sajili Privacy Policy — Your Data, Your Rights

1 Introduction

This Privacy Policy ("Policy") applies to all personal data collected, processed, and stored by sajili in connection with the operation of the online gaming platform accessible at sajili.cam. It describes the types of personal information we collect from players and prospective players, the purposes for which that information is used, the parties with whom it may be shared, the security measures we apply to protect it, and the rights you hold as a data subject under Philippine law.

sajili is licensed and regulated by the Philippine Amusement and Gaming Corporation (PAGCOR) and is fully subject to the provisions of the Data Privacy Act of 2012 (Republic Act 10173) and the implementing rules and regulations issued thereunder by the National Privacy Commission (NPC). This Policy is designed to satisfy the transparency and notice requirements imposed on personal information controllers under those laws.

By registering an account on sajili or by continuing to use any of our services, you acknowledge that you have read and understood this Policy. If you do not agree with the terms of this Policy, you must not use the sajili platform.

2 Data Controller Identity

For the purposes of the Data Privacy Act of 2012 and NPC regulations, sajili acts as the Personal Information Controller in respect of personal data collected through the sajili platform. As Personal Information Controller, sajili determines the purposes and means of processing personal data obtained from platform users.

sajili has appointed a designated Data Protection Officer (DPO) in compliance with NPC Circular 16-01. The DPO is responsible for overseeing sajili's data protection compliance program, handling data subject requests, and serving as the primary point of contact with the National Privacy Commission. Contact details for the sajili DPO are set out in Section 14 of this Policy.

3 Personal Data We Collect

3.1 Registration and Account Data

When you register a sajili account, we collect the following information:

• Full legal name;
• Date of birth;
• Philippine mobile number and/or email address;
• Residential address (barangay, city or municipality, province);
• Preferred payment method and associated account identifiers (e.g., GCash mobile number);
• Username and encrypted password.

3.2 Identity Verification (KYC) Data

To comply with PAGCOR licensing requirements and the Anti-Money Laundering Act of 2001 (RA 9160, as amended), sajili collects the following documentary information during the Know Your Customer (KYC) process:

• Government-issued photo identification (passport, PhilSys ID, LTO driver's license, UMID, Voter's ID, or PRC ID);
• Proof of residential address where required;
• Source of funds documentation in cases required under AML risk-based assessment procedures;
• Selfie or liveness verification image for identity confirmation.

3.3 Transaction and Gaming Data

In the course of your use of the sajili platform, we automatically collect and record:

• Deposit and withdrawal transaction history, amounts, timestamps, and payment method used;
• Betting history, including game type, wager amount, outcome, and timestamp;
• Bonus credits claimed and wagering activity against those credits;
• Account balance history.

3.4 Technical and Device Data

When you access the sajili platform, we collect certain technical data automatically, including:

• IP address and geolocation data derived therefrom;
• Device type, operating system, and browser type and version;
• Session duration, page views, and navigation data within the platform;
• Login timestamps and session identifiers;
• Cookie and similar tracking technology data as described in Section 8.

3.5 Communications Data

When you contact sajili's support team via live chat, email, or any other channel, we retain records of those communications, including the content of messages exchanged, for quality assurance, dispute resolution, and regulatory record-keeping purposes.

4 How We Collect Your Data

sajili collects personal data through the following channels:

• Directly from you — via the account registration form, KYC submission process, deposit and withdrawal requests, and communications with our support team;
• Automatically — through cookies, web server logs, and platform analytics tools as you navigate and interact with the sajili platform;
• From third-party payment providers — transaction confirmation data received from GCash, Maya, BPI, BDO, and other payment processors when you make a deposit or withdrawal;
• From identity verification partners — where sajili uses a third-party KYC verification service provider to validate government-issued identification documents;
• From fraud prevention services — device fingerprint data, behavioral analytics, and risk signals from third-party fraud detection tools used to protect the integrity of the sajili platform.

5 Lawful Basis for Processing

Under the Data Privacy Act of 2012, every processing activity carried out by sajili requires a lawful basis. The bases on which sajili relies are:

• Contractual necessity: Processing required to perform the contract between sajili and the player — including account creation, gaming services, deposits, and withdrawals;
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, AMLA obligations, NPC requirements, and other applicable Philippine laws;
• Legitimate interests: Processing for fraud prevention, platform security, and internal analytics, where those interests are not overridden by the player's data protection rights;
• Consent: Where sajili relies on consent — for example, for marketing communications — that consent is obtained separately, is specific and informed, and may be withdrawn at any time.

6 How sajili Uses Your Personal Data

sajili uses the personal data collected for the following purposes:

• Creating and managing your sajili player account;
• Verifying your identity and age (21+) in compliance with PAGCOR and AML requirements;
• Processing deposits and withdrawals via your chosen payment method;
• Delivering gaming services and maintaining your bet history and account records;
• Administering bonuses, promotions, and loyalty programs;
• Detecting, preventing, and investigating fraud, money laundering, and other prohibited conduct;
• Responding to player support queries and resolving disputes;
• Complying with PAGCOR reporting obligations and cooperating with regulatory inquiries;
• Monitoring and enforcing responsible gaming limits and self-exclusion arrangements;
• Improving the sajili platform through aggregate usage analytics;
• Sending transactional communications (account confirmations, withdrawal notifications, security alerts);
• Sending promotional communications where you have given explicit consent or where permitted under applicable law.

