jl500 Privacy Policy

jl500 ("jl500," "we," "us," or "our") operates the online gaming platform accessible at jl500.org and associated subdomains. jl500 is the personal information controller (as that term is defined under Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines, hereinafter "DPA") in respect of all personal data processed in connection with your use of the jl500 Platform.

jl500 operates under the regulatory oversight of the Philippine Amusement and Gaming Corporation (PAGCOR). In addition to the data privacy obligations imposed by the DPA and the National Privacy Commission (NPC), jl500 is subject to PAGCOR's player data protection requirements, anti-money laundering reporting obligations under the Anti-Money Laundering Act (AMLA), and related Philippine financial intelligence unit (AMLC) regulations.

Questions, requests, or complaints relating to this Privacy Policy or jl500's data processing practices may be directed to our Data Protection Officer (DPO) using the contact details set out in Section 15.

jl500 collects personal data that is necessary, adequate, and relevant to the specific purposes described in this Privacy Policy. We do not collect more data than is required for those purposes. The categories of personal data we process are set out below.

jl500 does not collect sensitive personal information (as defined under the DPA) beyond what is strictly required for identity verification and responsible gaming compliance — specifically, government ID numbers and facial images collected during KYC. These are processed under heightened security controls and access restrictions.

jl500 collects personal data through the following channels and mechanisms:

3.1 Directly from You

• When you register a jl500 account by providing your mobile number, email, and chosen password;
• When you complete KYC verification by submitting government ID documents, a selfie, and proof of address;
• When you make deposits or request withdrawals, which involves identifying your payment source;
• When you contact jl500 customer support via live chat or email;
• When you respond to promotions, surveys, or feedback requests.

3.2 Automatically During Platform Use

• Technical data including your IP address, device fingerprint, browser information, and session activity is collected automatically when you access and use the jl500 Platform;
• Game engine logs capture all wagering activity, game outcomes, and session metadata for integrity verification purposes;
• Behavioral analytics tools track navigation patterns to support platform improvement and fraud detection.

3.3 From Third Parties

• Identity verification and document authentication service providers who process KYC submissions on jl500's behalf;
• Payment processors including GCash, Maya, BPI, BDO, and Metrobank, who confirm transaction status and, where required by AMLA, provide transaction metadata;
• Fraud prevention and risk scoring services that supplement jl500's internal controls.

Under the Philippine Data Privacy Act, jl500 is required to have a lawful basis for every data processing activity. The principal legal bases applicable to jl500's processing activities are as follows:

• Contractual Necessity: Processing required to fulfill jl500's obligations under the account agreement — including operating your account, processing payments, and delivering game services — is processed on the basis that it is necessary to perform the contract between you and jl500;
• Legal Obligation: Processing required to comply with PAGCOR regulations, Anti-Money Laundering Act (AMLA) reporting obligations, NPC data protection requirements, and applicable court orders or regulatory directives;
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming behavioral monitoring, and analytics necessary for the safe and compliant operation of jl500, where such interests are not overridden by your rights and interests;
• Consent: Processing for optional marketing communications (SMS, email, push notifications), where jl500 will seek your separate, explicit consent and provide an easy withdrawal mechanism at any time.

jl500 uses your personal data for the following purposes, each linked to a lawful processing basis described in Section 4:

• Account Creation and Management: Registering your account, verifying your identity, maintaining accurate account records, and providing you access to platform features;
• KYC and Age Verification: Confirming your identity and verifying that you meet the 21+ age requirement in compliance with PAGCOR regulations. This is a non-negotiable processing activity — accounts that cannot be verified will be restricted;
• Payment Processing: Facilitating your deposits and withdrawals through GCash, Maya, InstaPay, and other approved Philippine payment channels; detecting and preventing payment fraud;
• Game Delivery and Integrity: Operating game services, maintaining complete records of all wagers and outcomes for dispute resolution and regulatory audit purposes, and ensuring the technical integrity of all game sessions;
• Fraud and Security: Detecting unusual login patterns, identifying unauthorized account access, preventing collusion and bonus abuse, and protecting the financial integrity of the platform;
• Responsible Gaming: Monitoring wagering patterns to identify potential problem gambling behaviors; applying player-requested restrictions; administering self-exclusion orders; fulfilling PAGCOR responsible gaming compliance obligations;
• Regulatory Compliance: Generating reports required by PAGCOR, submitting covered and suspicious transaction reports to the AMLC as required by AMLA, and responding to lawful requests from Philippine government authorities;
• Customer Support: Handling account queries, resolving disputes, processing complaints, and maintaining records of support interactions;
• Platform Improvement: Analyzing aggregated behavioral data to identify usability issues, improve navigation, and optimize the player experience;
• Marketing (with consent): Sending promotional offers, bonus notifications, and event updates via SMS, email, or push notification — only where you have provided explicit consent and have not subsequently withdrawn it.

