jilaa Privacy Policy

jilaa ("jilaa", "we", "us", "our") is the operator of the online casino and sports betting platform available at jilaa.app, operating under a PAGCOR licence for players in the Philippines. We take the privacy and security of your personal information seriously — not merely as a legal obligation, but as a fundamental commitment to every Filipino player who trusts us with their data.

This Privacy Policy describes how jilaa collects, uses, stores, discloses, and protects personal information in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations, and applicable PAGCOR regulatory requirements. It also describes the rights available to you as a data subject under Philippine law and how to exercise them.

If you are located in the Philippines and use the jilaa platform, this Privacy Policy applies to you. If you do not agree with the practices described in this Policy, you must not use the Platform.

For the purposes of the Data Privacy Act of 2012, jilaa is the personal information controller in respect of all personal data collected through the Platform. As controller, jilaa determines the purposes and means of processing your personal information and is responsible for ensuring that processing is conducted lawfully, fairly, and transparently.

jilaa has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with RA 10173 and this Privacy Policy. Contact details for the DPO are provided in Section 14 of this Policy.

jilaa collects the following categories of personal data:

Under RA 10173, certain categories of data are classified as "sensitive personal information" and attract heightened protection. jilaa may process sensitive personal information — including government ID numbers and financial data — where required by PAGCOR licensing conditions and AML obligations. Such processing is conducted strictly on the basis of legal obligation and is subject to enhanced security controls.

jilaa collects personal data through the following channels:

• Direct provision by you: Information you enter during account registration, KYC submission, deposit/withdrawal requests, contact form submissions, and live support interactions.
• Automated technical collection: Data collected automatically when you access the Platform, including IP addresses, device identifiers, browser data, and session activity logs, collected via server logs and cookies.
• Payment processors: Transaction confirmations and payment reference data received from GCash, Maya, BPI, BDO, and other payment providers when you make deposits or receive withdrawals.
• Third-party identity verification services: Verification results from identity document authentication providers used to support KYC processing.
• PAGCOR and regulatory authorities: Information shared by PAGCOR or law enforcement authorities in connection with regulatory obligations or investigations.

jilaa processes personal data on the following legal bases under RA 10173:

Processing required to perform our obligations under the account agreement with you — including account creation, game access, deposit and withdrawal processing, and customer support. Without this processing, jilaa cannot provide its services to you.

Processing required to comply with PAGCOR licensing conditions, AML obligations under RA 9160 as amended, KYC requirements, financial reporting obligations, and other applicable Philippine laws and regulations. This includes mandatory age verification to enforce the 21+ requirement, AML transaction monitoring, and PAGCOR compliance reporting.

Processing conducted in pursuit of jilaa's legitimate business interests, including fraud detection and prevention, platform security monitoring, responsible gaming monitoring, product improvement, and analytics — where such interests are not overridden by your rights and interests.

Processing of personal data for optional purposes — including direct marketing communications and use of non-essential cookies — where your prior consent has been obtained. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

jilaa does not sell your personal information. We share personal data only in the following circumstances and only to the extent necessary for the stated purpose:

• PAGCOR and regulatory authorities: jilaa is required by law to share certain player data, transaction records, and compliance reports with PAGCOR and, where applicable, the Anti-Money Laundering Council (AMLC) and other Philippine government authorities.
• Payment processors: Financial data is shared with GCash, Maya, BPI, BDO, and other payment providers strictly for the purpose of processing deposits and withdrawals. These providers operate under their own privacy policies and applicable Philippine financial regulations.
• Identity verification providers: KYC document data is shared with third-party identity verification service providers for the purpose of authenticating documents and confirming player identity. Such providers are contractually bound to process data only for verification purposes.
• Game software providers: Game studios and software providers may receive technical session data (but not full identity data) for the purpose of game delivery, RNG auditing, and dispute resolution support.
• Cloud and infrastructure providers: Platform infrastructure and data storage services may be hosted by third-party cloud providers, all of which are contractually bound to maintain data security standards consistent with jilaa's obligations under RA 10173.
• Law enforcement: Where required by a valid court order, warrant, or other lawful directive from Philippine law enforcement or judicial authorities, jilaa will disclose personal data as required by law.
• Business transfers: In the event of a merger, acquisition, or sale of jilaa's business, personal data may be transferred to the acquiring entity, subject to the same privacy protections required under this Policy and RA 10173.

