Privacy Policy — 26jl Platform

The data controller responsible for your personal information collected through the 26jl platform is the entity operating 26jl under its PAGCOR licence, accessible at 26jl.lat (hereinafter "26jl," "We," "Us," or "Our").

As the data controller, 26jl determines the purposes and means of processing your personal information and is responsible for ensuring that such processing complies with Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and all relevant National Privacy Commission (NPC) issuances.

26jl has designated a Data Protection Officer (DPO) as required under RA 10173. The DPO oversees all data privacy compliance matters and can be contacted through the support details in Section 12 of this policy.

26jl collects personal information in three ways: information you provide directly, information collected automatically through your use of the platform, and information received from third parties in connection with payment processing and identity verification.

Information You Provide Directly:

• Full legal name and date of birth (required for KYC age verification under PAGCOR rules)
• Philippine mobile number (used as your account identifier and for two-factor authentication)
• Government-issued ID details and document images (UMID, PhilSys National ID, driver's licence, or passport)
• Residential address
• Payment instrument details — including GCash account number, Maya/PayMaya account, bank account details, or other registered payment method information
• Account password (stored in hashed, non-reversible form — never in plain text)
• Source of funds declarations and supporting documentation (where requested for AML compliance)
• Communications sent to our support team via live chat or email

Information Collected Automatically:

• IP address and approximate geolocation at the time of login and transactions
• Device type, operating system, and browser type
• Session duration, pages visited, and in-platform navigation patterns
• Game history, wager amounts, and transaction records (deposits, withdrawals, bonuses claimed)
• Cookies and similar tracking technologies (see Section 7)

Information from Third Parties:

• Identity verification results from KYC/AML screening providers
• Transaction confirmation data from payment processors (GCash, Maya, banks)
• Fraud detection signals from security service providers

The table below sets out each category of processing activity, its specific purpose, and the legal basis under RA 10173 that authorises it.

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, and it does not affect processing carried out on other legal bases.

26jl does not sell or rent your personal information to third parties. We share your personal data only in the following circumstances and only to the extent strictly necessary:

• PAGCOR and regulatory authorities: 26jl is required by its operating licence to submit specified player data and transaction reports to PAGCOR on a periodic basis. We may also be required to disclose information in response to lawful requests from other Philippine government agencies including the Anti-Money Laundering Council (AMLC) and law enforcement bodies acting under valid legal authority.
• Payment processors: Transaction data is shared with the relevant payment service providers (e.g., GCash, Maya/PayMaya, BPI, BDO, UnionBank) as necessary to process your deposits and withdrawals. These providers process your data as independent data controllers under their own privacy policies and applicable financial regulations.
• KYC and identity verification providers: Your government ID details and document images are shared with our licensed KYC technology partners solely for the purpose of verifying your identity and age in compliance with PAGCOR requirements.
• Game providers and platform technology vendors: Game history and session data may be accessible to certified third-party game providers (such as JILI, PG Soft, Evolution Gaming, SA Gaming) to the extent required for game delivery, fairness certification, and dispute resolution. These providers are contractually bound to use your data only for these purposes.
• Security and fraud prevention services: Anonymised and pseudonymised data may be shared with fraud detection and cybersecurity providers to protect the integrity of the 26jl platform.
• Corporate transactions: In the event of a merger, acquisition, or transfer of business assets, your personal data may be transferred to the acquiring entity, provided that the acquiring entity commits to data handling standards at least equivalent to those set out in this policy and in compliance with RA 10173.

26jl retains personal information only for as long as is necessary for the purposes for which it was collected, or as required by applicable law, regulation, or PAGCOR licensing conditions — whichever is longer.

• Account and KYC records: Retained for a minimum of five (5) years following account closure, in compliance with PAGCOR requirements and RA 9160 (Anti-Money Laundering Act) record-keeping obligations.
• Transaction records: Retained for five (5) years in accordance with AMLC reporting and audit requirements.
• Support communications: Retained for two (2) years from the date of the last interaction, or longer where relevant to an unresolved dispute.
• Marketing preferences: Retained until you withdraw consent or request deletion, subject to the retention floors above.
• Technical logs: Retained for a rolling period of twelve (12) months for security and fraud investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual. Where anonymisation rather than deletion is applied, the resulting anonymised data may be retained indefinitely for aggregate statistical purposes.

