Table of Contents
- Introduction
- Data Controller Identity
- Personal Data We Collect
- How We Use Your Data
- Legal Bases for Processing
- Sharing with Third Parties
- Data Retention Periods
- Security Measures
- Cookies and Tracking
- Your Rights Under RA 10173
- Children and Minors
- Cross-Border Data Transfers
- Policy Updates
- Contact and Data Protection Officer
1 Introduction
355jl ("we," "our," "the Platform") is committed to protecting the privacy and personal data of every player who uses the 355jl online gaming platform. We understand that trust is the foundation of any relationship between a player and their gaming platform — and that trust starts with being transparent about what data we collect and how we use it.
This Privacy Policy has been prepared in compliance with Republic Act No. 10173, otherwise known as the Philippine Data Privacy Act of 2012, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines. 355jl processes personal data of players in the Philippines and structures its data practices to meet the standards required by the NPC.
This Policy also reflects 355jl's compliance obligations under the Anti-Money Laundering Act of 2001 (Republic Act No. 9160), as amended, which requires online gaming operators to collect and verify identity information and to report certain transactions to the Anti-Money Laundering Council (AMLC).
If you have any questions about this Privacy Policy that are not answered below, you may contact 355jl's Data Protection Officer at the address provided in Section 14.
2 Data Controller Identity
For the purposes of the Philippine Data Privacy Act of 2012, the data controller responsible for the personal data of 355jl players is:
Platform: 355jl.org
Contact: [email protected]
Data Protection Officer Contact: [email protected] (subject line: "Data Privacy – DPO Inquiry")
Jurisdiction: Republic of the Philippines
355jl has appointed a Data Protection Officer (DPO) in accordance with the requirements of the Data Privacy Act and the NPC's guidelines on DPO designation. The DPO is responsible for monitoring 355jl's compliance with the Data Privacy Act, advising on data privacy impact assessments, and acting as the primary point of contact for data subjects exercising their rights.
3 Personal Data We Collect
355jl collects personal data through several channels and at different stages of the player lifecycle. The following table provides a comprehensive breakdown of the categories of personal data collected, the source of collection, and the primary purpose for each category.
| Data Category | Specific Data Points | Collection Method |
|---|---|---|
| Identity Data | Full legal name, date of birth, government ID type and number, nationality, gender | Registration form; KYC document submission |
| Contact Data | Email address, Philippine mobile number (Globe / Smart / DITO), residential address | Registration form; account profile updates |
| Verification Data | Scanned / photographed government ID documents, selfie photograph, proof-of-address documents | KYC verification upload portal |
| Financial Data | GCash account reference, Maya account reference, bank account name and number (BPI, BDO, Metrobank, GrabPay), transaction amounts and timestamps | Payment processing at deposit / withdrawal |
| Gaming Activity Data | Game session history, bet amounts, game outcomes, bonus usage, wagering progress, session duration, session timestamps | Automatically recorded by the platform during gameplay |
| Technical Data | IP address, device type and OS, browser type and version, mobile network operator, platform access timestamps, session tokens | Automatically collected via server logs and browser / app data |
| Communication Data | Live chat transcripts, email correspondence, SMS OTP request logs, support ticket records | Customer support interactions; two-factor authentication events |
| Responsible Gaming Data | Deposit limit settings, session limit settings, self-exclusion status, cooling-off period records, responsible gaming tool activation history | Player account settings; responsible gaming tool usage |
3.1 Data We Do Not Collect
355jl does not collect the following categories of personal data, and no 355jl process or form will request them:
- Full credit or debit card numbers (355jl does not process card payments directly);
- Online banking passwords or PINs;
- GCash or Maya account PINs or one-time passwords (OTPs generated for those apps);
- Racial or ethnic origin, religious beliefs, political opinions, or health data, except where voluntarily disclosed in the context of a responsible gaming self-exclusion referral.
4 How We Use Your Personal Data
355jl processes your personal data solely for the purposes described below. We do not use personal data for any purpose incompatible with the purposes for which it was originally collected, except with your explicit consent or as permitted by Philippine law.
4.1 Account Management and Service Delivery
355jl processes identity, contact, and financial data to create and maintain your player account, verify your identity, authenticate your login sessions, process deposits and withdrawals through GCash, Maya, BPI, BDO, Metrobank, and GrabPay, and deliver the gaming services you access through the platform. This is the core operational purpose and is necessary for the performance of your agreement with 355jl.
4.2 Regulatory Compliance and KYC
355jl is required by PAGCOR guidelines and the Anti-Money Laundering Act to collect and verify player identity information, monitor transactions for suspicious activity, and report covered and suspicious transactions to the AMLC where required. Compliance with these obligations is a legal requirement that cannot be waived by player consent.
