Contents
1 Introduction & Controller 2 Definitions 3 Data We Collect 4 How We Collect Data 5 Legal Bases for Processing 6 How We Use Your Data 7 Sharing & Disclosure 8 Cookies & Tracking 9 Data Security 10 Data Retention 11 Your Rights 12 Children & Minors 13 Cross-Border Transfers 14 Third-Party Links 15 Changes to This Policy 16 Contact & DPO1.1 This Privacy Policy applies to all personal information processed by 10jill in connection with the operation of the online gaming platform accessible at https://10jill.app (the "Platform"), including its mobile web interface, customer support channels, promotional communications, and payment processing systems.
1.2 For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, 10jill is the Personal Information Controller in respect of the personal data of its registered players and platform visitors. A designated Data Protection Officer (DPO) has been appointed and may be contacted as described in Section 16 of this Policy.
1.3 10jill operates under PAGCOR regulatory oversight. The processing of certain personal data — particularly that related to player identity, source of funds, and transaction records — is required to fulfill 10jill's obligations as a PAGCOR-regulated gaming operator and under Republic Act No. 9160 (Anti-Money Laundering Act of 2001) and its amendments.
1.4 By registering a 10jill account, using any feature of the Platform, or submitting any information to 10jill, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal, subject to 10jill's regulatory retention obligations.
10jill collects personal data in the following categories in connection with account registration, platform use, financial transactions, and regulatory compliance:
| Category | Examples | Purpose |
|---|---|---|
| Registration Data | Full name, date of birth, Philippine mobile number, chosen username, password (hashed) | Account creation, authentication, age verification |
| Identity / KYC Documents | Government-issued ID type and number (PhilSys, passport, driver's license, SSS, GSIS, PRC, Voter's ID), photo of ID, selfie with ID | PAGCOR KYC compliance, AMLC obligations, withdrawal verification |
| Financial Data | GCash account reference, Maya account reference, bank name and account type, deposit and withdrawal transaction records, balance history | Payment processing, withdrawal verification, financial audit trail |
| Gaming Activity Data | Game session logs, wagering history, win/loss records, bonus activation history, game preferences | Platform operation, responsible gaming monitoring, dispute resolution, PAGCOR reporting |
| Technical & Device Data | IP address, device type and model, operating system, browser type, session timestamps, geolocation (country/region level) | Fraud detection, security monitoring, regulatory compliance, platform optimization |
| Communications Data | Customer support ticket content, live chat transcripts, email correspondence, feedback submissions | Customer service delivery, quality assurance, dispute resolution records |
| Marketing Preferences | Communication opt-in/opt-out status, preferred contact channel, promotional response data | Consent-based marketing communications management |
| Cookie & Analytics Data | Browsing behavior on the Platform, pages visited, click paths, session duration, A/B test group assignment | Platform performance, user experience improvement (see Section 8) |
3.1 Mandatory vs. Optional Data. Registration Data, KYC Documents (required prior to first withdrawal), and Financial Data are mandatory for the operation of your 10jill account and cannot be declined without affecting your ability to use the Platform. Marketing Preferences and certain analytics data are optional and governed by consent.
4.1 Directly From You
The majority of personal data 10jill holds is provided directly by you during account registration, KYC submission, deposit and withdrawal requests, customer support interactions, and promotional opt-ins. You are in control of what information you submit, subject to the mandatory requirements described in Section 3.
4.2 Automatically During Platform Use
When you access the 10jill Platform, certain technical data is collected automatically by our servers and analytics systems. This includes your IP address, device identifiers, browser type, session timestamps, pages viewed, and navigation patterns within the Platform. This data is collected through server logs, cookies, and similar tracking technologies described in Section 8.
4.3 From Payment Processors
When you make a deposit or request a withdrawal, your payment provider (GCash, Maya, BPI, BDO, Metrobank, or other approved channels) transmits transaction confirmation data to 10jill. 10jill does not receive or store full payment credentials such as GCash PINs, online banking passwords, or full bank account numbers — only the transaction reference, amount, and account identifier necessary to credit or debit your 10jill account.