jl500 does not sell, rent, or trade personal data. We share personal data only in the circumstances described below, and only to the extent necessary for the stated purpose:

6.1 Service Providers (Data Processors)

jl500 engages third-party service providers who process personal data on our behalf and under our documented instructions. These include:

• KYC and identity verification providers;
• Payment processors and e-wallet providers (GCash, Maya, BPI, BDO, Metrobank);
• Cloud hosting and infrastructure providers;
• Customer support platform providers;
• Fraud detection and risk analytics service providers;
• Game software providers (to the extent session data is shared for audit or integrity purposes).

All service providers are contractually bound to process personal data only as instructed by jl500, to maintain appropriate security measures, and not to sub-process data without jl500's prior written authorization.

6.2 Regulatory and Law Enforcement Disclosures

jl500 may disclose personal data to PAGCOR, the AMLC, the NPC, the Bureau of Internal Revenue (BIR), and other competent Philippine government authorities where such disclosure is required by law, regulation, or valid legal process (including court orders and subpoenas).

6.3 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of jl500's assets, personal data held by jl500 may be transferred to the acquiring entity. Players will be notified in advance of any such transfer that materially affects their data rights.

6.4 Protection of Rights and Platform Integrity

jl500 may disclose personal data where necessary to investigate fraud, enforce these Terms and Conditions, protect the rights and safety of jl500, its staff, or other players, or prevent illegal activity on the platform.

jl500 uses cookies and related tracking technologies to operate the platform, maintain session integrity, and analyze usage. The categories of cookies in use are as follows:

• Strictly Necessary Cookies: Essential to core platform functionality including authentication session management, security token validation, and payment flow continuity. These cannot be disabled without impairing platform use;
• Functional Cookies: Store your preferences such as language settings, lobby display preferences, and recently played games to improve your session experience;
• Analytics Cookies: Collect aggregated, anonymized data on how the jl500 platform is used — pages visited, session duration, navigation paths — to support platform improvement. No individual player is singled out in analytics reporting;
• Security Cookies: Support fraud detection by correlating session data against known attack patterns, flagging anomalous login behavior, and maintaining device consistency checks.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to log in and use the jl500 Platform. jl500 does not use advertising cookies or behavioral tracking cookies for third-party advertising purposes.

jl500 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Retention periods are determined as follows:

• Account and Identity Data: Retained for the duration of the account relationship, plus five (5) years following account closure, in compliance with PAGCOR and AMLA record-keeping requirements;
• KYC Documents: Retained for five (5) years post-account closure in compliance with AMLA, PAGCOR, and NPC requirements. Stored in access-controlled, encrypted repositories;
• Transaction and Gaming Records: Retained for five (5) years from the date of the relevant transaction, as required by AMLA and PAGCOR audit obligations;
• Customer Support Communications: Retained for three (3) years from the date of the most recent interaction, to support dispute resolution and platform quality review;
• Marketing Data: Retained only while you maintain an active consent to receive marketing communications. Withdrawn consent results in prompt deletion of marketing profile data;
• Technical and Log Data: Retained for twelve (12) months for security analysis purposes, after which it is deleted or anonymized.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents re-identification.

jl500 implements technical and organizational measures appropriate to the nature and sensitivity of the personal data processed, including:

• Encryption: All data in transit is protected by TLS 1.2 or higher. Sensitive data at rest — including KYC documents and financial records — is encrypted using AES-256;
• Access Controls: Internal access to personal data is restricted on a role-based, need-to-know basis. Access privileges are reviewed quarterly and revoked promptly upon staff departure;
• Authentication: All jl500 internal systems require multi-factor authentication. Player accounts support optional two-factor authentication via SMS OTP, which jl500 strongly recommends;
• Penetration Testing: jl500 engages independent security firms to conduct periodic penetration tests of platform infrastructure. Critical findings are remediated within defined SLA timeframes;
• Incident Response: jl500 maintains a documented data breach response procedure, including notification obligations to the NPC (within 72 hours of discovery for high-risk breaches) and affected players as required by the DPA;
• Staff Training: All jl500 staff with access to personal data undergo data privacy and security training at onboarding and annually thereafter.

