38jl Privacy Policy

1Introduction and Scope

This Privacy Policy ("Policy") describes the practices of 38jl ("38jl," "we," "us," or "our") with respect to the collection, use, storage, disclosure, and protection of personal information obtained from individuals ("you," "Player," or "User") who access or use the 38jl online gaming platform at https://38jl.vip and any associated services or features (collectively, the "Platform").

This Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations, the issuances of the National Privacy Commission ("NPC"), and applicable PAGCOR regulatory requirements governing player data management on licensed online gaming platforms.

This Policy should be read together with the 38jl Terms & Conditions, which govern the overall contractual relationship between you and 38jl, and the Responsible Gaming Policy, which governs the processing of data in the context of responsible gaming tools.

2Data Controller

For the purposes of the Philippine Data Privacy Act and applicable data protection legislation, 38jl is the personal information controller responsible for the processing of your personal data in connection with the Platform. 38jl operates under PAGCOR licensing and is accountable to both the National Privacy Commission and PAGCOR for its data processing activities.

38jl has designated a Data Protection Officer ("DPO") as required under the DPA. Enquiries regarding this Policy, data subject rights requests, and data protection concerns may be directed to the DPO through the contact channels specified in Section 15 of this Policy.

3Information We Collect

38jl collects personal data from and about you through several channels in the course of providing the Platform services. The categories of information collected are described below.

• Registration Data: Full legal name, date of birth, Philippine mobile number, email address, residential address, and account credentials;
• KYC and Identity Verification Documents: Government-issued identification (passport, driver's license, PhilSys ID, SSS/UMID, PRC ID, or voter's ID), selfie photographs, and proof of address documents;
• Financial Data: GCash or Maya account numbers, bank account details (where applicable), deposit amounts, transaction records, and withdrawal requests;
• Support Communications: Records of live chat conversations, email correspondence, and any information you voluntarily provide when contacting 38jl customer support;
• Responsible Gaming Data: Self-assessment responses, deposit limit settings, self-exclusion requests, and responsible gaming tool preferences.

• Device and Technical Data: IP address, browser type and version, device type and model, operating system, screen resolution, and time zone settings;
• Usage Data: Pages visited, game sessions initiated, wagers placed, session duration, click patterns, and navigation paths on the Platform;
• Location Data: Approximate geographic location derived from your IP address, used for jurisdictional access control and PAGCOR compliance;
• Cookies and Tracking Technologies: Information collected via cookies, web beacons, and similar tracking technologies as further described in Section 6.

• Identity and fraud screening data from authorized KYC verification service providers;
• Payment transaction verification data from GCash, Maya, BPI, BDO, and other payment processors;
• Compliance and sanctions screening data from regulatory and AML screening databases as required by PAGCOR and Philippine AML legislation.

4How We Use Your Personal Data

38jl processes your personal data for the following purposes. Each purpose is linked to a specific legal basis as described in Section 5.

5Legal Basis for Processing

Under the Philippine Data Privacy Act and applicable regulations, 38jl processes personal data only where a lawful basis exists. The principal legal bases upon which 38jl relies are as follows:

• Contract Performance: Processing that is necessary to provide the services you requested when creating a 38jl account, including account management, game access, deposit processing, and withdrawal execution;
• Legal Obligation: Processing required to comply with legal obligations under Philippine law, including the Anti-Money Laundering Act (RA 9160 as amended by RA 11521), PAGCOR licensing conditions, and NPC data processing requirements;
• Legitimate Interests: Processing that 38jl conducts in pursuit of its legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service analytics, provided such interests are not overridden by your data protection rights;
• Consent: Processing for direct marketing communications, for which 38jl will seek your explicit opt-in consent. You may withdraw marketing consent at any time without affecting the lawfulness of any prior processing.

