cljili Casino – Privacy Policy

1 Introduction & Scope

This Privacy Policy ("Policy") describes how cljili Casino, operating the website at cljili.cam (the "Platform"), collects, processes, stores, and protects the personal data of individuals who visit or use our services. It applies to all users, including registered account holders, prospective players, and visitors who access the Platform without registering.

This Policy is issued in compliance with Republic Act No. 10173, known as the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), and relevant issuances of the National Privacy Commission of the Philippines ("NPC"). By accessing or using the cljili Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read together with the cljili Terms & Conditions, available at /terms-conditions, which are incorporated herein by reference. In the event of any inconsistency between this Policy and the Terms & Conditions with respect to data privacy matters, this Policy shall prevail.

2 Data Controller

cljili Casino is the personal information controller ("PIC") in respect of the personal data processed under this Policy. As PIC, cljili determines the purposes and means of processing your personal information and is responsible for ensuring that such processing complies with applicable data privacy laws.

Where cljili engages third-party service providers to process personal data on its behalf — such as payment processors, game software providers, or fraud prevention services — those parties act as personal information processors ("PIPs") and are bound by data processing agreements that impose obligations consistent with the DPA and this Policy.

3 Personal Data We Collect

cljili collects the following categories of personal data, limited strictly to what is necessary for the purposes set out in Section 5:

3.1 Identity & Contact Data

• Full legal name as it appears on your government-issued identification;
• Date of birth and nationality;
• Registered email address;
• Philippine mobile number;
• Residential address (province, city/municipality);
• Government-issued ID type and number (e.g., UMID, PhilHealth, SSS, Passport, or Driver's License).

3.2 Financial Data

• GCash or PayMaya registered mobile number and account name;
• Bank account details (account name and account number) where bank transfer is used;
• Transaction history including deposit amounts, withdrawal requests, and timestamps;
• Source of funds declarations where required by AML compliance procedures.

3.3 Technical & Usage Data

• IP address and approximate geographic location derived therefrom;
• Device type, operating system, and browser version;
• Session timestamps, login history, and session duration;
• Game play logs, bet amounts, game outcomes, and wagering history;
• Cookie identifiers and similar tracking technology data (see Section 9).

3.4 Communications Data

• Content of live chat conversations with cljili support agents;
• Email correspondence with our support or compliance teams;
• Feedback, complaint, and dispute records.

4 How We Collect Your Data

cljili collects personal data through the following mechanisms:

Data obtained from third-party sources is used solely for identity verification, fraud prevention, and AML compliance purposes. cljili does not purchase personal data lists from marketing data brokers.

5 Purposes of Processing

cljili processes your personal data for the following defined purposes:

• Account creation and management — to establish, maintain, and administer your cljili account;
• Identity and age verification (KYC) — to confirm that you meet the 21+ age requirement and to verify your identity in compliance with applicable regulations;
• Payment processing — to facilitate GCash, PayMaya, and bank transfer deposits and withdrawals securely;
• Anti-money laundering (AML) compliance — to monitor transactions, detect suspicious activity, and meet statutory reporting obligations;
• Fraud prevention and platform security — to detect, investigate, and prevent fraudulent activity, collusion, bonus abuse, and other prohibited conduct;
• Gameplay and customer service — to operate games, resolve disputes, process complaints, and provide technical and account support;
• Responsible gaming — to identify patterns of play that may indicate problem gambling and to apply responsible gaming measures where appropriate;
• Marketing and promotions — to send you promotional communications about cljili offers (only where you have consented or where we have a legitimate interest to do so, with a clear opt-out mechanism in every communication);
• Legal and regulatory compliance — to comply with applicable Philippine laws, court orders, regulatory directives, and law enforcement requests;
• Platform improvement — to analyse usage data in aggregate and pseudonymised form to improve the cljili platform experience.