4.4 From Regulatory Sources
10jill may receive information about Players from PAGCOR or other regulatory authorities in connection with licensing compliance, self-exclusion registries, or enforcement actions. Such data will be processed solely for the regulatory purpose for which it was provided.
4.5 From Third-Party Game Providers
Game providers who supply content to 10jill — such as live dealer studio operators and RNG game software providers — may transmit game session data to 10jill in connection with game result verification, dispute resolution, and regulatory audit obligations. These providers operate as Personal Information Processors under data processing agreements with 10jill.
Under the Data Privacy Act of 2012 and its Implementing Rules, 10jill processes personal data on the following legal bases:
- Fulfillment of Contract: Processing necessary to perform the contractual obligations between 10jill and the Player under the Terms and Conditions — including account management, payment processing, game access, and customer support.
- Legal Obligation: Processing required to comply with applicable Philippine law, including PAGCOR licensing requirements, RA 9160 (Anti-Money Laundering Act), RA 10173 (Data Privacy Act), and any regulatory directives issued by PAGCOR, the Bangko Sentral ng Pilipinas (BSP), or the Anti-Money Laundering Council (AMLC).
- Legitimate Interests: Processing necessary for 10jill's legitimate interests in fraud prevention, platform security, and the prevention of money laundering, where those interests are not overridden by the Player's data protection rights.
- Consent: Processing for marketing communications, certain analytics, and non-essential cookies, where 10jill has obtained your explicit, informed, and freely given consent. You may withdraw consent at any time by contacting [email protected] or updating your account communication preferences.
10jill uses the personal data it collects for the following purposes, each of which corresponds to a legal basis identified in Section 5:
- Account Creation and Authentication: To create your 10jill account, verify your identity at login, deliver OTP codes to your registered mobile number, and maintain account security.
- Age and Identity Verification: To confirm that you are 21 years of age or older as required by PAGCOR, and to verify your identity for KYC compliance before processing withdrawals or as required by our regulatory obligations.
- Payment Processing: To process your deposits and withdrawal requests via your chosen Philippine payment method, reconcile your account balance, and maintain a full financial transaction audit trail.
- Regulatory Compliance and Reporting: To fulfill 10jill's reporting obligations to PAGCOR, submit mandatory reports to the AMLC under the Anti-Money Laundering Act, and maintain records required for regulatory audit and inspection.
- Platform Operation and Customer Support: To deliver game services, resolve technical issues, respond to your customer support inquiries, and maintain the operational integrity of the Platform.
- Fraud Detection and Security: To detect, investigate, and prevent account fraud, payment fraud, money laundering, bonus abuse, collusion, unauthorized access, and other activities that violate 10jill's Terms and Conditions or applicable law.
- Responsible Gaming: To monitor gaming patterns for indicators of problem gambling, deliver responsible gaming tools and interventions, process self-exclusion requests, and maintain records of player-set deposit and session limits.
- Platform Improvement: To analyze aggregated usage patterns, test platform features, and improve the user experience — using anonymized or pseudonymized data wherever possible.
- Marketing Communications (Consent Only): To send you promotional offers, bonus notifications, game announcements, and platform updates via your preferred contact channel, where you have consented to receive such communications.
7.1 10jill does not sell, rent, trade, or otherwise disclose your personal data to unrelated third parties for commercial purposes. Disclosure is limited to the categories described below, each of which is governed by a legal basis identified in Section 5.
7.2 Service Providers (Personal Information Processors)
10jill engages third-party service providers who process personal data on 10jill's instructions to deliver specific platform functions. These include payment gateway operators (GCash, Maya, bank transfer facilitators), game content providers (live dealer studio operators, RNG software providers), KYC and identity verification technology providers, cloud hosting and data storage providers, customer support platform providers, and analytics and fraud detection system operators. Each service provider is engaged under a written data processing agreement that restricts their use of personal data to the specific purpose for which it was shared and requires equivalent data protection standards.
7.3 Regulatory Authorities
10jill is required by law to disclose player data to PAGCOR, the AMLC, the National Privacy Commission (NPC), and other competent Philippine government authorities upon lawful demand. Such disclosures are made pursuant to 10jill's legal obligations under PAGCOR licensing conditions, RA 9160, RA 10173, and related legislation. 10jill will notify Players of such disclosures where legally permissible and not prohibited by a court order, regulatory directive, or law enforcement instruction.