6Cookies and Tracking Technologies

The 38jl Platform uses cookies and similar tracking technologies to operate correctly, improve user experience, maintain session security, and support compliance obligations. The cookies used on the Platform fall into the following categories:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in, security tokens that protect against cross-site request forgery, and cookies that enforce geographic access controls. These cannot be disabled without impairing Platform functionality;
• Functional Cookies: Enable personalisation features such as language preference storage, display settings, and responsible gaming reminder configurations. Disabling these cookies may reduce the personalisation of your experience;
• Performance and Analytics Cookies: Collect anonymised or pseudonymised usage data to help 38jl understand how the Platform is used, which pages are most visited, and where technical performance can be improved. Data collected via these cookies is processed in aggregate form;
• Compliance and Security Cookies: Used for fraud detection, bot prevention, and behavioral anomaly monitoring in connection with 38jl's AML and PAGCOR compliance obligations.

7Data Sharing and Disclosure

38jl does not sell your personal data to third parties. 38jl may share your personal data with third parties only in the following circumstances, each of which is governed by appropriate data processing agreements or legal requirements:

38jl engages third-party service providers to assist in delivering the Platform. These providers act as personal information processors under the DPA and are contractually bound to process data only in accordance with 38jl's instructions and applicable data protection law. Categories of processors include:

• KYC and identity verification providers;
• Payment processors (GCash, Maya, BPI, BDO, Metrobank, and other payment infrastructure providers);
• Game software and live dealer studio providers;
• Cloud hosting and infrastructure providers;
• Customer support platform providers;
• Analytics and fraud detection providers.

38jl is required to disclose personal data to the following authorities in accordance with applicable Philippine law and licensing obligations:

• PAGCOR, in connection with regulatory audits, compliance reporting, and player dispute investigations;
• The Anti-Money Laundering Council (AMLC), in connection with covered transaction reports and suspicious transaction reports under RA 9160 as amended;
• The National Privacy Commission, in the event of a personal data breach or in response to regulatory enquiries;
• Any court or tribunal of competent jurisdiction in the Philippines, pursuant to a valid court order or subpoena.

8Data Retention

38jl retains personal data for as long as is necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce its contractual rights. The following general retention periods apply:

• Account and KYC Records: Retained for a minimum of five (5) years following the closure of your account, as required by the Anti-Money Laundering Act and PAGCOR AML compliance guidelines;
• Financial Transaction Records: Retained for a minimum of five (5) years in accordance with PAGCOR requirements and applicable tax and AML legislation;
• Customer Support Records: Retained for a period of three (3) years following resolution of the support interaction, unless a longer retention period is required for dispute resolution purposes;
• Marketing Consent Records: Retained for the period of your marketing consent and for three (3) years following withdrawal of consent, to demonstrate compliance with opt-in requirements;
• Anonymised Analytics Data: May be retained indefinitely, as it does not constitute personal data following anonymisation in accordance with NPC guidelines.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with 38jl's data destruction procedures.

9Data Security

38jl implements and maintains technical, organisational, and physical security measures designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Specific measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the 38jl servers;
• Encryption at rest for databases containing sensitive personal and financial data;
• Multi-factor authentication and role-based access controls limiting internal access to personal data on a need-to-know basis;
• Regular penetration testing and vulnerability assessments of Platform infrastructure;
• Monitoring and logging of all access to personal data systems, with anomaly detection and alerting;
• Staff training on data protection obligations under the DPA and 38jl's internal data handling policies.

Despite 38jl's security measures, no internet-based service can guarantee absolute security. You are responsible for maintaining the security of your account credentials and for notifying 38jl promptly if you suspect any unauthorised access to your account.

10Cross-Border Data Transfers

Some of 38jl's third-party service providers, including cloud infrastructure providers and game software vendors, may process personal data in jurisdictions outside the Philippines. Where such transfers occur, 38jl ensures that appropriate safeguards are in place in accordance with NPC Advisory Opinion and Section 21 of the DPA, which may include:

• Standard contractual clauses approved by the NPC or equivalent regulatory body;
• Transfer to jurisdictions recognised by the NPC as providing an adequate level of data protection;
• Binding corporate rules applicable to 38jl's service providers.

