19jl Privacy Policy —
How We Collect, Use,
and Protect Your Data

This Policy applies to all personal data processed by 19jl in connection with the operation of its online gaming platform at 19jl.asia, including all sub-pages, features, games, and services offered thereon.

19jl is the personal information controller responsible for the collection and processing of your data as described in this Policy. 19jl operates under the regulatory oversight of the Philippine Amusement and Gaming Corporation (PAGCOR), and its data processing activities are subject to both PAGCOR's operating conditions and the requirements of the Data Privacy Act of 2012.

This Policy does not apply to third-party game providers, payment processors, or other external services linked from or integrated with the 19jl Platform. Those parties operate under their own privacy policies, which you are encouraged to review independently.

19jl collects the following categories of personal data, depending on how you interact with the Platform:

19jl collects personal data through the following methods:

• Directly from you: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or updating your account settings.
• Automatically: Technical data including IP address, device identifiers, and session logs collected when you access or use the Platform, including through cookies and similar tracking technologies (see Section 7).
• From third parties: Identity verification data from KYC service providers; transaction confirmation data from payment processors (GCash, PayMaya, BPI, BDO, Metrobank); fraud screening signals from anti-fraud service providers; regulatory data from PAGCOR where applicable to compliance obligations.

You are under no legal obligation to provide your personal data to 19jl. However, failure to provide data required for account registration, KYC verification, or payment processing will prevent you from using the relevant features of the Platform — including depositing, withdrawing, or receiving promotional offers.

Under the Data Privacy Act of 2012, 19jl processes your personal data on the following legal bases:

• Performance of Contract: Processing necessary to register your account, authenticate your identity, process deposits and withdrawals, provide games, and deliver customer support as part of your agreement with 19jl.
• Legal Obligation: Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (Republic Act No. 9160 as amended), the Terrorism Financing Prevention and Suppression Act, and other applicable Philippine laws and regulations.
• Legitimate Interests: Processing necessary for fraud prevention and platform security, responsible gaming monitoring, and improvement of Platform features — where such interests are not overridden by your data protection rights.
• Consent: Processing for direct marketing communications and non-essential cookies, where we rely on your explicit and freely given consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

19jl processes your personal data for the following specific purposes:

1. Account Management: To create, verify, maintain, and secure your 19jl player account, including password reset and Two-Factor Authentication (2FA) delivery.
2. Identity Verification (KYC): To verify your identity and age (21+ as required by PAGCOR), confirm your eligibility to use the Platform, and prevent underage gambling.
3. Payment Processing: To process deposits and withdrawals via your chosen payment method (GCash, PayMaya, BPI, BDO, Metrobank) and to maintain accurate transaction records.
4. Game Operation: To provide access to games, record and settle bets, calculate winnings, and maintain accurate game history records for dispute resolution.
5. Regulatory Compliance: To satisfy PAGCOR reporting obligations, Anti-Money Laundering (AML) monitoring requirements, and any other legal duty applicable to a licensed Philippine online gaming operator.
6. Responsible Gaming: To monitor gameplay patterns, identify potential problem gambling indicators, apply voluntary player-requested limits, and comply with PAGCOR's responsible gaming obligations.
7. Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, unauthorised account access, money laundering, and other illegal or prohibited activities.
8. Customer Support: To respond to your enquiries, resolve disputes, and improve the quality of our support services.
9. Marketing Communications: To send you promotional offers, bonus notifications, and platform updates by SMS or email, where you have opted in to receive such communications. You may opt out at any time.
10. Platform Improvement: To analyse aggregate usage data, identify technical issues, and improve the features, stability, and performance of the 19jl Platform.

19jl does not sell, rent, or trade your personal data to third parties for their own marketing purposes. Your personal data may be shared only in the following circumstances, and only to the minimum extent necessary:

• Payment Processors: GCash (G-Xchange, Inc.), PayMaya (PayMaya Philippines, Inc.), BPI, BDO, and Metrobank — to process your deposits and withdrawals. These entities are bound by their own privacy policies and applicable Philippine financial regulations.
• KYC / Identity Verification Providers: Third-party identity verification services used to authenticate your government-issued ID and confirm your eligibility. These providers are contractually bound to process your data only for KYC purposes.
• Game Providers: Third-party game developers and live dealer studio operators whose games are available on the 19jl Platform. Game providers may receive session-level technical data necessary to deliver game functionality. They do not receive your full personal profile.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government bodies, as required by law, court order, or regulatory directive.
• Fraud Prevention & Security Services: Third-party fraud detection and cybersecurity service providers who assist in protecting the Platform and its players from criminal activity.
• Legal and Professional Advisers: Legal counsel, auditors, and accountants who are bound by strict professional confidentiality obligations, in connection with the legitimate operation of 19jl's business.
• Business Transfers: In the event of a merger, acquisition, or sale of 19jl's business or assets, your personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

19jl uses the following categories of cookies and tracking technologies on its Platform:

You can manage your cookie preferences at any time through your browser settings. Disabling strictly necessary cookies will impair Platform functionality. Disabling analytics or marketing cookies will not affect your ability to play games or process transactions.

