18jil Privacy Policy

18jil ("we," "us," "our," or "18jil") is committed to protecting the privacy and security of your personal information. This Privacy Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA) of the Philippines, its Implementing Rules and Regulations (IRR), and the relevant issuances of the National Privacy Commission (NPC).

This Policy applies to all personal data processed by 18jil in connection with your use of the 18jil website at 18jil.org, the gaming platform, account management system, payment processing interface, customer support channels, and all other related services (collectively, the "Services"). It applies regardless of how you access the Services — whether via desktop browser, mobile browser, or any future application interface.

We understand that Filipino players value their privacy. Whether you're accessing 18jil from Metro Manila, Cebu, Davao, or anywhere else in the Philippines, your personal data is processed with the same standard of care and protection. We do not sell, rent, or trade your personal information to any third party for their independent marketing purposes.

For the purposes of the Data Privacy Act of 2012 and this Policy, 18jil is the personal information controller (PIC) responsible for the personal data you provide when using the Services. As a PAGCOR-regulated gaming platform serving Filipino players, 18jil is registered with and subject to oversight by both the Philippine Amusement and Gaming Corporation (PAGCOR) and the National Privacy Commission (NPC).

18jil collects personal data that is necessary, adequate, and not excessive relative to the purposes for which it is processed. The categories of personal data we collect include:

3.1 Registration and Account Data

• Full legal name as it appears on a Philippine government-issued identification document.
• Date of birth (for mandatory age verification — minimum 21 years of age).
• Philippine mobile number (used as your primary account identifier and for OTP-based login and communications).
• Email address (for account notifications, support correspondence, and promotional communications where consented).
• Username and encrypted password credentials.
• Residential address within the Philippines.

3.2 KYC (Know Your Customer) Verification Data

• Scanned copy or photograph of a valid Philippine government-issued photo ID (e.g., PhilSys National ID, passport, driver's licence, SSS/GSIS/Unified Multi-Purpose ID, PRC ID, or voter's ID).
• Proof of current residential address (e.g., utility bill, bank statement, or official government correspondence dated within 90 days).
• Selfie photograph holding your government-issued ID for liveness and identity match verification.
• Source of funds documentation, at 18jil's discretion, for accounts with significant transaction activity.

3.3 Financial and Transaction Data

• GCash account number (mobile number) associated with your GCash wallet.
• Maya (PayMaya) account details where used as a payment method.
• Bank account details (BPI, BDO, Metrobank, or other Philippine bank) where used for deposits or withdrawals.
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment method used.
• Account balance history and bonus credit/debit records.

3.4 Gaming Activity Data

• Game play logs including games played, bet amounts, win/loss outcomes, and session timestamps.
• Sports betting selections, stake amounts, and settlement records.
• Bonus and promotional participation history.
• Responsible gaming tool settings (deposit limits, session limits, self-exclusion status).

3.5 Technical and Device Data

• IP address and approximate geolocation derived from IP.
• Device type, model, operating system, and browser type and version.
• Session timestamps and login activity logs.
• Cookie identifiers and similar tracking technology data (see Section 9).

18jil collects personal data through the following means:

18jil processes your personal data only for specific, legitimate purposes. Under the Data Privacy Act of 2012, processing is lawful where it is based on consent, performance of a contract, compliance with a legal obligation, or the legitimate interests of 18jil as the data controller, provided those interests do not override your fundamental rights and freedoms.

• Account Registration and Management. Processing is necessary for the performance of the service contract between you and 18jil. We need your registration data to create, maintain, and operate your account.
• Age Verification and KYC Compliance. Processing is required to comply with PAGCOR's minimum age (21+) enforcement obligations and the Anti-Money Laundering Act (AMLA) requirements applicable to licensed gaming operators.
• Payment Processing. Processing of financial data is necessary to execute deposit and withdrawal transactions and to maintain accurate account balance records.
• Fraud Prevention and Security. Processing is based on 18jil's legitimate interests in preventing fraudulent activity, protecting platform integrity, and safeguarding other players.
• Regulatory Compliance and Reporting. Processing is required by PAGCOR licensing conditions, the DPA, and the AMLA. 18jil is legally obligated to retain certain transaction and identity records and to report covered transactions and suspicious transactions to the AMLC.
• Responsible Gaming Programme. Processing of gaming activity data is necessary to operate 18jil's responsible gaming tools, including limit enforcement, self-exclusion, and problem gambling indicators.
• Marketing and Promotions (with Consent). Where you have opted in to promotional communications, we process your contact data to send you relevant offers, bonuses, and platform updates. You may withdraw this consent at any time via your account notification settings or by contacting support.
• Customer Support. Processing is necessary to respond to your inquiries, resolve disputes, and provide technical assistance in connection with your 18jil account.

18jil may share your personal data with the following categories of recipients, subject to appropriate data processing agreements and safeguards:

• Payment Service Providers. GCash (Mynt/Globe Fintech), Maya (PayMaya Philippines), BPI, BDO, Metrobank, and other Philippine payment processors — solely for the purpose of processing your deposit and withdrawal transactions.
• Identity Verification and KYC Providers. Third-party KYC and AML screening service providers engaged by 18jil to perform identity verification as required by PAGCOR and AMLA obligations. These providers act as personal information processors under data processing agreements.
• Game Software Providers. Third-party game studios and live casino operators may receive session data necessary to deliver their games to your account. These providers are contractually bound to process such data only for game delivery purposes.
• Regulatory Authorities. PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government agencies as required by law, court order, or regulatory directive.
• Professional Advisers. Legal counsel, auditors, and compliance advisers engaged by 18jil, subject to professional confidentiality obligations.
• IT Infrastructure and Security Providers. Cloud hosting, cybersecurity, and platform infrastructure providers acting under data processing agreements with strict confidentiality and security obligations.

