Ji3 Privacy Policy

1. Who We Are — Data Controller

Ji3 Asia Ltd. is the Data Controller for personal data processed through the ji3 Platform. Ji3 operates under the regulatory oversight of the Philippine Amusement and Gaming Corporation (PAGCOR) and complies with the requirements of Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and relevant issuances of the National Privacy Commission (NPC) of the Philippines.

For all privacy-related inquiries, you may contact Ji3's designated Data Protection Officer (DPO) at: [email protected] (please include "Data Privacy" in your subject line).

2. Personal Data We Collect

Ji3 collects only the personal data that is necessary for the purposes described in this Policy. The categories of data we collect include:

Ji3 does not collect sensitive personal information as defined under the Data Privacy Act (such as religious affiliation, political views, or health data) unless specifically required by PAGCOR regulations in relation to responsible gaming assessments.

3. How We Collect Your Data

Ji3 collects personal data through the following means:

• Direct collection: Information you provide during account registration, KYC submission, payment processing, support interactions, and responsible gaming tool configuration;
• Automatic collection: Technical data collected automatically when you access the Platform, including through cookies, web beacons, and server logs;
• Third-party sources: Identity verification data from licensed KYC/AML service providers; fraud and risk data from payment processing partners; data from PAGCOR's self-exclusion registry where applicable.

4. Legal Basis for Processing

Ji3 processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform the gaming services contract with you, including account management, payment processing, and game provision;
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, Anti-Money Laundering Act obligations, National Privacy Commission requirements, and other applicable Philippine laws;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where these interests are not overridden by your data protection rights;
• Consent: Processing for direct marketing communications, where you have provided explicit consent that can be withdrawn at any time.

5. How We Use Your Personal Data

Ji3 uses collected personal data for the following purposes:

• Creating, verifying, and managing your player account;
• Processing deposits and withdrawals via GCash, PayMaya, BPI, BDO, and Metrobank;
• Providing access to games and all Platform features;
• Complying with PAGCOR licensing conditions, including age verification and responsible gaming requirements;
• Conducting KYC and AML screening as required under Republic Act No. 9160 and PAGCOR regulations;
• Detecting, investigating, and preventing fraud, cheating, collusion, and other prohibited conduct;
• Administering bonuses, promotions, and loyalty programs;
• Providing customer support and resolving disputes;
• Sending transactional communications (deposit confirmations, withdrawal status, security alerts) — these are not optional as they are essential to account management;
• Sending promotional communications where you have consented — you may opt out at any time by contacting [email protected];
• Improving the Platform through analysis of aggregated usage patterns.

6. Data Sharing & Disclosure

Ji3 does not sell your personal data to third parties. Ji3 may share personal data with the following categories of recipients, strictly to the extent necessary for the stated purpose:

• PAGCOR and regulatory authorities: As required by the ji3 PAGCOR license, applicable laws, or lawful regulatory directives;
• Anti-Money Laundering Council (AMLC): Mandatory reporting of covered and suspicious transactions under Republic Act No. 9160;
• National Privacy Commission (NPC): In response to lawful NPC investigations or as required by the Data Privacy Act;
• Law enforcement agencies: Where required by a valid court order or lawful process under Philippine law;
• Payment processors: GCash (Mynt), Maya Philippines, BPI, BDO, and Metrobank — to process deposits and withdrawals;
• KYC/identity verification providers: Licensed third-party providers engaged to verify identity documents and screen against sanctions and PEP lists;
• Game providers: Game software providers (e.g., JILI, PG Soft, Evolution Gaming) receive anonymised session tokens — they do not receive your full personal identity data;
• Cloud and infrastructure providers: Data hosting and processing infrastructure providers operating under contractual data processing agreements;
• Professional advisers: Legal counsel, auditors, and compliance consultants, under confidentiality obligations.

All third parties who process data on ji3's behalf are required to implement appropriate technical and organizational security measures and to process data only on ji3's documented instructions.

7. International Data Transfers

7.1 Ji3's primary data infrastructure is hosted within the Philippines. Where data is transferred to or processed by service providers located outside the Philippines (for example, cloud infrastructure providers with regional data centres in Southeast Asia), ji3 ensures that such transfers comply with Section 21 of the Data Privacy Act, including the requirement that the recipient country provides an adequate level of data protection or that appropriate contractual safeguards are in place.