19jl retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, and to comply with applicable legal and regulatory obligations. The following retention periods apply:

• Account and Identity Data: Retained for the duration of your account, plus a minimum of five (5) years after account closure, in compliance with PAGCOR licensing requirements and the Anti-Money Laundering Act.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, as required by AMLC regulations and PAGCOR reporting obligations.
• KYC Documents: Retained for the duration of the account relationship, plus five (5) years after account closure.
• Customer Support Communications: Retained for three (3) years from the date of the last communication, for quality assurance and dispute resolution purposes.
• Technical and Log Data: Retained for twelve (12) months, after which it is automatically deleted or anonymised.
• Marketing Data: Retained until you withdraw consent or opt out, plus a reasonable administrative period thereafter.

Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymised in accordance with 19jl's data disposal procedures.

19jl implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction:

• Encryption in Transit: All data transmitted between your device and 19jl's servers is encrypted using TLS 1.2 or higher (256-bit SSL). Connections to 19jl.asia are enforced over HTTPS at all times.
• Encryption at Rest: Sensitive personal data — including identity documents and financial account details — is encrypted at rest using AES-256 encryption in secure, access-controlled database environments.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Internal staff access requires multi-factor authentication, and access permissions are reviewed regularly.
• Two-Factor Authentication (2FA): Player accounts support 2FA via SMS OTP, significantly reducing the risk of unauthorised account access even if login credentials are compromised.
• Intrusion Detection: 19jl operates automated intrusion detection and prevention systems (IDS/IPS) that monitor for suspicious access patterns, brute-force attempts, and anomalous login activity 24/7.
• Vulnerability Management: The Platform undergoes regular security assessments and penetration testing by qualified third-party security professionals. Critical vulnerabilities are patched promptly.
• Staff Training: All 19jl employees and contractors who handle personal data receive mandatory data privacy and information security training at least annually.

As a data subject protected by the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 19jl:

• Right to Be Informed: You have the right to know what personal data 19jl collects about you, the purposes for which it is processed, and how long it is retained. This Policy fulfils that obligation.
• Right of Access: You may request a copy of the personal data 19jl holds about you, along with information about how it is used. Requests are processed within 15 business days.
• Right to Correction / Rectification: You may request correction of inaccurate or incomplete personal data. Some corrections (e.g., legal name changes) require documentary evidence.
• Right to Erasure / Right to Be Forgotten: You may request deletion of your personal data where it is no longer necessary for its original purpose, subject to 19jl's retention obligations under Philippine law (see Section 8).
• Right to Object: You may object to processing based on legitimate interests (including marketing communications) at any time. Marketing opt-outs are processed immediately.
• Right to Data Portability: You may request a machine-readable copy of personal data you provided to 19jl for your own use or for transfer to another platform.
• Right to Lodge a Complaint: If you believe your data privacy rights have been violated, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines.

The 19jl Platform is strictly intended for persons who are 21 years of age or older, as required by PAGCOR for online gaming operations in the Philippines. 19jl does not knowingly collect, process, or retain personal data from any person under 21 years of age.

If 19jl discovers or is notified that personal data has been collected from a person under the age of 21, that data will be immediately deleted, the associated account will be permanently closed, and any deposited funds will be returned to the originating payment method after verification of the source.

If you are a parent or guardian and believe that a minor in your care has registered a 19jl account, please contact our support team immediately at [email protected] so we can take prompt action.

19jl's primary data processing infrastructure is located in data centres serving the Philippine market. In limited circumstances, personal data may be transferred to or processed by service providers whose servers are located outside the Philippines — for example, globally distributed fraud detection systems or cloud-based KYC verification platforms.

Where such transfers occur, 19jl ensures that appropriate safeguards are in place to protect your personal data at a standard equivalent to, or greater than, that required by the Data Privacy Act of 2012. These safeguards may include contractual data processing agreements incorporating NPC-approved standard clauses, or reliance on the adequacy of data protection laws in the recipient jurisdiction as assessed by the NPC.

19jl reserves the right to update or revise this Privacy Policy at any time to reflect changes in law, regulatory guidance, Platform features, or data processing practices. When material changes are made, 19jl will:

• Update the "Last Updated" date at the top of this Policy.
• Post a notice on the 19jl Platform for a period of at least 30 days.
• Where the change is significant, send a notification to your registered mobile number or email address.

Your continued use of the 19jl Platform following the effective date of any updated Policy constitutes your acknowledgment of and agreement to the revised terms. If you do not agree with the updated Policy, you should stop using the Platform and may request account closure in accordance with the Terms and Conditions.

19jl has designated a Data Protection Officer (DPO) as required under the Data Privacy Act of 2012 and NPC Circular 16-01. The DPO is responsible for overseeing compliance with this Policy and applicable data privacy laws, and serves as the primary point of contact for data subjects exercising their rights.

To contact 19jl regarding this Privacy Policy, to exercise your data subject rights, or to report a privacy concern:

• Email (plain text, non-clickable): [email protected] — Subject line: "Data Privacy Request" or "DPO Enquiry"
• Live Chat: Available 24/7 on the 19jl Platform — for urgent matters, including suspected data breaches affecting your account.

If you are not satisfied with 19jl's response to your data privacy request, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, the independent regulatory body responsible for enforcing the Data Privacy Act of 2012.