906jl Privacy Policy

906jl ("we," "us," "our," or "the Platform") is committed to protecting the privacy and personal data of every player who registers for and uses the 906jl online gaming platform. This Privacy Policy describes in detail how we collect, process, store, share, and safeguard personal data in connection with your use of 906jl's services, accessible via the 906jl website.

This Privacy Policy is issued in compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR), as administered by the National Privacy Commission (NPC) of the Philippines. By registering for a 906jl account or by continuing to use the 906jl platform, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy.

This Privacy Policy should be read together with the 906jl Terms & Conditions, which govern the overall use of the platform. In the event of any conflict between this Privacy Policy and the Terms & Conditions with respect to data privacy matters, this Privacy Policy shall prevail.

For the purposes of the Data Privacy Act of 2012 and this Privacy Policy, the data controller responsible for the personal data of 906jl players is the 906jl Platform Operator ("906jl"). As the data controller, 906jl determines the purposes and means by which personal data collected through the platform is processed.

906jl has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with RA 10173 and this Privacy Policy. Players may contact the DPO regarding data privacy concerns through the contact details provided in Section 14 of this Privacy Policy.

Third-party service providers engaged by 906jl — including KYC verification providers, payment processors, and game providers — act as data processors under data processing agreements that bind them to handle personal data only in accordance with 906jl's documented instructions and applicable Philippine data privacy law.

906jl collects personal data in the following categories, depending on the nature of your interaction with the platform:

3.1 Identity & Registration Data

Collected at the time of account registration and KYC verification:

• Full legal name as it appears on a valid Philippine government-issued ID;
• Date of birth and age;
• Nationality and country of residence;
• Government-issued ID type, ID number, and a copy of the ID document;
• Selfie photograph taken alongside the ID document for identity verification purposes;
• Account username and encrypted password.

3.2 Contact Data

• Philippine mobile phone number;
• Email address;
• Residential address in the Philippines.

3.3 Financial & Transaction Data

• GCash or Maya account reference (mobile number associated with e-wallet);
• Bank account details where bank transfers are used (BPI, BDO, UnionBank);
• Transaction history: deposit amounts, dates, payment methods, and reference numbers;
• Withdrawal history: amounts, dates, destination accounts, and processing status;
• Bet history, game play records, and bonus transaction records.

3.4 Technical & Usage Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser type and version;
• Pages visited on the 906jl platform, session duration, and navigation patterns;
• Login timestamps and session activity logs;
• Cookies and similar tracking technologies (see Section 8).

3.5 Communications Data

• Records of live chat conversations with 906jl support agents;
• Email correspondence with 906jl customer support;
• Feedback, complaints, and dispute records.

906jl processes your personal data for the following purposes, each supported by a lawful basis under the Data Privacy Act of 2012:

906jl does not process personal data for any purpose other than those described in this Privacy Policy or as otherwise notified to you. Where we rely on consent as the legal basis for processing, you have the right to withdraw that consent at any time by contacting support or adjusting your account communication preferences.

906jl does not sell, rent, or trade your personal data to third parties for marketing or commercial purposes. Personal data is shared with third parties only in the following circumstances:

5.1 Service Providers (Data Processors)

906jl engages third-party service providers who process personal data strictly on 906jl's behalf, under written data processing agreements that prohibit any independent use of your data:

• KYC Verification Providers: Identity document verification services that validate government-issued IDs submitted during the 906jl registration process;
• Payment Processors: GCash (Mynt), Maya (Voyager Innovations), BPI, BDO, UnionBank, and other payment infrastructure partners necessary to process deposits and withdrawals in PHP;
• Game Providers: Casino game studios (e.g., Evolution Gaming, SA Gaming, Pragmatic Play Live) that receive a player authentication token — not full personal data — to enable game sessions;
• Cloud Infrastructure Providers: Hosting and data storage providers operating data centres relevant to 906jl's platform infrastructure.

5.2 Regulatory & Legal Disclosure

906jl may disclose personal data to the following authorities where required or permitted by Philippine law:

• PAGCOR (Philippine Amusement and Gaming Corporation) for licensing compliance and regulatory reporting;
• AMLC (Anti-Money Laundering Council) as required under RA 9160 (Anti-Money Laundering Act) and its amendments;
• National Privacy Commission (NPC) in connection with data privacy investigations or complaints;
• Philippine courts, law enforcement agencies, or other competent government authorities in response to valid legal process (court orders, subpoenas, search warrants).

906jl retains personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable Philippine law. The following general retention periods apply:

• Account and identity data (KYC documents): Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, consistent with PAGCOR and AML regulatory requirements;
• Transaction records (deposits, withdrawals, bet history): Retained for a minimum of five (5) years in accordance with Philippine AML reporting obligations;
• Support and communications records: Retained for three (3) years from the date of the last interaction, or longer if required in connection with an unresolved dispute;
• Technical and usage logs: Retained for twelve (12) months and then anonymised or deleted;
• Marketing consent records: Retained for the duration of the consent period and for two (2) years following withdrawal of consent, for compliance audit purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data. Anonymised or aggregated data that cannot be linked back to any individual may be retained indefinitely for analytical purposes.

