joliok Casino — Privacy Policy

For the purposes of the Philippine Data Privacy Act of 2012 and all applicable NPC regulations, the data controller responsible for the personal information processed through the joliok platform is joliok Casino, operating the website located at joliok.org and all associated subdomains, mobile interfaces, and progressive web application versions thereof.

joliok processes personal data in connection with the operation of an online casino and sports betting platform made available to registered Philippine users aged twenty-one (21) years and above. All data processing activities conducted by joliok are subject to the principles of transparency, legitimate purpose, and proportionality as mandated by Section 11 of Republic Act No. 10173.

If you have questions about this Policy or wish to exercise any of your data subject rights under Philippine law, please contact the joliok Data Protection Officer (DPO) using the contact details provided in Section 14 of this Policy.

joliok collects only the personal data necessary to provide, secure, and improve the platform experience for Filipino players, and to meet applicable legal obligations. The categories of personal data we process are set out in the table below:

joliok does not collect or store full payment card numbers, full bank account numbers, or biometric data through the platform. Government-issued ID documents submitted for KYC are processed by joliok's compliance team under strict access controls and are not retained beyond the period required by applicable legal obligations.

joliok collects personal data through the following channels and mechanisms:

• Account registration — when you create your joliok account using your Philippine mobile number, name, date of birth, and other required fields.
• KYC submission — when you upload identity documents to verify your age, identity, and payment method ownership prior to withdrawal.
• Deposit and withdrawal transactions — when you initiate financial transactions through GCash, Maya, GrabPay, QR Ph, InstaPay, BPI, BDO, Metrobank, or any other supported Eligible Payment Method.
• Support interactions — when you contact joliok via live chat or email, or submit a complaint or dispute for review.
• Responsible gaming tool usage — when you configure deposit limits, cooling-off periods, or self-exclusion through your account settings.
• Marketing communications — when you opt in or out of promotional communications from joliok.

• Platform server logs automatically record your IP address, session timestamps, device identifiers, game activity, and navigation behaviour each time you access joliok.org.
• Cookies, web beacons, and similar tracking technologies collect technical data to maintain your session state, authenticate your identity, and analyse platform performance. See Section 7 for full cookie details.
• Anti-fraud and security systems automatically monitor login attempts, transaction patterns, and account behaviour as part of joliok's fraud detection and platform integrity obligations.

• Payment processors (GCash, Maya, BancNet, InstaPay) provide transaction confirmation data to joliok upon deposit or withdrawal execution.
• Identity verification services used during KYC processing may return verification status results to joliok's compliance systems.
• Game providers (including JILI, Pragmatic Play, PG Soft, and Evolution Gaming) transmit game session data to joliok's platform systems for display in your account history and for dispute resolution purposes.

joliok processes personal data only where one or more of the following lawful bases under the Philippine Data Privacy Act of 2012 applies:

• Contractual Necessity (Section 12(b) DPA): Processing is necessary to perform joliok's obligations under the Terms & Conditions you agreed to upon registration — including account management, game delivery, payment processing, and withdrawal services.
• Consent (Section 12(a) DPA): Where you have given specific, freely given, informed consent — including for marketing communications, optional analytics cookies, and data processing activities not strictly required to deliver the core platform service.
• Legal Obligation (Section 12(c) DPA): Processing is required to comply with applicable Philippine laws, including the Anti-Money Laundering Act (RA 9160), responsible gaming obligations, age verification requirements, and lawful regulatory orders.
• Legitimate Interests (Section 12(f) DPA): Processing is necessary for joliok's legitimate interests in operating a secure, fraud-resistant, and commercially viable online gaming platform, provided those interests do not override the data subject's fundamental rights and freedoms.
• Vital Interests (Section 12(e) DPA): Processing of responsible gaming data, including self-exclusion and deposit limit records, may be based on the vital interests of the data subject where gambling harm prevention is the relevant purpose.

joliok processes your personal data strictly for the purposes for which it was collected, or for compatible purposes that a reasonable data subject would anticipate. The principal processing purposes are:

• Account Management: Creating, verifying, maintaining, and securing your joliok account — including authentication, password recovery, and session management.
• Game and Platform Delivery: Enabling your access to joliok's game library, sports betting markets, live casino tables, bingo rooms, and all associated platform features.
• Payment Processing: Processing GCash, Maya, and bank transfer deposits and withdrawals — including verification of payment method ownership and compliance with transaction limits.
• Identity Verification (KYC): Verifying your age (21+), identity, and source of funds in compliance with Philippine gaming and anti-money laundering regulations.
• Fraud Prevention and Security: Detecting and investigating potentially fraudulent activity, account takeover attempts, bonus abuse, money laundering, and other security threats.
• Responsible Gaming: Administering your deposit limits, cooling-off periods, self-exclusion status, and reality check settings. Monitoring for indicators of problem gambling behaviour and acting on those indicators in accordance with joliok's responsible gaming obligations.
• Customer Support: Resolving your account queries, payment issues, game disputes, and complaints submitted through joliok's live chat and email support channels.
• Regulatory Compliance: Fulfilling joliok's obligations under Philippine law, including Anti-Money Laundering Act reporting, age verification requirements, and responses to lawful orders from regulatory bodies or courts of competent jurisdiction.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve joliok's platform design, game performance, payment flow efficiency, and support response quality.
• Marketing Communications (Consent Only): Sending promotional offers, bonus notifications, and platform news to players who have opted in to marketing communications. You may withdraw this consent at any time via your Account Settings or by contacting joliok support.

