18ji Casino Privacy Policy — Philippine Data Protection

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "18ji" / "18ji Casino" / "we" / "us" / "our" — refers to the online gaming platform operating at 18ji.club and its operators responsible for processing personal data of Philippine players.
• "Personal Data" — any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained, or when put together with other information, would directly and certainly identify an individual. This includes, but is not limited to, full name, date of birth, mobile number, email address, government ID details, and financial account information.
• "Sensitive Personal Information" — personal data that includes government identification numbers (e.g., PhilSys ID, SSS number, TIN, passport number), financial records, and any other information designated as sensitive under Republic Act No. 10173.
• "Data Subject" / "you" / "your" — any natural person whose personal data is processed by 18ji, including registered account holders and website visitors.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For data collected via the 18ji platform, the data controller is 18ji Casino.
• "Processing" — any operation performed upon personal data including collection, recording, storage, use, modification, retrieval, transmission, deletion, or destruction.
• "NPC" — the National Privacy Commission of the Philippines, the government agency responsible for administering and implementing Republic Act No. 10173.
• "DPA" or "RA 10173" — the Data Privacy Act of 2012 (Republic Act No. 10173), the primary data protection legislation governing the collection and processing of personal data in the Philippines.
• "KYC" — Know Your Customer, the identity verification process required under anti-money laundering regulations and PAGCOR's online gaming regulatory framework.
• "Cookies" — small text files stored on a user's device by a web browser to maintain session state, remember preferences, and enable analytics functionality.

This Privacy Policy applies to all personal data collected and processed by 18ji Casino in connection with the operation of the 18ji platform at 18ji.club, including data collected through account registration, KYC verification, gameplay, customer support interactions, payment processing, and any other interaction between a data subject and the 18ji platform.

This policy applies to all registered account holders, prospective registrants who visit the 18ji website without completing registration, and individuals who interact with 18ji through customer support channels. It applies regardless of the device, browser, or network used to access the 18ji platform.

This policy does not govern the data practices of third-party service providers whose services are accessed through the 18ji platform, such as payment processors (GCash, Maya, BPI), game software providers, or external verification services. Each such provider operates under their own separate privacy policies, which we encourage you to review independently.

18ji collects personal data across several categories, depending on the nature of your interaction with the platform. The following table provides a structured overview of the data categories we process:

18ji does not intentionally collect racial or ethnic origin data, political opinions, religious beliefs, trade union membership, genetic data, or biometric data beyond what is required for standard government-ID-based KYC verification under PAGCOR requirements.

4.1 Directly From You

The majority of personal data 18ji holds is provided directly by you during interactions with the platform. This includes: information you enter during the account registration process; government ID documents and selfie photographs submitted during KYC verification; payment method details provided during deposit or withdrawal requests; information you share when contacting 18ji customer support via live chat or email; and preferences and settings you configure in your account dashboard.

4.2 Automatically Through Platform Use

When you access the 18ji website or platform on any device, we automatically collect certain technical and usage data. This is collected through server logs, session management systems, and browser cookies. Technical data collected automatically includes your IP address, device identifiers, browser type, operating system, and session timing information. This data is collected for security, fraud prevention, and platform optimisation purposes.

4.3 From Third-Party Service Providers

18ji may receive data about you from third-party service providers where necessary for platform operations. Payment processors such as GCash, Maya, BPI, BDO, and Metrobank may confirm transaction status and the registered name on the payment account for KYC matching purposes. Identity verification services engaged by 18ji may return verification results for submitted government IDs. Anti-fraud and AML screening services may provide risk assessments in connection with account activity. All such third-party data sharing is governed by contractual data processing agreements that require third parties to maintain standards equivalent to 18ji's data protection obligations.

18ji processes personal data only for specified, explicit, and legitimate purposes. The following are the primary purposes for which your personal data is processed on the 18ji platform:

• Account Creation and Management: To register your 18ji account, verify your identity, maintain your account profile, and deliver the gaming services you have requested;
• KYC and Identity Verification: To verify that you meet the 21+ age requirement and to confirm your identity in compliance with PAGCOR's requirements for online gaming operators and applicable anti-money laundering regulations;
• Payment Processing: To process your deposits and withdrawals in Philippine Peso via GCash, Maya, and supported bank channels, and to ensure withdrawals are directed only to payment accounts registered in your verified name;
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, money laundering, and other prohibited conduct on the 18ji platform;
• Regulatory and Legal Compliance: To comply with obligations under Republic Act No. 10173, PAGCOR regulations, the Anti-Money Laundering Act (AMLA), and any applicable court orders or directions from competent Philippine authorities;
• Customer Support: To respond to your enquiries, resolve account issues, process complaints, and maintain records of support interactions for quality assurance and dispute resolution purposes;
• Responsible Gaming: To monitor gaming activity for indicators of problem gambling, to administer deposit limits, loss limits, time-out periods, and self-exclusion requests, and to fulfil responsible gaming obligations under PAGCOR's framework;
• Platform Improvement: To analyse usage patterns, optimise platform performance, and improve the user experience for Filipino players, using anonymised and aggregated data where possible;
• Communications: To send you account-related notifications, transaction confirmations, OTP codes, and — where you have given consent — promotional communications about 18ji offers and new features.

