Privacy Policy

28phjoy is an online casino and sports betting platform operated under PAGCOR (Philippine Amusement and Gaming Corporation) regulation, serving Filipino players across the Philippines. For the purposes of Philippine data privacy law, 28phjoy acts as the Personal Information Controller (PIC) in respect of all personal data collected through the 28phjoy.app platform and its associated services.

As a PAGCOR-regulated operator, 28phjoy is subject to both the gaming regulatory framework administered by PAGCOR and the data privacy obligations established under Republic Act No. 10173 — the Data Privacy Act of 2012 — together with its Implementing Rules and Regulations (IRR) as issued by the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy applies to all players who access 28phjoy from any location in the Philippines, including Manila, Cebu, Davao, Quezon City, Makati, and all other regions. It covers all personal data collected through desktop and mobile access to the platform.

28phjoy collects only the personal data that is necessary for the lawful, safe, and effective operation of the platform and fulfillment of our regulatory obligations. The categories of personal data we collect are described in the table below:

28phjoy collects personal data through the following channels and mechanisms:

Direct Collection

The majority of personal data held by 28phjoy is information you provide to us directly. This includes:

• Information entered during account registration, including your name, date of birth, email address, and mobile number.
• Identity documents and selfie verification images submitted during the KYC process.
• Payment method details provided when making a deposit or requesting a withdrawal.
• Preferences and settings you configure within your 28phjoy account, including responsible gaming tool selections such as deposit limits and cooling-off periods.
• Content you submit through live chat, email correspondence, or any other customer support channel.

Automatic Collection

When you access and use the 28phjoy platform, certain technical and usage data is collected automatically through server logs, cookies, and similar technologies. This includes your IP address, device identifiers, browser fingerprint, session start and end times, pages visited within the platform, and in-game behavioral data linked to your account.

Third-Party Sources

In limited circumstances, 28phjoy may receive personal data about you from authorized third-party service providers. These include licensed KYC and identity verification service providers who validate the authenticity of documents you submit, payment processors who confirm the status of deposit and withdrawal transactions, and fraud prevention services that cross-reference account data against known risk indicators. Any data received from third parties is handled in accordance with this Privacy Policy and subject to the same protections as data you provide directly.

28phjoy uses your personal data for clearly defined purposes. We do not use personal data for any purpose that is incompatible with the purpose for which it was originally collected. The primary purposes for which 28phjoy processes player data are:

• Account Creation and Management: To register your 28phjoy account, verify your identity, maintain your account profile, and enable you to log in securely to the platform.
• KYC and Age Verification: To confirm that you are at least 21 years of age and to verify your identity as required by PAGCOR regulations and Philippine anti-money laundering legislation. This is a legal obligation and cannot be waived.
• Payment Processing: To process your deposits via GCash, Maya, BPI, BDO, UnionBank, Metrobank, 7-Eleven Cliqq, USDT TRC20, Coins.ph, and other accepted methods, and to facilitate the prompt processing of withdrawal requests to your registered payment method.
• Game Delivery and Platform Operation: To deliver JILI slots, live dealer games, online bingo, mines, sports betting, and all other platform content to your device, and to record gaming activity for account integrity and dispute resolution purposes.
• Responsible Gaming Compliance: To implement and monitor responsible gaming tools you have activated, including deposit limits, self-exclusion periods, cooling-off intervals, and session time limits, and to flag gaming patterns that may indicate problem gambling behavior in accordance with PAGCOR responsible gaming requirements.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, unauthorized account access, bonus abuse, money laundering, and other prohibited conduct as defined in the 28phjoy Terms & Conditions.
• Regulatory Compliance: To fulfill obligations imposed on 28phjoy by PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine regulatory and law enforcement authorities.
• Customer Support: To provide effective and responsive support to players who contact 28phjoy through live chat, email, or other support channels, and to maintain records of support interactions for quality assurance and dispute resolution purposes.
• Marketing Communications (with your consent): To send you promotional offers, bonus notifications, and platform updates if you have opted in to receive marketing communications from 28phjoy. You may withdraw your marketing consent at any time through your account settings without affecting the lawfulness of prior processing.
• Platform Improvement: To analyze aggregated and anonymized usage data to improve the performance, stability, and user experience of the 28phjoy platform.