joliok discloses personal data only to the following categories of recipients, and only to the extent necessary for the specified purpose:

• Payment Processors: GCash (G-Xchange Inc.), Maya (Voyager Innovations), BancNet, InstaPay/PesoNet operators, and partner Philippine banks (BPI, BDO, Metrobank) — solely to execute authorised deposit and withdrawal transactions.
• Game Providers: JILI, Pragmatic Play, PG Soft, Evolution Gaming, Asia Gaming, and other licensed game studios — solely to deliver game content and for game session data reconciliation purposes.
• Identity Verification Services: Third-party KYC and AML screening providers engaged to assist joliok in fulfilling its identity verification and anti-money laundering obligations under Philippine law.
• Technology and Infrastructure Providers: Cloud hosting, database management, cybersecurity, and platform monitoring service providers engaged under data processing agreements that require them to process personal data solely on joliok's documented instructions and to maintain appropriate security standards.
• Regulatory and Law Enforcement Authorities: Philippine government agencies, regulatory bodies (including PAGCOR), the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Philippine National Police (PNP), or any court of competent jurisdiction — where disclosure is required by law, court order, or lawful regulatory direction.
• Professional Advisors: Lawyers, accountants, auditors, and insurance providers engaged by joliok in connection with the operation of its business, subject to professional confidentiality obligations.

All third-party service providers who receive personal data from joliok are required, as a condition of engagement, to implement and maintain data protection standards at least equivalent to those required by RA 10173 and its IRR.

joliok uses cookies and similar tracking technologies on the joliok.org platform. A cookie is a small data file placed on your device by a web server. Cookies allow joliok to recognise your device on return visits, maintain your login session, and understand how the platform is used.

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies (to keep you logged in to joliok), CSRF protection tokens, and load balancing cookies. These cannot be disabled without impairing platform functionality. Legal basis: Contractual Necessity.
• Functional Cookies: Remember your preferences, such as language settings, game lobby view preferences, and notification settings. Legal basis: Consent.
• Analytics Cookies: Collect aggregated, anonymised data about how players navigate and use the joliok platform — used to identify performance issues and improve platform design. joliok uses server-side analytics and does not deploy third-party analytics scripts that send Filipino player data to external servers. Legal basis: Consent.
• Security Cookies: Used by joliok's anti-fraud systems to detect unusual login patterns, rate-limit brute force attempts, and identify suspicious device behaviour. Legal basis: Legitimate Interest.

You may manage or withdraw consent for non-essential cookies through the cookie preferences panel accessible from the joliok.org footer. Disabling strictly necessary cookies will prevent you from logging in to or using the joliok platform. Most Philippine browsers (Chrome on Android, Safari on iOS) also provide device-level cookie controls accessible through the browser settings menu.

joliok retains personal data only for as long as necessary to fulfil the purpose for which it was collected or as required by applicable Philippine law. The following retention schedule applies:

• Account and identity data (name, date of birth, KYC documents): 5 years post-account closure — required by Anti-Money Laundering Act (RA 9160) record-keeping obligations.
• Financial transaction records (deposits, withdrawals, bet history): 5 years — retained to comply with AMLC and applicable tax record-keeping requirements under Philippine law.
• Responsible gaming records (self-exclusion, deposit limits, cooling-off): Duration of exclusion + 2 years — to prevent re-registration during active exclusion periods and to honour reinstated exclusion requests.
• Support and complaint communications: 3 years — for dispute resolution and regulatory audit purposes.
• Technical logs (IP address, session logs, security events): 13 months — for security monitoring, fraud investigation, and platform performance analysis.
• Marketing consent and preference records: Until consent withdrawn + 3 years — to demonstrate consent compliance in the event of regulatory inquiry.

Upon expiry of the applicable retention period, personal data is deleted or anonymised in a manner that renders it permanently irrecoverable. Where anonymisation is applied, the resulting data is no longer personal data under RA 10173 and may be retained indefinitely for statistical or research purposes.

joliok implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, and destruction, consistent with the security standards required by Section 20 of RA 10173 and the NPC's guidelines on security incident management.

• TLS 1.3 encryption with 256-bit AES for all data transmitted between your device and the joliok platform (indicated by the padlock in your browser's address bar).
• Bcrypt password hashing with per-account salting. joliok never stores plain-text passwords and no joliok employee can view your password.
• Two-factor authentication (2FA) available to all accounts — strongly recommended for all Philippine players, particularly those with high account balances.
• Automated brute-force login protection: accounts are temporarily locked following repeated failed authentication attempts, with re-activation requiring mobile OTP verification.
• Database encryption at rest for sensitive personal data categories, including KYC identity documents and financial records.
• Continuous security monitoring and intrusion detection across joliok's platform infrastructure.

