xbjijl Casino – Privacy Policy

1 Introduction & Data Controller Identity

1.1  xbjijl Casino ("xbjijl," "we," "us," "our") is committed to protecting the personal data of every player and visitor who interacts with our platform. This Privacy Policy has been prepared in accordance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, the relevant issuances of the National Privacy Commission (NPC) of the Philippines, and applicable guidelines issued by the Philippine Amusement and Gaming Corporation (PAGCOR).

1.2  xbjijl acts as the Personal Information Controller (PIC) in respect of personal data collected through the xbjijl platform. As PIC, xbjijl determines the purposes and means of processing your personal data and is responsible for ensuring that processing is conducted lawfully, fairly, and transparently.

1.3  Where xbjijl engages third-party service providers to process personal data on its behalf — such as payment processors and identity verification providers — those entities act as Personal Information Processors (PIPs) and are contractually bound to process data only on xbjijl's documented instructions and to maintain appropriate security measures.

1.4  Questions or requests regarding this Privacy Policy or xbjijl's data processing activities should be directed to the Data Protection Officer (DPO) using the contact details provided in Section 16.

2 Categories of Personal Data We Collect

xbjijl collects the following categories of personal data, limited to what is necessary for the stated purposes described in Section 5:

Category	Examples	Purpose
Identity Data	Full legal name, date of birth, government ID type and number	KYC verification, age compliance (21+), account registration
Contact Data	Mobile number (Philippine), email address	Account communication, OTP delivery, support
Financial Data	GCash number, PayMaya number, bank account details (BPI, BDO, Metrobank)	Deposit processing, withdrawal disbursement, AML compliance
Technical Data	IP address, device type, browser type, operating system, session data	Platform security, fraud detection, performance optimisation
Usage Data	Games played, wager amounts, session duration, login timestamps	Responsible gaming monitoring, personalisation, regulatory reporting
Communication Data	Support chat transcripts, email correspondence, complaint records	Dispute resolution, service improvement, regulatory audit trail
Marketing Preferences	Consent flags, communication opt-in/opt-out status	Promotion delivery, compliance with marketing consent requirements

2.1  xbjijl does not intentionally collect sensitive personal information as defined under the DPA (e.g., health data, religious beliefs, political affiliations) unless expressly required by a specific regulatory obligation. Where such data is inadvertently provided, it will be deleted promptly upon identification.

3 How We Collect Personal Data

xbjijl collects personal data through the following channels and mechanisms:

• Direct provision: Information you submit during account registration, KYC verification, deposit and withdrawal requests, or when contacting support;
• Automated collection: Technical and usage data collected automatically when you access the xbjijl platform, including through cookies, log files, and session tracking technologies;
• Third-party sources: Identity verification data from government-issued ID validation services, fraud screening data from anti-money laundering screening providers, and transaction data from payment processors;
• PAGCOR-required reporting: Data shared with or received from PAGCOR and the Anti-Money Laundering Council (AMLC) in connection with xbjijl's regulatory compliance obligations.

4 Legal Bases for Processing

4.1  xbjijl processes your personal data only where a valid legal basis exists under the Data Privacy Act of 2012. The applicable legal bases are as follows:

• Contractual necessity: Processing required to perform the xbjijl service agreement with you — including account creation, game access, payment processing, and withdrawal disbursement;
• Legal obligation: Processing required to comply with applicable Philippine law, including PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), and NPC regulations;
• Legitimate interests: Processing conducted for xbjijl's legitimate business interests, including fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by your privacy rights;
• Consent: Processing of data for optional marketing communications, non-essential cookies, and any processing not covered by the above bases — consent is freely given, specific, informed, and may be withdrawn at any time.

