jiboss Privacy Policy — Your Data, Protected

1.1 This Privacy Policy ("Policy") is published by jiboss ("jiboss", "we", "us", "our") and applies to all personal data collected from individuals ("you", "Player", "User") who visit or use the jiboss online gaming platform accessible at jiboss.org.

1.2 This Policy covers all processing activities conducted by jiboss in connection with the operation of its platform, including account registration and management, identity and age verification, payment processing, gaming activity, customer support, marketing communications, and regulatory compliance reporting.

1.3 jiboss operates its platform primarily in the Philippine market and the collection, processing, and storage of personal data is subject principally to the Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and the issuances of the National Privacy Commission (NPC) of the Philippines. Where jiboss processes data of individuals in other jurisdictions, applicable local data protection laws will also be observed.

1.4 This Policy should be read together with the jiboss Terms and Conditions available at jiboss.org/terms-conditions. In the event of any conflict between this Policy and the Terms and Conditions on data privacy matters, this Policy shall prevail.

2.1 jiboss is the data controller responsible for your personal data processed in connection with the jiboss platform. As data controller, jiboss determines the purposes for which and the means by which personal data is processed.

2.2 jiboss has designated a Data Protection Officer (DPO) responsible for overseeing data protection strategy and implementation, and for ensuring compliance with the DPA 2012 and NPC requirements. Contact details for the jiboss DPO are available upon request through the support contact details set out in Section 16 of this Policy.

2.3 jiboss is registered with the National Privacy Commission of the Philippines as a personal information controller in accordance with applicable NPC registration requirements for entities processing personal data at the scale applicable to online gaming platforms.

3.1 Depending on how you interact with the jiboss platform, we may collect the following categories of personal data:

3.2 We do not intentionally collect or process special categories of sensitive personal data (such as health or medical information, biometric data beyond liveness verification for KYC, political opinions, or religious beliefs) except where explicitly required by Philippine regulatory obligations.

4.1 jiboss collects personal data through the following channels:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, respond to a survey, or interact with any feature of the jiboss platform that requires you to provide information.
• Automatically through platform use: When you access jiboss.org, our servers automatically collect technical and device data including your IP address, session timestamps, browser information, and navigation patterns through server logs, cookies, and similar tracking technologies. See Section 6 for full cookie information.
• From third-party service providers: jiboss may receive identity verification data from third-party KYC and fraud prevention service providers who process your submitted documents and return verification results. We may also receive updated address or identity data from data enrichment services where permitted by law.
• From payment processors: When you use GCash, Maya, or bank transfer services, jiboss receives transaction confirmation data from the relevant payment processor, including transaction reference numbers and anonymised payment account identifiers required for withdrawal processing.
• From regulatory authorities: In certain circumstances, jiboss may receive data from PAGCOR or other Philippine government agencies in connection with compliance inquiries or investigations.

5.1 jiboss processes your personal data for the following purposes, each of which is grounded in a legal basis as provided for under the DPA 2012:

• Account creation and management — necessary for the performance of our contract with you as a registered jiboss player.
• Age and identity verification (KYC) — required by law under Philippine PAGCOR regulations and anti-money laundering legislation (AMLA, RA 9160 as amended).
• Payment processing — necessary for the performance of our contract with you; required by law for AML transaction reporting.
• Delivery of gaming services — necessary for the performance of our contract with you.
• Fraud detection and prevention — legitimate interest of jiboss and a legal obligation under applicable anti-fraud and financial crime legislation.
• Responsible gaming monitoring — legitimate interest of jiboss; regulatory requirement under PAGCOR responsible gaming standards.
• Customer support — necessary for the performance of our contract with you; legitimate interest in maintaining service quality.
• Marketing and promotions — based on your explicit consent. You may withdraw consent at any time. See Section 12.
• Platform security and integrity — legitimate interest of jiboss in protecting the platform and its users from unauthorized access, abuse, and exploitation.
• Regulatory compliance and reporting — legal obligation under PAGCOR regulations, AMLA, and other applicable Philippine laws requiring reporting to regulatory and law enforcement bodies.
• Platform improvement and analytics — legitimate interest of jiboss in improving our services; processing conducted on anonymised or aggregated data where possible.

6.1 jiboss uses cookies and similar tracking technologies (including local storage and session tokens) when you access the platform. Cookies are small text files placed on your device that help jiboss operate the platform, remember your preferences, maintain session security, and understand how you use our services.

6.2 jiboss uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the platform to function correctly, including session authentication, security tokens, and load-balancing. These cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your preferences such as language settings, game lobby view options, and display preferences to improve your experience across sessions.
• Analytics Cookies: Collect anonymised or aggregated data about how players use the jiboss platform — which pages are visited most, how long sessions last, and where navigation paths break down. This data is used to improve platform design and functionality.
• Security Cookies: Used for fraud detection, bot prevention, and to detect suspicious login activity associated with your session.