Under the Data Privacy Act of 2012 (RA 10173), 18ji processes your personal data on the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform the contract between you and 18ji — i.e., delivering the gaming services you registered for, processing payments, and managing your account;
• Legal Obligation: Processing required to comply with applicable Philippine law, including PAGCOR regulatory requirements, the Anti-Money Laundering Act, the Data Privacy Act itself, and any directions from competent regulatory or law enforcement authorities;
• Legitimate Interests: Processing necessary for 18ji's legitimate business interests, including fraud prevention, platform security, and internal analytics, provided such interests are not overridden by your fundamental rights and freedoms;
• Consent: Where no other legal basis applies, 18ji will request your explicit consent before processing personal data for optional purposes, such as receiving promotional communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

18ji does not disclose your personal data to third parties except in the following circumstances, and only to the extent necessary for the stated purpose:

7.1 Service Providers (Data Processors)

18ji engages third-party service providers to perform functions on our behalf, including payment processing, identity verification, KYC document review, fraud screening, customer support platform hosting, and cloud infrastructure. These providers act as data processors under contractual data processing agreements that prohibit them from using your personal data for any purpose other than performing services for 18ji, and require them to maintain data protection standards equivalent to those applied by 18ji.

7.2 Regulatory and Law Enforcement Authorities

18ji will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other competent Philippine government authorities where required or directed to do so by applicable law, regulation, court order, or lawful authority. 18ji will notify the relevant data subject of such disclosure where legally permitted to do so.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of the assets of 18ji, personal data held by 18ji may be transferred to the acquiring entity as part of that transaction. 18ji will provide notice to registered account holders prior to any such transfer that results in a material change to this Privacy Policy or in how personal data is used.

18ji retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:

• Account Data (active accounts): Retained for the duration of your registered account and for a period of five (5) years following permanent account closure, in compliance with PAGCOR record-keeping requirements and the Anti-Money Laundering Act;
• KYC Documents: Retained for a minimum of five (5) years following account closure or the last transaction, whichever is later, as required by AMLC regulations applicable to designated non-financial businesses and professions;
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, consistent with AMLA record-keeping obligations;
• Customer Support Records: Retained for two (2) years from the date of the last interaction, for dispute resolution and quality assurance purposes;
• Technical and Usage Data: Retained for up to twelve (12) months in identifiable form for fraud prevention and security purposes, after which such data is aggregated and anonymised;
• Responsible Gaming Records: Self-exclusion and problem gambling records are retained for the duration required to enforce exclusion periods and for a minimum of three (3) years thereafter.

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised in accordance with 18ji's data disposal procedures. Where deletion is not immediately feasible due to technical constraints, data will be quarantined and access restricted pending secure deletion at the earliest practicable opportunity.

18ji implements a range of technical, organisational, and administrative security measures designed to protect your personal data against unauthorised access, accidental loss, disclosure, destruction, or alteration. Key security measures in place on the 18ji platform include:

• Transport Encryption: All data transmitted between your device and the 18ji platform is encrypted using 256-bit SSL/TLS technology, identical to the encryption standard used by major Philippine banks;
• Data-at-Rest Encryption: Sensitive personal data stored in 18ji's databases, including KYC documents and financial records, is encrypted at rest using industry-standard encryption protocols;
• Access Controls: Internal access to personal data is restricted to 18ji personnel who require it to perform their specific job functions. Access is governed by role-based access control policies and is logged for audit purposes;
• Two-Factor Authentication: 18ji employees with access to systems containing personal data are required to use multi-factor authentication. Account holders are offered SMS OTP two-factor authentication for their 18ji login;
• Security Monitoring: 18ji operates continuous security monitoring systems that detect and alert on unusual access patterns, login anomalies, and potential data breach indicators;
• Third-Party Security Audits: 18ji's platform security controls are subject to periodic independent security reviews and vulnerability assessments.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, 18ji will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, and will notify affected data subjects without undue delay where the breach is likely to result in a high risk to your rights and freedoms, in accordance with RA 10173 and NPC Circular No. 16-03.

The 18ji platform uses cookies and similar tracking technologies to operate essential platform functions, maintain your login session, remember your preferences, and analyse platform usage. The following categories of cookies are used on the 18ji platform:

• Strictly Necessary Cookies: Required for the 18ji platform to function. These include session authentication cookies that keep you logged in, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without impairing platform functionality;
• Functional Cookies: Used to remember your preferences, such as language settings, preferred game categories, and responsible gaming limit configurations. These improve your experience on return visits;
• Analytics Cookies: Used to collect anonymised or pseudonymised data about how players use the 18ji platform — including which pages are visited most frequently and where navigation problems occur. This data is used to improve the platform. 18ji does not share analytics data with third-party advertising networks;
• Security Cookies: Used to support fraud detection, bot prevention, and account security monitoring by identifying unusual session behaviours.

