28jili Privacy Policy

1. Introduction

This Privacy Policy applies to all personal data collected and processed by 28jili in connection with your use of the 28jili platform, accessible at 28jili.cam, including all game categories, account management features, payment processing, customer support interactions, and marketing communications.

This Privacy Policy should be read in conjunction with the 28jili Terms & Conditions, which govern your use of the platform. Defined terms used but not defined in this Privacy Policy carry the meanings assigned to them in the Terms & Conditions.

28jili is committed to protecting your privacy and handling your personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations issued by the National Privacy Commission of the Philippines.

2. Data Controller

For the purposes of the Data Privacy Act of 2012, 28jili is the data controller responsible for the personal data you provide to us and the personal data we collect about you through your use of the platform.

As the data controller, 28jili determines the purposes and means of processing your personal data and is responsible for ensuring compliance with applicable data protection obligations. All queries, complaints, or data subject requests related to your personal data should be directed to 28jili through the contact channels specified in Section 14 of this Privacy Policy.

3. Personal Data We Collect

28jili collects and processes several categories of personal data in connection with your use of the platform. The specific data collected depends on the services you use and how you interact with 28jili.

3.1 Data You Provide Directly

When you register for a 28jili account, complete KYC verification, make deposits or withdrawals, or contact customer support, you provide us with the following types of personal data:

3.2 Data Collected Automatically

When you access and use the 28jili platform, we automatically collect certain technical and behavioral data:

3.3 Data from Third Parties

In limited circumstances, 28jili receives personal data about you from third-party sources:

• Payment processors — GCash, Maya, and banking partners confirm transaction completion and account verification status;
• Identity verification services — third-party KYC providers may verify the authenticity of submitted government ID documents;
• Fraud prevention providers — services that assess transaction risk and flag suspicious account behavior based on device fingerprinting and behavioral patterns;
• Game providers — third-party game studios confirm game round outcomes and RTP performance data for games you play on their platforms integrated into 28jili.

4. How We Use Your Data

28jili processes your personal data for the following specific purposes, all of which are necessary to operate the platform, comply with legal obligations, or pursue legitimate business interests while respecting your rights:

4.1 Account Management & Service Delivery

• Creating and maintaining your 28jili account;
• Processing your login credentials and authenticating your identity at each sign-in;
• Managing your PHP wallet balance, including deposits, wagers, winnings, and withdrawals;
• Processing your participation in games, sports betting markets, bingo rooms, and racing events;
• Administering bonuses, promotions, and loyalty rewards you have claimed or are eligible for;
• Providing customer support and responding to your inquiries via live chat, email, or Viber;
• Sending transactional notifications related to your account activity (deposit confirmations, withdrawal approvals, bonus credits, etc.).

4.2 Legal & Regulatory Compliance

• Verifying your identity and age to comply with the 21+ age restriction mandated by Philippine gaming regulations;
• Complying with anti-money laundering (AML) obligations under the Anti-Money Laundering Act (AMLA) as amended;
• Detecting, investigating, and preventing fraud, collusion, bonus abuse, and other prohibited conduct;
• Maintaining records for audit and regulatory inspection purposes as required by PAGCOR or other relevant authorities;
• Responding to lawful requests for information from Philippine law enforcement, regulators, or courts;
• Enforcing the 28jili Terms & Conditions and investigating breaches or disputes.

4.3 Platform Security & Fraud Prevention

• Monitoring login attempts, transaction patterns, and gameplay behavior for signs of unauthorized access or fraudulent activity;
• Implementing device fingerprinting and IP geolocation to detect multi-accounting and jurisdiction violations;
• Blocking access from prohibited jurisdictions or from devices associated with prior terms violations;
• Protecting the platform integrity by identifying and blocking automated bot access and scraping attempts.

4.4 Responsible Gaming

• Monitoring gameplay patterns to identify behavior consistent with problem gambling and triggering responsible gaming interventions where appropriate;
• Enforcing deposit limits, cooling-off periods, and self-exclusion restrictions you have set on your account;
• Maintaining self-exclusion records to prevent re-registration by excluded players;
• Complying with any player protection directives issued by gaming regulatory authorities.

4.5 Platform Improvement & Analytics

• Analyzing aggregated usage data to identify technical issues, optimize game loading performance, and improve the mobile experience;
• Understanding which game categories, features, and promotions are most used across our player base in order to make informed product development decisions;
• Conducting internal research and analytics on player behavior at an aggregated, anonymized level — this analysis does not result in individual profiling for marketing purposes.

4.6 Marketing Communications

With your explicit consent at registration or any time thereafter, 28jili may send you promotional communications about new games, upcoming events, special offers, and platform updates via SMS, email, or Viber. You may withdraw your consent to marketing communications at any time by updating your account notification preferences or by contacting our support team. Withdrawal of marketing consent does not affect transactional communications related to your account activity.