7.4 Legal Proceedings
10jill may disclose personal data in connection with legal proceedings, enforcement of its Terms and Conditions, protection of 10jill's legal rights, or investigation of suspected fraud or criminal activity, where such disclosure is authorized or required by applicable Philippine law.
7.5 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of all or a substantial part of 10jill's business assets, personal data held by 10jill may be transferred to the successor entity as part of that transaction. 10jill will notify affected Players of any such transfer and ensure that the successor entity is bound by obligations equivalent to those in this Privacy Policy.
8.1 10jill uses cookies and similar tracking technologies (collectively, "cookies") on the Platform to deliver essential functionality, improve performance, and — with your consent — support analytics and marketing features. The following categories of cookies are used:
8.2 Cookies set by strictly necessary and security purposes do not require your consent. Analytics and functional cookies that go beyond core Platform delivery are only activated following your consent, which you may withdraw at any time by clearing your browser cookies or adjusting your browser's cookie settings. Withdrawing consent for non-essential cookies will not affect your ability to play games, deposit, or withdraw on 10jill.
9.1 10jill implements organizational, technical, and physical security measures appropriate to the nature of the personal data processed and the risks of unauthorized access, disclosure, alteration, or destruction. These measures include:
- 256-bit SSL/TLS encryption for all data transmitted between your device and 10jill's servers;
- Encryption of sensitive data fields (including ID document images and payment references) at rest in 10jill's databases;
- Password hashing using industry-standard algorithms — 10jill does not store plaintext passwords;
- Role-based access controls limiting staff access to personal data to those with a demonstrated operational need;
- Multi-factor authentication for administrative access to systems containing personal data;
- Regular security assessments and penetration testing of Platform infrastructure;
- Data breach detection and incident response procedures compliant with NPC notification requirements under RA 10173.
9.2 While 10jill applies robust security measures, no online platform can guarantee absolute security. You are responsible for maintaining the security of your own account credentials, as described in Section 5 of the 10jill Terms and Conditions. You should immediately report any suspected unauthorized access to your account to [email protected].
9.3 Data Breach Notification. In the event of a personal data breach likely to result in risk to your rights and freedoms, 10jill will notify you and the National Privacy Commission within the timeframe required by RA 10173 and the NPC's Circular on Personal Data Breach Management. Notification will be provided via your registered contact information and through a Platform notice.
10.1 10jill retains personal data only for as long as is necessary to fulfill the purpose for which it was collected, to comply with applicable legal and regulatory retention obligations, or to protect 10jill's legitimate interests in the event of disputes. The following retention periods apply as a general guide:
| Data Type | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | PAGCOR licensing, AMLC RA 9160 |
| KYC identity documents | Duration of account + 5 years post-closure | RA 9160 mandatory retention |
| Financial transaction records | 5 years from transaction date | RA 9160, PAGCOR reporting obligations |
| Gaming activity logs | 3 years from session date | Dispute resolution, PAGCOR audit requirements |
| Customer support communications | 3 years from interaction date | Dispute resolution, quality assurance |
| Self-exclusion records | Indefinitely (regulatory requirement) | PAGCOR responsible gaming compliance |
| Marketing preference records | Until withdrawal of consent + 1 year | Evidence of consent under RA 10173 |
| Analytics / cookie data | Up to 13 months from collection | Platform improvement purposes |
10.2 Upon expiry of the applicable retention period, 10jill will securely destroy, delete, or anonymize personal data in a manner that prevents reconstruction or re-identification. Secure destruction methods include cryptographic erasure for digitally stored data and verified deletion from backup systems within the subsequent backup rotation cycle.
As a data subject under Republic Act No. 10173, you have the following rights with respect to your personal data held by 10jill. These rights are subject to applicable exemptions and 10jill's legal retention obligations:
Right to Access
Request a copy of the personal data 10jill holds about you, along with information about how it is processed and disclosed.
Right to Rectification
Request correction of inaccurate, incomplete, or outdated personal data in your 10jill account, subject to identity verification.
Right to Erasure
Request deletion of personal data that is no longer necessary, unlawfully processed, or for which consent has been withdrawn — subject to legal retention requirements.
Right to Object
Object to processing based on legitimate interests or for direct marketing purposes. 10jill will cease such processing unless compelling grounds exist that override your interests.
Right to Data Portability
Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible.
Right to Complain
Lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe 10jill has violated your rights under RA 10173.
11.1 Exercising Your Rights. To exercise any of the above rights, submit a written request to 10jill's Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request." Include your full name, registered mobile number, and a clear description of the right you wish to exercise and the data concerned. 10jill will verify your identity before processing your request and will respond within the timeframe required by the NPC's implementing rules — generally within 30 calendar days, subject to complexity and volume.
11.2 Some rights are subject to limitations. For example, the right to erasure cannot override 10jill's obligations to retain data for the periods specified in Section 10 under PAGCOR and AMLC requirements. Where 10jill is unable to fully comply with a request, we will explain the reason for the limitation.
12.1 The 10jill Platform is strictly restricted to persons who are 21 years of age or older under PAGCOR regulations governing online gaming in the Philippines. 10jill does not knowingly collect, process, or retain personal information of individuals under 21 years of age.
12.2 Age verification measures — including date-of-birth collection at registration and government ID verification at first withdrawal — are implemented specifically to prevent access by minors. Any account found to have been created by or on behalf of a person under 21 will be immediately closed, all data deleted except where retention is required for regulatory reporting of the violation, and the matter referred to PAGCOR as required by our licensing obligations.
12.3 If you are a parent or guardian and believe that a minor in your care has registered a 10jill account, contact [email protected] immediately. 10jill will investigate and take appropriate action, including account closure and deletion of personal data where legally permissible.
13.1 Some of 10jill's service providers — including cloud infrastructure providers, game content providers, and certain analytics and fraud detection technology vendors — may process personal data on servers located outside the Republic of the Philippines. Any such cross-border transfer is conducted in compliance with Section 21 of RA 10173, which requires that personal data transferred to foreign countries be protected by standards at least equivalent to those imposed by the DPA.
13.2 Cross-border transfers are conducted only where: (a) the foreign country is recognized by the NPC as providing adequate levels of data protection; or (b) contractual safeguards equivalent to those required under RA 10173 are in place between 10jill and the foreign recipient; or (c) another lawful basis for transfer applies under the DPA's Implementing Rules.
13.3 Regardless of where personal data is processed, 10jill remains responsible as the Personal Information Controller and retains liability for ensuring that your data is handled in accordance with this Privacy Policy and applicable Philippine data protection law.
14.1 The 10jill Platform does not include links to third-party websites or external services beyond those integral to Platform operation (such as embedded payment gateway interfaces and live dealer game streams). Where any third-party interface appears within the Platform, it is provided by a contracted service provider under a data processing agreement with 10jill as described in Section 7.2.
14.2 10jill is not responsible for the privacy practices of any third-party website or service that you access independently outside the Platform. If you navigate to any third-party site from outside the 10jill Platform, you are subject to the privacy policy of that third party, and 10jill assumes no responsibility for their data handling practices.
15.1 10jill reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or Platform features. The updated Policy will be published at https://10jill.app/privacy-policy with a revised Effective Date.
15.2 Where a change materially affects your rights or how we use your personal data, 10jill will provide advance notice via a Platform notification or by message to your registered contact information at least seven (7) calendar days before the change takes effect. Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Privacy Policy.
15.3 If any amendment requires fresh consent (for example, a new processing purpose that was not covered by your original consent), 10jill will request your consent through an appropriate mechanism before commencing the new processing activity. You may decline such consent without affecting your ability to continue using the Platform for its existing purposes.
For questions about this Privacy Policy, to exercise your data subject rights, to report a privacy concern, or to contact 10jill's designated Data Protection Officer, use the following channels:
Response timeframe: Within 5 business days for general inquiries; within 30 calendar days for formal data subject rights requests as required by RA 10173.
Hours: Monday – Sunday, 9:00 AM – 12:00 MN Philippine Standard Time (PHT / UTC+8)
Related 10jill policies referenced in this Privacy Policy: