635jl Privacy Policy

635jl, accessible at 635jl.app, is the personal information controller (as defined under Republic Act No. 10173, the Data Privacy Act of 2012) responsible for the personal data of all Players and visitors to the Platform. References to "635jl," "we," "us," and "our" throughout this Privacy Policy refer to the 635jl platform operator.

635jl operates in compliance with PAGCOR's online gaming regulations and the National Privacy Commission (NPC) of the Philippines. The Platform has designated a Data Protection Officer (DPO) who is responsible for ensuring compliance with applicable data privacy laws and responding to data subject requests. Contact details for the DPO are provided in Section 14 of this Policy.

635jl collects personal data that is necessary for the operation of the Platform, compliance with Philippine legal obligations, and the delivery of gaming services to Filipino players. The categories of personal data we collect include:

2.1 Registration Data

• Philippine mobile number (primary account identifier);
• Account username (if separately configured);
• Account password (stored in encrypted, hashed form — not readable by 635jl staff);
• Date of birth (for age verification purposes).

2.2 KYC Identity Verification Data

• Full legal name as it appears on your government-issued Philippine identification document;
• Date of birth and age;
• Government-issued ID type and ID number (e.g., PhilSys ID, passport, UMID, driver's license, SSS/GSIS card);
• Scanned or photographed copy of the identification document;
• Live selfie photograph taken at the time of KYC submission for facial match verification.

2.3 Financial Transaction Data

• GCash account number or registered mobile number linked to GCash/PayMaya;
• Bank account name and number (for BDO, BPI, Metrobank, or other bank transfers);
• Transaction amounts, timestamps, and reference numbers for all deposits and withdrawals;
• Account balance history as required for regulatory reporting.

2.4 Gaming Activity Data

• Game session logs including titles played, bet amounts, outcomes, and timestamps;
• Responsible gaming tool usage (deposit limit settings, session time configurations, self-exclusion requests);
• Bonus and promotional activity history.

2.5 Technical and Device Data

• IP address at the time of each login and game session;
• Device type, operating system, and browser version;
• Session identifiers and authentication tokens;
• Cookie data as described in Section 9 of this Policy.

2.6 Communication Data

• Content of support chat sessions and support email correspondence;
• SMS OTP delivery logs (timestamps only — OTP content is not retained after use);
• Promotional communication preferences (opt-in/opt-out status).

635jl collects personal data through the following channels and mechanisms:

• Direct submission during registration — mobile number, password, and date of birth provided by you when creating your 635jl Account;
• KYC verification submission — identity documents and selfie photographs uploaded through the Platform's KYC interface;
• Payment transactions — account details provided when initiating GCash, PayMaya, or bank transfer deposits and withdrawals;
• Platform usage — game session data, login records, and navigation behavior collected automatically as you use the 635jl platform;
• Customer support interactions — information you provide when contacting 635jl via live chat or email;
• Cookies and tracking technologies — as described in Section 9 of this Policy;
• Third-party payment processors — transaction confirmation data from GCash, PayMaya, BDO, BPI, Metrobank, and InstaPay necessary to reconcile your account balance;
• Regulatory reporting channels — data shared by PAGCOR or the AMLC in the course of compliance or investigation procedures.

635jl processes your personal data for the following specific, legitimate purposes:

635jl does not use your personal data for purposes beyond those listed above without obtaining your separate, informed consent. Where processing is based on consent, you retain the right to withdraw that consent at any time as described in Section 10.

Under the Data Privacy Act of 2012, 635jl relies on the following lawful bases for processing your personal data:

• Contractual Necessity: Processing required to fulfill our contractual obligations to you under the 635jl Terms & Conditions — including account management, game delivery, payment processing, and customer support;
• Legal Obligation: Processing required to comply with applicable Philippine laws, including PAGCOR gaming regulations, the Anti-Money Laundering Act (RA 9160, as amended), the Data Privacy Act (RA 10173), and any lawful orders from Philippine regulatory or law enforcement authorities;
• Consent: Processing for which you have provided specific, informed, and freely given consent — primarily marketing and promotional communications. You may withdraw consent at any time without affecting the lawfulness of prior processing;
• Legitimate Interests: Processing necessary for the legitimate interests of 635jl, including fraud prevention, platform security, responsible gaming monitoring, and internal analytics, where such interests are not overridden by your fundamental rights and freedoms as a data subject.