5 How xbjijl Uses Your Personal Data

xbjijl uses personal data collected from players for the following purposes:

• Creating, maintaining, and administering your xbjijl account;
• Verifying your identity and age (21+ requirement) in compliance with PAGCOR regulations and the DPA;
• Processing deposits and withdrawals through GCash, PayMaya, and Philippine banking channels;
• Conducting anti-money laundering (AML) and counter-terrorist financing (CTF) screening as required under Philippine law;
• Detecting, investigating, and preventing fraudulent activity, cheating, collusion, and other prohibited conduct as defined in the xbjijl Terms & Conditions;
• Monitoring gameplay data to identify patterns consistent with problem gambling and administering responsible gaming tools;
• Providing customer support services and resolving complaints and disputes;
• Sending transactional communications — account notifications, OTPs, withdrawal confirmations, and security alerts — which are not optional and do not require separate consent;
• Sending promotional communications, offers, and bonus notifications — only where you have provided explicit, informed consent and have not subsequently withdrawn it;
• Complying with PAGCOR reporting obligations, court orders, and lawful requests from Philippine regulatory and law enforcement authorities;
• Improving platform performance, security, and user experience through aggregated and anonymised analytics.

6 Disclosure to Third Parties

6.1  xbjijl may disclose your personal data to the following categories of third parties, strictly for the purposes identified:

• Payment processors: GCash (G-Xchange Inc.), PayMaya (Voyager Innovations), BPI, BDO, and Metrobank — for deposit and withdrawal processing;
• Identity verification providers: Third-party KYC and document verification service providers engaged to assist with PAGCOR-mandated player verification;
• PAGCOR: Philippine Amusement and Gaming Corporation — xbjijl's regulatory body, to whom periodic player activity reports and compliance data are submitted as a licensing condition;
• AMLC: Anti-Money Laundering Council — recipient of mandatory suspicious transaction reports and covered transaction reports as required under the AMLA;
• National Privacy Commission (NPC): In the event of a data breach notification obligation or regulatory inquiry;
• Technology infrastructure providers: Cloud hosting, CDN, and platform security providers operating under contractual data processing agreements with appropriate security and confidentiality obligations;
• Legal and professional advisors: In connection with enforcement of xbjijl's legal rights, regulatory proceedings, or litigation;
• Law enforcement and courts: Where disclosure is required by valid legal process, court order, or applicable Philippine law.

6.2  All third-party service providers acting as Personal Information Processors on xbjijl's behalf are required to execute data processing agreements that mandate compliance with the DPA, restrict further sub-processing without xbjijl's approval, and obligate the implementation of appropriate technical and organisational security measures.

7 International Transfers of Personal Data

7.1  xbjijl's primary data processing infrastructure is located within the Philippines. Where personal data is processed by or transmitted to service providers located outside the Philippines — for example, cloud infrastructure providers — xbjijl ensures that appropriate safeguards are in place in accordance with NPC guidelines on cross-border data transfer, including the use of contractual clauses that impose data protection obligations equivalent to those under Philippine law.

7.2  xbjijl will not transfer personal data to jurisdictions that do not provide adequate levels of data protection without implementing additional protective measures and, where required, obtaining your prior consent.

8 Data Retention

8.1  xbjijl retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and PAGCOR licensing conditions.

8.2  As a general framework:

• Account and KYC data: Retained for a minimum of five (5) years from the date of account closure, as required by PAGCOR and AMLA regulations;
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with AMLA retention obligations;
• Support and communication records: Retained for three (3) years from the date of each interaction;
• Marketing consent records: Retained for as long as the consent remains relevant plus an additional three (3) years for accountability purposes;
• Technical and usage data: Retained for up to two (2) years unless required longer for security or legal proceedings.

8.3  Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with NPC guidelines.

9 Security Measures

9.1  xbjijl implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These include:

• 256-bit TLS encryption for all data transmitted between your browser and xbjijl's servers;
• AES-256 encryption for personal data stored at rest in xbjijl's databases;
• Role-based access controls ensuring that personal data is accessible only to personnel with a verified need-to-know;
• Comprehensive access logging and monitoring systems that record all personnel access to databases containing personal data;
• Two-factor authentication requirements for all staff accessing production data systems;
• Regular vulnerability assessments and penetration testing of xbjijl's platform infrastructure;
• Staff training on data privacy obligations and information security best practices.

9.2  While xbjijl takes all reasonable steps to protect your data, no internet transmission or electronic storage system is entirely immune to risk. Players are encouraged to protect their own account credentials and to enable two-factor authentication on their xbjijl account.

