Privacy Policy

1. Introduction & Scope

This Privacy Policy ("Policy") describes how ajjili ("the Company", "we", "us", "our") collects, uses, stores, shares, and protects the personal information of individuals ("you", "your", "the Player") who access or use the ajjili platform, including the website at ajjili.app and all associated gaming, betting, cashier, and account management services offered to players in the Philippines.

This Policy is issued in compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC") of the Philippines. By registering an account with ajjili or continuing to use the platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

This Policy applies to all personal data collected through the ajjili platform, including data provided during registration, account verification, gameplay, financial transactions, customer support interactions, and marketing communications. It does not apply to third-party websites or services that may be linked from our platform, even if they appear within the ajjili interface.

2. Data Controller

For the purposes of the Data Privacy Act of 2012 and NPC regulations, ajjili acts as the Personal Information Controller (PIC) with respect to the personal data collected through the ajjili platform. As PIC, ajjili determines the purposes and means of processing your personal information and is responsible for ensuring that all processing activities are carried out in a lawful, fair, and transparent manner.

ajjili has designated a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data protection laws. You may contact the DPO for any privacy-related concerns at the contact details provided in Section 14 of this Policy.

3. Data We Collect

3.1 Personal Identification Data

When you register an account with ajjili or complete identity verification (KYC), we collect:

• Full legal name as it appears on your government-issued ID
• Date of birth and age verification information
• Residential address in the Philippines (city, province, ZIP code)
• Philippine mobile number registered to a local network
• Valid email address
• Copies of government-issued identification documents (passport, PhilSys, UMID, driver's license, voter's ID, or PRC ID)
• Selfie or live photo for facial verification where required

3.2 Financial Data

To process deposits, withdrawals, and comply with AML obligations, we collect:

• GCash or PayMaya account details (mobile number only — we do not store full wallet credentials)
• BPI, BDO, or Metrobank account details for bank transfer transactions
• Transaction histories, deposit and withdrawal amounts, and timestamps
• Source of funds declarations where required by PAGCOR or AMLC guidelines

3.3 Usage and Gameplay Data

During your use of the ajjili platform, we automatically collect:

• Game session data including game type, bet amounts, outcomes, and session duration
• Login timestamps, IP addresses, and device identifiers
• Browser type, operating system, and screen resolution
• Pages visited, features accessed, and navigation patterns within the platform
• Sports betting selections, odds accepted, and settlement outcomes

3.4 Communications Data

When you contact our support team or respond to our communications, we collect:

• Content of live chat, email, and support ticket exchanges
• Survey responses and player feedback submissions
• Marketing email open rates and click-through data where you have opted in to communications

4. How We Collect Your Data

ajjili collects personal data through the following channels:

• Directly from you — when you register, complete KYC verification, make a deposit or withdrawal, contact support, or participate in promotions
• Automatically — through cookies, web beacons, log files, and similar tracking technologies as you navigate the platform (see Section 9)
• From third-party verification partners — identity verification and KYC service providers who confirm the authenticity of the documents you submit
• From payment providers — GCash, PayMaya, BPI, BDO, and Metrobank may share transaction confirmation data with us to facilitate deposits and withdrawals
• From regulatory and law enforcement bodies — PAGCOR, AMLC, or other Philippine government agencies may provide or request information in connection with their regulatory or investigatory functions

5. Purpose & Legal Basis for Processing

ajjili processes your personal data only where a lawful basis exists under the Data Privacy Act of 2012. The table below sets out the primary purposes for which we process your data and the corresponding legal basis for each:

Where processing is based on your consent, you have the right to withdraw that consent at any time by updating your communication preferences in Account Settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Data Sharing and Disclosure

6.1 Third-Party Service Providers

ajjili engages carefully selected third-party service providers ("Personal Information Processors" under the DPA) who process personal data on our behalf and under our instructions. These include:

• KYC and identity verification providers — for document authentication and facial verification
• Payment processors — GCash, PayMaya, BPI, BDO, Metrobank, and InstaPay network operators
• Cloud infrastructure providers — for secure hosting of platform data
• Customer support software providers — for managing live chat and ticketing systems
• Analytics providers — for aggregated, anonymised platform usage analytics

All third-party processors are bound by data processing agreements that require them to maintain appropriate security measures and process data only as instructed by ajjili. ajjili does not sell your personal data to any third party.

