jll3 Privacy Policy – How We Protect Your Data

1. Introduction

This Privacy Policy ("Policy") describes how jll3 ("jll3," "we," "us," or "our") collects, uses, stores, discloses, and protects the personal information of individuals ("Data Subjects," "Players," "Users," or "you") who access or use the jll3 online gaming platform at jll3.app ("Platform").

jll3 is committed to protecting the privacy and security of your personal data. This Policy has been prepared in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), its Implementing Rules and Regulations ("IRR"), and the issuances of the National Privacy Commission ("NPC").

By registering an account on jll3, accessing the Platform, or providing any personal information to jll3, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

2. Data Controller Identity

For purposes of the Philippine Data Privacy Act of 2012, jll3 acts as the Personal Information Controller (PIC) with respect to the personal data of its registered players and Platform visitors. As PIC, jll3 determines the purposes and means of processing your personal data.

Certain data processing activities — such as KYC identity verification, payment processing, and game provision — are carried out by third-party vendors acting as Personal Information Processors (PIPs) under written data processing agreements with jll3. Such processors are contractually obligated to process data only on jll3's documented instructions and to implement appropriate data security measures.

For any privacy-related inquiries, requests, or concerns, please contact our Data Protection Officer as described in Section 13 of this Policy.

3. Personal Data We Collect

3.1 Categories of Personal Data

jll3 collects the following categories of personal data, depending on your level of engagement with the Platform:

3.2 Special Categories of Data

jll3 does not intentionally collect sensitive personal information as defined under the DPA (such as health data, racial origin, or political affiliation) unless specifically required for regulatory compliance purposes (e.g., age-related health declarations in responsible gaming contexts). Where such data is collected, jll3 applies heightened protection measures consistent with DPA Section 13 requirements.

3.3 Data Collected from Minors

jll3 does not knowingly collect personal data from individuals under 21 years of age. The jll3 Platform is strictly for adults aged 21 and above as required under Philippine law. If jll3 discovers that data from an underage person has been collected, such data will be deleted immediately and the associated account closed.

4. Purposes of Processing and Legal Basis

jll3 processes your personal data only for specific, legitimate purposes and where there is a lawful basis for doing so under the DPA. The following table summarizes our primary processing activities:

5. Data Sharing and Disclosure

5.1 Third-Party Processors

jll3 shares personal data with the following categories of third-party processors, strictly on a need-to-know basis and under written data processing agreements:

• KYC and Identity Verification Providers: Third-party services that verify the authenticity of identity documents submitted during registration
• Payment Processors: GCash (Mynt), Maya (Voyager Innovations), card networks, and bank payment gateways processing your PHP transactions
• Game Providers: JILI Games, PG Soft, Pragmatic Play, and other licensed studios whose games are hosted on jll3 — these providers receive necessary session data to deliver their games
• IT Infrastructure Providers: Cloud hosting, CDN, and cybersecurity service providers that support Platform operations
• Customer Support Tools: Live chat and ticketing platforms used to handle player support requests

5.2 Regulatory Disclosure

jll3 may disclose personal data to Philippine government authorities and regulatory bodies including PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), law enforcement agencies, and courts of competent jurisdiction where required by applicable law, court order, or regulatory mandate. Such disclosures are made only to the extent required by law.

5.3 No Sale of Data

jll3 does not sell, rent, lease, or otherwise commercially transfer your personal data to unaffiliated third parties for their own marketing or commercial purposes. This prohibition applies regardless of the form of consideration.

5.4 Business Transfer

In the event of a merger, acquisition, restructuring, or sale of jll3's business or assets, personal data held by jll3 may be transferred to the acquiring entity as part of the transaction, subject to equivalent data protection obligations. jll3 will notify affected data subjects of any such transfer through a notice published on the Platform.

6. Data Retention

jll3 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account data and transaction records: Retained for a minimum of 5 years from the date of account closure, as required by Philippine AML regulations
• KYC documents: Retained for a minimum of 5 years from the date of submission or account closure, whichever is later
• Game activity logs: Retained for a minimum of 3 years for dispute resolution and regulatory audit purposes
• Customer support records: Retained for 2 years from the date of the last interaction
• Marketing preferences and opt-in records: Retained until opt-out or account closure, plus 1 year thereafter for compliance documentation
• Cookie and analytics data: Session cookies are deleted at browser close; analytics data is retained for up to 24 months

Upon expiry of the applicable retention period, personal data is either securely deleted or anonymized such that it can no longer be attributed to an identified or identifiable individual.