635jl does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. We share your personal data only in the following circumstances and only to the extent necessary for the stated purpose:

6.1 Licensed Game Providers

Game provider partners (such as Pragmatic Play, PG Soft, Jili, and others) may receive session identifiers and player wallet tokens necessary to deliver game functionality. These providers do not receive your full KYC identity data, mobile number, or financial account details. All provider integrations are governed by data processing agreements requiring compliance with applicable privacy standards.

6.2 Payment Processors

To process deposits and withdrawals, 635jl transmits necessary transaction data to GCash, PayMaya, BDO, BPI, Metrobank, and InstaPay. The data shared is limited to what is required to initiate and confirm the specific transaction. These payment processors are independently regulated entities under Philippine law.

6.3 KYC and Compliance Service Providers

635jl may engage accredited third-party KYC verification services to assist with identity document authentication and facial match verification. Such providers act as data processors on behalf of 635jl and are contractually bound to process KYC data only for the stated verification purpose and in accordance with RA 10173.

6.4 Regulatory and Law Enforcement Authorities

635jl will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies when required to do so by law, regulation, court order, or lawful regulatory direction. Such disclosures will be made in accordance with applicable legal requirements and will be documented for accountability purposes.

635jl retains personal data for the minimum period necessary to fulfill the purpose for which it was collected, subject to any longer retention periods required by Philippine law or regulatory requirements:

• KYC identity documents: Retained for a minimum of five (5) years from the date of account closure, as required by PAGCOR and AMLA regulations;
• Financial transaction records: Retained for a minimum of five (5) years from the transaction date, in accordance with AMLA record-keeping requirements;
• Game session logs: Retained for a minimum of two (2) years from the session date for dispute resolution and regulatory audit purposes;
• Support communication records: Retained for a minimum of two (2) years from the date of the interaction;
• Marketing consent records: Retained for the duration of your account and for one (1) year following account closure or consent withdrawal, as evidence of lawful processing;
• Account data generally: Retained for five (5) years following permanent account closure, after which personal data will be securely deleted or irreversibly anonymized.

Where retention beyond these periods is required by a specific Philippine regulatory direction or court order, 635jl will comply with such direction and document the basis for extended retention.

635jl implements technical and organizational security measures appropriate to the nature of the personal data processed and the risks associated with its processing. These measures include:

• Transport Layer Security: All data transmissions between your device and 635jl servers are encrypted using TLS 1.2 or higher (256-bit SSL). This applies to account access, payment processing, and all in-platform data exchanges;
• Password Security: Account passwords are stored using industry-standard cryptographic hashing algorithms. 635jl staff cannot read or recover your password in plaintext;
• Two-Factor Authentication: OTP-based two-factor authentication is available for all account logins and is mandatory for new-device logins;
• Access Controls: Internal access to personal data is restricted on a role-based, need-to-know basis. Staff access to KYC data is logged and audited;
• Data Encryption at Rest: Sensitive personal data, including KYC documents and financial records, is encrypted at rest on 635jl servers;
• Security Monitoring: 635jl maintains continuous security monitoring for anomalous access patterns, unauthorized login attempts, and other indicators of compromise;
• Regular Security Assessments: 635jl conducts periodic security assessments and vulnerability testing of its platform infrastructure.

635jl uses cookies and similar tracking technologies on the Platform for the following purposes:

9.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function correctly. They maintain your authenticated session after login, preserve your account state during a game session, and enable security features such as CSRF protection. These cookies cannot be disabled without preventing basic Platform functionality. No consent is required for strictly necessary cookies under applicable Philippine privacy guidance.

9.2 Functional Cookies

Functional cookies remember your preferences — such as your language settings, responsible gaming tool configurations, and interface preferences — to provide a more personalized experience on subsequent visits. These cookies are set based on your use of the Platform's preference features.

9.3 Analytics Cookies

635jl uses analytics tools to understand how Players use the Platform — which game categories are most accessed, how the login flow performs across different devices, and where technical issues most commonly occur. Analytics data is aggregated and anonymized where possible. Analytics cookies are activated with your consent, which may be managed through the Platform's cookie settings interface.