• Access to personal data is restricted on a strict need-to-know basis — only joliok employees and systems with a documented operational requirement may access any specific category of personal data.
• All personnel with access to personal data are bound by contractual confidentiality obligations and receive periodic data privacy training.
• joliok maintains a documented data breach response procedure in compliance with NPC Circular 16-03. In the event of a personal data breach that is likely to result in serious harm, joliok will notify the NPC and affected data subjects within seventy-two (72) hours of becoming aware of the breach.

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data processed by joliok. These rights may be exercised by contacting the joliok Data Protection Officer at the contact details set out in Section 14:

• Right to Be Informed (Sec. 16(a)): You have the right to be informed whether joliok processes your personal data, the purposes for which it is processed, and the categories of data processed — as provided in this Policy.
• Right to Access (Sec. 16(b)): You have the right to request a copy of the personal data joliok holds about you, including your game history, transaction records, and account data. joliok will respond to access requests within fifteen (15) business days.
• Right to Rectification (Sec. 16(c)): You have the right to request correction of inaccurate, incomplete, or outdated personal data held in your joliok account. Minor corrections (name spelling, mobile number updates) can be made directly through your account settings or by contacting support.
• Right to Erasure or Blocking (Sec. 16(d)): You have the right to request the deletion or blocking of personal data where it is no longer necessary for the purpose for which it was collected, where consent has been withdrawn and there is no other legal basis for processing, or where it is being processed unlawfully. This right is subject to joliok's legal obligation to retain certain data (see Section 8).
• Right to Object (Sec. 16(f)): You have the right to object to the processing of your personal data on legitimate interest grounds, and to withdraw consent for consent-based processing (such as marketing communications) at any time.
• Right to Data Portability (Sec. 18): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that it be transmitted to another data controller where technically feasible.
• Right to File a Complaint: If you believe joliok has violated your rights under RA 10173, you have the right to file a complaint with the National Privacy Commission of the Philippines (NPC) at privacy.gov.ph.

joliok employs age verification at the point of registration and at the point of first withdrawal to enforce the 21+ minimum age requirement. If joliok becomes aware or has reasonable grounds to believe that a registered account was created by or is being used by an individual under the age of twenty-one (21), joliok will immediately: (a) suspend the account; (b) void any pending or historical winnings associated with the account; (c) return the net deposited Real Money Balance (after deducting any funds wagered) via the original payment method; and (d) permanently close the account without the right to re-registration.

If you are a parent or guardian and believe your child has created a joliok account without your knowledge, please contact joliok support immediately via live chat or at [email protected]. We will investigate the matter and take appropriate action as a matter of priority.

Some of joliok's data processing activities involve the transfer of personal data outside the Philippines — specifically in connection with game providers (including European-headquartered studios such as Pragmatic Play and Evolution Gaming) and cloud infrastructure providers whose servers may be located in data centres outside Philippine territory.

joliok ensures that all cross-border transfers of personal data comply with the requirements of Section 21 of RA 10173 and the NPC's Circular on Cross-Border Data Transfers. Specifically, joliok only transfers personal data to recipients located in a country that maintains an adequate level of data protection, or where appropriate contractual safeguards (including standard data protection clauses) are in place to ensure that your data receives protection equivalent to Philippine standards.

You may request details of the specific cross-border transfer safeguards applicable to your personal data by contacting the joliok DPO at the contact details in Section 14.

joliok may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, NPC guidance, or operational circumstances. Material changes to this Policy will be notified to registered Philippine players through:

• A notice displayed on the joliok platform upon your next login, requiring acknowledgment before continued use of the platform.
• An SMS notification to your registered Philippine mobile number at least seven (7) calendar days before the updated Policy takes effect.

Your continued use of the joliok platform after the effective date of a revised Privacy Policy constitutes your acknowledgment of the updated Policy. If you do not agree to the revised Policy, you must cease using the platform and may request account closure in accordance with Section 9 of the joliok Terms & Conditions available at joliok.org/terms-conditions.

Previous versions of this Privacy Policy are archived by joliok's compliance team and are available upon request to the joliok DPO.

joliok has designated a Data Protection Officer (DPO) as required by Section 21(g) of RA 10173 and NPC Advisory Opinion No. 2017-044. The DPO is responsible for overseeing joliok's compliance with the DPA and this Policy, and for serving as the primary point of contact for data subject rights requests, privacy complaints, and regulatory inquiries.

To exercise any of your data subject rights, submit a privacy complaint, request information about joliok's data processing activities, or contact the DPO for any other privacy-related matter, please use the following contact channels. Email addresses are provided as plain text only and are not clickable links:

If you are unsatisfied with joliok's response to a privacy complaint or data subject rights request, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC). The NPC is the independent government authority responsible for administering and enforcing RA 10173 in the Philippines.