jilibo Privacy Policy — How We Handle Your Personal Data

jilibo ("we", "us", "our", "the Company") operates the online gaming platform accessible at jilibo.cam (the "Platform"). In the course of providing our services to registered players and website visitors in the Philippines and elsewhere, we collect and process certain personal data.

This Privacy Policy ("Policy") describes the types of personal data jilibo collects, the purposes for which it is processed, the legal bases relied upon, the parties with whom it may be shared, the period for which it is retained, and the rights available to you as a data subject under applicable Philippine law.

This Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations ("IRR"), and applicable issuances of the National Privacy Commission ("NPC"). It supplements, and should be read together with, our Terms & Conditions.

We may update this Policy from time to time. The most current version is always published at jilibo.cam/privacy-policy. Material changes will be communicated to registered players by email or in-platform notification prior to taking effect.

For the purposes of the Philippine Data Privacy Act of 2012, the data controller responsible for personal data processed through the jilibo platform is:

jilibo has designated a Data Protection Officer ("DPO") in accordance with the DPA and NPC requirements. Queries and requests relating to the exercise of data subject rights should be directed to the DPO via the contact details set out in Section 14 of this Policy.

jilibo collects the following categories of personal data from players and website visitors. The specific data points collected depend on your level of interaction with the Platform:

We do not intentionally collect sensitive personal information as defined under the DPA (such as health information, political opinions, or biometric data) unless strictly required for compliance with a specific regulatory obligation and with your explicit consent where applicable.

jilibo collects personal data through the following methods:

• Direct Provision: Data you provide when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or participate in promotions.
• Automated Collection: Technical and usage data collected automatically when you access or interact with the jilibo Platform, including through cookies, log files, and similar technologies. See Section 7 for details on cookies.
• Third-Party Sources: Identity and address verification data received from third-party KYC verification service providers engaged by jilibo for AML compliance purposes. Payment transaction data received from payment processors including GCash, PayMaya, and partner banks. Fraud detection signals from our fraud prevention service partners.
• PAGCOR and Regulatory Sources: Information received from PAGCOR or other Philippine regulatory authorities in the context of licensing, compliance reviews, or regulatory investigations.

jilibo processes your personal data for the following purposes, each supported by a lawful basis under the DPA:

jilibo does not sell, rent, or trade your personal data. We share personal data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• PAGCOR and Regulatory Authorities: Mandatory regulatory reporting, compliance audits, licensing reviews, and responses to formal regulatory inquiries. Disclosure is required by law and does not require your separate consent.
• Philippine Law Enforcement: Where jilibo receives a valid court order, subpoena, or formal request from Philippine law enforcement in accordance with due legal process, we are required to disclose relevant data. We will notify you of such requests where legally permitted to do so.
• AML and Financial Intelligence: Reports to the Anti-Money Laundering Council (AMLC) where transactions or account activity meet reporting thresholds under RA 9160, as amended.
• Payment Processors: GCash (Mynt), PayMaya (Voyager Innovations), BPI, BDO, Metrobank, UnionBank, and other payment partners receive the minimum financial data necessary to process your deposit or withdrawal transaction.
• KYC Verification Providers: Third-party identity verification service providers engaged by jilibo to assist with age verification, document authentication, and fraud screening. These providers are bound by confidentiality obligations and data processing agreements compliant with the DPA.
• Game Software Providers: Game providers (such as PG Soft, Pragmatic Play, Jili, and Evolution Gaming) may receive anonymized or pseudonymized session data for game integrity and technical support purposes. These providers do not receive your identity or financial data.
• Cloud and Infrastructure Providers: Enterprise cloud infrastructure providers hosting jilibo's platform are subject to strict data processing agreements and security obligations aligned with the DPA.

All third parties with whom jilibo shares personal data are required to maintain appropriate technical and organizational security measures and to process data only in accordance with jilibo's instructions and applicable Philippine law.

jilibo uses cookies and similar tracking technologies on the Platform to provide core functionality, maintain security, and improve the player experience. The following types of cookies are used:

• Essential Cookies: Strictly necessary for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember your preferences, language settings, and previously visited game categories to personalize your experience on return visits.
• Analytics Cookies: Collect anonymized data about how players navigate the Platform — pages visited, features used, time on page — to help jilibo improve the user experience. This data is aggregated and does not identify you individually.
• Security and Fraud Prevention Cookies: Used to detect and prevent fraudulent activity, unauthorized access attempts, and other security threats. These are essential for platform integrity.

jilibo does not use third-party advertising or retargeting cookies. Your browsing activity on jilibo is not shared with advertising networks.