5. Legal Basis for Processing

Under the Data Privacy Act of 2012, 28jili processes your personal data on the following legal bases:

• Contractual necessity — processing required to create and manage your account, facilitate transactions, and deliver the gaming services you have signed up for;
• Legal obligation — processing required to comply with Philippine anti-money laundering, gaming regulation, and tax reporting requirements;
• Legitimate interests — processing for fraud detection, platform security, responsible gaming monitoring, and internal analytics, where these interests are not overridden by your fundamental rights and freedoms;
• Consent — processing for optional marketing communications, where you have given explicit, freely withdrawable consent.

Where we rely on legitimate interests as the legal basis, we conduct an assessment to ensure that our interests do not outweigh your privacy rights, taking into account the nature of the data, the processing activities, and the safeguards in place. You may request information about any legitimate interests assessment by contacting our Data Protection Officer.

6. Data Sharing & Disclosure

28jili does not sell your personal data. We share personal data with third parties only in the limited circumstances described below, and only where such sharing is necessary, proportionate, and subject to appropriate safeguards.

6.1 Service Providers

28jili engages third-party service providers who process personal data on our behalf under data processing agreements that bind them to confidentiality and security obligations equivalent to those we apply internally. Categories of service providers include:

• Payment processing providers (GCash, Maya/PayMaya, BPI, BDO, Metrobank, and other partners listed in the Cashier section);
• KYC and identity verification service providers;
• Fraud detection and anti-money laundering screening providers;
• Customer support platform providers (live chat infrastructure);
• Cloud hosting and data storage providers;
• Game content providers (who receive anonymized game round data, not identifiable player data, for reporting and certification purposes).

6.2 Regulatory & Law Enforcement Disclosure

28jili will disclose personal data to Philippine government authorities, regulators, law enforcement agencies, or courts where we are legally required to do so, including but not limited to:

• The Anti-Money Laundering Council (AMLC) — for suspicious transaction reports and covered transaction reports required under AMLA;
• The National Privacy Commission (NPC) — in response to lawful orders, investigation requests, or data breach notification obligations;
• The Philippine Amusement and Gaming Corporation (PAGCOR) or other competent gaming regulatory bodies — for compliance inspection or player dispute investigations;
• Philippine courts or law enforcement agencies — pursuant to a valid subpoena, court order, or lawful official request.

28jili will not disclose personal data to government authorities beyond the scope of the lawful request and will only disclose the minimum data necessary to satisfy the request.

6.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of 28jili's assets, your personal data may be transferred to the successor entity. You will be notified of any such transfer via email or a prominent platform notice prior to your personal data being transferred and becoming subject to a different privacy policy.

7. Data Retention

28jili retains personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal retention obligations, and resolve any outstanding disputes or enforce our Terms & Conditions. The following general retention periods apply:

• Account and identity data — retained for the duration of your account's active status and for a minimum of five (5) years following account closure, to comply with AML record-keeping requirements;
• Transaction and wagering records — retained for a minimum of five (5) years from the date of each transaction, as required by applicable financial and gaming regulations;
• KYC documentation — retained for a minimum of five (5) years from the date of verification, or such longer period as may be required by the AMLC or relevant gaming regulator;
• Customer support communications — retained for three (3) years from the date of the most recent interaction in the relevant support thread;
• Marketing consent records — retained for the duration of your account and three (3) years thereafter, as evidence of valid consent;
• Technical and usage logs — retained for ninety (90) days to one (1) year, depending on the category of log data and its relevance to ongoing security monitoring.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized, except where continued retention is required by a specific legal obligation or an ongoing dispute resolution process.

8. Cookies & Tracking Technologies

The 28jili platform uses cookies and similar tracking technologies to provide core platform functionality, improve the user experience, and gather aggregated analytics data. The following categories of cookies are used:

8.1 Strictly Necessary Cookies

These cookies are required for the platform to function. They include session management cookies that maintain your logged-in state, security tokens, and cookies that store your preferred language and currency settings. Strictly necessary cookies cannot be disabled without breaking core platform functionality.

8.2 Functional Cookies

These cookies remember your preferences across sessions — including your last visited game category, preferred bingo room settings, and notification preferences — so you don't have to reconfigure them every time you log in.

8.3 Analytics Cookies

28jili uses analytics cookies to understand how players navigate the platform, which pages and game categories receive the most visits, and where technical issues cause session interruptions. This data is collected in aggregated, anonymized form and is used exclusively for platform improvement.

8.4 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to view, block, or delete cookies. However, disabling strictly necessary cookies will impair or prevent platform access. Disabling functional cookies will cause your preferences to reset on each visit. Your current browser's documentation provides instructions for cookie management specific to your browser type.