6.2 Regulatory and Legal Disclosure

ajjili may disclose your personal data to government authorities and regulators where required by law or pursuant to a valid legal process, including:

• PAGCOR — Philippine Amusement and Gaming Corporation, as our regulatory authority
• AMLC — Anti-Money Laundering Council, for covered and suspicious transaction reporting under RA 9160
• National Privacy Commission — in connection with data breach notifications or regulatory inquiries
• Philippine courts, law enforcement agencies, or other government bodies — pursuant to valid court orders, subpoenas, or statutory obligations

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of ajjili's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material change to the processing of your data that results from it.

7. Data Retention

ajjili retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by Philippine law. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to an identifiable individual.

8. Data Security

ajjili implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include, but are not limited to:

• Encryption in transit: All data transmitted between your device and the ajjili platform is protected by TLS 1.3 encryption
• Encryption at rest: Sensitive personal data stored in our systems is encrypted using AES-256 standards
• Access controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication
• Penetration testing: The ajjili platform undergoes regular third-party penetration testing and vulnerability assessments
• Incident response: ajjili maintains a documented data breach response plan aligned with NPC Circular No. 16-03
• Employee training: All ajjili staff who handle personal data receive data privacy training upon onboarding and on an annual basis

While ajjili takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is 100% secure. You are also responsible for maintaining the security of your own account credentials and for notifying us immediately of any suspected unauthorised access to your account.

9. Cookies and Tracking Technologies

9.1 What Are Cookies

Cookies are small text files placed on your device when you visit the ajjili platform. They allow us to recognise your device, remember your preferences, maintain your session, and collect information about how you use the platform. Similar technologies such as web beacons, pixel tags, and local storage objects may also be used for comparable purposes.

9.2 Types of Cookies We Use

• Strictly necessary cookies: Essential for the platform to function. These enable core features such as account login, session management, and security. They cannot be disabled without breaking platform functionality.
• Functional cookies: Remember your preferences such as language settings and display options to personalise your experience.
• Analytics cookies: Collect anonymised data about how players navigate the platform to help us identify areas for improvement. This data is aggregated and not linked to identifiable individuals.
• Marketing cookies: Used with your consent to deliver relevant promotional content and measure the effectiveness of our marketing campaigns.

9.3 Managing Cookies

You can manage or disable non-essential cookies through your browser settings or through the cookie preference centre available on the ajjili platform. Please note that disabling certain cookies may affect the functionality and performance of the platform. Strictly necessary cookies cannot be disabled as they are required for basic platform operation.

10. Your Rights as a Data Subject

Under the Data Privacy Act of 2012 and NPC regulations, you have the following rights with respect to your personal data held by ajjili:

To exercise any of these rights, please submit a written request to our Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request". ajjili will respond to all verified requests within fifteen (15) business days as required by the NPC. We may need to verify your identity before processing your request.

11. Minors and Age Policy

The ajjili platform is strictly intended for individuals who are 21 years of age or older, in compliance with PAGCOR regulations governing online gaming in the Philippines. ajjili does not knowingly collect personal data from any person below the age of 21. If we become aware that personal data has been collected from a person under 21, we will take immediate steps to delete that information and close the associated account.

If you are a parent or guardian and believe that a minor under your care has registered an account with ajjili, please contact us immediately at [email protected] so we can investigate and take appropriate action.

12. Cross-Border Data Transfers

In certain circumstances, ajjili may transfer personal data to service providers or infrastructure partners located outside the Philippines — for example, where our cloud infrastructure provider operates data centres in other countries. Any such transfers are conducted in accordance with Section 21 of the Data Privacy Act of 2012, which requires that the receiving country or organisation provide a comparable level of data protection to that guaranteed under Philippine law.

Where required, ajjili enters into data transfer agreements that incorporate standard contractual clauses approved by the NPC, or relies on other lawful transfer mechanisms. Personal data transferred internationally remains subject to the same security standards and processing restrictions described in this Policy.

13. Changes to This Privacy Policy

ajjili reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, new regulatory requirements, or enhancements to the platform. When material changes are made, we will notify registered players via their registered email address and post a prominent notice on the ajjili platform at least seven (7) days before the changes take effect.

We encourage you to review this Policy periodically to stay informed about how ajjili protects your personal data. The "Last Updated" date at the top of this document indicates when the most recent revision was made. Your continued use of the ajjili platform following the effective date of any updated Policy constitutes your acceptance of the revised terms.

14. Contact Us & Filing a Complaint

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by ajjili, please contact our Data Protection Officer:

If you are not satisfied with ajjili's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the government body responsible for enforcing the Data Privacy Act of 2012. Information on how to file a complaint with the NPC is available on the NPC's official website. ajjili fully cooperates with NPC investigations and is committed to resolving all privacy concerns in good faith.

For concerns related to responsible gaming, self-exclusion, or problem gambling support, please visit the Responsible Gaming page or reach out to our support team directly.