336jl Privacy Policy — Your Data, Protected and Transparent

1 Data Controller Identity

The data controller responsible for your personal data collected through the 336jl platform is the operator of 336jl, the PAGCOR-regulated online casino and sports betting service accessible at https://336jl.net. 336jl operates under Philippine law and is subject to the jurisdiction of the National Privacy Commission (NPC) of the Philippines.

A designated Data Protection Officer (DPO) has been appointed in accordance with Section 21 of Republic Act No. 10173 (the Data Privacy Act of 2012) and its Implementing Rules and Regulations. You may contact the 336jl DPO for any data privacy concern by writing to the contact details provided in Section 14 of this policy.

2 Personal Data We Collect

336jl collects the following categories of personal data from players and platform visitors. We apply the principle of data minimisation — we collect only what is genuinely necessary for the purposes described in this policy.

3 How We Collect Your Data

336jl collects personal data through the following channels and methods:

• Direct registration: When you create a 336jl account using the registration form, you voluntarily provide your name, date of birth, email address, and mobile number.
• 336jl Login sessions: Each time you log in to your account, we record the login timestamp, IP address, and device identifier for security monitoring purposes.
• KYC document submission: When you submit government-issued identification and address verification documents to complete the KYC process prior to withdrawals.
• Payment transactions: When you make deposits or withdrawal requests via GCash, Maya, BPI, BDO, UnionBank, or other accepted methods, our payment processing partners relay transaction reference data to 336jl.
• Automated technologies: Our platform automatically collects technical usage data such as IP addresses, browser identifiers, device fingerprints, and page interaction events via server logs and first-party cookies.
• Customer support interactions: When you contact our support team via live chat or email, we retain the contents of those communications for service quality and compliance purposes.
• Third-party verification providers: We may receive identity confirmation signals from regulated KYC and anti-fraud service providers engaged to support our PAGCOR compliance obligations.

4 Legal Basis for Processing

Under the Data Privacy Act of 2012 (RA 10173), 336jl processes your personal data on the following lawful bases:

• Contractual necessity: Processing your identity, contact, financial, and account data is necessary to fulfil 336jl's obligations under the user agreement you enter into when registering an account — including delivering games, processing deposits and withdrawals, and managing your 336jl Login credentials.
• Legal obligation: Processing for KYC verification, anti-money laundering (AML) record-keeping, and PAGCOR compliance reporting is required by Philippine law, including Republic Act No. 9160 (Anti-Money Laundering Act), Republic Act No. 10365, and PAGCOR's regulatory requirements.
• Legitimate interests: Processing usage data for fraud detection, responsible gaming monitoring, and platform security serves the legitimate interests of 336jl and its players, and does not override your fundamental privacy rights.
• Consent: Where we send you optional marketing communications or use non-essential cookies, we rely on your freely given, specific, and informed consent, which you may withdraw at any time.

5 How We Use Your Personal Data

336jl uses the personal data we collect for the following specific purposes:

• Account creation and management: Setting up and maintaining your 336jl player account, processing your 336jl Login credentials securely, and managing account preferences and settings.
• Identity and age verification: Verifying that you are at least 21 years old and are a legitimate individual in the Philippines, as required by PAGCOR regulations. This involves reviewing the KYC documents you submit.
• Payment processing: Processing PHP deposits via GCash, Maya, BPI, BDO, UnionBank, and other accepted methods; approving withdrawal requests; and maintaining accurate financial records.
• Regulatory compliance: Meeting our obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), and the Data Privacy Act. This includes transaction monitoring, suspicious activity reporting, and maintaining records for audit purposes.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, multi-accounting, money laundering, and unauthorised access to player accounts.
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behaviour; implementing deposit limits, cooling-off periods, and self-exclusion measures where requested or required by our duty of care obligations.
• Customer support: Responding to your enquiries, resolving disputes, and improving the quality of our support services.
• Platform improvement: Using anonymised and aggregated usage analytics to understand how players interact with the 336jl platform and to improve game selection, interface design, and performance.
• Marketing communications (with consent only): Sending you promotional offers, bonus updates, and platform announcements where you have opted in to receive such communications. You may opt out at any time.