All third-party data recipients are subject to data processing agreements or equivalent contractual protections consistent with RA 10173 requirements.

jilaa retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to mandatory retention periods required by PAGCOR and applicable Philippine law.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents re-identification, unless further retention is required by law or court order.

jilaa implements technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and jilaa's servers.
• Encryption of sensitive data at rest, including KYC documents and financial data.
• Access controls limiting internal access to personal data on a strict need-to-know basis, with role-based permissions and multi-factor authentication for administrative systems.
• Regular security audits, penetration testing, and vulnerability assessments of the Platform and supporting infrastructure.
• Intrusion detection and monitoring systems that alert the security team to suspicious access patterns in real time.
• Staff training on data protection obligations and security awareness.
• Formal data breach response procedures, including notification obligations to the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of a breach that may cause risk to data subjects, as required by RA 10173 and NPC Circular 16-03.

While jilaa takes all reasonable steps to protect your personal data, no system is entirely immune to security risks. You are responsible for maintaining the security of your account credentials. In the event of a data breach affecting your personal data, jilaa will notify you in accordance with its obligations under RA 10173.

jilaa uses cookies and similar tracking technologies to operate the Platform, enhance your experience, and gather analytics. Cookies are small text files stored on your device when you visit jilaa.app.

• Essential cookies: Required for core platform functionality — session management, authentication, and security. These cannot be disabled without impairing Platform use.
• Performance and analytics cookies: Used to measure how players interact with the Platform, identify technical issues, and improve user experience. Data collected is aggregated and anonymised where possible.
• Functional cookies: Remember your preferences (language, display settings) to personalise your experience.
• Marketing cookies: Used only with your prior consent to deliver relevant promotional content. You may opt out of marketing cookies at any time via your browser settings.

You may control cookie settings through your browser preferences. Blocking essential cookies will impair your ability to use the Platform, including the ability to log in to your jilaa account. Blocking non-essential cookies will not affect core Platform functionality. For detailed guidance on managing cookies in your specific browser, refer to your browser's help documentation.

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by jilaa:

• Right to be informed: You have the right to be informed about how your personal data is being collected and processed — which this Privacy Policy fulfils.
• Right of access: You may request a copy of the personal data that jilaa holds about you, along with information about how it is being used.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data held about you. You can update most account information directly in your account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to jilaa's legal retention obligations under PAGCOR and AML regulations.
• Right to object: You may object to the processing of your personal data for purposes other than those strictly required by law or contract — including direct marketing.
• Right to data portability: You may request a copy of your personal data in a structured, commonly used, and machine-readable format where technically feasible.
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe jilaa has breached its obligations under RA 10173.

To exercise any of these rights, contact jilaa's Data Protection Officer at the address provided in Section 14. jilaa will respond to all verified data subject requests within thirty (30) calendar days, as required by RA 10173. Identity verification may be required before requests are processed to prevent unauthorised disclosure.

The jilaa Platform is strictly for use by persons aged 21 years and above in accordance with PAGCOR requirements. jilaa does not knowingly collect personal data from persons under the age of 21. Age verification is conducted as part of the mandatory KYC process for all account registrations.

If jilaa discovers that an account has been created by a person under 21 years of age, the account will be immediately closed, all balances will be handled in accordance with PAGCOR guidelines, and any associated personal data will be retained only as required by law for regulatory reporting purposes before being deleted.

If you have reason to believe that a person under 21 has registered an account on jilaa, please contact our support team immediately at [email protected].

jilaa's primary operations are based in the Philippines, and personal data is processed primarily within Philippine territory. Where technical infrastructure or third-party service providers require data to be transferred outside the Philippines — for example, cloud infrastructure hosted in other jurisdictions — jilaa ensures that:

• Such transfers are made only to countries or entities that provide an adequate level of data protection, or are subject to appropriate contractual safeguards (including standard contractual clauses) consistent with RA 10173 requirements.
• Cross-border data transfer agreements are maintained with all relevant processors and sub-processors where required by RA 10173 and NPC guidance.
• The National Privacy Commission is notified of significant cross-border transfer arrangements where NPC guidelines require notification.

jilaa reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. Material changes will be communicated to registered players via the email address on file at least fourteen (14) days before the changes take effect, except where immediate changes are required by law.

The current version of this Privacy Policy will always be available at jilaa.app/privacy-policy, with the effective date displayed at the top of the document. Continued use of the jilaa Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy.

For questions about this Privacy Policy, to exercise your data subject rights, or to report a privacy concern, please contact jilaa's Data Protection Officer:

For responsible gaming support, self-exclusion requests, or deposit limit inquiries, please visit jilaa Responsible Gaming or contact support directly. All privacy-related and responsible gaming requests are handled with strict confidentiality and in accordance with RA 10173.