You may configure your browser to refuse or delete cookies. Please note that disabling strictly necessary cookies will impair your ability to use the 18ji platform, including the ability to log in to your account. Browser-level cookie controls do not affect server-side session management for active logged-in sessions.

As a data subject under Republic Act No. 10173 (Data Privacy Act of 2012), you are entitled to exercise the following rights with respect to personal data processed by 18ji:

• Right to Be Informed: The right to be informed of the existence of processing, the nature of the personal data being processed, and the purposes for which it is being processed — as fulfilled by this Privacy Policy;
• Right of Access: The right to request reasonable access to the personal data 18ji holds about you, including a copy of such data in a legible format;
• Right to Rectification: The right to request correction of any inaccurate or incomplete personal data in your 18ji account. For information that cannot be self-corrected via the account dashboard, please contact support;
• Right to Erasure / Right to be Forgotten: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to 18ji's legal retention obligations under PAGCOR regulations and AMLA requirements;
• Right to Data Portability: The right to receive personal data you have provided to 18ji in a structured, commonly used, and machine-readable format, and to have such data transmitted to another controller where technically feasible;
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests. Upon receipt of a valid objection, 18ji will cease the relevant processing unless there are compelling legitimate grounds that override your objection;
• Right to Withdraw Consent: Where processing is based on your consent, the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact 18ji's Data Protection Officer (DPO) via the contact details in Section 15 of this policy. 18ji will respond to all data subject rights requests within thirty (30) calendar days of receipt of a complete, verifiable request, in accordance with the NPC's prescribed response timeframes.

18ji does not knowingly collect, process, or retain personal data from individuals under the age of 21 years. The KYC verification process is specifically designed to confirm that all registered account holders meet the minimum age requirement. Where 18ji discovers or has reasonable grounds to believe that personal data has been collected from a person under 21 — whether through false representation during registration or any other means — 18ji will immediately suspend the relevant account, delete the personal data of the minor to the extent permitted by law, and report the matter to PAGCOR as required under applicable regulations.

If you are a parent or guardian and have reason to believe that a minor under your care has registered on the 18ji platform, please contact 18ji's support team or Data Protection Officer immediately with the relevant account details.

The 18ji platform primarily processes personal data within the Philippines. However, certain service providers engaged by 18ji — including cloud infrastructure providers, game software suppliers, and fraud screening services — may process personal data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, 18ji ensures that such transfers are subject to appropriate safeguards in compliance with Section 21 of RA 10173 and the NPC's guidelines on cross-border data transfers. Such safeguards may include contractual clauses binding the recipient to data protection standards equivalent to those applicable in the Philippines, adequacy determinations, or other mechanisms approved by the NPC.

18ji will not transfer your personal data to jurisdictions that do not provide adequate levels of data protection without implementing appropriate safeguards and, where required, obtaining your informed consent for such transfers.

18ji reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, platform features, or data processing practices. Material changes — particularly those that affect the categories of data collected, the purposes of processing, data sharing arrangements, or data subject rights — will be communicated to registered account holders via the email address or mobile number associated with their account at least fourteen (14) days before the changes take effect.

For non-material changes, such as typographical corrections or clarifications that do not alter the substantive rights of data subjects, 18ji may update this policy without advance notice. The revised policy will be published on this page with an updated effective date.

Your continued use of the 18ji platform following the effective date of any amendment constitutes your acknowledgement of the updated Privacy Policy. We encourage you to review this page periodically to remain informed of how 18ji protects your personal data.

In compliance with Republic Act No. 10173 and NPC Circular No. 16-01, 18ji has designated a Data Protection Officer (DPO) responsible for overseeing the platform's compliance with applicable data protection laws, handling data subject rights requests, and acting as the point of contact with the National Privacy Commission.

To exercise your data subject rights, submit a privacy-related complaint, inquire about 18ji's data processing practices, or contact the Data Protection Officer for any other privacy matter, please use the following channels:

• Email (non-clickable): [email protected] — please include "Privacy / DPO Request" in your subject line to ensure your message is routed to the Data Protection Officer;
• Live Chat: Available 24/7 through the 18ji platform after logging in to your account. Advise the support agent that your enquiry is a data protection or privacy matter for DPO referral;
• Written Correspondence: Formal written data subject rights requests submitted via email will be acknowledged within five (5) business days and responded to within thirty (30) calendar days in accordance with NPC guidelines.

For complaints that cannot be resolved through 18ji's internal process, data subjects have the right to escalate to the National Privacy Commission of the Philippines. Information on filing an NPC complaint is available at the NPC's official website.