4.3 Fraud Prevention and Platform Integrity
Technical data, gaming activity data, and financial data are analyzed by 355jl's fraud and security systems to detect and prevent account takeovers, bonus abuse, collusive play, money laundering, and other prohibited conduct. This processing is necessary for the legitimate interests of 355jl and the player community in maintaining a fair and secure platform.
4.4 Responsible Gaming Monitoring
Gaming activity data and responsible gaming tool usage data are processed to identify patterns that may indicate problem gambling behavior, to enforce player-set deposit and session limits, and to implement self-exclusion decisions. This processing protects the vital interests of players and fulfills 355jl's responsible gaming obligations.
4.5 Communications and Customer Support
Contact data and communication data are used to respond to support inquiries, send transactional notifications (deposit confirmations, withdrawal updates, security alerts), and deliver OTP codes for two-factor authentication. Marketing communications are only sent where the player has provided explicit consent, and consent can be withdrawn at any time through account settings.
4.6 Platform Improvement and Analytics
Aggregated and anonymized technical data and gaming activity data are used to analyze platform performance, identify technical issues, and improve the gaming experience. Individual-level data is not used for this purpose in a way that would produce decisions affecting any individual player.
5 Legal Bases for Processing
Under the Philippine Data Privacy Act of 2012, 355jl processes personal data on the following legal bases depending on the processing activity:
Contractual Necessity
Processing required to perform the agreement between 355jl and the player — account creation, payment processing, KYC verification, game delivery.
Legal Obligation
Processing required to comply with PAGCOR regulations, the AMLA, the Data Privacy Act, and other applicable Philippine laws and NPC issuances.
Legitimate Interests
Processing for fraud prevention, platform security, abuse detection, and responsible gaming monitoring — balanced against player rights and not overridden by them.
Consent
Marketing communications, optional data collection beyond operational requirements, and any processing activity where explicit consent is the most appropriate legal basis.
6 Sharing Personal Data with Third Parties
6.1 Categories of Recipients
355jl shares personal data with third parties only to the extent necessary for the following purposes, and only with recipients who are bound by appropriate data protection obligations:
- Payment service providers — GCash (Globe Fintech Innovations), Maya (Voyager Innovations), InstaPay participant banks (BPI, BDO, Metrobank), and GrabPay receive the minimum data necessary to process each transaction (typically account reference number and transaction amount);
- KYC and identity verification service providers — Third-party identity verification platforms that process government ID images and selfie photographs to assist in completing KYC verification are bound by strict data processing agreements and may not use data for any purpose other than the specific verification task;
- Game content providers — Game developers and live dealer studios whose games are hosted on or integrated into the 355jl platform may receive aggregated or session-level gaming data for the purpose of certifying game integrity and RTP performance;
- Regulatory authorities — PAGCOR, the AMLC, the National Privacy Commission, and other Philippine government authorities as required by applicable law;
- Cloud infrastructure and security service providers — Hosting, content delivery, DDoS protection, and cybersecurity service providers whose systems the 355jl platform runs on, subject to data processing agreements.
6.2 Prohibition on Sale of Data
355jl does not sell, rent, lease, or transfer personal data to any third party for commercial, advertising, or marketing purposes. Any sharing arrangement with third parties is governed by a written data processing agreement that restricts the recipient's use of personal data to the specific, declared purpose of the arrangement.
7 Data Retention Periods
355jl retains personal data for the shortest period necessary to fulfill the purpose for which it was collected, subject to any minimum retention requirements imposed by Philippine law. The following retention schedule applies:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account identity and KYC documents | 5 years after account closure | AMLA / PAGCOR regulatory requirement |
| Financial transaction records | 5 years from transaction date | AMLA record-keeping obligation |
| Gaming activity and session logs | 2 years from session date | PAGCOR audit trail requirement |
| Customer support communications | 3 years from last interaction | Dispute resolution and audit purposes |
| Responsible gaming tool records | 5 years after account closure | Player protection and regulatory compliance |
| Marketing consent records | Until consent is withdrawn, plus 1 year | Proof of consent under Data Privacy Act |
| Technical and access logs | 12 months from creation | Security incident investigation |
Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized so that it can no longer be associated with an identified or identifiable individual. Where data is anonymized rather than deleted, it may be retained indefinitely for statistical and research purposes.
8 Security Measures
355jl implements technical and organizational security measures designed to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:
Encryption at Rest & In Transit
All personal data is encrypted using AES-256 at rest and transmitted via TLS 1.3 or higher. Database fields containing sensitive personal information are encrypted at the field level.
Access Controls
Access to personal data is restricted on a strict need-to-know basis. All internal access is logged, role-based, and subject to multi-factor authentication requirements.
Penetration Testing
355jl conducts regular third-party penetration tests and vulnerability assessments of its platform infrastructure, with findings remediated according to a defined risk priority schedule.
Breach Response
355jl maintains a documented personal data breach response plan. In the event of a breach affecting Filipino data subjects, the NPC and affected individuals will be notified within the timeframes required by the Data Privacy Act.