9. Data Security

28jili implements a comprehensive set of technical and organizational security measures designed to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• SSL/TLS encryption — all data transmitted between your device and 28jili servers is encrypted using industry-standard TLS protocols;
• Encryption at rest — sensitive personal data, including KYC documents and financial account details, is encrypted at rest on 28jili's storage infrastructure;
• Password hashing — account passwords are never stored in plain text; they are stored as one-way cryptographic hashes using current industry-standard hashing algorithms;
• Multi-factor authentication — OTP verification via registered mobile number is required at login and for sensitive account actions including withdrawals;
• Access controls — internal access to personal data is restricted by role-based access controls; only personnel with a legitimate operational need can access specific categories of player data;
• Security monitoring — 28jili's infrastructure is continuously monitored for unauthorized access attempts, anomalous activity, and potential data breaches;
• Staff training — all personnel with access to personal data receive regular data protection and security awareness training.

10. Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 28jili. These rights are not absolute and may be subject to limitations where processing is required for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims.

• Right to be Informed — the right to know that your personal data is being collected, processed, and retained, and to receive clear information about how it is used (this Privacy Policy fulfills this obligation);
• Right of Access — the right to request a copy of the personal data 28jili holds about you, including information about the categories of data, the purposes of processing, and any third parties to whom it has been disclosed;
• Right to Rectification — the right to request correction of inaccurate or incomplete personal data. Many corrections can be made directly in your account settings; for identity data corrections, contact our support team with supporting documentation;
• Right to Erasure — the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (subject to our legal retention obligations);
• Right to Object — the right to object to the processing of your personal data where we rely on legitimate interests as the legal basis, including profiling for analytics purposes;
• Right to Data Portability — the right to receive your personal data in a structured, commonly used, machine-readable format where technically feasible;
• Right to Damages — the right to claim compensation for damages sustained as a result of inaccurate, incomplete, outdated, false, or unlawfully obtained personal data in accordance with the Data Privacy Act.

To exercise any of these rights, please contact 28jili through the channels set out in Section 14. We will acknowledge your request within 72 hours and respond substantively within 30 calendar days. We may need to verify your identity before processing any data subject request.

11. Children's Privacy

28jili does not knowingly collect personal data from individuals under the age of 21. The platform is intended exclusively for players aged 21 and above in compliance with Philippine gaming regulations. Registration requires submission of government-issued identification confirming age eligibility, and accounts failing age verification are closed.

If you are a parent or guardian and believe that a minor has registered on 28jili or has had their personal data collected through the platform without your consent, please contact our support team immediately. Upon confirmation, 28jili will promptly close the account and delete the associated personal data, subject to any applicable legal retention obligations.

12. International Data Transfers

28jili's primary data storage and processing infrastructure is located within or operated for the Philippine market. In certain circumstances, your personal data may be transferred to, stored in, or processed in countries other than the Philippines — for example, where cloud infrastructure providers or specialized service providers operate data centers outside the Philippines.

Where such transfers occur, 28jili ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that required by the Data Privacy Act of 2012. These safeguards may include contractual clauses, data processing agreements, or transfers to jurisdictions that the National Privacy Commission has assessed as providing adequate data protection.

You may request information about the specific safeguards in place for any international transfer of your personal data by contacting our Data Protection Officer through the channels in Section 14.

13. Changes to This Privacy Policy

28jili may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or platform features. Material changes — those that significantly affect your rights or our core processing activities — will be communicated to you via email to your registered address at least 14 days before the changes take effect. A prominent notice will also be displayed on the 28jili platform during this period.

Non-material changes — including corrections of typographical errors, clarifications of existing provisions, or additions of new data categories that are consistent with the existing purposes described in this policy — may be published without advance notice and will take effect upon publication.

The effective date and last-updated date at the top of this Privacy Policy will be revised with each update. We encourage you to review this Privacy Policy periodically. Your continued use of 28jili following any change constitutes your acceptance of the updated Privacy Policy.

14. Contact & Complaints

14.1 Contacting 28jili

For any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, please contact the 28jili Data Protection team through the following channels:

• Live Chat: Available 24/7 directly through the 28jili platform
• Viber Support: Available 24/7
• Email: [email protected]

When submitting a data subject request or privacy complaint, please include your registered mobile number and email address, a clear description of your request or concern, and any relevant reference numbers or dates. This enables us to locate your records and process your request efficiently.

14.2 Complaints to the National Privacy Commission

If you are not satisfied with our response to a privacy concern or data subject request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC), which is the independent regulatory body responsible for enforcing the Data Privacy Act of 2012. Information about the NPC complaints process is available through the NPC's official channels. 28jili encourages you to contact us first to allow us the opportunity to resolve your concern directly before escalating to the NPC.