Under Republic Act No. 10173 (Data Privacy Act of 2012), you have the following rights in respect of your personal data held by jl500. These rights may be exercised by submitting a written request to the jl500 DPO using the contact details in Section 15.

The jl500 Platform is strictly intended for persons aged twenty-one (21) years and above. jl500 does not knowingly collect personal data from individuals under the age of 21. Age is verified through mandatory KYC submission of a valid Philippine government-issued photo identification document before any real-money features are enabled.

If jl500 becomes aware — through any means — that personal data belonging to a person under 21 years of age has been collected, jl500 will immediately suspend the associated account, initiate a KYC review, and, where underage use is confirmed, permanently close the account and return all deposited funds to the payment source. Any winnings accrued by an underage account will be forfeited.

Parents or guardians who believe their child has registered a jl500 account should contact jl500 support immediately via live chat or email to initiate an urgent account investigation.

jl500 is a Philippine-based platform and the primary processing of personal data occurs within Philippine jurisdiction. However, certain service providers engaged by jl500 — including cloud infrastructure, KYC verification services, and game software providers — may process data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, jl500 ensures that appropriate safeguards are in place in compliance with NPC cross-border transfer requirements, including:

• Data processing agreements with contractual clauses requiring recipients to maintain data protection standards equivalent to the Philippine DPA;
• Transfer impact assessments for transfers to jurisdictions without equivalent data protection frameworks;
• Restriction of transferred data to the minimum necessary for the specific service being provided.

jl500's responsible gaming program involves a specific category of personal data processing — behavioral monitoring — that warrants specific explanation. jl500's systems monitor wagering patterns, deposit frequency, loss sequences, and session duration to identify behavioral indicators that may be associated with problem gambling.

This processing is conducted on the basis of jl500's legitimate interest in preventing gambling-related harm and PAGCOR's regulatory requirement that licensed operators maintain effective problem gambling detection mechanisms. The monitoring is system-driven, not targeted at individual players without cause. Where concerning patterns are detected, jl500 may:

• Display in-platform reality check notifications;
• Send an account message from the responsible gaming team;
• Prompt a review of the player's voluntary protection settings;
• In serious cases, initiate an account restriction pending a welfare check in compliance with PAGCOR guidelines.

All responsible gaming data — including self-exclusion status, limit history, and support interactions — is retained separately under enhanced access controls and is not used for marketing profiling under any circumstances. Self-exclusion data is retained for the duration of the exclusion period and for five (5) years thereafter to prevent re-registration by excluded players.

jl500 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance from the NPC or PAGCOR, changes in jl500's data processing practices, or organizational changes. Material amendments will be communicated to registered Players via the email address on file and prominently displayed on jl500.org for no less than fourteen (14) days prior to the amended policy taking effect.

Continued use of the jl500 Platform following the effective date of an amended Privacy Policy constitutes acknowledgment of the updated terms. If you do not accept an amended Privacy Policy, you should cease using the platform and contact jl500 support to arrange account closure.

The "Effective Date" displayed at the top of this document reflects the date of the most recent revision. Prior versions of this Privacy Policy are available upon request from the jl500 DPO.

jl500 has designated a Data Protection Officer (DPO) as required under the Philippine Data Privacy Act. The DPO is responsible for overseeing jl500's data protection compliance, responding to data subject requests, and serving as the primary point of contact with the National Privacy Commission.

To exercise your data rights, submit a privacy complaint, or ask any question about this Privacy Policy or jl500's data practices, please contact the jl500 DPO through the following channels:

• Email: [email protected] (please include "DPO / Data Privacy" in your subject line);
• Live Chat: Available 24/7 on the jl500 Platform — ask to be connected to the Data Privacy Team;
• Response Time: The DPO will acknowledge your request within five (5) business days and provide a substantive response within thirty (30) calendar days.

If you are not satisfied with jl500's handling of your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.