6.3 jiboss does not use third-party advertising cookies or share cookie data with advertising networks. You can manage cookie preferences through your browser settings, though disabling strictly necessary cookies will impair platform functionality.

7.1 jiboss does not sell your personal data. We share personal data only in the following circumstances, and only to the minimum extent necessary for the purpose of sharing:

• KYC and identity verification providers: Third-party services engaged by jiboss to verify the identity and age of players. These providers are contractually bound to process data only for the KYC verification purpose and to maintain appropriate security standards.
• Payment processors: GCash (G-Xchange Inc.), Maya (PayMaya Philippines Inc.), and Philippine bank payment networks require transaction data to process deposits and withdrawals to and from your jiboss account.
• Game software providers: Live casino and RNG game studios that provide games on the jiboss platform may receive anonymised session and wager data necessary to deliver the game experience. No personally identifying information beyond a session token is typically shared with game providers.
• PAGCOR and Philippine regulatory bodies: jiboss is legally required to report player data, suspicious transaction reports, and other compliance information to PAGCOR, the Anti-Money Laundering Council (AMLC), and other competent Philippine authorities as required by law.
• Law enforcement and courts: jiboss will disclose personal data to Philippine law enforcement agencies, courts, or other governmental bodies when required to do so by a valid legal process, court order, or law enforcement request.
• Fraud prevention and security services: Third-party fraud detection and cybersecurity providers engaged to protect the jiboss platform and its users.
• Professional advisers: Lawyers, auditors, accountants, and insurers acting as service providers to jiboss, subject to contractual confidentiality obligations.

7.2 All third parties with whom jiboss shares personal data are required by contract to process such data lawfully, maintain appropriate technical and organizational security measures, and use the data only for the specified purpose.

8.1 Some of jiboss's service providers — particularly game studio providers and certain KYC and fraud prevention technology vendors — may process personal data in jurisdictions outside the Republic of the Philippines. Where such transfers occur, jiboss takes steps to ensure that personal data is afforded a level of protection consistent with the DPA 2012 and applicable NPC standards.

8.2 Measures employed by jiboss to safeguard international transfers include contractual data processing agreements incorporating data protection clauses consistent with NPC requirements, and vendor due diligence assessments of the data protection standards maintained by recipient entities.

8.3 jiboss will not transfer personal data to any third party located outside the Philippines where jiboss has reasonable grounds to believe that the recipient does not maintain adequate data protection standards, unless required by Philippine law.

9.1 jiboss retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, subject to any longer retention periods required by applicable Philippine law or regulatory obligation. The following general retention guidelines apply:

• Active account data: Retained for the duration of your jiboss account plus a minimum of five (5) years following account closure, consistent with PAGCOR operator retention requirements and anti-money laundering record-keeping obligations under the AMLA.
• KYC documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, in accordance with AMLC record-keeping requirements.
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction, consistent with AMLA and BSP record-keeping requirements applicable to electronic payment service providers.
• Support and communications records: Retained for two (2) years from the date of the most recent communication, or longer where the matter involves an unresolved dispute, investigation, or legal proceeding.
• Marketing consent records: Retained for three (3) years from the date of most recent consent or withdrawal of consent, to demonstrate compliance with consent-based marketing obligations.
• Technical and log data: Retained for a maximum of twelve (12) months, except where specific log data is required in connection with a security incident, fraud investigation, or regulatory inquiry.

9.2 At the end of the applicable retention period, personal data is securely deleted, destroyed, or anonymised in a manner that prevents recovery and re-identification.

10.1 jiboss implements a layered set of technical and organizational security measures designed to protect personal data against accidental or unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• Industry-standard TLS/SSL encryption for all data in transit between player devices and jiboss servers;
• Encryption of sensitive data at rest, including KYC documents, payment method identifiers, and authentication credentials;
• Access controls based on the principle of least privilege — jiboss staff access to personal data is restricted to those roles with a legitimate operational need;
• Two-factor authentication (2FA) available to all jiboss account holders, and mandatory for privileged internal system access;
• Regular security assessments, penetration testing, and vulnerability scanning of the jiboss platform infrastructure;
• Data Loss Prevention (DLP) controls to monitor and restrict unauthorized transfer of personal data outside jiboss systems;
• Staff training on data protection obligations, phishing awareness, and incident response procedures.

10.2 No security system is completely impenetrable. In the event of a security breach affecting your personal data, jiboss will notify you and the NPC in accordance with the requirements of Section 14 of this Policy and applicable DPA 2012 breach notification obligations.

11.1 Under the Data Privacy Act of 2012 and NPC implementing rules, Philippine data subjects are granted the following rights in respect of their personal data:

11.2 Right to Be Informed: You have the right to be informed about how your personal data is being collected and processed, including the purposes of processing, the entities with whom your data is shared, and your rights as a data subject. This Privacy Policy fulfils that obligation.

