Privacy Policy – How 38jl Protects Your Data in the Philippines

This Privacy Policy ("Policy") describes how 38jl ("we," "us," "our"), the operator of the online gaming and sports betting platform accessible at 38jl.best ("Platform"), collects, uses, stores, discloses, and protects the personal information of registered members and visitors in the Philippines.

This Policy is written in accordance with the Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC) of the Philippines.

By creating an account on the 38jl platform, you acknowledge that you have read and understood this Policy and you consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, please do not register or use the Platform.

38jl collects personal data in two main ways: information you provide to us directly, and information generated automatically through your use of the Platform. Here is a breakdown of each category:

Information You Provide Directly:

• Full legal name, date of birth, and nationality — collected during account registration for identity verification.
• Email address and mobile number — used for account communication, transaction notifications, and security alerts.
• Residential address — collected as part of Know Your Customer (KYC) requirements under applicable regulations.
• Government-issued ID details — required for identity verification prior to withdrawals or at the request of our compliance team.
• Payment method details — including GCash or Maya account numbers, bank account numbers, or card details (stored and processed by our PCI-compliant payment providers, not directly by 38jl).
• Support correspondence — records of messages you send to 38jl support, including account queries, complaints, and dispute submissions.

Information Collected Automatically:

• IP address, browser type, device model, and operating system — used for security monitoring, fraud detection, and platform optimisation.
• Session data including login timestamps, pages visited, bets placed, and session duration — used to monitor responsible gaming compliance and detect unusual activity.
• Cookies and similar tracking technologies — used to maintain session state, remember preferences, and analyse platform performance. See Section 9 for our full Cookie Policy.
• Geolocation data at login — used to verify that your access is consistent with your registered location and to detect suspicious login patterns.

38jl processes your personal data for the following specific purposes. We only process data where we have a lawful basis to do so under the Data Privacy Act:

38jl does not use your personal data for purposes beyond what is listed above without first obtaining your explicit consent or as otherwise required by law.

38jl does not sell or rent your personal data to third parties. We may share your information with the following categories of recipients, strictly limited to what is necessary for each purpose:

• Payment Processors: GCash, Maya, GrabPay, Coins.ph, BDO, BPI, UnionBank, Visa/Mastercard network processors and InstaPay/PESONet partners. Shared data is limited to what is required to process your transaction. These providers operate under their own privacy policies and are independently responsible for your payment data.
• Identity Verification Providers: Third-party KYC service providers who verify government-issued identification documents on behalf of 38jl. These providers process your ID data under contractual data processing agreements and are bound to use it only for verification purposes.
• Regulatory and Law Enforcement Bodies: Philippine gaming regulators, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and law enforcement agencies where disclosure is required by law or regulatory direction. 38jl will always disclose to regulators when legally required to do so.
• Technology Service Providers: Cloud infrastructure, platform hosting, cybersecurity, and analytics providers who process data on our behalf under strict data processing agreements that prohibit any use beyond what 38jl specifies.
• Professional Advisors: Legal counsel, auditors, and compliance consultants, where access to data is necessary for them to provide professional services to 38jl and is subject to professional confidentiality obligations.

38jl retains personal data only for as long as it is necessary for the purposes set out in this Policy, or as required by applicable Philippine law and regulatory obligations. The following general retention periods apply:

• Account data and KYC records: Retained for the duration of your account and for a minimum of five (5) years following account closure, as required under Philippine anti-money laundering regulations.
• Transaction records (deposits, withdrawals, bets): Retained for a minimum of five (5) years in compliance with regulatory requirements.
• Customer support correspondence: Retained for three (3) years from the date of the relevant interaction.
• Marketing opt-in records: Retained until you withdraw your consent, plus one (1) year to demonstrate compliance.
• Technical and security logs: Retained for up to twelve (12) months for security and fraud monitoring purposes.

Once the applicable retention period expires and no legal basis for continued retention exists, 38jl will securely delete or anonymise your personal data so that it can no longer be associated with your identity.

The Philippine Data Privacy Act of 2012 grants you the following rights with respect to your personal data held by 38jl. You can exercise any of these rights at any time by contacting us at support@38jl.best:

To exercise any of these rights, email us at support@38jl.best with the subject line "Data Rights Request" and your registered account email address. 38jl will respond within 10 business days. For complex requests, we may extend this period by up to 20 additional business days and will notify you accordingly.

If you believe 38jl has not adequately addressed your data rights request, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines.

38jl implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, loss, or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and the 38jl platform is encrypted using TLS (Transport Layer Security) 1.2 or higher.
• Encryption at rest: Sensitive personal data stored on our servers — including identity documents and financial information — is encrypted using AES-256 encryption.
• Access controls: Internal access to personal data is limited to staff who require it for their role. Access is controlled through role-based permissions, and all internal access is logged and monitored.
• Two-factor authentication: Available for all 38jl member accounts. We strongly recommend enabling it for maximum account security.
• Regular security audits: The 38jl platform undergoes regular vulnerability assessments and penetration testing by independent security specialists.
• Payment data security: Card and e-wallet payment processing is handled by PCI DSS-compliant payment processors. 38jl does not store full card numbers or mobile wallet credentials on our own servers.

Some of the third-party service providers that 38jl works with — including cloud infrastructure providers and certain payment processors — may process your data on servers located outside the Philippines. When this occurs, 38jl ensures that appropriate safeguards are in place to protect your data, including:

• Contractual data processing agreements that require recipient organisations to maintain a level of data protection equivalent to that required under Philippine law.
• Transferring data only to jurisdictions with recognised data protection frameworks or to organisations with demonstrated compliance programmes.
• Limiting the scope of data transferred to the minimum necessary for the specific service being provided.

If you have questions about the international transfer of your data or the safeguards in place, please contact the 38jl Data Protection Officer at support@38jl.best.

The 38jl platform uses cookies and similar technologies to maintain your session, remember your preferences, and analyse how the platform is used. The types of cookies used are:

• Strictly necessary cookies: Required for the platform to function. These include session cookies that keep you logged in during your visit. These cannot be disabled.
• Functional cookies: Remember your display preferences and other settings so you don't have to re-enter them on each visit.
• Analytics cookies: Collect anonymised, aggregated information about how players navigate the 38jl platform, helping us identify and fix usability issues.
• Security cookies: Used to detect and prevent fraudulent activity, including duplicate account attempts and suspicious login patterns.

38jl does not use third-party advertising cookies or tracking technologies that build profiles for external marketing purposes.

You can manage cookie preferences through your browser settings. Note that disabling cookies beyond the strictly necessary category may affect your experience on the 38jl platform.

38jl may send promotional communications — including information about bonuses, new features, and upcoming events — to members who have explicitly opted in to receive them. The following applies to all marketing communications from 38jl:

• Marketing communications are sent only to members who have opted in, either during account registration or through account settings.
• You can withdraw your consent to marketing communications at any time by updating your notification preferences in your 38jl account settings or by clicking the unsubscribe link in any marketing email.
• Withdrawing consent for marketing communications does not affect your ability to use the platform or receive transactional notifications (such as deposit confirmations and withdrawal alerts).
• 38jl does not share your contact details with third-party marketers for their own promotional use.

In the event of a personal data breach that poses a real risk of serious harm to affected individuals, 38jl will:

• Notify the National Privacy Commission within 72 hours of becoming aware of the breach, as required under the Data Privacy Act.
• Notify affected members directly without undue delay, providing clear information about what data was involved, what 38jl is doing about it, and what steps affected members should take to protect themselves.
• Conduct a full internal investigation and implement remediation measures to prevent recurrence.

Breach notifications to members will be sent to the email address registered on your 38jl account. It is your responsibility to keep your registered email address current so that you receive any such notifications promptly.

38jl may update this Privacy Policy from time to time to reflect changes in our data practices, platform features, or applicable law. When material changes are made, we will notify registered members via their registered email address and display a notice on the platform. The updated Policy will take effect on the date specified in the notice.

Your continued use of the 38jl platform after the effective date of any amended Policy constitutes your acceptance of the revised terms.

If you have any questions, concerns, or requests related to this Privacy Policy or the way 38jl handles your personal data, please contact our Data Protection Officer:

• Email: support@38jl.best (subject: "Privacy Enquiry")
• Platform: 38jl.best — via the live chat support feature available on the platform
• Response time: We aim to respond to all privacy-related enquiries within 10 business days.

This Privacy Policy was last updated on 1 June 2025.