6 Data Sharing and Third Parties

336jl does not sell, rent, or trade your personal data to third parties for commercial marketing purposes — full stop. We share personal data only in the following limited and controlled circumstances:

• Payment processors: GCash (Mynt — Globe Fintech Innovations, Inc.), Maya (PayMaya Philippines, Inc.), BPI, BDO, UnionBank, and other accepted payment providers receive only the transaction data necessary to process your deposits and withdrawals. These providers are independently regulated by Bangko Sentral ng Pilipinas (BSP).
• KYC and identity verification providers: Regulated third-party KYC service providers engaged by 336jl to assist with identity document verification receive only the specific data required to fulfil verification. These providers operate under contractual data processing agreements with 336jl.
• Game technology providers: Third-party game providers (such as those supplying slot, bingo, and table game content) may receive your anonymised player session identifier for game log reconciliation purposes. They do not receive your personally identifiable information.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities may receive your data where required by law, court order, or lawful regulatory direction.
• Professional advisers: Our lawyers, auditors, and accountants may access your data on a need-to-know basis under strict professional confidentiality obligations.

7 Cookies and Tracking Technologies

The 336jl platform uses first-party cookies and similar technologies to ensure the platform functions correctly, to maintain your authenticated 336jl Login session, and to collect anonymised usage analytics. We use the following categories of cookies:

• Strictly necessary cookies: These cookies are essential for the 336jl platform to function. They manage your authenticated session after 336jl Login, maintain your account security state, and enable core features such as the cashier and game lobby. These cannot be disabled without breaking platform functionality.
• Analytics cookies: We use anonymised, aggregated analytics to understand how players navigate the 336jl platform — which pages are visited most, where users encounter difficulties, and how game categories perform. No personally identifiable information is included in analytics data.
• Preference cookies: These cookies remember your language preferences, display settings, and other optional personalisation choices to improve your experience on return visits.

336jl does not use third-party advertising cookies, cross-site tracking pixels, or social media tracking scripts on the platform. You can manage or delete cookies through your browser settings at any time, though disabling strictly necessary cookies will impair platform functionality including your ability to complete 336jl Login.

8 Data Retention

336jl retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following retention periods and principles:

• Active account data: Personal data associated with your active 336jl account is retained for the full duration of the account relationship and for a minimum period of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and AMLA obligations under Philippine law.
• KYC documents: Identity and address verification documents submitted as part of the KYC process are retained for a minimum of five (5) years from the date of submission or account closure, whichever is later, as required by the AMLC's record-keeping rules.
• Financial transaction records: Deposit, withdrawal, and wagering transaction records are retained for a minimum of five (5) years in accordance with PAGCOR requirements and the AMLA.
• Customer support communications: Support tickets and chat transcripts are retained for two (2) years to support dispute resolution and service quality monitoring.
• Marketing data: Where you have consented to marketing communications, your preference and contact data for this purpose is retained until you withdraw consent or for two (2) years of inactivity, whichever occurs first.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification, unless a legal obligation or legitimate interest requires further retention.

9 Data Security Measures

336jl implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our security framework includes:

• Encryption in transit: All data exchanged between your device and the 336jl platform is encrypted using TLS 1.3 protocols. Connections over unencrypted HTTP are automatically redirected to HTTPS.
• Encryption at rest: Personal data stored on 336jl servers — including KYC documents, financial records, and account credentials — is encrypted at rest using AES-256 encryption standards.
• Access controls: Access to personal data is restricted to authorised 336jl staff on a strict need-to-know basis. All internal access is logged, monitored, and subject to regular audit.
• Password security: 336jl Login passwords are stored using industry-standard one-way hashing algorithms (bcrypt). 336jl staff cannot retrieve your plaintext password — if you lose access, a secure password reset process is used.
• Two-factor authentication: SMS OTP-based two-factor authentication is available for 336jl Login and is strongly recommended for all players.
• Penetration testing: The 336jl platform undergoes periodic security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Staff training: All 336jl personnel with access to personal data receive regular data privacy and security awareness training, including awareness of their obligations under RA 10173.

