joliok Casino Privacy Policy

Introduction & Scope

This Privacy Policy (the "Policy") describes how joliok (the "Company", "we", "us", or "our"), operator of the online gaming platform at joliok.club (the "Platform"), collects, uses, stores, shares, and protects the personal data of individuals who visit or register on the Platform.

This Policy applies to all registered players, prospective players who have initiated but not completed registration, visitors to the joliok website, and any other individual whose personal data joliok processes in connection with the Platform's services. It applies regardless of whether you are accessing the Platform from Metro Manila, Cebu City, Davao, or any other location in the Philippines.

joliok processes personal data in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its implementing rules and regulations as issued by the National Privacy Commission (NPC). By registering on the Platform and accepting the Terms & Conditions, you acknowledge that you have read and understood this Policy.

Data Controller

joliok is the personal information controller (PIC) in respect of personal data processed in connection with the Platform, as defined under the Data Privacy Act of 2012. As PIC, joliok determines the purposes and means of processing your personal data and bears primary responsibility for ensuring that such processing is lawful, fair, and transparent.

joliok has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with data protection obligations, responding to data subject requests, and liaising with the National Privacy Commission. Contact details for the DPO are provided in Section 14 of this Policy.

Personal Data We Collect

joliok collects the following categories of personal data in connection with the Platform:

joliok does not intentionally collect sensitive personal information as defined under Section 3(l) of the Data Privacy Act — including racial or ethnic origin, political opinions, religious beliefs, or health information — unless specifically required for responsible gaming purposes (for example, where a player voluntarily discloses a gambling-related health condition when requesting self-exclusion).

How We Collect Your Personal Data

joliok collects personal data through the following means:

• Direct provision: Information you enter when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated collection: Technical and usage data collected automatically via server logs, cookies, and similar tracking technologies when you access or interact with the Platform (see Section 10).
• Third-party sources: Identity verification data received from KYC service providers; transaction confirmation data received from GCash, Maya, and Philippine banking institutions; fraud risk signals received from anti-fraud screening services.
• Regulatory sources: Information shared with joliok by competent Philippine regulatory or law enforcement authorities in connection with legal obligations.

Purposes & Legal Bases for Processing

joliok processes personal data only where a lawful basis under the Data Privacy Act exists. The table below sets out the primary processing purposes and their corresponding legal bases:

Data Sharing & Disclosure

joliok does not sell, rent, or trade your personal data to third parties. We share personal data only in the following circumstances, and only to the extent necessary for the stated purpose:

• Service providers and processors: Third-party companies that perform functions on joliok's behalf, including KYC/identity verification providers, payment processors (GCash, Maya, and Philippine banks), cloud hosting and infrastructure providers, customer support platform providers, fraud screening services, and email/SMS communication platforms. All processors are bound by data processing agreements that restrict their use of your data to joliok's instructions.
• Game providers: Licensed game software providers (such as JILI, PG Soft, Pragmatic Play, and live dealer studio operators) may receive technical session data necessary to deliver and authenticate game sessions. These providers do not receive full personal profiles.
• Regulatory and law enforcement authorities: joliok will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Bureau of Investigation (NBI), the Philippine National Police (PNP), and other competent authorities when required to do so by law, court order, or valid legal process.
• Professional advisors: Legal counsel, auditors, and insurers, under strict obligations of confidentiality, in connection with legal proceedings, audits, or insurance claims.
• Corporate restructuring: In the event of a merger, acquisition, or sale of all or substantially all of joliok's assets, your personal data may be transferred to the successor entity. You will be notified of any such transfer.

joliok requires all third parties to respect the security of your personal data and to handle it in accordance with applicable Philippine data protection law. joliok does not allow third-party service providers to use your personal data for their own independent marketing purposes.

International Data Transfers

Some of joliok's service providers and game technology partners operate infrastructure outside the Philippines. Where personal data is transferred to a country that has not been recognised by the NPC as providing adequate data protection standards, joliok will ensure that appropriate safeguards are in place — including, where applicable, standard contractual clauses approved by the NPC or other legally recognised transfer mechanisms.

joliok will not transfer your personal data internationally for purposes beyond those described in this Policy, and will only do so with service providers who are contractually bound to process your data securely and lawfully.

Data Retention

joliok retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and regulation. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of your active account plus 5 years after account closure, in accordance with AML record-keeping obligations and applicable gaming regulations.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, as required by Philippine AML regulations and PAGCOR licensing conditions.
• KYC documents: Retained for a minimum of 5 years after submission, or longer if required by a regulatory authority in connection with an investigation or proceeding.
• Customer support communications: Retained for 3 years from the date of the interaction, unless the communication relates to an unresolved complaint or legal matter.
• Marketing consent records: Retained for 5 years from the date of consent or withdrawal of consent, to demonstrate compliance with consent obligations.
• Technical and usage logs: Typically retained for 12 months, unless a longer period is required for security investigations or regulatory purposes.