7.2 Ji3 does not transfer player personal data to jurisdictions outside Southeast Asia as a matter of operational policy. Any exception to this policy requires specific documented authorization from Ji3's Data Protection Officer.

8. Data Retention

Ji3 retains personal data for as long as necessary to fulfil the purpose for which it was collected, subject to the following minimum retention periods:

• Account and identity data (KYC documents): Retained for five (5) years from account closure, as required by PAGCOR regulations and Anti-Money Laundering Act obligations;
• Financial transaction records: Retained for five (5) years from the date of the transaction, in compliance with the AMLC's record-keeping requirements;
• Gaming session logs: Retained for three (3) years from the date of the session;
• Customer support correspondence: Retained for three (3) years from closure of the support ticket;
• Responsible gaming records (self-exclusion, limits): Retained for the duration of the exclusion period plus five (5) years.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

9. Cookies & Tracking Technologies

9.1 Ji3 uses cookies and similar tracking technologies (web beacons, local storage) to operate and improve the Platform. The categories of cookies used include:

• Strictly necessary cookies: Required for Platform functionality including authentication session management, load balancing, and security. These cannot be disabled.
• Functional cookies: Remember your preferences such as language settings, game volume, and interface customizations.
• Analytical cookies: Collect anonymised usage data to help ji3 understand how players use the Platform and identify areas for improvement. No individually identifying data is stored in analytical cookies.
• Security cookies: Used for fraud detection, device fingerprinting for login anomaly detection, and session integrity verification.

9.2 Ji3 does not use advertising or cross-site tracking cookies. Ji3 does not participate in advertising networks or share cookie data with advertising platforms.

9.3 You may control non-essential cookies through your browser settings. Note that disabling functional cookies may impair some Platform features.

10. Security Measures

Ji3 implements the following technical and organizational security measures to protect your personal data:

• SSL/TLS 256-bit encryption for all data transmitted between your device and the ji3 Platform;
• Encryption at rest for all databases containing personal and financial data;
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis;
• Multi-factor authentication required for all ji3 staff with access to personal data systems;
• Regular independent security audits and penetration testing;
• Automated anomaly detection for unauthorized access attempts;
• Incident response procedures compliant with NPC breach notification requirements (72-hour notification for high-risk breaches).

While ji3 implements industry-standard security controls, no system can guarantee absolute security. You are responsible for maintaining the security of your own account credentials.

11. Your Data Subject Rights

Under Republic Act No. 10173 (Data Privacy Act of 2012), you have the following rights in relation to your personal data held by ji3:

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Subject Rights Request." Ji3 will respond within fifteen (15) business days. Identity verification may be required before processing your request.

12. Minors — Persons Under 21

Ji3's gaming services are strictly restricted to persons aged 21 and above, in accordance with PAGCOR regulations. Ji3 does not knowingly collect personal data from persons under the age of 21. Registration requires submission of a valid Philippine government-issued ID, which is verified to confirm eligibility. If ji3 determines that personal data has been collected from a person under 21, the account will be immediately suspended and all data relating to that person will be deleted in accordance with ji3's retention and deletion procedures, subject to any mandatory reporting obligations under Philippine law.

13. Changes to This Privacy Policy

13.1 Ji3 reserves the right to update this Privacy Policy at any time. Material changes — including changes to the categories of data collected, the purposes of processing, or your data subject rights — will be communicated to registered players by email and/or by prominent notice on the Platform at least seven (7) days before the amended Policy takes effect.

13.2 Non-material changes (such as clarifications, corrections of typographical errors, or changes to formatting) may be made without advance notice but will be reflected in the updated effective date.

13.3 Continued use of the Platform after the effective date of an amended Policy constitutes acceptance of the amended terms.

14. Contact & Data Protection Officer

For all privacy-related inquiries, data subject rights requests, or to report a suspected privacy incident, please contact Ji3's Data Protection Officer:

• Email: [email protected] (subject: "Data Privacy")
• Response time: Acknowledgement within 24 hours; substantive response within 15 business days
• Regulator: National Privacy Commission of the Philippines

If you are not satisfied with ji3's response to your data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines.