40jl Casino Privacy Policy

40jl Casino ("40jl," "the Platform") is an online casino and sports betting service operated for the Philippine market at 40jl.app. The operation of the 40jl Platform necessarily involves the collection, use, storage, and disclosure of personal information about the players and users who engage with our services.

40jl is committed to handling personal data responsibly, transparently, and in full compliance with the Philippine Data Privacy Act of 2012 (RA 10173) and the related issuances of the National Privacy Commission (NPC). This commitment is not merely a regulatory obligation — it is a foundational part of how 40jl operates as a Philippine-first platform.

This Privacy Policy describes in plain language: what personal data we collect and when, the lawful purpose behind each category of data collection, how that data is used within 40jl's operations, under what circumstances it may be shared with third parties, how long it is retained, and what rights you have over your own data under Philippine law.

For purposes of the Philippine Data Privacy Act of 2012, 40jl is the Personal Information Controller (PIC) with respect to the personal data collected through the 40jl.app platform. This means 40jl determines the purposes for which, and the means by which, your personal data is processed.

40jl has designated a Data Privacy Officer (DPO) responsible for overseeing compliance with RA 10173 and serving as the primary point of contact for all data privacy matters, including player rights requests, data breach notifications, and NPC inquiries. Contact details for the 40jl DPO are provided in Section 14 of this Policy.

Third-party service providers who process personal data on behalf of 40jl — including payment processors, KYC verification services, and game providers — do so as Personal Information Processors (PIPs) under written agreements that bind them to process data only as instructed by 40jl and in compliance with RA 10173.

The following table summarizes the categories of personal data that 40jl may collect, the circumstances of collection, and the primary purpose for each category.

Sensitive Personal Information. In certain circumstances, 40jl may process data that qualifies as sensitive personal information under RA 10173 — specifically, government-issued ID data collected as part of KYC verification, and health-related information disclosed voluntarily in the context of responsible gaming support requests. Such data is subject to heightened protection measures within the 40jl data management framework.

40jl processes personal data for the following purposes, each of which has a defined legal basis under RA 10173 (detailed in Section 5):

• Account Creation and Management: To create, maintain, secure, and administer your 40jl player account, including processing your login credentials, managing your wallet balance, and providing access to all platform features.
• Identity Verification (KYC): To verify your identity in compliance with PAGCOR licensing conditions and the Anti-Money Laundering Act (AMLA). KYC verification is mandatory before any withdrawal can be processed and may be required at other regulatory thresholds.
• Transaction Processing: To process deposits through GCash, PayMaya, and Philippine bank channels, and to process withdrawal requests to your nominated payment method. This requires sharing relevant financial identifiers with licensed payment service providers.
• Gaming Service Delivery: To deliver the games, sports betting markets, bingo rooms, and other entertainment services that constitute the 40jl Platform, including storing game results and transaction histories accessible to you via your account dashboard.
• Fraud and AML Prevention: To detect, investigate, and prevent fraudulent activity, money laundering, terrorist financing, multiple account registration, bonus abuse, and other prohibited conduct. This includes automated monitoring systems that flag anomalous patterns for manual review by the 40jl compliance team.
• Regulatory Compliance: To fulfill reporting obligations to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine regulatory authorities.
• Responsible Gaming: To support your use of responsible gaming tools (deposit limits, self-exclusion, cooling-off), to send reality check notifications, and to identify accounts that may exhibit patterns consistent with problem gambling for appropriate intervention measures.
• Customer Support: To handle your support inquiries, account recovery requests, payment disputes, and complaints received via live chat, email, or other contact channels.
• Platform Improvement: To analyze aggregated, anonymized usage data for the purpose of improving the 40jl platform — including user experience, site performance, game library curation, and sports betting market coverage.
• Marketing Communications: To send you information about 40jl promotions, bonuses, and new features, where you have consented to receive such communications. You may withdraw marketing consent at any time through your account settings or by contacting support.

Under the Data Privacy Act of 2012, every processing activity undertaken by 40jl is grounded in one or more of the following lawful bases:

• Contractual Necessity (Section 12(b), RA 10173): Processing is necessary for the performance of the contract between you and 40jl — i.e., providing you with online gaming services, processing your deposits and withdrawals, and maintaining your account. Without this processing, 40jl cannot deliver the services you registered for.
• Legal Obligation (Section 12(c), RA 10173): Processing is required to comply with legal obligations imposed on 40jl by Philippine law, including PAGCOR licensing conditions, AMLA reporting requirements, tax obligations, and NPC data privacy compliance requirements.
• Legitimate Interest (Section 12(f), RA 10173): Processing is necessary for 40jl's legitimate interests in operating a secure, fraud-free platform and in improving its services, provided those interests are not overridden by your fundamental rights and freedoms. This basis applies to fraud detection, platform analytics, and security monitoring.
• Consent (Section 12(a), RA 10173): Where processing is not covered by the bases above — specifically, for direct marketing communications and for certain uses of sensitive personal information — 40jl relies on your explicit consent. Consent is obtained at registration or at the specific point when the relevant processing begins. You may withdraw consent for marketing communications at any time without affecting the other legal bases.

40jl does not sell your personal data to any third party. We may share your data with the following categories of recipients strictly to the extent necessary for the purposes described in this Policy:

• Licensed Payment Service Providers: GCash (GCash is operated by G-Xchange, Inc.), PayMaya (Maya Bank, Inc.), BPI, BDO, and Metrobank — to process your deposit and withdrawal transactions. Only the financial identifiers necessary to complete each transaction are shared with the relevant provider.
• KYC and Identity Verification Services: Third-party identity verification providers engaged by 40jl to conduct document authentication and liveness checks as part of the mandatory KYC process. These providers are bound by RA 10173 compliant data processing agreements.
• Licensed Game Providers: JILI Games, PG Soft, Pragmatic Play, FA Chai, CQ9, Spade Gaming, Evolution, Ezugi, and other licensed studio providers whose games are integrated into the 40jl platform. Only the player session token and bet data necessary to run the game are shared — your full personal profile is not passed to game providers.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), the National Privacy Commission (NPC), and any other competent Philippine government authority, where disclosure is required by law, court order, or regulatory directive.
• Fraud Prevention and Compliance Tools: Specialized compliance service providers engaged to perform AML screening, politically exposed persons (PEP) checks, and sanctions screening. These providers process data solely as instructed by 40jl.
• Professional Advisers: Legal counsel, auditors, and insurers engaged by 40jl in the ordinary course of business, subject to professional confidentiality obligations.

40jl uses cookies and similar technologies (including local storage and session tokens) on the 40jl.app website and mobile application. These technologies serve the following functions:

• Strictly Necessary Cookies: Essential for the operation of the platform. These include session authentication cookies that keep you logged in during an active gaming session, security tokens that protect against CSRF attacks, and wallet state cookies. These cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your preferences such as language settings, game volume, last-played game categories, and responsible gaming tool configurations. These improve your experience across sessions without being strictly required for the platform to function.
• Analytics Cookies: Collect anonymized and aggregated data about how players navigate the 40jl platform — which pages are visited most frequently, what game categories are popular, and where usability issues arise. This data is used internally to improve the platform and does not identify individual players.
• Security Monitoring Cookies: Used by 40jl's fraud detection systems to identify anomalous session patterns, multiple account activity, and automated bot access attempts. These are part of the platform's security infrastructure and cannot be disabled.

Most web browsers and mobile operating systems allow you to manage cookie preferences through settings. Disabling strictly necessary cookies will affect your ability to use the 40jl platform. Disabling functional or analytics cookies will reduce platform personalization but will not prevent access to core gaming services.

40jl implements appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, and destruction. These measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your browser or app and the 40jl servers is encrypted using TLS 1.2 or higher with AES-256 cipher suites. The 40jl.app domain operates exclusively over HTTPS.
• Encryption at Rest: Sensitive personal data — including KYC document images, government ID numbers, and financial account details — is encrypted at rest in 40jl's database systems using industry-standard encryption.
• Access Controls: Personal data is accessible only to 40jl personnel and authorized service providers who have a legitimate need to access it for defined operational purposes. Access is governed by role-based access controls and is logged for audit purposes.
• Password Security: Player passwords are stored as salted cryptographic hashes using a secure one-way function. 40jl personnel cannot view or recover player passwords in plain text.
• Two-Factor Authentication (2FA): 40jl offers 2FA via SMS OTP to all registered players. Players are encouraged to enable 2FA in their account security settings to add an additional layer of protection to their accounts.
• Security Audits: The 40jl platform undergoes periodic security assessments conducted by qualified third-party security professionals. Identified vulnerabilities are addressed according to a documented remediation process.
• Data Breach Response: In the event of a personal data breach that poses a risk to your rights and freedoms, 40jl will notify the National Privacy Commission within 72 hours of becoming aware of the breach, as required under NPC Circular 16-03. Affected players will be notified without undue delay where the breach is likely to result in high risk to them.

40jl retains personal data for the minimum period necessary to fulfill the purpose for which it was collected, unless a longer retention period is required or permitted by Philippine law. The following retention schedule applies:

• Account Registration Data: Retained for the duration of the active account relationship plus five (5) years following account closure, in compliance with PAGCOR licensing retention requirements.
• KYC Documentation: Retained for five (5) years from the date of verification, or for the duration of the account relationship plus five (5) years following closure, whichever is longer. This is mandated by Section 9 of the Anti-Money Laundering Act (RA 9160 as amended).
• Financial Transaction Records: Retained for five (5) years from the date of each transaction, in compliance with AMLA and BIR record-keeping requirements.
• Gaming Activity Logs: Retained for three (3) years from the date of each session or transaction, for dispute resolution, regulatory reporting, and responsible gaming monitoring purposes.
• Customer Support Communications: Retained for two (2) years from the date of each interaction, for quality assurance and dispute resolution purposes.
• Marketing Consent Records: Retained for the duration of the consent period plus three (3) years, to demonstrate compliance in the event of a consent-related inquiry.

Upon expiry of the applicable retention period, 40jl will securely delete or irreversibly anonymize personal data in a manner that prevents recovery. Anonymized, aggregated data (from which no individual can be identified) may be retained indefinitely for platform analytics purposes.

To exercise any of the data rights described in this Policy (access, rectification, erasure, objection, portability, or complaint), you may contact the 40jl Data Privacy Officer as follows:

• Email: [email protected] with the subject line "Data Privacy Request — [Your Registered Mobile Number]"
• Live Chat: Available 24/7 on 40jl.app. State that you are submitting a data privacy request at the start of the conversation.

All verifiable data rights requests will be acknowledged within three (3) working days and actioned within fifteen (15) working days. Where the complexity of the request warrants additional time, 40jl will notify you of the extended timeline and the reason for the extension. 40jl may request proof of identity before processing a data rights request to protect against fraudulent requests made by third parties.

The 40jl Platform is strictly intended for persons aged twenty-one (21) years and above, in compliance with PAGCOR regulations and Philippine gambling law. 40jl does not knowingly collect or process personal data of any person under the age of 21.

All registrations on the 40jl Platform undergo age verification as part of the KYC process. Any account that is found to have been registered by a person under 21 years of age will be immediately closed, and any personal data associated with that account will be deleted as soon as practicable, subject to any legal retention obligations applicable to financial transaction records.

If you have reason to believe that a person under 21 has registered on the 40jl Platform, please contact [email protected] immediately with details so that 40jl can investigate and take appropriate action.

The 40jl Platform may reference or integrate with third-party services — including payment gateways like GCash and PayMaya — that have their own privacy policies and data handling practices. 40jl is not responsible for the privacy practices of any third-party service, and this Privacy Policy does not extend to such services.

When you initiate a GCash or bank transfer transaction through the 40jl Cashier, you are also subject to the terms and privacy policy of the relevant payment service provider. 40jl recommends that you review the privacy policies of all third-party services you interact with in connection with your 40jl account.

40jl reserves the right to update or amend this Privacy Policy at any time to reflect changes in Philippine law, NPC guidance, PAGCOR regulations, or 40jl's data processing practices. The "Effective Date" displayed at the top of this Policy will be updated when material changes are made.

Where a change materially affects how 40jl uses your personal data or your rights under this Policy, 40jl will notify you via the mobile number registered to your account before the change takes effect. Continued use of the 40jl Platform after the effective date of an updated Privacy Policy constitutes your acceptance of the revised Policy.

The current, always-authoritative version of this Privacy Policy is available at 40jl.app/privacy-policy. If you are reading a printed, cached, or forwarded version of this document, please check that page to ensure you are reviewing the current version.

For all questions, concerns, or formal requests relating to this Privacy Policy or 40jl's data processing practices, please contact:

• Role: Data Privacy Officer, 40jl Casino
• Email: [email protected]
• Subject Line: "Data Privacy — [describe your request or concern briefly]"
• Live Chat: Available 24/7 at 40jl.app — state "Data Privacy" at the start of the conversation for routing to the appropriate team
• Response Commitment: Acknowledgment within three (3) working days; substantive response within fifteen (15) working days