21jl Casino — Privacy Policy
& Data Protection

About This Privacy Policy

This Privacy Policy ("Policy") is issued by 21jl Casino ("21jl", "we", "us", "our"), the operator of the online gaming platform accessible at 21jl.vip. This Policy describes how 21jl collects, processes, stores, shares, and protects personal information relating to individuals who register as players, visit the Platform, or otherwise interact with 21jl's services.

This Policy applies to all personal data processing activities carried out by 21jl in connection with the operation of 21jl.vip, whether conducted online through the website or through any affiliated mobile interface.

By registering a 21jl account, accessing the Platform, or providing any personal information to 21jl, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not create an account or use the Platform.

Data Controller

For the purposes of the Data Privacy Act of 2012 and applicable data protection legislation, 21jl Casino is the personal information controller ("PIC") responsible for the personal data collected through the 21jl.vip platform.

Where 21jl engages third-party service providers to process personal data on its behalf (such as payment processors, KYC verification providers, and platform infrastructure suppliers), those parties act as personal information processors ("PIPs") under contractual data processing agreements that obligate them to handle personal data only in accordance with 21jl's instructions and applicable law.

Contact details for the 21jl Data Protection Officer are provided in Section 16 of this Policy.

Personal Data We Collect

21jl collects several categories of personal information, depending on the nature of your interaction with the Platform. The table below summarises the main categories, specific data points, and the context in which each is collected:

How We Collect Personal Data

21jl collects personal data through the following channels:

• Direct Collection: Information you provide directly when registering an account, completing KYC verification, making deposits or withdrawal requests, updating account settings, or contacting customer support via live chat or email.
• Automated Technical Collection: Data automatically generated and collected when you access the Platform, including IP address, device identifiers, session activity, page navigation patterns, and cookies (see Section 8).
• Third-Party Sources: Where necessary for KYC compliance or fraud prevention, 21jl may receive identity verification data from third-party identity verification service providers. 21jl may also receive transaction confirmation data from payment processors (GCash, Maya, BPI, BDO, UnionBank, and others) in connection with deposits and withdrawals.
• Regulatory Sources: In limited circumstances required by law, 21jl may receive or be required to share personal data with the Anti-Money Laundering Council (AMLC), PAGCOR, or other Philippine government agencies.

How We Use Your Personal Data

21jl uses the personal data it collects for the following purposes:

• Account Management: Creating, maintaining, and managing your 21jl player account, including processing login sessions, updating profile information, and managing account security settings.
• Identity Verification (KYC): Verifying your identity, age, and eligibility to use the Platform in compliance with PAGCOR regulations and the requirement that all players be 21 years of age or older.
• Payment Processing: Processing deposits to and withdrawals from your 21jl wallet, including communicating with payment providers and maintaining transaction records.
• Platform Delivery: Operating the casino games, sports betting, and other Platform features you access, and maintaining accurate records of game sessions, bets, and outcomes.
• Fraud Prevention and Security: Detecting and preventing fraudulent activity, money laundering, account takeovers, and other security threats. This includes automated analysis of login patterns, transaction behaviour, and game activity.
• Regulatory Compliance: Meeting 21jl's legal obligations under Philippine law, including PAGCOR requirements, Anti-Money Laundering Act (AMLA) reporting obligations, and data retention requirements under the Data Privacy Act.
• Responsible Gaming: Monitoring usage patterns to identify potential problem gambling behaviours and providing appropriate responsible gaming interventions, including communications about available support tools.
• Customer Support: Responding to enquiries, resolving complaints, and maintaining support communication records.
• Marketing Communications (Opt-In Only): Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. You may withdraw consent at any time through your account settings.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the quality, performance, and features of the 21jl Platform.