You may request information about the specific safeguards applied to cross-border transfers of your personal data by contacting the 38jl Data Protection Officer through the channels specified in Section 15.

11Children's Privacy and Underage Access

The 38jl Platform is strictly intended for adults aged 21 years and over, as required by PAGCOR regulations governing online casino-style gaming in the Philippines. 38jl does not knowingly collect personal data from persons under the age of 21.

38jl employs age verification procedures during the registration and KYC process to identify and prevent underage access to the Platform. Where 38jl becomes aware that personal data has been collected from a person under 21 years of age, that account will be immediately suspended, all associated data will be securely deleted to the extent not required to be retained for legal or regulatory purposes, and the matter will be reported to PAGCOR.

12Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data processed by 38jl. These rights are subject to certain limitations and exceptions as provided under the DPA and its Implementing Rules and Regulations.

• Right to be Informed: You have the right to be informed of the fact that your personal data is being or will be processed, and of the basis and scope of such processing — which this Policy fulfils;
• Right of Access: You have the right to reasonable access to your personal data held by 38jl, including the sources from which it was obtained, the recipients to whom it was disclosed, and the purposes of processing;
• Right to Rectification: You have the right to dispute and have corrected any inaccuracy or error in your personal data without charge, except where correction is technically not feasible;
• Right to Erasure or Blocking: You have the right to suspend, withdraw, or order the removal or destruction of your personal data where it is incomplete, outdated, false, unlawfully obtained, or no longer needed for the purpose it was collected, subject to legal retention requirements;
• Right to Data Portability: You have the right to obtain a copy of your personal data in a structured, commonly used, and machine-readable format, where technically feasible;
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes, for profiling and automated decision-making, and for certain other processing activities where 38jl relies on legitimate interests;
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe that 38jl has processed your personal data in a manner inconsistent with the DPA.

To exercise any of the above rights, please contact the 38jl Data Protection Officer as specified in Section 15. 38jl will acknowledge your request within five (5) business days and respond substantively within fifteen (15) business days, or such extended period as may be necessary for complex requests, with notice to you of any extension.

13Marketing Communications

38jl may send you promotional communications about bonuses, new games, platform updates, and other offers by SMS, email, or in-platform notification, subject to your communication preferences. Marketing communications will be sent only where you have provided your explicit opt-in consent at registration or at any subsequent point.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in your 38jl account settings;
• Clicking the unsubscribe link included in any 38jl marketing email;
• Contacting 38jl customer support through live chat and requesting removal from marketing lists.

Withdrawal of marketing consent will not affect the receipt of transactional and service communications, which 38jl may send regardless of marketing preferences. These include account security notifications, KYC requests, deposit and withdrawal confirmations, and regulatory communications.

14Changes to This Privacy Policy

38jl reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. When material changes are made, 38jl will provide notice through one or more of the following methods: a prominent notice on the Platform, an email to your registered address, or a notification within your 38jl account.

The effective date of the current version of this Policy is displayed at the top of this page. We encourage you to review this Policy periodically. Your continued use of the 38jl Platform after the effective date of any amendment constitutes acknowledgment of the amended Policy.

If the changes are material and require your consent under applicable law — such as changes to marketing processing activities — 38jl will seek your renewed consent before processing your data under the amended terms.

15Contact and Complaints

For data protection enquiries, data subject rights requests, or concerns about 38jl's data processing practices, please contact the 38jl Data Protection Officer through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, accessible from any page on the 38jl Platform. This is the fastest method for urgent data protection matters;
• Email: [email protected] — please include "Data Privacy Request" in the subject line for efficient routing to the Data Protection Officer. Response time is typically 1–2 business days for initial acknowledgment and 15 business days for substantive response.

This Privacy Policy was last reviewed and updated on 1 January 2026. The current version supersedes all previously published versions of the 38jl Privacy Policy.