Under the Data Privacy Act of 2012, 28phjoy processes your personal data on the following legal bases depending on the specific processing activity:

• Contractual Necessity: Processing your identity data, contact data, financial data, and transaction data is necessary to perform the contract between you and 28phjoy — that is, to provide you with access to the gaming platform, process your deposits and withdrawals, and deliver the services you have registered for.
• Legal Obligation: Processing your identity documents, KYC data, and transaction records is required by applicable Philippine law — including the Anti-Money Laundering Act (AMLA), its amendments (AMLA-IRR), and PAGCOR licensing regulations — to which 28phjoy is legally subject as a licensed operator.
• Legitimate Interests: Processing technical data and gaming activity data for fraud prevention, security monitoring, and platform performance improvement is carried out on the basis of 28phjoy's legitimate interests as a regulated gaming operator, provided those interests are not overridden by your fundamental rights and freedoms as a data subject.
• Consent: Processing your data for direct marketing communications is carried out only on the basis of your freely given, specific, and informed consent, which you may withdraw at any time.

28phjoy may share your personal data with the following categories of recipients in the circumstances described:

Payment Service Providers

To process your deposits and withdrawals, 28phjoy shares necessary financial data with licensed payment processors operating GCash, Maya, BPI, BDO, UnionBank, Metrobank, 7-Eleven Cliqq, USDT TRC20 blockchain networks, and Coins.ph integrations. Each payment processor is a separately licensed entity subject to its own regulatory and data protection obligations.

KYC and Identity Verification Providers

Your identity documents and verification data are processed by licensed third-party KYC service providers who verify the authenticity of submitted documents and cross-reference identity information against watchlists maintained for anti-money laundering and counter-terrorism financing compliance purposes.

Game Content Providers

JILI Games and other third-party game studios whose content is available on 28phjoy may receive technical identifiers (such as a pseudonymous player ID) necessary to initialize game sessions, record wager outcomes, and calculate real-time game results. These providers do not receive your full identity data, contact details, or financial information.

Regulatory and Law Enforcement Authorities

28phjoy is legally required to disclose certain player data to PAGCOR as part of its licensing obligations, to the Anti-Money Laundering Council (AMLC) in the event of a covered or suspicious transaction report, and to other competent Philippine authorities in response to a lawful order, subpoena, or regulatory directive. 28phjoy will notify you of such disclosures where permitted by law to do so.

Fraud Prevention and Risk Management Services

Certain technical and behavioral data may be shared with specialist fraud detection service providers to identify and prevent account takeovers, payment fraud, coordinated bonus abuse, and other platform security threats. Data shared with these providers is subject to strict contractual data protection obligations.

28phjoy retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The general retention periods applied by 28phjoy are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that renders re-identification impossible. Where a legal dispute or regulatory investigation is ongoing at the time a retention period expires, data relevant to that matter will be retained until the matter is resolved.

28phjoy uses cookies and similar tracking technologies to enable the core functionality of the platform, maintain your login session, and analyze platform usage patterns. Cookies are small text files stored on your device when you visit 28phjoy.app.

Types of Cookies Used

• Essential Cookies: Required for the platform to function. These include session cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without impairing platform functionality.
• Performance Cookies: Used to collect anonymized data about how players navigate and use the 28phjoy platform, including which pages are visited most frequently and how long sessions last. This data helps 28phjoy improve platform performance and user experience.
• Functional Cookies: Used to remember your preferences and settings within the platform, such as your chosen language, notification preferences, and responsible gaming tool configurations.
• Security Cookies: Used by 28phjoy's fraud prevention systems to identify suspicious behavioral patterns that may indicate unauthorized account access, bot activity, or coordinated abuse attempts.

28phjoy does not use third-party advertising cookies or behavioral tracking cookies for the purpose of building advertising profiles or targeting you with ads on external websites. You may manage cookie preferences through your browser settings, but disabling essential cookies will impair your ability to use the 28phjoy platform.