10 Your Data Privacy Rights

As a data subject under Republic Act No. 10173 (Data Privacy Act of 2012), you have the following rights with respect to your personal data held by 336jl. You may exercise any of these rights by contacting the 336jl Data Protection Officer using the details in Section 14:

• Right to be informed: You have the right to be informed of how your personal data is collected, used, and processed — which is the primary purpose of this Privacy Policy.
• Right of access: You may request a copy of the personal data 336jl holds about you, along with information about how it is being processed. 336jl will respond to access requests within fifteen (15) working days.
• Right to rectification: If any personal data 336jl holds about you is inaccurate, incomplete, or outdated, you have the right to request correction. Some corrections may require re-submission of KYC documents.
• Right to erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal obligations (such as AMLA record-keeping requirements) that may require 336jl to retain certain data.
• Right to data portability: Where technically feasible, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests where you believe your rights override those interests.
• Right to lodge a complaint: If you believe 336jl has violated your data privacy rights, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

11 Children's Privacy and the 21+ Rule

The 336jl platform is strictly intended for adults aged 21 years and above, in accordance with PAGCOR's minimum age requirements for online casino-style gambling in the Philippines. 336jl does not knowingly collect, process, or retain personal data from any person under the age of 21.

As part of our KYC verification process, 336jl verifies the age of all players prior to approving withdrawal access. Any account found to have been registered by a person under the age of 21 will be immediately closed, any balance will be reviewed, and the matter will be referred to PAGCOR in accordance with our regulatory obligations.

If you are a parent or guardian and believe that your child under 21 has registered an account on the 336jl platform, please contact us immediately at the details provided in Section 14. We will take prompt action to close the account and delete any associated personal data to the extent permitted by law.

12 Cross-Border Data Transfers

The 336jl platform primarily processes and stores data within data centres serving the Philippine market. However, some of our technology service providers — including certain KYC verification vendors and cloud infrastructure partners — may process data in server locations outside the Philippines.

Where personal data is transferred outside of the Philippines, 336jl ensures that such transfers are carried out in compliance with Section 21 of the Data Privacy Act and the NPC's rules on cross-border data flows. Specifically:

• Data is only transferred to countries or organisations that provide an adequate level of data protection, or under contractual clauses that impose equivalent data protection obligations on the recipient.
• All cross-border data transfers are documented and subject to review by the 336jl Data Protection Officer.
• Third-party service providers engaged by 336jl for cross-border processing are vetted for data security compliance and are bound by data processing agreements that enforce 336jl's privacy standards.

13 Changes to This Privacy Policy

336jl reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, technological developments, regulatory requirements, or guidance from the National Privacy Commission.

Any material changes to this Privacy Policy — meaning changes that significantly affect your rights or the way we process your personal data — will be communicated to registered players via email notification and a prominent notice on the 336jl platform at least fourteen (14) days before the changes take effect.

Non-material changes (such as clarifications of existing provisions, typographic corrections, or reorganisation of content without substantive change) may be published without advance notice. The "Last Updated" date at the top of this policy will always reflect the date of the most recent revision.

Your continued use of the 336jl platform following notification of Privacy Policy changes constitutes your acknowledgement of the updated policy. If you do not agree with a material change to this policy, you should cease using the platform and may close your account by contacting support.

14 Contact Us & NPC Complaints

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by 336jl, please contact our Data Protection Officer using the details below. All privacy inquiries are handled in English and Filipino.

• Data Protection Officer (DPO) — 336jl: Contact via email at [email protected] with the subject line "Data Privacy Request — [Your Full Name]".
• Response time: 336jl aims to acknowledge all data privacy requests within five (5) working days and to provide a substantive response within fifteen (15) working days of receiving a complete request.
• Mailing address: Available upon request via the support email above, consistent with our data minimisation practices.

If you are not satisfied with 336jl's response to your data privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, the independent regulatory authority established under RA 10173 to enforce data privacy rights in the Philippines.