7. Data Security Measures

jll3 implements a comprehensive set of technical and organizational security measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and jll3 servers is encrypted using TLS 1.2 or higher
• Encryption at rest: Stored personal data, financial records, and KYC documents are encrypted using AES-256 or equivalent standards
• Access controls: Personal data access is restricted to jll3 personnel on a need-to-know basis, with role-based access controls and audit logging
• Two-factor authentication: Available for all player accounts and mandatory for jll3 administrative access
• Penetration testing: Regular security assessments and vulnerability scans by independent third parties
• Incident response: A documented data breach response plan consistent with NPC Circular 16-03 reporting requirements

8. Cookies and Tracking Technologies

8.1 Types of Cookies Used

jll3 uses the following categories of cookies and similar tracking technologies on the Platform:

• Strictly Necessary Cookies: Essential for Platform functionality, including authentication session management and security tokens. These cannot be disabled without affecting basic site operation.
• Functional Cookies: Remember your preferences such as language settings, login state (if "Remember Me" is selected), and game lobby filters.
• Analytics Cookies: Aggregate, anonymized data on how players navigate the jll3 Platform — used to improve usability and identify technical issues. jll3 uses privacy-respecting analytics tools with IP anonymization enabled.
• Security Cookies: Assist fraud detection, bot prevention, and account security monitoring.

8.2 Cookie Management

You may control non-essential cookies through your browser settings. Most modern browsers allow you to block, delete, or receive alerts before cookies are set. Note that disabling certain cookies may affect the functionality of the jll3 Platform, including the ability to stay logged in or retain game preferences.

jll3 does not use third-party advertising cookies or behavioral profiling cookies for targeted advertising purposes on its Platform.

9. Your Rights as a Data Subject

Under the Philippine Data Privacy Act of 2012 and its IRR, you have the following rights with respect to your personal data held by jll3:

• Right to be Informed: The right to know whether jll3 processes your personal data, the purposes for such processing, and the identity of third parties with whom it may be shared.
• Right of Access: The right to obtain a copy of your personal data in a commonly used format upon verified request.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data in jll3's records.
• Right to Erasure or Blocking: The right to request deletion or blocking of personal data where processing is no longer necessary, where consent has been withdrawn, or where processing violates the DPA — subject to jll3's legal retention obligations.
• Right to Data Portability: The right to receive your personal data in a structured, machine-readable format and to transmit it to another data controller, where technically feasible.
• Right to Object: The right to object to processing based on legitimate interest or for direct marketing purposes.
• Right to Damages: The right to be indemnified for damages sustained as a result of inaccurate, incomplete, or false personal information held by jll3.
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission (NPC) at privacy.gov.ph if you believe jll3 has violated your data privacy rights.

To exercise any of the above rights, submit a written request to jll3's Data Protection Officer using the contact details in Section 13. jll3 will respond to verified requests within 15 business days of receipt.

10. Minors and Age Policy

The jll3 Platform is strictly prohibited for use by individuals under 21 years of age, consistent with Philippine law governing online gaming and PAGCOR regulations. jll3 does not knowingly collect, process, or retain personal data from persons under the age of 21.

During the registration process, jll3 collects date of birth and conducts age verification through its KYC process. Where jll3 has reasonable grounds to believe that a registered account belongs to a person under 21 years of age, jll3 will:

• Immediately suspend the account and restrict access to gaming services
• Initiate a mandatory identity verification review
• Delete any personal data collected from the underage individual upon confirmed identification
• Handle any account balance in accordance with applicable Philippine law and regulatory guidance

Parents and guardians who believe that a person under 21 in their care has registered on jll3 should contact our support team immediately via live chat or email to facilitate account closure and data deletion.

11. Cross-Border Data Transfers

jll3 primarily processes personal data within the Philippines. Certain third-party service providers — including KYC verification vendors, cloud infrastructure providers, and game studios — may process data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, jll3 ensures that adequate safeguards are in place in accordance with the DPA and NPC regulations, including:

• Binding contractual clauses incorporating DPA-equivalent data protection standards
• Transfers only to jurisdictions recognized as providing adequate data protection
• Written data processing agreements requiring processors to implement equivalent security measures

By using the jll3 Platform and consenting to this Privacy Policy, you acknowledge and agree to the transfer of your personal data to third countries as described in this section, subject to the safeguards outlined above.

12. Changes to This Privacy Policy

jll3 reserves the right to update or revise this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or Platform features. Material changes will be communicated to registered users via email notification to their registered address and/or a prominent notice on the jll3 Platform.

The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. jll3 recommends that you review this Policy periodically to stay informed about how your personal data is being protected. Your continued use of the jll3 Platform following the effective date of any revised Policy constitutes acceptance of the changes.

If changes to this Policy require additional consent under the DPA, jll3 will obtain such consent from affected data subjects before the revised processing activities commence.

13. Contact and Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or your personal data held by jll3, please contact our Data Protection Officer through the following channels:

• Email: [email protected] — please include "Privacy / DPO Request" in the subject line
• Live Chat: Available 24/7 on the jll3 Platform — human agents 8AM–12MN PHT for data privacy matters

jll3's Data Protection Officer is responsible for overseeing compliance with the DPA, responding to data subject rights requests, coordinating with the National Privacy Commission, and maintaining jll3's Privacy Management Program.

If you are not satisfied with jll3's response to your privacy concern, you have the right to escalate your complaint directly to the National Privacy Commission of the Philippines.