18jil retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable Philippine law, whichever is longer. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with the NPC's guidelines on data disposal. Anonymised and aggregated data from which you cannot be identified may be retained indefinitely for statistical and platform improvement purposes.

18jil implements and maintains appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, and disclosure. These measures include, but are not limited to:

• Transport Layer Security (TLS 1.2 or higher) encryption for all data transmitted between your device and 18jil servers.
• Encryption at rest for sensitive personal data fields including KYC documents, payment details, and password credentials (bcrypt hashing).
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis.
• Multi-factor authentication requirements for all 18jil staff accessing production data systems.
• Automated intrusion detection and threat monitoring systems operating on a 24/7 basis.
• Regular security audits, vulnerability assessments, and penetration testing conducted by qualified third parties.
• Staff data privacy training and confidentiality obligations as conditions of employment and contractor engagement.
• Incident response procedures aligned with the NPC's 72-hour breach notification requirements under the DPA.

The 18jil platform uses cookies and similar tracking technologies to operate core platform functions, improve user experience, and support fraud detection and security operations. The following categories of cookies are used:

• Strictly Necessary Cookies. Required for the platform to function. These include session authentication tokens, security tokens, and load balancer cookies. These cookies cannot be disabled without preventing you from using the platform.
• Functional Cookies. Remember your preferences such as language settings, game lobby layout, and "Remember Me" login status. These improve convenience but are not required for basic platform operation.
• Analytics Cookies. Collect anonymised usage statistics (pages visited, session duration, features used) to help 18jil understand how the platform is used and improve it over time. No personally identifiable information is included in analytics data.
• Security and Fraud Detection Cookies. Used to detect suspicious login patterns, bot activity, and account abuse. These are necessary for the protection of your account and the platform.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies may impair or prevent your ability to use the 18jil platform. 18jil does not use third-party advertising or behavioural tracking cookies.

Under the Data Privacy Act of 2012 and its IRR, you have the following rights as a data subject. 18jil is committed to facilitating the exercise of these rights promptly and without undue restriction.

• Right to Be Informed. You have the right to be informed of what personal data 18jil holds about you, the purposes for which it is processed, and the basis for processing — all of which are set out in this Policy.
• Right to Access. You may request a copy of the personal data 18jil holds about you. Requests will be acknowledged within 5 business days and fulfilled within 15 business days of verification.
• Right to Correction. You may request correction of inaccurate or incomplete personal data. You can update basic account information directly via your account settings; other corrections may require support contact and verification.
• Right to Erasure / Right to be Forgotten. You may request deletion of your personal data where it is no longer necessary for the purposes collected, where consent has been withdrawn and there is no other legal basis, or where processing was unlawful. Note that 18jil may be required to retain certain data under PAGCOR and AMLA obligations notwithstanding a deletion request.
• Right to Data Portability. Where processing is based on consent or contract and is carried out by automated means, you may request your personal data in a structured, commonly used, machine-readable format.
• Right to Object. You may object to processing based on legitimate interests or carried out for direct marketing purposes. Objection to marketing communications can be actioned immediately via account notification settings or by contacting support.
• Right to Lodge a Complaint. If you believe 18jil has processed your personal data in violation of the DPA, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

Parents and guardians who believe their minor child has accessed or registered an account on the 18jil platform should contact [email protected] immediately. 18jil takes underage access reports seriously and will investigate and act on all such reports within 24 hours. 18jil cooperates fully with PAGCOR and Philippine authorities in all cases involving suspected underage account access.

Certain third-party service providers engaged by 18jil, including cloud infrastructure providers, game software studios, and specialist KYC verification platforms, may process or store personal data in locations outside the Republic of the Philippines.

Where personal data is transferred outside the Philippines, 18jil ensures that appropriate safeguards are in place consistent with the requirements of the DPA and the NPC's guidelines on cross-border data transfers. These safeguards include contractual data protection clauses equivalent to those required under Philippine law, assessment of the recipient country's data protection framework, and ongoing monitoring of recipient compliance. 18jil will not transfer personal data to jurisdictions that do not provide adequate protections without implementing additional safeguards as required by the NPC.

18jil reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this page reflects the date of the most recent revision.

Material changes — that is, changes that substantively affect how your personal data is collected, used, or shared — will be communicated to registered players via email (to the address on file) and/or through a notification in the 18jil platform at least seven (7) days before the change takes effect. Your continued use of the 18jil platform following the effective date of a revised Policy constitutes your acceptance of the changes. If you do not accept the revised Policy, you should close your account and cease use of the platform.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact 18jil using the details below. Our Data Protection Officer oversees all privacy-related matters and is available to assist you.

If you are not satisfied with 18jil's response to a privacy inquiry or rights request, you may escalate your concern to the National Privacy Commission (NPC) of the Philippines, which is the competent supervisory authority for data privacy matters under the DPA.