26jl implements technical and organisational security measures designed to protect your personal information against unauthorised access, disclosure, alteration, and destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and our servers
• At-rest encryption for sensitive personal information stored on our systems
• Password hashing using industry-standard one-way algorithms — plain-text passwords are never stored
• Two-factor authentication (2FA) available on all player accounts
• Role-based access controls limiting internal staff access to personal data on a strict need-to-know basis
• Intrusion detection and security monitoring systems operating on a continuous basis
• Periodic security assessments and penetration testing of platform infrastructure
• Data breach response procedures meeting the NPC's 72-hour notification requirement

26jl uses cookies and similar web tracking technologies to enable core platform functionality, maintain your login session, and analyse how the platform is used. The categories of cookies we deploy are:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Store your preferences such as language settings, display preferences, and remembered device settings. These improve your experience but are not essential for the platform to operate.
• Analytics cookies: Collect anonymised information about how Players navigate the platform — which game categories are most visited, which pages generate the most support queries, and where users encounter friction. This data is used to improve the 26jl platform and is not linked to individually identifiable users where technically avoidable.

You may control non-essential cookies through your browser settings. Disabling strictly necessary cookies will prevent you from logging in to or using the 26jl platform. Most modern mobile browsers — including Chrome and Safari on Android and iPhone — provide cookie management options in their privacy settings.

26jl does not knowingly collect personal information from individuals under 21 years of age. Access to real-money gaming on the 26jl platform is strictly limited to persons who are 21 years of age or older, as mandated by PAGCOR's licensing conditions and applicable Philippine gaming law.

All Players are required to complete KYC identity verification — including submission of a valid government-issued ID — before being granted real-money access. This verification process is designed to confirm that each Player meets the minimum age requirement.

If 26jl becomes aware that personal information has been collected from a person under 21, that account will be immediately suspended, any deposits will be refunded, and all personal data associated with the underage account will be deleted, subject only to any legal retention obligations arising from the detection itself.

Under Republic Act No. 10173, you have the following rights in relation to your personal data held by 26jl:

• Right to be informed: The right to know what personal data we hold about you, how it is being processed, and with whom it has been shared. This policy is part of how we fulfil this right.
• Right of access: The right to request a copy of the personal data we hold about you. We will respond to verified access requests within fifteen (15) business days.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data. You may update most account information directly through Account Settings. For KYC documents, a formal correction request is required.
• Right to erasure: The right to request deletion of your personal data, subject to our legal obligations to retain certain data for the minimum periods set out in Section 5. Requests that conflict with our regulatory retention obligations will be partially fulfilled — data beyond the mandatory retention period will be deleted.
• Right to object: The right to object to processing based on legitimate interest, including marketing communications. You may unsubscribe from marketing at any time through Account Settings or by contacting support.
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format and to have it transmitted to another data controller where technically feasible.
• Right to damages: The right to claim compensation for actual damages sustained as a result of inaccurate, incomplete, outdated, or unlawfully obtained or used personal data.

To exercise any of the above rights, contact the 26jl Data Protection Officer through the support details in Section 12. We may require you to verify your identity before processing your request to prevent unauthorised access to another person's data.

Some of the third-party service providers engaged by 26jl — particularly certified game providers and platform technology vendors — may process data on servers located outside the Philippines. Where such cross-border transfers occur, 26jl ensures that appropriate safeguards are in place as required by RA 10173 and NPC regulations, including:

• Contractual data protection clauses that bind the recipient to standards at least equivalent to those required under Philippine law
• Transfer only to countries or organisations that provide an adequate level of data protection as recognised by the NPC
• Your explicit consent to the transfer where required under Philippine law

26jl will not transfer your personal data outside the Philippines where doing so would result in a lower level of protection than you would receive under RA 10173.

26jl may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, PAGCOR requirements, or platform services. When material changes are made, we will notify registered Players via the mobile number or contact information on file at least seven (7) calendar days before the updated policy takes effect.

The effective date at the top of this policy reflects the date on which the current version took effect. Your continued use of the 26jl platform after the effective date of any updated policy constitutes your acceptance of the revised terms, to the extent that your acceptance is the applicable legal basis. Where processing is required by law or for contract performance, it will continue regardless of whether you accept the updated policy.

Previous versions of this Privacy Policy are available on request through our support contact.

If you have questions about this Privacy Policy, wish to exercise your data subject rights, or want to report a potential data privacy concern, please contact the 26jl Data Protection Officer:

You may also contact 26jl through the live chat function available within the platform after logging in to your account. Support is available 24 hours a day, 7 days a week.

If you are not satisfied with our response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. The NPC handles complaints from data subjects regarding breaches of RA 10173. Contact the NPC at privacy.gov.ph (type this address directly into your browser — this is an external government website).