privacy Act unless specifically required by law (for example, as part of regulatory-mandated identity verification procedures).

03 How We Collect Your Data

90jl collects your personal data through the following means:

• Directly from you: When you register an account, complete identity verification, make a deposit or withdrawal request, contact customer support, respond to a survey, or otherwise interact with the platform and its staff;
• Automatically: Through cookies, web beacons, server logs, and similar technologies when you visit or use the 90jl platform — see Section 7 for details on cookies;
• From third-party payment processors: When you make deposits or request withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, or other integrated payment providers, necessary transaction data is shared with 90jl to process and reconcile the transaction;
• From identity verification providers: Where 90jl uses third-party KYC services to verify identity documents, those providers may share verification results with 90jl;
• From PAGCOR and regulatory bodies: In limited circumstances, 90jl may receive information from PAGCOR or other regulatory authorities in connection with compliance obligations.

04 Legal Basis for Processing

90jl processes your personal data on the following legal bases under the Data Privacy Act of 2012 and its Implementing Rules and Regulations:

• Performance of a Contract: Processing necessary for the performance of the account agreement between you and 90jl, including account management, payment processing, and game service delivery;
• Legal Obligation: Processing required to comply with applicable Philippine law, including PAGCOR regulatory requirements, Anti-Money Laundering Act obligations (Republic Act No. 9160), and KYC/identity verification requirements;
• Legitimate Interests: Processing necessary for the legitimate interests of 90jl, including fraud prevention, security monitoring, platform improvement, and responsible gaming programme administration, where such interests are not overridden by your fundamental rights;
• Consent: Where consent is the applicable legal basis (for example, for certain marketing communications), 90jl will obtain your prior, informed, and freely given consent. You may withdraw such consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

05 How We Use Your Personal Data

90jl uses the personal data we collect for the following purposes:

• Creating, managing, and maintaining your 90jl account;
• Processing deposits and withdrawals via GCash, PayMaya, and bank transfer;
• Verifying your identity and age in accordance with PAGCOR requirements;
• Detecting, investigating, and preventing fraud, money laundering, and other prohibited conduct;
• Administering 90jl's responsible gaming programme, including monitoring gaming behaviour for indicators of problem gambling and applying any limits or restrictions you have set;
• Delivering customer support and resolving disputes;
• Sending transactional communications including deposit confirmations, withdrawal notifications, and account security alerts;
• Sending marketing communications where you have provided consent or where permitted by law;
• Improving and personalising the 90jl platform based on your usage patterns and preferences;
• Complying with legal obligations including PAGCOR reporting requirements and regulatory audits;
• Enforcing 90jl's Terms and Conditions and other applicable policies.

06 Data Sharing and Third-Party Disclosure

90jl does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share your personal data only in the following limited circumstances:

• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, and other integrated payment providers receive the minimum data necessary to process your financial transactions;
• Identity verification providers: Third-party KYC and identity verification services receive identity data for the purpose of verifying your identity in accordance with PAGCOR requirements;
• Game software providers: Game providers whose titles are integrated into the 90jl lobby may receive session data and player identifiers as required for game functionality and RTP certification purposes;
• PAGCOR and regulatory authorities: 90jl is required by law to provide certain gaming and player data to PAGCOR as part of its regulatory obligations. Such disclosures are made in accordance with applicable law;
• Law enforcement: 90jl may disclose personal data to the Anti-Money Laundering Council (AMLC), the National Bureau of Investigation (NBI), or other law enforcement authorities where required by court order, legal process, or applicable law;
• IT and infrastructure providers: Cloud hosting, cybersecurity, and IT service providers who process data on 90jl's behalf under appropriate data processing agreements that require them to maintain data confidentiality and security;
• Professional advisors: Legal counsel, auditors, and compliance advisors who require access to data in the course of providing professional services to 90jl, under obligations of professional confidentiality.

All third-party recipients of personal data are subject to appropriate contractual safeguards or are themselves subject to applicable legal obligations regarding data protection.

07 Cookies and Tracking Technologies

The 90jl website uses cookies and similar tracking technologies to enhance your browsing experience, maintain session state, detect fraud, and analyse platform usage. The following categories of cookies are used:

• Essential Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in during your visit and security cookies that protect against cross-site request forgery. These cannot be disabled without impairing platform functionality;
• Performance and Analytics Cookies: Used to collect aggregated, anonymised data about how users navigate the platform, which pages are visited most frequently, and where users encounter difficulties. This data is used to improve the platform;
• Functional Cookies: Used to remember your preferences such as language settings, preferred game categories, and display options;
• Fraud Detection Cookies: Used to identify and prevent fraudulent activity, including the use of multiple accounts and automated bots.