9 Cookies and Tracking Technologies
355jl uses cookies and similar tracking technologies on the 355jl.org website to deliver and improve the platform experience, maintain login sessions, detect fraud, and analyze platform performance. The following categories of cookies are used:
| Cookie Type | Purpose | Duration | Can Be Disabled? |
|---|---|---|---|
| Login session management, CSRF protection, load balancing, fraud signal collection | Session to 30 days | No — required for platform function | |
| Aggregated platform usage analysis — page load times, navigation patterns, device categories. No individual profiling. | Up to 12 months | Yes — via cookie preferences | |
| Remembering language preferences, UI customizations, and your last-played game category | Up to 12 months | Yes — via cookie preferences |
355jl does not use third-party advertising cookies or behavioral tracking cookies that build profiles of players for cross-site advertising purposes. Cookie preferences can be managed through your browser settings or the cookie preferences panel on the platform. Disabling essential cookies will impair platform functionality, including login.
10 Your Rights Under the Philippine Data Privacy Act (RA 10173)
As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 355jl. To exercise any of these rights, contact the 355jl Data Protection Officer as described in Section 14.
Right to Access
You have the right to obtain from 355jl confirmation of whether we hold personal data about you, and to receive a copy of that data in a commonly used electronic format.
Right to Rectification
You have the right to request correction of any inaccurate personal data we hold about you. Identity and contact information can often be updated directly through your account settings.
Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purposes it was collected, subject to our legal retention obligations under the AMLA and PAGCOR regulations.
Right to Object
You may object to processing based on legitimate interests (such as marketing analytics) at any time. Objection to processing for fraud prevention or legal compliance may not be honored where legal obligations override.
Right to Data Portability
You may request a copy of the personal data you have provided to 355jl in a structured, machine-readable format (JSON or CSV) for transfer to another service provider.
Right to Lodge a Complaint
If you believe 355jl has processed your personal data in violation of RA 10173, you may file a complaint with the National Privacy Commission of the Philippines via the NPC's official complaint process.
355jl will respond to verified data subject rights requests within fifteen (15) business days of receipt. We may ask for proof of identity before processing a rights request to ensure that data is not disclosed to or deleted at the request of an unauthorized third party.
11 Children and Minors
355jl does not knowingly collect personal data from individuals below 21 years of age. The 355jl platform is strictly restricted to adults aged 21 years and older, consistent with Philippine regulations on casino-style gambling. Age verification through KYC is a mandatory step before any account becomes active.
If 355jl discovers or is notified that a minor has provided personal data through the registration process, we will immediately suspend the account, delete the personal data submitted by the minor to the extent permitted by law, and — where required — notify PAGCOR. If you are a parent or guardian and believe a minor in your care has registered a 355jl account, please contact the 355jl Data Protection Officer immediately using the details in Section 14.
12 Cross-Border Data Transfers
355jl may transfer personal data outside the Philippines in the following limited circumstances:
- To cloud infrastructure providers whose servers are located outside the Philippines, where such providers are certified or adequately regulated under data protection standards recognized by the NPC;
- To game content providers and live dealer studios located in jurisdictions with adequate data protection frameworks where integration of their services requires data sharing;
- To KYC identity verification platforms that process document images through servers in other jurisdictions.
All cross-border transfers of personal data by 355jl are governed by contractual data transfer agreements that impose data protection standards equivalent to those required by RA 10173. 355jl does not transfer personal data to jurisdictions that do not provide an adequate level of protection unless appropriate safeguards are in place.
13 Changes to This Privacy Policy
355jl reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, NPC guidelines, or PAGCOR regulations. When material changes are made, 355jl will:
- Update the "Effective Date" at the top of this Privacy Policy;
- Send a notification to all registered players via their registered email address summarizing the material changes at least 14 days before the changes take effect;
- Display a notice on the 355jl platform for a period of not less than 14 days following the effective date of the change.
Your continued use of the 355jl platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated Policy. If you do not agree with any material changes, you may close your 355jl account before the effective date and request deletion of your data subject to applicable retention obligations.
Archived versions of previous Privacy Policies are available upon request to the 355jl Data Protection Officer.
14 Contact and Data Protection Officer
For any questions, concerns, or requests relating to this Privacy Policy or your personal data held by 355jl — including the exercise of your rights under the Philippine Data Privacy Act — please contact us through the following channels:
Email (plain text — not a link): [email protected]
Use subject line: "Data Privacy – [Your Request Type]" — e.g., "Data Privacy – Access Request" or "Data Privacy – DPO Inquiry"
For non-sensitive privacy queries, the 355jl live chat team is available around the clock. For formal data subject rights requests or sensitive privacy matters, email correspondence to the DPO is the preferred channel.
This Privacy Policy is effective as of January 2026 and supersedes all prior versions. The most current version is always published at 355jl.org/privacy-policy.