27jl collects only the personal data that is strictly necessary for account registration, identity verification, regulatory compliance, and the delivery of our gaming services. We do not collect data speculatively or beyond what serves a documented, lawful purpose.
27jl does not sell, rent, or commercially trade your personal data to any third party. Data shared with external parties is limited to regulated service providers — payment processors, KYC verification partners, and game technology providers — operating under strict contractual confidentiality obligations.
All personal data transmitted between your device and the 27jl platform is protected by SSL/TLS encryption. Account passwords are stored using industry-standard cryptographic hashing — they are never stored or transmitted in plaintext. Access to player data within 27jl is governed by role-based access controls.
Under the Data Privacy Act of 2012, Filipino data subjects have enforceable rights including access, correction, erasure, and data portability. 27jl has a documented process for handling all data rights requests, and we respond within the timeframes mandated by the National Privacy Commission.
27jl retains personal data only for as long as required by law, regulation, or legitimate business purpose. PAGCOR and AMLA requirements mandate specific retention periods for gambling transaction records and KYC documents. Data beyond its retention period is securely deleted or anonymised.
In the event of a personal data breach that poses a real risk of serious harm, 27jl will notify affected players and the National Privacy Commission within 72 hours of becoming aware of the breach, as required under the Data Privacy Act and NPC Circular 16-03.
This Privacy Policy ("Policy") describes how 27jl ("27jl," "we," "us," or "our"), the operator of the online casino and sports betting platform at 27jl.club, collects, uses, stores, shares, and protects the personal data of users who register accounts, access, or interact with the 27jl platform ("you," "your," or "data subject").
27jl is committed to protecting the privacy and personal data of its players in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations ("IRR"), and the issuances of the National Privacy Commission ("NPC") of the Philippines. This Policy is also informed by 27jl's obligations under PAGCOR's regulatory framework and the Anti-Money Laundering Act (Republic Act No. 9160, as amended by RA 10365 and RA 11521).
By registering an account or using any 27jl service, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy forms part of and should be read alongside 27jl's Terms & Conditions.
The data controller responsible for your personal data is 27jl, the operator of the platform accessible at 27jl.club. 27jl operates under PAGCOR's regulatory framework and is the entity that determines the purposes and means of processing personal data collected through the platform.
27jl has appointed a Data Protection Officer ("DPO") as required under the Data Privacy Act of 2012 and NPC Circular 17-01. The DPO oversees 27jl's data protection compliance program, handles data subject rights requests, and serves as the primary point of contact with the National Privacy Commission. Contact details for the DPO are set out in Section 15 of this Policy.
27jl collects personal data through multiple channels: account registration forms, identity verification submissions, payment transactions, gameplay interactions, customer support communications, and automated technical data collection. The categories of personal data collected are set out below.
| Data Category | Specific Data Points | Collection Method |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, government ID number and type, photograph | Registration form; KYC document submission |
| Contact Data | Philippine mobile number, email address, residential address | Registration form; account settings updates |
| Financial Data | GCash / Maya account reference, bank account details, deposit and withdrawal transaction records, account balance history | Payment processing; transaction logs |
| Gaming Data | Game history, bet amounts, win/loss records, session duration, responsible gaming limits set, self-exclusion records | Platform activity logging |
| Technical Data | IP address, device identifier, browser type and version, operating system, screen resolution, login timestamps | Automated collection; server logs |
| Communications Data | Live chat transcripts, email correspondence, support ticket content, verification call recordings where applicable | Customer support interactions |
| Marketing Preferences | Promotional opt-in and opt-out records, communication channel preferences | Account settings; preference updates |
Under the Data Privacy Act, certain categories of personal information are classified as "sensitive personal information" and are subject to heightened protection. 27jl may process the following sensitive personal information where necessary for regulatory compliance: copies of government-issued identification documents, financial account details sufficient to establish source of funds for AMLA compliance purposes, and, where required by PAGCOR's responsible gaming framework, information pertaining to a player's self-exclusion status or problem gambling history.
The processing of sensitive personal information by 27jl is limited to circumstances where it is required by law, necessary for the performance of our legal obligations, or where you have given explicit informed consent.
27jl processes your personal data for the following purposes:
Under the Data Privacy Act of 2012, personal data may only be processed where a lawful basis exists. 27jl relies on the following legal bases for its processing activities:
27jl does not sell, rent, or commercially distribute your personal data to third parties. Personal data is shared only in the following circumstances and with the following categories of recipients:
The 27jl platform uses cookies and similar tracking technologies to deliver and improve the service, maintain your session state, and analyse platform usage. Cookies are small data files stored on your device by your browser when you visit the 27jl website.
You can control non-essential cookies through your browser settings. Most browsers allow you to block or delete cookies. Note that disabling strictly necessary cookies will impair the functionality of the 27jl platform, including the ability to maintain your login session. For instructions on managing cookies in your specific browser, refer to your browser's documentation.
27jl retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulation. The following retention periods apply:
| Data Category | Retention Period | Legal / Operational Basis |
|---|---|---|
| KYC / Identity Documents | 5 years from account closure | PAGCOR regulatory requirements; AMLA customer due diligence obligations |
| Financial Transaction Records | 5 years from transaction date | Anti-Money Laundering Act (RA 9160 as amended); BIR record-keeping obligations |
| Gaming / Bet History | 5 years from account closure | PAGCOR operational compliance; dispute resolution purposes |
| Account Profile Data | Account lifetime + 5 years post-closure | Contractual obligations; regulatory compliance |
| Customer Support Records | 3 years from last interaction | Dispute resolution; service quality improvement |
| Marketing Consent Records | Duration of consent + 3 years | NPC accountability requirements |
| Technical / Server Logs | 12 months | Security monitoring; fraud investigation |
| Self-Exclusion Records | Duration of exclusion + 5 years | PAGCOR responsible gaming requirements |
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data is anonymised, the anonymised dataset may be retained for longer-term platform analytics purposes, as it no longer constitutes personal data under the Data Privacy Act.