You may configure your browser to reject cookies or to alert you when cookies are being sent. However, disabling essential cookies will impair the functionality of the 90jl platform and may prevent you from accessing certain features including the game lobby and account dashboard.

08 Data Security

90jl implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers;
• Encryption of sensitive data fields (including financial identifiers) at rest in our databases;
• Role-based access controls limiting employee access to personal data to those with a legitimate operational need;
• Two-factor authentication requirements for internal administrative access to production systems;
• Regular security vulnerability assessments and penetration testing of the platform infrastructure;
• Incident response procedures for detecting, reporting, and responding to personal data breaches in accordance with NPC notification requirements.

While 90jl takes reasonable and appropriate measures to protect your data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own login credentials and for promptly notifying 90jl if you suspect unauthorised access to your account.

09 Data Retention

90jl retains personal data for as long as is necessary to fulfil the purposes described in this policy, and for periods required by applicable Philippine law. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account's active status, plus a minimum of five (5) years following account closure, in accordance with PAGCOR record-keeping requirements and AML obligations under Republic Act No. 9160;
• Financial transaction data: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act;
• Gaming records: Retained for a minimum of five (5) years in accordance with PAGCOR regulatory requirements;
• Customer support records: Retained for three (3) years from the date of the last interaction to support dispute resolution;
• Marketing consent records: Retained for the duration of the consent plus three (3) years to demonstrate compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised using industry-standard data destruction procedures. Data subject to ongoing legal proceedings or regulatory investigations will be retained until those proceedings are concluded.

10 Your Rights Under the Data Privacy Act

As a data subject under Republic Act No. 10173, you have the following rights with respect to your personal data held by 90jl:

• Right to be Informed: The right to be informed of how your personal data is being collected, processed, and used — this policy serves that purpose;
• Right of Access: The right to obtain a copy of the personal data 90jl holds about you, along with information about how it is processed;
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to Erasure: The right to request deletion of your personal data where processing is no longer necessary, subject to applicable legal retention obligations;
• Right to Object: The right to object to the processing of your personal data on the basis of legitimate interests, and to object to processing for direct marketing purposes at any time;
• Right to Data Portability: The right to receive your personal data in a structured, commonly used format where processing is carried out by automated means on the basis of your consent or a contract;
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data protection rights have been violated.

To exercise any of the above rights, please contact 90jl's Data Privacy Officer using the contact details in Section 14. 90jl will respond to verified data subject requests within thirty (30) days of receipt in accordance with NPC requirements. 90jl may require you to verify your identity before processing any request.

11 International Data Transfers

Some of 90jl's service providers, including game software providers and cloud infrastructure providers, may be located outside the Philippines. Where personal data is transferred to recipients in other countries, 90jl ensures that appropriate safeguards are in place to protect your data in accordance with the Data Privacy Act, including contractual clauses that require overseas recipients to apply data protection standards equivalent to those required under Philippine law.

By using the 90jl platform, you acknowledge that your personal data may be processed in countries outside the Philippines where data protection laws may differ from those in the Philippines. 90jl takes reasonable steps to ensure that any such transfers are conducted lawfully and with appropriate protective measures in place.

12 Children's Privacy and Age Restriction

The 90jl platform is strictly intended for individuals aged twenty-one (21) years and above, in accordance with PAGCOR regulations. 90jl does not knowingly collect personal data from individuals below this age. Where 90jl discovers or has reason to believe that personal data has been collected from a minor, such data will be promptly deleted and the associated account will be terminated.

If you are a parent or guardian and believe that a minor has created an account on the 90jl platform or has provided personal data to 90jl without your consent, please contact our Data Privacy Officer immediately using the contact details in Section 14.

13 Changes to This Privacy Policy

90jl reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. Where a material change is made, 90jl will provide notice via the platform or by communication to your registered contact details.

The date of the most recent revision is shown at the top of this policy. Your continued use of the 90jl platform following the effective date of any amendment constitutes your acknowledgment of the revised Privacy Policy. We encourage you to review this policy periodically to stay informed about how 90jl protects your personal data.

14 Contact & Data Privacy Officer

For all data privacy-related inquiries, requests to exercise your rights under the Data Privacy Act, or complaints regarding 90jl's data processing practices, please contact 90jl's designated Data Privacy Officer through the following channels:

• Live Chat: 24/7 via the chat widget on 90jl.asia
• Email: [email protected]

Please mark your enquiry as "DATA PRIVACY REQUEST" to ensure it is routed directly to the DPO. 90jl will acknowledge receipt of your request within five (5) business days and will respond in full within thirty (30) days of receipt.

If you are not satisfied with 90jl's response to your data privacy complaint, you have the right to lodge a complaint directly with the National Privacy Commission of the Philippines via the NPC's official complaint procedures.