Privacy Policy – ajili Casino Philippines

1. Introduction

ajili Casino ("ajili," "we," "us," "our") operates the online gaming platform accessible at ajili.co (the "Platform"). We are committed to protecting the privacy and personal data of all individuals ("Players," "you," "your") who interact with our Platform, whether as registered account holders or visitors.

This Privacy Policy ("Policy") describes how ajili collects, uses, stores, discloses, and protects your personal information. It has been prepared in compliance with the Republic Act No. 10173 — Data Privacy Act of 2012 of the Philippines and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC). This Policy forms part of ajili's Terms and Conditions and should be read in conjunction with that document.

By registering an account on the ajili Platform or by continuing to use our services, you acknowledge that you have read and understood this Policy and consent to the data processing activities described herein.

2. Legal Basis & Regulatory Framework

ajili Casino processes personal data in compliance with the following Philippine legal instruments:

• Republic Act No. 10173 (Data Privacy Act of 2012) — the primary legislation governing personal data protection in the Philippines.
• NPC Circular No. 16-01 — guidelines on privacy notices and consent.
• PAGCOR Regulations — Philippine Amusement and Gaming Corporation licensing conditions which require collection and retention of certain Player data for regulatory and AML/KYC compliance purposes.
• Republic Act No. 9160 (Anti-Money Laundering Act) as amended — imposes mandatory record-keeping and reporting obligations on gaming operators.

Where these regulatory obligations require ajili to collect or retain data regardless of Player consent, the legal basis for such processing is legal obligation rather than consent. In all other cases, ajili relies on one or more of the following lawful bases: your consent, the performance of a contract with you, compliance with a legal obligation, or the legitimate interests of ajili where those interests are not overridden by your rights and freedoms.

3. Personal Data We Collect

3.1 Data Provided Directly by You

• Identity Data: Full legal name, date of birth, gender, nationality, and copies of Philippine government-issued identification documents (UMID, Passport, Driver's License, SSS/GSIS ID) submitted during KYC verification.
• Contact Data: Email address, Philippine mobile number, residential address.
• Financial Data: GCash account details, PayMaya account details, bank account information (BPI, BDO, Metrobank, UnionBank), deposit and withdrawal transaction records, and payment instrument ownership verification documents.
• Account Credentials: Username and encrypted password hash. Note: ajili never stores your password in plain text and our staff cannot view it.
• Communications: Content of messages sent to ajili's support team via live chat, email, or Messenger/Viber, including support ticket records.

3.2 Data Collected Automatically

• Technical Data: IP address, device type and operating system, browser type and version, screen resolution, and device identifiers.
• Usage Data: Login timestamps, session duration, pages visited, games launched, betting history, game outcomes, and Platform navigation patterns.
• Location Data: Approximate geographic location derived from IP address, used for fraud detection and geographic eligibility verification.
• Cookie & Tracking Data: Data collected through cookies and similar technologies as described in Section 7 of this Policy.

3.3 Data Received from Third Parties

• Identity verification results from KYC service providers;
• Fraud risk scores from payment processor fraud detection systems;
• PEP (Politically Exposed Person) and sanctions screening results from AML compliance databases;
• Where you connect a social login (e.g., Google or Facebook), basic profile information (name, email) as permitted by your social account privacy settings.

4. How We Use Your Personal Data

5. Legal Grounds for Processing

Under the Data Privacy Act of 2012, ajili relies on the following criteria for lawful processing:

• Consent: Where you have given clear, freely given, specific, and informed consent, such as for receiving marketing emails or SMS promotions. You may withdraw consent at any time by updating your communication preferences in account settings or by contacting support.
• Contract: Processing necessary for the performance of the Terms and Conditions you have agreed to, including operating your account and processing transactions.
• Legal Obligation: Processing required to comply with PAGCOR conditions of operation, the Anti-Money Laundering Act, the Data Privacy Act itself, and other applicable Philippine laws and regulations.
• Legitimate Interests: Where ajili has a legitimate business interest in processing (such as fraud prevention and platform security) that does not override your fundamental rights and freedoms. We conduct a balancing test before relying on this basis.

6. Data Sharing & Disclosure

ajili does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only in the following circumstances:

6.1 Service Providers (Personal Information Processors)

We engage regulated third-party processors who act on ajili's instructions and are bound by data processing agreements consistent with the Data Privacy Act:

• Payment Processors: GCash (G-Xchange Inc.), PayMaya Philippines Inc., BPI, BDO, Metrobank, UnionBank — for transaction processing.
• KYC Providers: Third-party identity verification services for document authentication and biometric verification.
• Game Content Providers: Licensed game studios whose platforms host games accessible through ajili — limited game session data is shared for game operation purposes.
• Cloud & IT Infrastructure Providers: Hosting and database providers maintaining ajili's Platform infrastructure within the Philippines.
• Customer Support Tools: Live chat and ticketing system providers for support operations.

6.2 Regulatory Disclosure

ajili is required by law to disclose Player data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine authorities upon receipt of a valid lawful order, subpoena, or regulatory directive. We will, where legally permissible, notify affected Players of such disclosures.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of ajili's assets, Player data may be transferred to the successor entity, subject to equivalent privacy protections. Affected Players will be notified in advance where feasible.

7. Cookies & Tracking Technologies

ajili uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly Necessary Cookies: Required for Platform operation, including session management, authentication state, and security tokens. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language, game display settings, and "Remember Me" login state.
• Analytics Cookies: Used by ajili's internal analytics systems to understand aggregated usage patterns and improve Platform performance. No third-party analytics data is shared externally.
• Fraud Detection Cookies: Technical identifiers used to detect suspicious login patterns and prevent account compromise.

