jl20 Privacy Policy

1 Introduction

1.1 This Privacy Policy describes the personal data practices of jl20 ("jl20", "we", "us", or "our") — the online gaming platform operated at jl20.org and all associated services.

1.2 By registering an account with jl20 or using any service available through the jl20 platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein, to the extent that consent is the applicable legal basis for such processing.

1.3 This Privacy Policy applies to all current and former jl20 players, prospective players who interact with the jl20 platform without completing registration, and any individual whose personal data is submitted in connection with a jl20 account (for example, in the context of responsible gaming notifications).

1.4 This Policy should be read together with the jl20 Terms and Conditions, which are available at /terms-conditions. The Terms and Conditions govern the legal relationship between jl20 and players; this Policy governs jl20's data handling practices within that relationship.

2 Data Controller Identity

2.1 For the purposes of Republic Act No. 10173 (Data Privacy Act of 2012) and applicable data protection law, the personal information controller responsible for your data is jl20, operating the platform at jl20.org.

2.2 If you have any questions about how jl20 handles your personal data, or wish to exercise your data subject rights as described in Section 11, you may contact jl20's data privacy point of contact at:

3 Personal Data We Collect

3.1 jl20 collects personal data from you in several ways — directly when you register or interact with the platform, automatically when you use the platform, and from third-party sources in connection with payment processing and identity verification. The categories of personal data collected are described below.

3.1 Registration and Account Data

When you create a jl20 account, we collect:

• Full legal name;
• Date of birth (to verify the 21+ age requirement);
• Email address;
• Philippine mobile number;
• Username and password (password is stored as a cryptographic hash — jl20 cannot retrieve your plaintext password);
• Preferred language and communication settings.

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering obligations and PAGCOR-aligned operating standards, jl20 collects the following as part of the KYC process:

• Government-issued photo identification document (e.g., Philippine Passport, LTO Driver's License, PhilSys National ID, SSS/GSIS ID, Postal ID, PRC ID, or UMID Card) — including the document image and the data contained therein;
• Proof of current residential address (utility bill, barangay clearance, bank statement);
• Selfie photograph for facial matching against identity documents;
• Any additional documentation requested during enhanced due diligence.

3.3 Financial and Transaction Data

• GCash wallet reference details (masked);
• PayMaya account reference details (masked);
• Philippine bank account details for BPI, BDO, and Metrobank transactions (masked);
• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method used;
• Wallet balance history.

3.4 Gameplay and Activity Data

• Game session records — game titles accessed, bets placed, outcomes, session duration;
• Sports betting markets and selections;
• Bonus offers claimed and associated wagering activity;
• Responsible gaming tool settings (deposit limits, self-exclusion status).

3.5 Technical and Device Data

• IP address at time of login and session activity;
• Device type, operating system, and browser version;
• Session timestamps and login history;
• Cookies and similar tracking technologies as described in Section 10.

3.6 Communications Data

• Live chat and support ticket transcripts;
• Email correspondence with jl20 customer support;
• Responsible gaming self-assessment responses (where completed).

4 How jl20 Uses Your Personal Data

4.1 jl20 uses personal data for the purposes set out below. The applicable legal basis for each purpose is identified in Section 5.

5 Legal Bases for Processing

5.1 jl20 processes personal data on one or more of the following legal bases as applicable under Republic Act No. 10173 and general data protection principles:

• Contract Performance: Processing necessary to enter into or fulfil the terms of a jl20 account agreement — including account setup, payment processing, game delivery, and withdrawal management.
• Legal Obligation: Processing required to comply with applicable Philippine law, including KYC verification under anti-money laundering regulations, age verification requirements, and regulatory reporting to PAGCOR and relevant authorities.
• Legitimate Interests: Processing for jl20's legitimate business interests where those interests are not overridden by the Player's data protection rights — including fraud detection, account security, platform optimization, and responsible gaming monitoring.
• Consent: Processing for purposes where your specific consent has been obtained — primarily direct marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6 Sharing of Personal Data

6.1 jl20 does not sell your personal data to third parties. Personal data is shared only where necessary for the purposes described in Section 4, and only with recipients who are bound by appropriate data protection obligations.

6.1 Service Providers and Data Processors

jl20 shares personal data with carefully selected third-party service providers acting as data processors on jl20's behalf. These include:

• Payment Processors: GCash (GXI), PayMaya (Voyager Innovations), and Philippine bank partners (BPI, BDO, Metrobank) — to process deposit and withdrawal transactions;
• KYC Verification Providers: Identity verification service providers that perform document authentication and facial matching for jl20's KYC process;
• Game Providers: Licensed game studios and live dealer operators whose titles are accessible through the jl20 platform — receive session identifiers and wager data necessary to deliver and settle games;
• Customer Support Platforms: Live chat and ticketing systems used to deliver player support;
• Analytics Providers: Platform performance and user experience analytics services — operating on aggregated or pseudonymized data only.

6.2 Regulatory and Law Enforcement Disclosures

jl20 may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), Philippine law enforcement agencies, or other regulatory bodies where required by applicable law, court order, or where jl20 reasonably believes disclosure is necessary to protect legal rights, prevent fraud, or comply with a legal obligation.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of jl20's business assets, personal data held by jl20 may be transferred to the acquiring entity as part of that transaction. Players would be notified of any such transfer that materially affects how their data is processed, prior to the transfer becoming effective.

7 International Data Transfers

7.1 Some of jl20's service providers — including certain game providers and technical infrastructure partners — may be located outside the Philippines. Where personal data is transferred internationally, jl20 takes reasonable steps to ensure that the recipient provides an adequate level of data protection, including through contractual data protection clauses, data processing agreements, or other appropriate safeguards.