10 Cookies & Tracking Technologies

10.1  xbjijl uses cookies and similar tracking technologies on the xbjijl platform to enable core functionality and improve your experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function — including session management, login state, and security tokens. These cannot be disabled without impairing core functionality;
• Performance Cookies: Used to collect anonymised data about page load times, error rates, and navigation patterns to improve platform performance. No personal identity is associated with this data;
• Functionality Cookies: Used to remember your preferences, such as language settings and game lobby layout, to personalise your experience;
• Analytics Cookies: Used — with your consent — to analyse aggregated usage patterns across the platform. You may opt out of non-essential analytics cookies through your browser settings.

10.2  xbjijl does not use third-party advertising or cross-site tracking cookies. You can manage or disable non-essential cookies through your browser's cookie settings. Disabling strictly necessary cookies may affect your ability to use certain features of the platform.

11 Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by xbjijl. To exercise any of these rights, contact the xbjijl Data Protection Officer using the details in Section 16.

11.1  xbjijl will respond to verified data subject requests within thirty (30) days of receipt. Where a request is complex or voluminous, xbjijl may extend this period by a further thirty (30) days, with notification of the extension and reasons provided to the requester within the initial period.

11.2  Identity verification may be required before a data subject request is processed, to ensure that personal data is not disclosed to an unauthorised party.

12 Marketing Communications

12.1  xbjijl will only send you promotional emails, SMS notifications, and bonus offers where you have provided specific, informed, and freely given consent to receive such communications during the registration process or subsequently via your Account settings.

12.2  You may withdraw your marketing consent at any time by updating your communication preferences in the xbjijl account settings, or by contacting support. Withdrawal of marketing consent does not affect xbjijl's ability to send transactional communications required to administer your account.

12.3  xbjijl will never send marketing communications to any player whose account has an active responsible gaming limit or who has entered a cooling-off or self-exclusion period.

13 Protection of Minors

13.1  If you are a parent or guardian and believe that a minor under your care has provided personal data to xbjijl, please contact the Data Protection Officer immediately using the details in Section 16. xbjijl will investigate and take appropriate action within forty-eight (48) hours of receiving a verified notification.

14 Personal Data Breach Notification

14.1  In the event of a personal data breach that is reasonably likely to result in serious harm to the rights and freedoms of affected data subjects, xbjijl will comply with its mandatory breach notification obligations under the DPA and NPC Circular No. 16-03, including:

• Notifying the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, where technically and practically feasible;
• Notifying affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms, providing them with clear information about the nature of the breach, the data affected, and the steps xbjijl is taking in response;
• Maintaining a breach register as required by the NPC.

14.2  xbjijl maintains an incident response plan for data breaches and conducts periodic drills to ensure readiness. All security incidents are investigated and documented regardless of whether they meet the threshold for mandatory notification.

15 Changes to This Privacy Policy

15.1  xbjijl reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. Material changes will be communicated to registered players via the email address associated with their Account and/or through a prominent notification on the xbjijl platform, at least seven (7) days before the revised policy takes effect.

15.2  The most current version of this Privacy Policy will always be accessible at xbjijl.cam/privacy-policy. Continued use of the platform after the effective date of any revision constitutes your acceptance of the updated policy.

16 Contact & Data Protection Officer

16.1  xbjijl has designated a Data Protection Officer (DPO) as required under the Data Privacy Act of 2012. The DPO is responsible for overseeing xbjijl's compliance with the DPA and serves as the primary point of contact for all data privacy matters, including data subject rights requests, complaints, and regulatory inquiries.

16.2  To exercise your data subject rights, raise a privacy concern, or contact the DPO, please use the following channels:

• Email: [email protected] (subject line: "Data Privacy Request" or "DPO Contact")
• Live Chat: Available 24/7 on xbjijl.cam — request escalation to the DPO for formal privacy matters

16.3  Players who are not satisfied with xbjijl's response to a data privacy concern may file a complaint with the National Privacy Commission of the Philippines.