28phjoy implements a layered approach to data security that combines technical, organizational, and procedural controls designed to protect personal data against unauthorized access, disclosure, alteration, or destruction. Key security measures include:

• Encryption in Transit: All data transmitted between your device and 28phjoy servers is encrypted using TLS (Transport Layer Security) protocols. The 28phjoy.app platform is accessible only via HTTPS.
• Encryption at Rest: Sensitive personal data — including identity documents, payment method details, and account credentials — is encrypted at rest using AES-256 or equivalent encryption standards.
• Access Controls: Access to personal data within 28phjoy's systems is restricted on a strict need-to-know basis. Personnel with access to player data are subject to confidentiality obligations and undergo background screening.
• Two-Factor Authentication: 28phjoy supports and encourages the use of two-factor authentication (2FA) on player accounts to reduce the risk of unauthorized access.
• Intrusion Detection: 28phjoy maintains network monitoring and intrusion detection systems to identify and respond to unauthorized access attempts in real time.
• Data Breach Response: In the event of a personal data breach affecting your information, 28phjoy will notify the National Privacy Commission (NPC) within 72 hours as required by the Data Privacy Act, and will notify affected players promptly where the breach is likely to result in a high risk to their rights and freedoms.

As a data subject under the Philippine Data Privacy Act of 2012, you hold the following rights in relation to your personal data processed by 28phjoy. These rights may be exercised by contacting the 28phjoy Data Protection Officer as described in Section 13.

28phjoy will respond to data rights requests within 30 days of receipt. Complex requests may require up to 60 days, in which case 28phjoy will notify you of the extension and the reason for it within the initial 30-day period.

28phjoy implements age verification as a mandatory step during account registration and during the KYC process. If 28phjoy discovers or has reason to believe that personal data has been collected from a person under 21 years of age — whether through fraudulent registration or any other means — the following actions will be taken immediately:

• The account will be permanently closed without prior notice.
• Any deposits made by the underage individual will be refunded to the originating payment method, net of any amounts won using those funds, in accordance with PAGCOR guidelines for underage access incidents.
• All personal data associated with the underage account will be securely deleted, subject to any mandatory retention obligations under PAGCOR or AMLA regulations applicable to the specific circumstances of the case.
• The incident will be reported to PAGCOR as required under the applicable licensing framework.

Parents and guardians who believe a minor under their care may have registered a 28phjoy account are encouraged to contact 28phjoy customer support immediately via live chat or at [email protected] to report the matter. 28phjoy will investigate and act promptly on all such reports.

28phjoy may update this Privacy Policy from time to time to reflect changes in our data processing practices, updates to applicable Philippine law, amendments to PAGCOR regulatory requirements, or improvements in our platform's privacy governance framework. The date of the most recent update is always displayed at the top of this page.

When material changes are made to this Privacy Policy — that is, changes that affect how we collect, use, or share your personal data in ways that may meaningfully impact your rights — 28phjoy will notify registered players by email and/or through a prominent notice on the 28phjoy platform at least fourteen (14) days before the updated policy takes effect.

Your continued use of the 28phjoy platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with the updated Privacy Policy, you should discontinue use of the platform and may request closure of your account by contacting customer support.

Minor changes — such as clarifications of existing language, corrections of typographical errors, or formatting updates that do not alter the substance of the policy — may be made without prior notice. The "Last Updated" date at the top of the page will always reflect when any change, major or minor, was last made.

28phjoy has appointed a Data Protection Officer (DPO) as required under the Data Privacy Act of 2012 and its Implementing Rules and Regulations. The DPO is responsible for overseeing 28phjoy's compliance with Philippine data privacy law, handling data subject rights requests, and serving as the primary point of contact with the National Privacy Commission (NPC).

If you wish to exercise any of your data rights under Section 10 of this Privacy Policy, have a question about how 28phjoy processes your personal data, or need to report a potential data privacy concern, you may contact 28phjoy through any of the following channels:

When submitting a data rights request, please include your registered email address, the nature of your request, and any relevant details that will help us locate and process your data efficiently. 28phjoy may need to verify your identity before acting on a rights request to ensure that personal data is not disclosed to or deleted at the request of an unauthorized person.