906jl implements a multi-layered approach to data security, designed to protect personal data against unauthorised access, disclosure, alteration, or destruction:

• Encryption in Transit: All data transmitted between your device and the 906jl platform is protected using TLS 1.2 or higher (HTTPS). Outdated and insecure protocol versions (SSL 3.0, TLS 1.0) are disabled;
• Encryption at Rest: Sensitive personal data — including ID document files, government ID numbers, and payment reference data — is stored using AES-256 encryption;
• Access Controls: Access to production databases containing personal data is restricted to authorised 906jl personnel and operates on a principle of least privilege. All access is logged and subject to periodic review;
• Two-Factor Authentication (2FA): Internal 906jl systems that handle personal data require 2FA for all staff access. Players are also encouraged to enable 2FA on their own 906jl accounts;
• Vulnerability Management: 906jl conducts regular security assessments, including penetration testing, to identify and remediate security vulnerabilities before they can be exploited;
• Incident Response: 906jl maintains a documented data breach incident response plan, including procedures for containment, assessment, notification to the NPC, and communication to affected players where required by law.

The 906jl platform uses cookies and similar tracking technologies to enable core functionality, maintain session state, and gather aggregate usage analytics. A "cookie" is a small text file placed on your device by the 906jl web server when you visit the platform.

8.1 Types of Cookies Used by 906jl

906jl does not use third-party advertising or tracking cookies. No cookie data from the 906jl platform is shared with advertising networks, social media platforms, or external marketing service providers.

You may manage or delete cookies through your browser settings at any time. Please note that deleting essential cookies will require you to log in again and may affect the functionality of the 906jl platform during your session.

The 906jl platform is strictly intended for individuals who are 21 years of age or older, consistent with PAGCOR's minimum age requirement for casino-style gaming in the Philippines. 906jl does not knowingly collect personal data from individuals under the age of 21.

As part of the KYC verification process, 906jl verifies the age of every account holder before permitting real-money gaming activity. Any person who provides false information about their age for the purpose of circumventing 906jl's age verification controls will have their account immediately closed and all balances forfeited. This may also be reported to the relevant Philippine regulatory authorities.

If 906jl becomes aware that personal data belonging to an individual under 21 years of age has been collected, that data will be deleted as promptly as practicable and the associated account will be closed permanently.

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 906jl. You may exercise any of these rights by contacting 906jl support via live chat or email:

Some of the third-party service providers engaged by 906jl — including game providers and cloud infrastructure partners — may be located outside the Philippines. Where personal data is transferred to recipients in other countries, 906jl ensures that such transfers are made in compliance with Section 21 of the Data Privacy Act of 2012 and the NPC's guidelines on cross-border data transfers.

Specifically, 906jl ensures that: (a) the country or territory to which data is transferred has been deemed to provide an adequate level of data protection; or (b) appropriate safeguards have been implemented, such as contractual clauses requiring the recipient to process data in accordance with standards equivalent to those required under Philippine law; or (c) the transfer is necessary for the performance of a contract between 906jl and the player.

Where a game provider receives a session authentication token from 906jl, this token does not contain full personal data — it contains only the minimum information required to establish the game session (typically an anonymised player identifier and session parameters).

In the event of a personal data breach — defined as any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed by 906jl — the following protocol applies:

• Containment: 906jl's security team will take immediate steps to contain the breach and prevent further unauthorised access;
• Assessment: The nature, scope, and impact of the breach will be assessed as promptly as possible, including an evaluation of the categories and approximate volume of personal data involved and the likely consequences for affected players;
• NPC Notification: Where a data breach is likely to give rise to a real risk of serious harm to affected players, 906jl will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, as required by the DPA and NPC Circular 16-03;
• Player Notification: Where a data breach is likely to result in high risk to the rights and interests of affected players, those players will be notified directly in a timely manner with sufficient information to enable them to take protective measures;
• Documentation: 906jl maintains a record of all data breaches, including those that do not require NPC notification, consistent with accountability obligations under the DPA.

906jl reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law (including NPC issuances and circulars), or the services offered on the platform.

Material changes to this Privacy Policy — such as changes to the categories of data collected, new purposes for processing, or new categories of third-party recipients — will be communicated to registered players via the email address associated with their 906jl account at least 14 days before taking effect. A summary of the changes will also be displayed prominently on the platform.

Non-material changes — such as typographical corrections or minor clarifications that do not substantively affect how data is processed — may take effect upon publication on this page without prior notice. The "Effective Date" shown at the top of this Privacy Policy will always reflect the date of the most recent update.

Continued use of the 906jl platform following the effective date of any amendment to this Privacy Policy constitutes your acceptance of the revised Privacy Policy.

For any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data by 906jl — including exercising any of your rights under RA 10173 — please contact us through the following channels:

• Live Chat: Available daily from 8:00 AM to 12:00 MN (GMT+8). Accessible from the 906jl platform after logging in at 906jl Login.
• Email: [email protected] — for privacy-related requests, please include "Privacy Request" in the subject line so that your enquiry is routed directly to the Data Protection Officer.

The 906jl Data Protection Officer (DPO) oversees all data privacy compliance matters for the platform. The DPO can be reached through the same contact channels above. 906jl aims to respond to all data subject rights requests within 30 calendar days of receipt, consistent with the timeframes prescribed by the Data Privacy Act of 2012.

If you are unsatisfied with 906jl's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.