You may manage cookie preferences through your browser settings. Disabling essential cookies will impair your ability to use the Platform. For more control over analytics and functional cookies, access the cookie preference center in your account settings.

jilibo retains personal data for no longer than is necessary for the purpose for which it was collected, subject to mandatory retention periods imposed by Philippine law. The following general retention framework applies:

Upon expiry of the applicable retention period, personal data is securely deleted from jilibo's active systems or anonymized such that it can no longer be attributed to any individual. Backups containing personal data are subject to the same retention schedules and are overwritten accordingly.

jilibo implements comprehensive technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or disclosure. Our security framework includes:

• Transport Encryption: All data transmitted between your device and jilibo's servers is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to all pages of the Platform, not just payment screens.
• At-Rest Encryption: Sensitive data stored in jilibo's databases — including identity documents, financial data, and KYC records — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within jilibo is strictly limited to personnel who require it for their role. Role-based access controls, multi-factor authentication, and audit logging are applied to all systems containing personal data.
• Infrastructure Security: jilibo's platform is hosted on enterprise-grade cloud infrastructure with DDoS protection, intrusion detection systems, and regular vulnerability assessments.
• Pseudonymization: Where technically feasible, jilibo pseudonymizes personal data in analytics and development environments, reducing the risk of individual identification.
• Incident Response: jilibo maintains a documented data breach incident response plan. In the event of a personal data breach that poses a significant risk to data subjects, jilibo will notify the National Privacy Commission and affected players within the timeframes prescribed by the DPA and NPC regulations.
• Third-Party Security: All service providers with access to jilibo personal data are subject to security requirements set out in data processing agreements. We conduct due diligence on the security practices of key data processors.

As a data subject under the Philippine Data Privacy Act of 2012, you are entitled to the following rights with respect to your personal data held by jilibo. These rights may be exercised by submitting a written request to our Data Protection Officer at the contact details in Section 14:

jilibo will respond to all verified data subject rights requests within 15 business days of receipt. We may request proof of identity before fulfilling access or correction requests to protect against unauthorized disclosure. Where a request cannot be fully fulfilled — for example, due to mandatory legal retention requirements — we will explain the reason in our response.

If you are unsatisfied with jilibo's response to a data rights request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

The jilibo platform is strictly restricted to individuals aged 21 years and above, in compliance with PAGCOR regulations governing online gambling in the Philippines. jilibo does not knowingly collect personal data from individuals under 21.

Age verification is enforced at registration and prior to the first withdrawal. Any account found to belong to a person under 21 will be immediately suspended, all associated data will be deleted (subject to any mandatory regulatory retention requirements applicable to KYC records), and any balance will be handled in accordance with applicable law and jilibo's Terms and Conditions.

If you believe that jilibo has inadvertently collected personal data from a person under 21, please contact our Data Protection Officer immediately at [email protected] and we will take prompt action to delete the data and close the account.

jilibo is a Philippines-focused platform and primarily stores and processes data within Philippine and regional data center infrastructure. However, some service providers — including cloud infrastructure providers and game platform vendors — may process data in data centers located outside the Philippines.

Where personal data is transferred outside the Philippines, jilibo ensures that:

• The recipient country's data protection laws provide adequate protection, or
• Appropriate contractual safeguards are in place between jilibo and the data recipient (such as standard contractual clauses based on NPC guidance), or
• The transfer is otherwise permitted under the DPA and its IRR.

jilibo does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate safeguards. Cross-border transfers are documented and subject to jilibo's data governance review process.

jilibo may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or PAGCOR regulatory requirements. The following process applies:

• Material Changes: Changes that materially affect your rights or the way we handle your data will be communicated to registered players via email to the address on file and/or by a prominent notice displayed upon login, with a minimum of 14 days' advance notice before the changes take effect.
• Minor Updates: Typographical corrections, clarifications that do not alter data subject rights, or updates required by immediate regulatory instruction may take effect without advance notice.
• Version History: The "Last Updated" date at the top of this Policy indicates the most recent revision. Previous versions of this Policy are available from our Data Protection Officer upon request.

Your continued use of the jilibo platform after the effective date of a revised Privacy Policy constitutes your acknowledgment of the updated practices. If you do not agree with material changes, you have the right to close your account before the changes take effect by contacting our support team.

For any questions about this Privacy Policy, to exercise your data subject rights, or to report a privacy concern, please contact jilibo's Data Protection Officer through the following channels:

• Email: [email protected] — subject line: "Privacy / Data Rights Request"
• Live Chat: Available 24/7 from your jilibo account dashboard — for urgent privacy concerns.

jilibo will acknowledge all privacy-related requests within 5 business days and provide a substantive response within 15 business days, or as otherwise required under NPC regulations.

If you are not satisfied with jilibo's response to your privacy complaint, you have the right to escalate the matter to the National Privacy Commission of the Philippines, the independent authority responsible for enforcing the Data Privacy Act of 2012.