Upon expiry of the applicable retention period, joliok will securely delete or anonymise your personal data. Anonymised data that can no longer identify you may be retained indefinitely for statistical or research purposes.

Security Measures

joliok implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Key security measures include:

• TLS 1.3 encryption for all data in transit between the Platform and end-user devices.
• Encryption at rest for sensitive personal data and financial records stored on joliok's servers.
• Role-based access controls that restrict staff access to personal data to those with a legitimate operational need.
• Multi-factor authentication for administrative access to data systems.
• Regular security vulnerability assessments and penetration testing of the Platform.
• Incident response procedures that include notification to affected data subjects and the NPC within 72 hours of becoming aware of a personal data breach that is likely to result in risk to data subjects, as required under the Data Privacy Act.

While joliok employs industry-standard security measures, no digital platform can guarantee absolute security. You are responsible for maintaining the security of your own joliok account credentials, including your password and OTPs. Do not share your credentials with anyone. joliok staff will never ask for your password.

Cookies & Tracking Technologies

joliok uses cookies and similar tracking technologies (such as web beacons and local storage) to support the operation of the Platform, to remember your preferences, to analyse usage patterns, and to detect fraud. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled without impairing your ability to use the Platform.
• Functional cookies: Used to remember your preferences — such as language settings and responsible gaming limits — across sessions.
• Analytics cookies: Used to collect aggregated, anonymised data about how visitors navigate the Platform, which games are most popular, and where technical issues occur. This data is used to improve the Platform.
• Security cookies: Used to detect automated access, fraudulent login attempts, and other anomalous activity that may indicate a security threat.

joliok does not use third-party advertising cookies or deploy cross-site tracking technologies for the benefit of external advertisers. You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not affect your ability to play games or access your account.

Minors & Age Restriction

joliok is strictly restricted to persons aged 21 years and above. The Platform does not knowingly collect personal data from any individual under the age of 21. If joliok becomes aware that personal data has been collected from a person under 21, that account will be immediately closed and all associated personal data will be deleted, subject to any retention obligations arising from regulatory reporting requirements.

If you are a parent or guardian and believe that a minor under your care has provided personal data to joliok, please contact our Data Protection Officer immediately using the contact details in Section 14. We will investigate and take appropriate remedial action without delay.

Your Data Subject Rights

Under the Data Privacy Act of 2012, as a data subject you have the following rights in respect of your personal data held by joliok. These rights are enforceable and joliok is legally obligated to respond to verified requests within the timeframes prescribed by the NPC.

Marketing Communications

Where you have consented to receive marketing communications from joliok, we may send you promotional emails and SMS messages about new games, current offers, reload bonuses, and VIP programme updates. Your consent is recorded at the time of registration and is entirely voluntary.

You may withdraw your marketing consent at any time through your joliok account settings (Account → Notifications → Marketing Preferences), or by requesting opt-out via the joliok support team. Withdrawal of marketing consent does not affect the lawfulness of any communications sent prior to withdrawal, and does not affect any other aspect of your joliok account.

Note that certain service communications — such as transaction confirmations, OTP messages, security alerts, and account-related notifications — are not marketing communications and cannot be unsubscribed from while your account remains active, as they are necessary for the performance of the contract.

Data Protection Officer

joliok has appointed a Data Protection Officer (DPO) who is responsible for overseeing this Policy, managing data subject requests, and liaising with the National Privacy Commission. To exercise any of your data subject rights, or to raise a data privacy concern, please contact the joliok DPO as follows:

• Role: Data Protection Officer, joliok
• Email: [email protected] (subject line: "Data Privacy Request")
• Response time: joliok will acknowledge your request within 3 business days and will provide a substantive response within 15 business days, extendable by a further 15 days where the complexity of the request so requires.

Please include your full name, registered mobile number or email address, and a clear description of your request. We may need to verify your identity before processing the request.

Complaints

If you believe that joliok has failed to handle your personal data in accordance with this Policy or the Data Privacy Act of 2012, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines. The NPC accepts complaints from data subjects and has authority to investigate, mediate, and impose sanctions on personal information controllers that breach the DPA.

Before escalating to the NPC, we strongly encourage you to contact joliok's DPO directly, as many privacy concerns can be resolved quickly through our internal process. If you are not satisfied with our response, you are free to escalate to the NPC without restriction.

Amendments to This Policy

joliok reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or Platform features. Where changes are material, joliok will provide notice to registered players via email or a prominent on-Platform notice at least 7 calendar days prior to the amended Policy taking effect. For minor updates, the "Last updated" date at the top of this page will be revised.

Your continued use of the joliok Platform after the effective date of any amendment constitutes your acknowledgement of the revised Policy. We encourage you to review this page periodically to stay informed about how joliok protects your data.