Legal Bases for Processing

Under the Data Privacy Act of 2012, every processing activity 21jl undertakes must have a lawful basis. The following bases apply to 21jl's data processing activities:

• Contractual Necessity: Processing required to perform the contract between you and 21jl — specifically, the operation of your player account, processing of transactions, and delivery of gaming services.
• Legal Obligation: Processing required to comply with applicable Philippine law, including PAGCOR licensing requirements, AMLA compliance, AMLC reporting, and NPC-mandated data governance obligations.
• Legitimate Interest: Processing necessary for 21jl's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and service quality improvement, where such interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — principally for the sending of marketing and promotional communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Data Sharing & Third-Party Disclosure

21jl does not sell personal data to third parties. Personal data is shared only in the following limited circumstances:

• Payment Processors: GCash (Mynt), Maya (Voyager Innovations), BPI, BDO, UnionBank, 7-Eleven Cliqq, Coins.ph, and USDT network providers receive the minimum personal and financial data necessary to process transactions on your behalf. These parties operate under their own privacy policies and are subject to BSP (Bangko Sentral ng Pilipinas) regulation.
• KYC and Identity Verification Providers: Third-party identity verification specialists may process identity documents and selfie data to facilitate KYC compliance. These providers act as personal information processors under contractual agreements with 21jl.
• Game Providers: Third-party game studios (JILI, PG Soft, Pragmatic Play, and others) may receive anonymised session identifiers necessary to deliver their games through the 21jl platform. Game providers do not receive your full identity, contact, or financial data.
• Regulatory Authorities: 21jl will disclose personal data to PAGCOR, the AMLC, the NPC, or other Philippine government bodies when required to do so by law, court order, or binding regulatory directive.
• Legal and Professional Advisers: Legal counsel, accountants, and auditors may access personal data on a strictly need-to-know basis in connection with regulatory filings, legal proceedings, or compliance reviews.
• Business Succession: In the event of a merger, acquisition, or transfer of the 21jl business, personal data may be transferred to the acquiring entity subject to equivalent privacy protections and player notification.

Cookies & Tracking Technologies

21jl uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you access a website. 21jl uses the following categories of cookies:

• Strictly Necessary Cookies: Essential to the functioning of the Platform. These include session authentication cookies that keep you logged in during a visit, security tokens, and load-balancing cookies. These cannot be disabled without impairing core Platform functionality.
• Functional Cookies: Remember your preferences (such as language settings and game display preferences) to provide a more personalised experience. These are not required for basic operation but improve usability.
• Analytics Cookies: Used by 21jl to understand how players navigate and use the Platform — which pages are most visited, where users encounter errors, and how the Platform performs on different devices and connection types. Data from analytics cookies is aggregated and used to improve Platform quality.
• Security Cookies: Used to detect and prevent fraudulent login attempts, bot activity, and account takeover attempts by correlating device fingerprints and session patterns.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will significantly impair your ability to use the Platform, including the ability to remain logged in to your 21jl account.

Data Retention

21jl retains personal data for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following retention periods apply as a general guide:

• Account and Identity Data: Retained for the duration of your account relationship with 21jl, plus a minimum of five (5) years following account closure, as required under AMLA record-keeping obligations.
• Financial and Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, or longer if required by PAGCOR or AMLC regulatory directions.
• Gaming Session Data: Retained for a minimum of three (3) years from the date of each session for dispute resolution, regulatory audit, and responsible gaming monitoring purposes.
• Communications Records: Customer support interactions and formal complaints are retained for a minimum of two (2) years from the date of final resolution.
• Marketing Consent Records: Records of your consent to or withdrawal from marketing communications are retained for a minimum of three (3) years for compliance demonstration purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with 21jl's data lifecycle management procedures.

Data Security Measures

21jl implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the 21jl Platform, including login credentials, payment data, and account information;
• Secure, access-controlled server infrastructure with encrypted data storage for sensitive personal and financial data;
• Role-based internal access controls ensuring that 21jl staff can only access personal data to the extent required for their specific operational role;
• Multi-factor authentication requirements for internal administrative access to systems holding personal data;
• Regular security assessments and vulnerability testing of Platform infrastructure;
• Data breach response procedures including notification protocols in compliance with the NPC's mandatory 72-hour breach notification requirement under the Data Privacy Act.