You may configure cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair Platform functionality, including the ability to log in to your ajili account. ajili does not use third-party advertising cookies or cross-site tracking technologies.

8. Data Security

ajili implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your browser or app and ajili's servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Encryption at Rest: Sensitive personal data stored in ajili's databases is encrypted using AES-256 encryption.
• Password Hashing: Passwords are stored exclusively as salted cryptographic hashes using bcrypt. ajili staff have no ability to view any Player's password in plain text.
• Access Controls: Internal access to Player data is restricted on a strict need-to-know basis through role-based access control (RBAC). All staff access to production data is logged and audited.
• Security Audits: The Platform undergoes periodic third-party penetration testing and security assessments. Critical vulnerabilities are remediated within 72 hours of identification.
• Incident Response: ajili maintains a documented data breach response procedure. In the event of a personal data breach, ajili will notify the NPC within 72 hours and affected Players without undue delay, as required by NPC Circular No. 16-03.

While ajili takes all reasonable steps to protect your data, no electronic transmission or storage system is 100% secure. You are responsible for maintaining the confidentiality of your ajili login credentials and for notifying us immediately of any suspected unauthorised access to your account.

9. Data Retention Periods

ajili retains personal data for the minimum period necessary for the purpose for which it was collected, subject to applicable legal retention requirements:

• Account Data (active accounts): For the full duration of your ajili account relationship plus 5 years after account closure — required for PAGCOR compliance and AML record-keeping obligations.
• Transaction & Financial Records: 10 years from the date of each transaction, as required by the Anti-Money Laundering Act and Philippine tax regulations.
• KYC / Identity Verification Documents: 5 years from account closure or from the date of the last KYC refresh.
• Support Communications: 3 years from the date of the interaction, unless the communication forms part of an ongoing dispute or regulatory matter.
• Technical & Log Data: 12 months on a rolling basis, except where specific log data is required for an identified security investigation or legal matter.
• Marketing Consent Records: For the duration of the marketing relationship plus 3 years, to evidence consent and comply with NPC requirements.

Upon expiry of the applicable retention period, personal data is either securely deleted from ajili's systems or anonymised such that it can no longer be linked to an individual.

10. Your Data Privacy Rights

Under the Data Privacy Act of 2012 and applicable NPC regulations, you have the following rights with respect to your personal data held by ajili:

• Right to be Informed: The right to know what personal data ajili holds about you and how it is processed — which this Policy fulfils.
• Right of Access: The right to request a copy of the personal data ajili holds about you, free of charge, once per 12-month period.
• Right to Rectification: The right to request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure ("Right to be Forgotten"): The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations (such as AML record-keeping).
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: The right to object to processing of your personal data where ajili relies on legitimate interests as the lawful basis, and where your fundamental rights override those interests.
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe ajili has violated your data privacy rights.

To exercise any of these rights, please contact ajili's Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request." ajili will respond within 30 calendar days of receiving a verifiable request. We may require identity verification before processing certain requests to prevent fraudulent access to another person's data.

11. Children's Privacy

The ajili Casino Platform is strictly intended for adults aged 21 years and older. ajili does not knowingly collect personal data from individuals under 21. Registration is prohibited for persons under 21 and is void if such registration occurs.

If ajili becomes aware that personal data has been collected from a person under 21 years of age, we will immediately suspend the relevant account, delete the associated personal data to the extent permitted by applicable law, and — where required — report the matter to PAGCOR. Parents or guardians who believe their minor child has registered on the ajili Platform are urged to contact us immediately at [email protected].

12. Cross-Border Data Transfers

ajili Casino's primary data storage and processing infrastructure is located within the Republic of the Philippines. In certain circumstances, personal data may be accessed by or transferred to third-party service providers located outside the Philippines — for example, internationally headquartered game studios or cloud platform providers with Philippine data centres.

Where such cross-border transfers occur, ajili ensures that adequate safeguards are in place in accordance with NPC guidelines, including contractual data protection clauses that require the recipient to apply a standard of data protection equivalent to or greater than that required by Philippine law. ajili will not transfer personal data to jurisdictions that do not provide an adequate level of protection without implementing appropriate safeguards and, where required, obtaining prior NPC authorisation.

13. Marketing Communications

ajili may send you promotional emails, SMS messages, or in-Platform notifications about bonuses, new games, and special offers, subject to your expressed consent at registration or through subsequent communications preference updates.

You may withdraw your marketing consent at any time by:

• Clicking the "Unsubscribe" link in any marketing email from ajili;
• Replying "STOP" to any marketing SMS;
• Updating your communication preferences in your ajili account settings; or
• Contacting ajili support at [email protected].

Withdrawal of marketing consent does not affect the lawfulness of processing based on consent before withdrawal, nor does it affect essential transactional communications regarding your account (such as deposit confirmations, withdrawal notifications, and security alerts) — these are sent regardless of marketing preferences as they are required for contract performance.

14. Amendments to This Policy

ajili may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or Platform features. When material changes are made, we will notify registered Players via email to their registered address and/or via a prominent notice on the Platform, with a minimum of 14 days' advance notice before the updated Policy takes effect, except where immediate amendment is required by law.

The current version of this Privacy Policy, together with the effective date, is always available at ajili.co/privacy-policy. We encourage you to review this Policy periodically. Your continued use of the ajili Platform after the effective date of any amendment constitutes acceptance of the revised Policy.

15. Contact & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or ajili's data practices, please contact our Data Protection Officer:

Formal data subject rights requests must be submitted in writing via email with sufficient information to verify your identity. ajili may request a copy of a government-issued ID to confirm your identity before processing access or deletion requests, in order to protect you from fraudulent requests by third parties.