joliok Privacy Policy

For the purposes of this Privacy Policy and applicable Philippine data protection law, joliok — the operator of the online gaming platform accessible at joliok.net — is the Personal Information Controller (PIC) responsible for the personal data of players who register and use the joliok Platform.

joliok is an online gaming platform serving Filipino players across the Philippines, including Metro Manila, Cebu, Davao, Iloilo, and provincial communities. As a platform operating in the Philippine market and collecting personal data of Philippine residents, joliok is subject to and complies with Republic Act No. 10173 — the Data Privacy Act of 2012 — and its Implementing Rules and Regulations issued by the National Privacy Commission (NPC).

This Privacy Policy applies to all personal data processed by joliok in connection with the joliok Platform, including registration, login, gameplay, financial transactions, customer support interactions, and marketing communications.

joliok collects only the personal data necessary for the purposes described in this Privacy Policy. The categories of personal data collected include:

2.1 Registration and Identity Data

• Full legal name (as it appears on your government-issued Philippine ID);
• Date of birth;
• Philippine mobile number;
• Email address;
• Username and encrypted password;
• Residential address (for KYC verification purposes).

2.2 Identity Verification (KYC) Data

• Government-issued Philippine identification document (e.g., PhilSys ID, passport, driver's licence, UMID, voter's ID) — including the document image, document number, and expiry date;
• Selfie photograph submitted for facial comparison against identity document;
• Tax Identification Number (TIN) where required by applicable regulation.

2.3 Financial and Transaction Data

• GCash account number or Maya account number used for deposits and withdrawals;
• Bank account details (BPI, BDO, Metrobank) where used for transactions;
• Deposit and withdrawal history;
• Betting history, game activity logs, and wallet balance records;
• Bonus and promotional credit records.

2.4 Technical and Usage Data

• IP address and geolocation data (country and city level);
• Device type, model, and operating system;
• Browser type and version;
• Session timestamps, duration, and login history;
• Pages accessed and features used on the joliok Platform;
• Clickstream data and navigation behaviour.

2.5 Communications Data

• Customer support chat transcripts and email correspondence;
• Records of any complaints, disputes, or escalations submitted to joliok;
• Survey or feedback responses voluntarily provided by you.

joliok collects your personal data through the following channels:

• Direct Provision: Information you provide when registering for a joliok Account, completing KYC verification, making deposits or withdrawals, contacting customer support, or responding to surveys;
• Automated Collection: Technical and usage data collected automatically when you access the joliok Platform through cookies, session trackers, server logs, and analytics tools;
• Payment Processors: Transaction confirmation and status data shared by payment providers (GCash, Maya, BPI, BDO) in connection with deposit and withdrawal processing;
• Identity Verification Providers: Verification outcomes and risk flags returned by third-party KYC service providers engaged by joliok;
• Fraud and Risk Systems: Data generated by joliok's internal and third-party fraud detection and anti-money laundering (AML) screening tools.

The table below summarises the primary purposes for which joliok processes your personal data:

Under Republic Act No. 10173 and its Implementing Rules and Regulations, joliok processes your personal data on one or more of the following legal bases:

• Consent (Section 12(a), RA 10173): Where you have given joliok your express, freely given, specific, and informed consent to process your personal data — particularly for marketing communications and optional data collection features;
• Contractual Necessity (Section 12(b), RA 10173): Where processing is necessary for the performance of a contract to which you are a party — specifically, the joliok Terms and Conditions governing your use of the Platform;
• Legal Obligation (Section 12(c), RA 10173): Where processing is required to comply with joliok's legal and regulatory obligations under Philippine law, including PAGCOR licensing requirements, Anti-Money Laundering Act (AMLA) obligations, and National Privacy Commission directives;
• Legitimate Interest (Section 12(f), RA 10173): Where processing is necessary for joliok's legitimate interests — such as fraud prevention, Platform security, IT maintenance, and product improvement — provided such interests are not overridden by your rights and freedoms.

joliok does not sell, rent, or trade your personal data to any third party for commercial purposes. Your personal data may be shared only in the circumstances described below:

6.1 Service Providers and Data Processors

joliok engages trusted third-party service providers who process personal data on joliok's behalf, under written data processing agreements that require them to handle your data securely, confidentially, and only for the instructed purpose. These include:

• Payment processors (GCash / GXI, Maya / Voyager Innovations, BancNet, InstaPay network members);
• KYC and identity verification service providers;
• Fraud detection and AML screening solution providers;
• Cloud infrastructure and data hosting providers;
• Customer support platform providers;
• Game software providers (who may process game log data).

6.2 Regulatory and Law Enforcement Authorities

joliok may disclose personal data to government agencies, regulatory bodies, and law enforcement authorities where required by Philippine law or a valid legal order, including:

• The Philippine Amusement and Gaming Corporation (PAGCOR);
• The Anti-Money Laundering Council (AMLC);
• The National Privacy Commission (NPC);
• The Bureau of Internal Revenue (BIR);
• Philippine National Police (PNP) or National Bureau of Investigation (NBI) upon valid legal process.

6.3 Business Transfers

In the event of a merger, acquisition, business combination, or sale of substantially all of joliok's assets, your personal data may be transferred to the acquiring entity, provided that the acquiring entity agrees to be bound by privacy obligations no less protective than those described in this Privacy Policy.

The joliok Platform uses cookies and similar tracking technologies to operate correctly, analyse usage patterns, and improve the player experience. A cookie is a small text file stored on your device by your web browser when you visit a website.

7.1 Types of Cookies Used

• Strictly Necessary Cookies: Essential for the joliok Platform to function — including session authentication cookies that keep you logged in during your joliok session. These cannot be disabled without breaking Platform functionality;
• Performance and Analytics Cookies: Collect anonymised or aggregated data about how players navigate and use the joliok Platform, allowing joliok to identify usability improvements;
• Functional Cookies: Remember your preferences and settings on the joliok Platform, such as language, display options, and game lobby filters;
• Security Cookies: Support fraud detection, session integrity, and bot prevention functions.

7.2 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to refuse, delete, or manage cookies on a site-by-site basis. Please note that disabling strictly necessary cookies may prevent certain joliok Platform features from functioning correctly, including the joliok Login process.

joliok implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• Encryption in Transit: All data transmitted between your device and the joliok Platform is encrypted using TLS 1.2 or higher (256-bit SSL);
• Encryption at Rest: Sensitive personal data stored on joliok's systems is encrypted using AES-256 encryption;
• Access Controls: Access to personal data is restricted to joliok staff on a strict need-to-know basis. All staff access is role-based, individually authenticated, and logged for audit purposes;
• Two-Factor Authentication: joliok's internal systems require multi-factor authentication for staff accessing player data environments;
• Penetration Testing: joliok's infrastructure and Platform undergo regular third-party security assessments and penetration testing;
• Vulnerability Management: Security patches are applied to joliok's systems on a continuous basis in accordance with industry best practices;
• Incident Response: joliok maintains a documented data breach incident response procedure, including escalation paths and NPC notification protocols.

While joliok takes these security measures seriously, no online platform can guarantee absolute security. You also have a responsibility to protect your joliok Account credentials. Never share your password or OTP codes, and use a unique password not reused across other services such as your GCash or banking apps.

joliok retains your personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following considerations:

• Active Account Data: Personal data associated with an active joliok Account is retained for the duration of the account relationship and for a minimum period of five (5) years after account closure, as required by PAGCOR licensing obligations and Anti-Money Laundering Act (AMLA) record retention requirements;
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years following account closure or the last transaction, in compliance with AMLA and PAGCOR requirements;
• Transaction Records: Financial transaction records, including deposit and withdrawal history, are retained for a minimum of ten (10) years in compliance with BIR and AMLA record-keeping obligations;
• Customer Support Records: Customer support correspondence is retained for three (3) years after the resolution of the relevant interaction;
• Marketing Data: Personal data processed for marketing purposes is retained until you withdraw your consent or until two (2) years of inactivity, whichever comes first;
• Cookie and Session Data: Session cookies expire at the end of your browser session. Analytics data is retained in anonymised or aggregated form for up to 26 months.

Upon the expiry of applicable retention periods, personal data is securely and permanently deleted or irreversibly anonymised in accordance with joliok's data deletion procedures.

Under Republic Act No. 10173, every Filipino player has the following rights with respect to their personal data held by joliok. These rights are real, enforceable, and joliok will respond to all valid requests within the timeframes specified:

To exercise any of these rights, contact joliok's Data Protection Officer using the details in Section 15. joliok may require identity verification before processing data subject requests to prevent unauthorised access to player data.

If joliok discovers or is notified that personal data has been collected from an individual under 21 years of age — whether through false registration information or other means — joliok will immediately:

• Suspend and close the associated Account;
• Forfeit any winnings accrued through the underage Account in accordance with joliok's Terms and Conditions;
• Securely delete the personal data of the underage individual, subject only to any legal retention obligations;
• Report the incident to relevant authorities where required by law.

Parents and guardians are strongly encouraged to monitor internet usage by minors in their household and to use parental control software on shared or family devices to prevent unauthorised access to the joliok Platform.

With your consent, joliok may send you marketing and promotional communications by SMS, email, or push notification (where applicable). These may include information about new games, bonuses, promotions, special events, and other joliok Platform updates relevant to your interests as a player.

You may opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link in any joliok marketing email;
• Replying STOP to any joliok SMS marketing message;
• Updating your communication preferences in your joliok Account settings;
• Contacting joliok's support team or Data Protection Officer directly.

Opting out of marketing communications does not affect transactional communications that joliok is required to send as part of the service — such as deposit confirmations, withdrawal notifications, account security alerts, and regulatory notices.

Some of joliok's service providers and technology partners — including cloud infrastructure providers and game software vendors — may process personal data in jurisdictions outside the Philippines. joliok complies with Section 21 of RA 10173 governing the transfer of personal data to foreign countries.

When transferring personal data outside the Philippines, joliok ensures appropriate safeguards are in place, which may include:

• Standard contractual clauses approved or recognised under Philippine data protection law;
• Transfers to countries or entities that have been assessed to provide an adequate level of protection for personal data;
• Binding corporate rules applicable to joliok's group of entities where relevant.

You may request further information about the safeguards applicable to any specific cross-border transfer by contacting joliok's Data Protection Officer.

joliok reserves the right to update or amend this Privacy Policy at any time to reflect changes in joliok's data processing practices, applicable Philippine law, or NPC guidance. The "Last Updated" date at the top of this document reflects the most recent revision.

Where an amendment is material — meaning it significantly changes how joliok collects or uses your personal data or reduces your rights under this Privacy Policy — joliok will provide advance notice via:

• A prominent notice on the joliok Platform;
• Email notification to the address registered to your joliok Account; and/or
• SMS notification to your registered Philippine mobile number.

Your continued use of the joliok Platform after the effective date of any amendment constitutes your acknowledgement of the updated Privacy Policy. If you do not agree to material amendments, you may close your Account and request deletion of your personal data subject to the retention obligations described in Section 9.

For any questions, concerns, or requests relating to this Privacy Policy, or to exercise your data subject rights under RA 10173, please contact joliok's Data Protection Officer:

Please include "Privacy Request — [your joliok account email]" in the subject line of any email to the joliok DPO to ensure timely routing and response.