6 Legal Bases for Processing

Under the DPA, cljili relies on the following legal bases for processing your personal data:

• Contractual necessity — processing required to perform our obligations under the Terms & Conditions you accepted upon registration, including account management, payment processing, and gameplay services;
• Legal obligation — processing necessary to comply with applicable laws, including AML regulations, KYC requirements, and any regulatory directives issued by Philippine authorities;
• Legitimate interests — processing for fraud prevention, platform security, and aggregate platform analytics, where these interests are not overridden by your fundamental rights and freedoms;
• Consent — processing for marketing communications and, where applicable, for responsible gaming assessments involving sensitive data indicators. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7 Sharing Your Personal Data

cljili does not sell your personal data. We share personal data only with the following categories of recipients, and only to the extent strictly necessary for the stated purpose:

• Payment service providers (e.g., GCash, PayMaya, BPI, BDO, Metrobank, UnionBank) — to process your deposits and withdrawals securely;
• Identity verification and KYC providers — to conduct electronic identity and document verification as part of our KYC obligations;
• Fraud screening and AML services — to screen transactions and account activity against relevant databases;
• Game software providers and platform operators — to deliver gameplay services, with access limited to technical data required for game operation;
• IT and cloud infrastructure providers — hosting, storage, and security services operating under data processing agreements;
• Philippine regulatory authorities and law enforcement — where cljili is legally required to disclose information pursuant to a valid legal order, warrant, or regulatory directive;
• Professional advisers — lawyers, auditors, and insurers, under obligations of confidentiality.

All third-party processors engaged by cljili are required to implement appropriate technical and organisational security measures and are prohibited from using your personal data for any purpose other than that for which it was disclosed.

8 International Data Transfers

Some of the third-party service providers engaged by cljili — including game software providers and cloud infrastructure partners — may operate servers located outside the Republic of the Philippines. Where personal data is transferred internationally, cljili ensures that such transfers are subject to appropriate safeguards consistent with the DPA, including:

• Contractual clauses binding the recipient to data protection standards equivalent to or greater than those required by RA 10173;
• Transfers to jurisdictions recognised by the NPC as providing adequate data protection;
• Binding corporate rules where the recipient is part of a corporate group with an approved BCR programme.

You may request details of the specific safeguards applicable to any international transfer of your personal data by contacting our Data Protection Officer (see Section 16).

9 Cookies & Tracking Technologies

cljili uses cookies and similar tracking technologies on the Platform for the following purposes:

9.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function and cannot be disabled. They maintain your logged-in session state, apply security protections, and remember your language preferences. No consent is required for strictly necessary cookies under applicable law.

9.2 Performance & Analytics Cookies

These cookies collect anonymised or pseudonymised data about how players interact with the cljili Platform — which pages are visited, how long sessions last, and where errors occur. This data is used in aggregate to improve the Platform. These cookies are set only with your consent.

9.3 Functional Cookies

Functional cookies remember your preferences (such as preferred deposit method or display settings) to personalise your experience on return visits. These are set with your consent and can be disabled, though doing so may affect the Platform's functionality.

You can manage your cookie preferences through your browser settings at any time. Disabling cookies entirely may prevent certain features of the cljili Platform from operating correctly.

10 Data Retention

cljili retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to applicable legal minimum retention requirements. The following indicative retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that renders re-identification impossible. Where data is anonymised rather than deleted, the resulting anonymised dataset is no longer treated as personal data and may be retained indefinitely for analytical purposes.

11 Security Measures

cljili implements the following technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction:

• Encryption in transit: All data transmitted between your device and cljili servers is encrypted using TLS 1.2 or higher (256-bit SSL);
• Encryption at rest: Sensitive personal data and financial records stored on cljili infrastructure are encrypted using AES-256 or equivalent standards;
• Access controls: Internal access to personal data is governed by role-based access controls on the principle of least privilege. Only personnel with a documented operational need may access personal data;
• Two-factor authentication (2FA): Available to all Players and mandatory for internal administrative access to production systems;
• Segregated player funds: Player account balances are held in accounts segregated from cljili operating funds;
• Security monitoring: The Platform is monitored 24/7 for anomalous access patterns and security incidents;
• Staff training: All personnel with access to personal data complete data privacy and security training consistent with DPA requirements;
• Third-party audits: Security controls are periodically reviewed by independent third-party assessors.

In the event of a personal data breach that is likely to result in a real risk of serious harm to affected individuals, cljili will notify the NPC and affected data subjects within 72 hours of becoming aware of the breach, in accordance with the DPA Breach Notification requirements.

12 Your Data Subject Rights

Under the Philippine Data Privacy Act (RA 10173), you hold the following rights with respect to your personal data processed by cljili:

• Right to be informed — the right to be notified of how your personal data is being processed, as set out in this Policy;
• Right of access — the right to request a copy of the personal data that cljili holds about you;
• Right to rectification — the right to request correction of inaccurate or incomplete personal data;
• Right to erasure ("right to be forgotten") — the right to request deletion of your personal data, subject to our legal retention obligations;
• Right to object — the right to object to certain processing activities, including direct marketing communications;
• Right to data portability — the right to receive a copy of your personal data in a structured, commonly used, machine-readable format;
• Right to lodge a complaint — the right to file a complaint with the National Privacy Commission if you believe your data privacy rights have been violated.

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 16. cljili will respond to data subject rights requests within thirty (30) calendar days of receipt. Where a request is complex or requires extended processing, we will notify you within 30 days and provide a revised timeline not exceeding a further 60 days.

Please note that certain rights are subject to limitations. For example, the right to erasure does not apply where retention is required by law (such as AML record-keeping requirements). Where we are unable to fulfil a request in full, we will provide a written explanation of the reason.

13 Children & Minors

The cljili Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. If we become aware that personal data has been collected from an individual under 21 years of age, we will immediately suspend the relevant account, delete the associated personal data, and take appropriate action in accordance with our Terms & Conditions.

Parents and guardians who believe that a minor may have accessed the cljili Platform or submitted personal data are encouraged to contact our Data Protection Officer immediately at the contact details in Section 16.

14 Responsible Gaming & Data Processing

cljili uses gameplay and transaction data to support its responsible gaming programme. Specifically, we may analyse wagering frequency, session duration, deposit patterns, and loss trajectory data to identify accounts that may exhibit indicators of problem gambling behaviour. Where such indicators are identified, cljili may:

• Display in-platform responsible gaming messages or prompts;
• Proactively contact the Player via email or live chat to offer support resources;
• Apply account-level deposit or loss limits in accordance with our Responsible Gaming Policy;
• Refer the Player to external support resources, including the NCMH crisis hotline at 0917-899-8727.

This processing is carried out under our legitimate interests in protecting player welfare and in fulfilment of our responsible gaming obligations. The responsible gaming data processing described in this section does not involve sharing your personal data with any third party other than the support service providers named above, and is subject to all the security measures described in Section 11.

For a full description of our responsible gaming tools and your options for self-exclusion or account restriction, please visit our Responsible Gaming page.

15 Amendments to This Policy

cljili reserves the right to amend this Privacy Policy at any time. Material changes — those that affect your rights as a data subject, the categories of data we collect, or the purposes for which we process your data — will be communicated to you via the email address registered to your account at least fourteen (14) calendar days before the amended Policy takes effect.

Non-material updates (such as typographical corrections, clarifications that do not change the substance of the Policy, or changes required by regulatory guidance with immediate effect) will be reflected by updating the "Last Updated" date at the top of this page without separate notification.

Your continued use of the cljili Platform after the effective date of any amended Privacy Policy constitutes your acknowledgment of the updated terms. If you do not agree with the amended Policy, you are entitled to exercise your rights under Section 12, including requesting account closure.

16 Contact & Data Protection Officer

cljili Casino has designated a Data Protection Officer ("DPO") in accordance with the requirements of the Philippine Data Privacy Act. If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or wish to raise a data privacy concern, please contact our DPO through the following channels:

• Email: [email protected] (please include "Data Privacy" or "DPO Request" in the subject line)
• Live Chat: Available 24/7 on every page of the cljili Platform
• Response Time: We aim to acknowledge all DPO inquiries within 3 business days and to provide a substantive response within 30 calendar days

If you are not satisfied with our response, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. The NPC can be reached through its official website and contact channels. cljili cooperates fully with NPC investigations and is committed to resolving all data privacy complaints in good faith.