7 Data Sharing and Third-Party Disclosure

sajili does not sell, rent, or trade your personal data to third parties for their commercial or marketing purposes. Personal data is shared with third parties only in the following circumstances:

7.1 Service Providers

sajili engages third-party service providers who process personal data on its behalf for purposes including payment processing, KYC verification, fraud prevention, customer support software, cloud infrastructure, and platform analytics. All service providers are contractually bound to process data only on sajili's instructions and to maintain appropriate security standards consistent with Philippine law.

7.2 Regulatory and Law Enforcement Authorities

sajili will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, or other competent Philippine authorities when required by law, court order, or regulatory direction. sajili will cooperate fully with lawful government requests for player information in connection with criminal investigations or regulatory enforcement proceedings.

7.3 Game Content Providers

Certain game providers integrated into the sajili platform may receive player identifiers (such as anonymized session tokens) necessary to deliver their games. No directly identifiable personal data beyond what is strictly necessary for game delivery is shared with game providers.

7.4 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of sajili's business or assets, personal data held by sajili may form part of the assets transferred to a successor entity, subject to that entity's commitment to maintain protections equivalent to those in this Policy.

8 Cookies and Tracking Technologies

sajili uses cookies and similar technologies (including web beacons and session identifiers) to operate and improve the platform. The categories of cookies used are:

• Strictly necessary cookies: Required for core platform functionality such as maintaining your login session, accessing your account, and processing transactions. These cannot be disabled without impairing platform functionality.
• Functional cookies: Remember your preferences, such as language settings and display options, to improve your experience across sessions.
• Analytics cookies: Collect aggregate, anonymized data about how players navigate and use the sajili platform, enabling sajili to improve performance and usability. No personally identifiable information is included in analytics data transmitted externally.
• Security cookies: Used for fraud detection, session integrity verification, and protection against automated bot activity on the sajili platform.

You may manage cookie preferences through your browser settings. Note that disabling cookies beyond strictly necessary categories may affect the functionality of certain sajili platform features.

9 Data Retention

sajili retains personal data for as long as is necessary for the purposes for which it was collected, having regard to our regulatory obligations. The following general retention periods apply:

• Account and KYC data: Retained for a minimum of five (5) years following account closure, consistent with the record-keeping obligations under the Anti-Money Laundering Act of 2001 (RA 9160, as amended) and PAGCOR requirements;
• Transaction and betting records: Retained for a minimum of five (5) years for regulatory reporting and dispute resolution purposes;
• Support communications: Retained for two (2) years from the date of the communication, unless a longer period is required for ongoing dispute resolution;
• Technical and session logs: Retained for a maximum of 12 months from collection unless a security incident investigation requires extended retention;
• Marketing consent records: Retained for the duration of the marketing relationship plus three (3) years to evidence consent compliance.

Upon expiry of applicable retention periods, sajili securely deletes or anonymizes personal data in a manner that prevents reconstruction of the original information.

10 Security Measures

sajili implements a layered set of technical and organizational security measures to protect personal data against unauthorized access, loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between the player's device and sajili's servers;
• AES-256 encryption at rest for sensitive personal data stored on sajili's infrastructure;
• Role-based access controls ensuring that only authorized personnel can access player data, limited to the scope required for their function;
• Multi-factor authentication for sajili staff accounts with access to player data systems;
• Continuous intrusion detection and monitoring of sajili's network infrastructure;
• Regular third-party penetration testing and vulnerability assessments of the sajili platform;
• Secure data disposal procedures for decommissioned hardware and expired data;
• Staff training on data privacy obligations and security best practices.

11 Your Data Subject Rights

Under the Data Privacy Act of 2012 and NPC regulations, you are entitled to the following rights in relation to personal data held by sajili:

To exercise any of the above rights, contact the sajili Data Protection Officer using the details in Section 14. sajili will respond to valid requests within the timeframes prescribed by NPC regulations. Requests may be subject to identity verification before processing.

12 Children's Privacy and Age Restriction

Age verification is conducted during account registration and as part of the KYC process. If sajili discovers that personal data has been collected from a person under the age of 21, it will immediately close the associated account, delete the personal data to the extent permitted by regulatory obligations, and refund any net deposits in accordance with applicable regulations.

Parents and guardians are encouraged to use parental control tools to prevent minors from accessing gambling platforms, and to monitor internet usage by persons under 21 in their household.

13 Amendments to This Policy

sajili reserves the right to amend this Privacy Policy at any time. Where changes are material — for example, where we introduce a new category of data processing or a new sharing arrangement — sajili will notify registered players by email or in-platform notification no less than seven (7) calendar days before the amended Policy takes effect.

The "Last Updated" date at the top of this page reflects the most recent revision. We encourage you to review this Policy periodically. Continued use of the sajili platform after the effective date of any amendment constitutes your acknowledgment of the updated Policy.

If a proposed amendment relates to a processing activity for which sajili relies on your consent, we will seek fresh consent before the amendment takes effect in respect of that activity.

14 Contact and Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy, your personal data held by sajili, or the exercise of your data subject rights, please contact the sajili Data Protection Officer through the following channels:

sajili will acknowledge data subject requests within three (3) business days and will endeavor to respond substantively within the timeframes set by NPC regulations. Where requests are complex or numerous, a response period extension of up to one additional month may apply, with notice provided to the requester.

If you remain dissatisfied after engaging with sajili's Data Protection Officer, you are entitled to escalate your concern to the National Privacy Commission of the Philippines at privacy.gov.ph.