7.2 Transfers of KYC documents and financial data are subject to additional protective measures given the sensitivity of this data category. jl20 does not transfer KYC documentation to jurisdictions that do not provide adequate data protection standards without implementing additional safeguards.

8 Data Retention Periods

8.1 jl20 retains personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and Registration Data: For the duration of the active jl20 account, plus a minimum of five (5) years following permanent account closure — to satisfy anti-money laundering record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years following account closure or the date of the last transaction, in accordance with AMLC record-keeping regulations.
• Transaction Records: A minimum of five (5) years from the date of each transaction.
• Gameplay Data: Active account duration plus two (2) years, unless required for longer retention in the context of an unresolved dispute, regulatory inquiry, or legal claim.
• Customer Support Communications: Two (2) years from the date of the last communication, unless the subject matter is connected to an ongoing dispute or investigation.
• Marketing Consent Records: For the duration of consent plus three (3) years following withdrawal, for evidentiary purposes.

8.2 Upon expiry of the applicable retention period, jl20 will securely delete or irreversibly anonymize the personal data concerned, unless a legal obligation requires further retention.

9 Security Measures

9.1 jl20 implements technical and organizational security measures appropriate to the risk level of the personal data processed. Current measures include:

• SSL/TLS Encryption: All data transmitted between your device and the jl20 platform is encrypted using industry-standard SSL/TLS protocols — the same technology used by Philippine banking applications.
• Password Security: Account passwords are stored as cryptographic hashes — jl20 does not store or have access to your plaintext password.
• Access Controls: Access to personal data within jl20's systems is restricted to staff and systems with a legitimate operational need. KYC documentation is subject to additional access restrictions.
• Two-Factor Authentication: Players are encouraged to enable 2FA on their jl20 account to add a mobile OTP requirement to login.
• Session Management: Active sessions are subject to timeout controls; login activity from new devices triggers security alerts to the registered email address.
• Regular Security Review: jl20 conducts periodic reviews of its technical security infrastructure and access controls.

9.2 In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, jl20 will notify affected individuals and, where required by law, the National Privacy Commission, within the timeframes prescribed by Republic Act No. 10173 and its implementing regulations.

10 Cookies and Tracking Technologies

10.1 jl20 uses cookies and similar tracking technologies on the jl20 platform. The following categories of cookies are used:

10.2 jl20 does not use advertising or retargeting cookies. jl20 does not share tracking data with third-party advertising networks.

10.3 You can manage or disable non-essential cookies through your browser settings at any time. Note that disabling essential cookies will impair or prevent your ability to use the jl20 platform.

11 Your Data Subject Rights

11.1 Under Republic Act No. 10173 (Data Privacy Act of 2012) and applicable data protection law, you have the following rights in relation to your personal data held by jl20:

11.2 To exercise any of the rights above, please contact jl20 via the contact details in Section 15. jl20 will respond to all valid data subject requests within thirty (30) days of receipt. Where a request is complex or jl20 receives a large volume of requests, this period may be extended by a further two (2) months, with notice provided to you within the initial thirty-day period.

11.3 jl20 will not charge a fee for processing data subject requests unless a request is manifestly unfounded, excessive, or repetitive. In such cases, jl20 may charge a reasonable fee or decline to act on the request, providing written reasons.

12 Marketing Communications

12.1 jl20 may send promotional communications — including bonus offers, game announcements, and platform updates — to Players who have opted in to receive such communications during registration or through their account settings.

12.2 You may withdraw consent for marketing communications at any time by updating your notification preferences in your jl20 account settings. Withdrawal of marketing consent does not affect your ability to use the jl20 platform or the processing of your data for other lawful purposes.

12.3 jl20 does not sell, rent, or otherwise provide player contact details to third-party marketers. Marketing communications are sent by jl20 directly from its own systems.

12.4 Players who have self-excluded from jl20 for responsible gaming purposes will be removed from all marketing communications lists for the duration of the self-exclusion period, and will not receive promotional materials during that time.

13 Minors and Age Restriction

13.1 jl20 does not knowingly collect, store, or process personal data of individuals under 21 years of age. Registration by individuals under this age is prohibited under jl20's Terms and Conditions and Philippine gaming regulations.

13.2 Where jl20 identifies through KYC verification or other means that an account holder is under 21 years of age, the account will be immediately suspended, all personal data associated with the underage account will be deleted in accordance with applicable law, and any balance will be forfeited as set out in the Terms and Conditions.

13.3 If you believe that a minor under the age of 21 has created a jl20 account, please notify jl20 immediately via the contact details in Section 15 so that appropriate action can be taken without delay.

14 Updates to This Privacy Policy

14.1 jl20 may update this Privacy Policy from time to time to reflect changes in data processing practices, applicable law, or platform functionality. The effective date at the top of this Policy indicates when the current version took effect.

14.2 Material changes to this Privacy Policy — particularly those that affect the legal basis for processing, the categories of data collected, or the rights available to players — will be communicated to registered Players via the email address associated with their jl20 account before the change takes effect.

14.3 The current version of this Privacy Policy is always available at jl20.org/privacy-policy. Players are encouraged to review this Policy periodically to stay informed about how jl20 handles their personal data.

15 Contact and Complaints

15.1 For any questions about this Privacy Policy, to exercise your data subject rights, or to report a privacy concern, please contact jl20's data privacy point of contact:

15.2 If you are not satisfied with jl20's response to a privacy concern or data subject rights request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC), which is the supervisory authority responsible for enforcing Republic Act No. 10173. Information about how to contact the NPC and file a complaint is available through the NPC's official channels.

15.3 jl20 encourages players to contact us directly in the first instance so that we can attempt to resolve any concern before escalation to the regulatory authority.