11.3 Right of Access: You may request a copy of the personal data that jiboss holds about you. jiboss will respond to such requests within fifteen (15) business days of receipt of a verified request, in accordance with NPC guidelines.

11.4 Right to Rectification: If any personal data jiboss holds about you is inaccurate or incomplete, you may request that we correct or update it. Many details can be updated directly within your jiboss account settings. For data that cannot be self-updated, contact jiboss support.

11.5 Right to Erasure: You may request that jiboss delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the processing is unlawful. This right is subject to jiboss's legal obligations to retain data under AMLA, PAGCOR regulations, and other applicable Philippine law — such obligations take precedence over erasure requests to the extent required by law.

11.6 Right to Object: You may object to the processing of your personal data where jiboss relies on legitimate interest as the legal basis, or for direct marketing purposes. If you object to direct marketing, jiboss will cease processing your data for that purpose immediately.

11.7 Right to Data Portability: Where technically feasible and legally permissible, you may request a structured, machine-readable copy of the personal data you have provided to jiboss, for the purpose of transferring it to another service provider.

11.8 To exercise any of your rights under the DPA 2012, contact the jiboss data protection team using the details in Section 16. jiboss may require you to verify your identity before processing a data rights request to prevent unauthorized disclosure or modification of your data.

11.9 If you believe your data protection rights have not been respected by jiboss, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph). We encourage you to contact jiboss first so we have the opportunity to resolve your concern before escalation.

12.1 jiboss may send you promotional communications — including bonus offers, new game announcements, VIP program updates, and seasonal promotions — by email and SMS, where you have provided your explicit consent to receive such communications at the time of account registration or subsequently through your account communication preferences.

12.2 Marketing communications from jiboss will always clearly identify jiboss as the sender and will always include a clear and functional mechanism to unsubscribe or opt out of future communications.

12.3 You may withdraw your consent to marketing communications at any time by:

• Updating your notification preferences in your jiboss account settings;
• Clicking the unsubscribe link included in any jiboss marketing email; or
• Contacting jiboss support at [email protected] with a written opt-out request.

12.4 Withdrawal of marketing consent will be processed within five (5) business days. Transactional and account-related communications (such as deposit confirmations, withdrawal notifications, KYC status updates, and security alerts) are not marketing communications and will continue to be sent regardless of marketing preferences, as they are necessary for the operation of your account.

12.5 jiboss will not send marketing communications to players who have applied for self-exclusion or who have an active cooling-off period on their account.

13.1 jiboss implements mandatory age verification as part of its account registration and KYC process. If jiboss becomes aware that personal data has been collected from a person under the age of 21, that account will be immediately suspended, all data relating to the minor will be deleted to the extent permitted by law, and any funds deposited will be returned to the originating payment account.

13.2 If a parent or guardian becomes aware that their child under 21 has registered an account with jiboss, they should contact jiboss immediately at [email protected] so that the account can be closed and data deleted promptly.

14.1 In the event of a personal data breach — meaning a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed by jiboss — jiboss will take the following steps:

• Contain the breach and assess the risk to affected individuals as quickly as possible;
• Notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, where the breach is likely to result in a serious risk to the rights and freedoms of affected individuals, as required under Section 20(f) of the DPA 2012 and applicable NPC breach notification guidelines;
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights, providing a clear description of the breach, the categories of data affected, likely consequences, and measures taken or proposed to address the breach;
• Conduct a post-incident review and implement remediation measures to prevent recurrence.

14.2 jiboss maintains a breach response plan and designated incident response team responsible for managing data security incidents in a timely and effective manner.

15.1 jiboss may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, NPC guidance, or operational requirements. The effective date at the top of this document reflects when the current version came into force.

15.2 Where changes to this Policy are material — meaning they significantly affect how we process your personal data or the rights available to you — jiboss will notify you by email to your registered address and/or by a prominent notice displayed upon your next login to the jiboss platform, providing at least fourteen (14) days' advance notice before the changes take effect.

15.3 Minor updates, including clarifications of existing practices, corrections of typographical errors, or changes required to comply with updated NPC guidelines, may be implemented without prior individual notification. The current version of this Policy is always available at jiboss.org/privacy-policy.

15.4 Your continued use of the jiboss platform after the effective date of any revision to this Policy constitutes your acceptance of the revised terms. If you do not agree with a material revision, your right is to close your jiboss account before the effective date of the change.

16.1 If you have any questions, concerns, or requests relating to this Privacy Policy or jiboss's handling of your personal data, please contact us through the following channels:

16.2 jiboss will acknowledge data privacy inquiries within five (5) business days and aims to resolve all requests within fifteen (15) business days. Complex requests may take longer, in which case jiboss will provide status updates.

16.3 If you are not satisfied with jiboss's response to a data privacy concern, you may file a complaint with the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority for data protection matters in the Republic of the Philippines. The NPC's contact information and complaint procedures are available at the NPC's official government website.