Your Data Rights

As a data subject under the Data Privacy Act of 2012, you have the following rights in respect of the personal data 21jl holds about you:

• Right to be Informed: The right to be informed that your personal data is being collected and processed, and to receive clear information about the purposes, scope, and method of processing — as provided in this Privacy Policy.
• Right of Access: The right to obtain confirmation of whether 21jl processes personal data about you, and to request a copy of that data in a structured, commonly used format.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data held by 21jl. You may update basic contact and preference data directly through your account settings. Corrections to KYC-verified identity data require document resubmission.
• Right to Erasure: The right to request deletion of personal data that is no longer necessary for the purposes for which it was collected, where processing was based on consent that has been withdrawn, or where processing is unlawful. Note that erasure requests may be limited by mandatory retention obligations under AMLA and PAGCOR regulations.
• Right to Object: The right to object to processing based on legitimate interest, including profiling for direct marketing purposes. You may withdraw consent to marketing communications at any time through your account settings.
• Right to Data Portability: The right to receive a copy of personal data you have provided to 21jl in a structured, machine-readable format, and to request its transmission to another controller where technically feasible.
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe 21jl has violated your data privacy rights.

To exercise any of the above rights, contact 21jl's Data Protection Officer using the details in Section 16. 21jl will acknowledge your request within 72 hours and provide a substantive response within 15 business days.

Children and Minors

The 21jl Platform is strictly restricted to persons aged 21 years or older, in compliance with PAGCOR regulations governing online gaming in the Philippines. 21jl does not knowingly collect personal data from individuals under the age of 21.

If 21jl becomes aware, through KYC review or other means, that personal data has been collected from an individual under the age of 21, the relevant account will be immediately suspended, all data will be deleted (subject only to mandatory regulatory retention requirements related to the underage access incident), and any balances held in the account will be handled in accordance with applicable law and PAGCOR guidelines.

International Data Transfers

Some of 21jl's third-party service providers — including certain game studios and cloud infrastructure providers — may be located outside the Philippines. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection to that of the Philippines, 21jl ensures that such transfers are protected by:

• Contractual data processing agreements that impose data protection obligations equivalent to those required under the Data Privacy Act of 2012;
• Standard contractual clauses approved by the National Privacy Commission where applicable; or
• Other appropriate safeguards consistent with NPC guidance on cross-border data transfers.

Where technically feasible, 21jl minimises cross-border data exposure by anonymising or pseudonymising personal data before it is transmitted to overseas processors.

Third-Party Platforms and Links

The 21jl Platform may contain references or links to third-party game providers and payment processors whose privacy practices are governed by their own privacy policies. 21jl is not responsible for the data collection or privacy practices of third-party platforms, even where 21jl integrates their services within the 21jl Platform.

We encourage you to review the privacy policies of GCash, Maya, BPI, BDO, and other payment providers before submitting personal or financial data to those services. 21jl's Privacy Policy applies exclusively to data collected and processed by 21jl in connection with the operation of 21jl.vip.

Updates to This Privacy Policy

21jl reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or changes in the services offered on the Platform.

Material changes to this Policy will be communicated to registered players via the email address on file, or through a prominent notice published on the 21jl Platform, at least seven (7) days before the amended Policy takes effect. Non-material clarifications may be published with immediate effect.

Your continued use of the Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the updated Policy, you must cease using the Platform and may request account closure in accordance with the Terms and Conditions.

The current version and effective date of this Privacy Policy are displayed at the top of this page. Earlier versions are available upon request by contacting the 21jl Data Protection Officer.

Contact Us & Data Protection Officer

If you have questions about this Privacy Policy, wish to exercise any of your data rights described in Section 11, or need to report a data privacy concern, please contact 21jl's Data Protection Officer through the following channels:

21jl will acknowledge data privacy requests within 72 hours of receipt. Substantive responses to access, correction, and erasure requests will be provided within fifteen (15) business days, which may be extended by a further fifteen (15) business days in cases of complexity, with notification to you of the extension.

If you believe 21jl has failed to adequately address your data privacy concern, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Philippines. The NPC's contact and complaint channels are available through the NPC's official government website.