27jl implements and maintains technical, organisational, and physical security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Key measures include:
As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 27jl. To exercise any of these rights, contact the 27jl Data Protection Officer using the contact details in Section 15. 27jl will respond within fifteen (15) working days of receiving a verified request, consistent with NPC guidelines.
You have the right to obtain confirmation of whether 27jl processes your personal data and, if so, to receive a copy of that data and information about how it is processed.
You have the right to have inaccurate or incomplete personal data corrected. Most account details can be updated directly in Account Settings; others require document submission to the KYC team.
You may request deletion of your personal data where it is no longer necessary for the purpose collected. Note that data subject to legal retention requirements (AMLA, PAGCOR) cannot be deleted until the mandatory retention period expires.
You may object to processing based on legitimate interests or for direct marketing purposes. Objection to direct marketing will result in immediate cessation of marketing communications to your registered contact details.
You may request a copy of your personal data in a structured, commonly used, and machine-readable format, to the extent technically feasible for the categories of data held by 27jl.
You have the right to be informed when your personal data is being collected, including the identity of the data controller, purpose of processing, and the basis on which it is being processed. This Policy fulfils that obligation.
If you believe your data rights have not been respected by 27jl, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). Information about the NPC complaints process is available on the NPC's official website.
The 27jl platform is strictly intended for persons aged 21 years and above, as mandated by PAGCOR for all licensed online casino and gambling platforms in the Philippines. 27jl does not knowingly collect, process, or retain personal data from individuals below the age of 21.
Age verification is conducted as part of the mandatory KYC process during account registration. Accounts for which age verification cannot be completed, or where misrepresentation of age is detected, are closed without prejudice to 27jl's right to forfeit any associated balance in accordance with the Terms & Conditions.
If 27jl becomes aware that personal data has been collected from a person below the age of 21 through an account that circumvented the age verification process, 27jl will take immediate steps to delete that data, close the account, and report the matter to PAGCOR in accordance with its regulatory reporting obligations. Parents or guardians who believe a minor has accessed the 27jl platform should contact the Data Protection Officer immediately.
Some of 27jl's third-party service providers — including game technology providers such as Evolution Gaming, Pragmatic Play, and PG Soft — operate data processing infrastructure outside the Philippines. Personal data transferred to these providers in connection with game delivery and session management may be processed in jurisdictions other than the Philippines.
Where personal data is transferred outside the Philippines, 27jl ensures that such transfers are undertaken in compliance with Section 21 of the Data Privacy Act and NPC guidelines on cross-border data transfers, including through the execution of data processing agreements that impose data protection obligations equivalent to Philippine standards.
27jl conducts transfer impact assessments where required and maintains records of all cross-border data transfers as part of its data processing register. Details of specific third-party providers and their data processing locations are available from the Data Protection Officer upon written request.
27jl may send promotional communications — including information about bonuses, special offers, new game launches, and platform updates — to players who have given their express consent to receive marketing communications during account registration or subsequently via Account Settings.
Marketing communications from 27jl are sent via SMS to your registered Philippine mobile number and/or email to your registered email address. 27jl does not send unsolicited marketing communications via messaging applications or social media platforms, and any communication claiming to be from 27jl via such channels should be treated as suspicious.
You may withdraw your consent to marketing communications at any time by: (a) updating your communication preferences in Account Settings; or (b) contacting 27jl's live chat support and requesting removal from marketing communications. Withdrawal of marketing consent does not affect the lawfulness of communications sent prior to withdrawal, nor does it affect transactional and account-related communications that 27jl is required to send regardless of marketing preferences.
27jl reserves the right to update this Privacy Policy from time to time to reflect changes in applicable law, PAGCOR regulatory requirements, NPC guidance, or 27jl's data processing practices. The effective date at the top of this Policy indicates the date of the most recent revision.
Material changes to this Policy — such as changes to the categories of data collected, the purposes for which data is processed, or the third parties with whom data is shared — will be notified to registered players via the email address or mobile number on their account at least seven (7) days before the change takes effect, except where immediate changes are required by law or regulatory direction.
We encourage you to review this Policy periodically. Continued use of the 27jl platform after the effective date of any revision constitutes your acceptance of the revised Policy.
For all data privacy inquiries, data subject rights requests, or complaints relating to 27jl's handling of your personal data, please contact the 27jl Data Protection Officer through the following channels. Email addresses and contact details are provided as plain text for reference only and are not hyperlinked.
Your privacy is a foundational commitment at 27jl — not a checkbox. Sign in to your account and play knowing that your personal data is protected under Philippine law, PAGCOR regulation, and 27jl's own data security standards.
21+ Only · PAGCOR Regulated · Data Privacy Act Compliant
Related Legal Documents. This Privacy Policy should be read alongside 27jl's Terms & Conditions, which govern the contractual relationship between 27jl and its players, and our Responsible Gaming page, which details the player welfare tools and self-exclusion processes available on the platform.