9.4 Cookie Management

You may manage non-essential cookie preferences through your browser settings or the cookie consent interface on the Platform. Disabling analytics cookies will not affect your ability to use the 635jl Platform, access games, deposit, or withdraw. Disabling strictly necessary cookies will impair Platform functionality and is not recommended for normal use.

Under the Data Privacy Act of 2012 (RA 10173), registered data subjects — including all 635jl Players who are Philippine nationals or residents — hold the following rights with respect to their personal data:

To exercise any of the above rights, submit a written request to the 635jl Data Protection Officer at the contact details provided in Section 14. 635jl will acknowledge your request within five (5) business days and provide a substantive response within fifteen (15) business days. Requests that are manifestly unfounded or excessive may be declined with written reasons provided to you.

The 635jl Platform is strictly restricted to individuals who are 21 years of age or older, in compliance with PAGCOR regulations for online gambling in the Philippines. 635jl does not knowingly collect, process, or retain personal data from individuals under the age of 21.

If 635jl becomes aware that it has inadvertently collected personal data from a person under 21 years of age, the Platform will immediately close the associated account, delete the personal data to the extent legally permissible, and return any real-money balance in accordance with applicable regulations. KYC data associated with underage accounts may be retained for the minimum period required by Philippine law enforcement and PAGCOR compliance requirements.

635jl's primary data processing infrastructure is hosted in data centers located in the Philippines or in jurisdictions with data protection standards assessed as adequate for the types of personal data transferred. Where it is necessary to transfer personal data outside the Philippines — for example, to game provider servers located in other countries — 635jl ensures that such transfers are subject to appropriate contractual safeguards.

All cross-border personal data transfers involving the personal data of Philippine data subjects are conducted in compliance with the Data Privacy Act of 2012 and any applicable NPC advisories regarding international data transfers. 635jl maintains records of all cross-border transfer arrangements as required by applicable Philippine privacy regulations.

Game providers that receive session data from 635jl are required to maintain appropriate security standards for such data under the terms of their data processing agreements with 635jl. Personal data transferred to game providers for session management purposes is limited to what is strictly necessary for game delivery and does not include full KYC identity records or financial account details.

635jl reserves the right to update or amend this Privacy Policy at any time. Material changes — such as changes to the categories of data collected, the purposes of processing, data sharing practices, or your rights as a data subject — will be communicated to registered Players via SMS notification to their registered Philippine mobile number not less than fourteen (14) calendar days before the amended Policy takes effect.

Non-material changes — such as clarifications of existing language, corrections of typographical errors, or minor formatting revisions — may be made without advance notice. The effective date at the top of this Policy will be updated to reflect the date of the most recent revision.

Your continued use of the 635jl Platform following the effective date of any amendment constitutes your acknowledgment of the revised Privacy Policy. If you disagree with any material change to this Policy, you may close your account and request deletion of your personal data subject to applicable retention obligations, as described in Section 7.

We encourage all Players to periodically review this Privacy Policy to stay informed of how 635jl handles your personal data. The current version of this Policy is always available at 635jl.app/privacy-policy.

For all data privacy-related requests, inquiries, and complaints, please contact the 635jl Data Protection Officer through the following channels:

• Data Privacy Inquiries & Subject Access Requests: [email protected] — please include "Data Privacy Request" in the subject line
• Live Chat Support: Available 24/7 through the Platform — for urgent data breach or unauthorized access notifications
• Partnerships / Legal Correspondence: [email protected]

635jl will acknowledge receipt of all data privacy requests within five (5) business days. A complete substantive response will be provided within fifteen (15) business days of receipt of a properly documented request. Where additional time is required due to the complexity of a request, the data subject will be notified with a revised response timeline.

If you are not satisfied with 635jl's response to your data privacy request or complaint, you have the right to escalate the matter to the National Privacy Commission of the Philippines (NPC). Information on how to file a complaint with the NPC is available through the NPC's official government website and publicly accessible offices. 635jl will cooperate fully with any NPC investigation or inquiry arising from a data subject complaint.