Privacy
Policy

1. Introduction

This Privacy Policy ("Policy") describes how nojili ("nojili," "we," "us," or "our") collects, uses, stores, shares, and protects the personal information of users ("you," "Player," or "User") who access or use the nojili online gaming platform at nojili.net and any associated mobile applications (collectively, the "Platform").

nojili is committed to protecting your privacy and handling your personal data with transparency, integrity, and in full compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission (NPC). Our data practices are also subject to oversight by the Philippine Amusement and Gaming Corporation (PAGCOR) as part of our regulatory obligations as a licensed gaming operator.

By registering an account on nojili or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, please discontinue use of the Platform and contact our support team to close your account.

This Policy should be read together with nojili's Terms & Conditions and Responsible Gaming Policy, which are incorporated by reference.

2. Data Controller

nojili is the personal information controller responsible for your data collected through the Platform. As the data controller, nojili determines the purposes and means of processing your personal information and is accountable for ensuring that such processing complies with applicable Philippine privacy laws.

nojili has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable data privacy regulations. Contact details for the DPO are provided in Section 15 of this Policy.

3. Data We Collect

nojili collects the following categories of personal data:

nojili does not collect sensitive personal information beyond what is strictly required for KYC and regulatory compliance. We do not collect biometric data beyond identity document photographs required for verification purposes.

4. How We Collect Your Data

nojili collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically when you access the Platform, including through cookies, log files, and session tracking technologies.
• Third-party sources: Identity verification data from KYC service providers; payment data from GCash, PayMaya, and banking partners; fraud screening data from security service providers. All third-party data sources are contractually bound to comply with applicable privacy laws.
• Regulatory sources: Information received from PAGCOR or other Philippine government authorities in connection with our regulatory obligations, including self-exclusion registers.

5. How We Use Your Data

nojili processes your personal data for the following purposes:

• Creating and managing your nojili account, including identity verification and age confirmation (21+ requirement).
• Processing deposits and withdrawals through approved Philippine payment channels (GCash, PayMaya, bank transfer).
• Complying with PAGCOR licensing conditions, anti-money laundering (AML) obligations, and other applicable Philippine regulatory requirements.
• Detecting, investigating, and preventing fraud, cheating, money laundering, and other prohibited activities on the Platform.
• Providing customer support and resolving disputes or complaints.
• Administering bonuses, promotions, and loyalty programmes.
• Monitoring gameplay for responsible gaming purposes, including enforcing deposit limits, self-exclusion orders, and session controls.
• Sending transactional communications (account notifications, deposit/withdrawal confirmations, security alerts). Marketing communications are sent only with your explicit consent and you may opt out at any time.
• Improving Platform performance, user experience, and game offerings through aggregated analytics.
• Complying with legal obligations, including responding to lawful requests from Philippine courts, law enforcement, or regulatory authorities.

6. Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, nojili processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you (the Terms & Conditions), including account management, payment processing, and game provision.
• Legal obligation: Processing required to comply with PAGCOR regulations, AML laws, tax obligations, and other applicable Philippine legal requirements.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where such interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have provided explicit, informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing & Disclosure

nojili does not sell, rent, or trade your personal data. We share your data only in the following circumstances:

• Service providers: KYC verification providers, payment processors (GCash, PayMaya, banking partners), cloud hosting providers, customer support platforms, and fraud detection services. All service providers are bound by data processing agreements requiring them to process your data only on nojili's instructions and in compliance with applicable privacy laws.
• Regulatory authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), and other Philippine government bodies, where disclosure is required by law or regulatory directive.
• Law enforcement: Philippine law enforcement agencies, courts, or other public authorities where disclosure is required by a valid legal order or where nojili reasonably believes disclosure is necessary to prevent imminent harm or illegal activity.
• Business transfers: In the event of a merger, acquisition, or sale of nojili's business assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. You will be notified of any such transfer.

nojili does not transfer your personal data to recipients outside the Philippines except where necessary for the operation of cloud infrastructure or KYC services, and only where adequate data protection safeguards are in place as required by the NPC.

8. Data Retention

nojili retains your personal data for as long as your account is active and for a period thereafter as required by applicable law and regulatory obligations:

• Account and KYC data: Retained for a minimum of five (5) years after account closure, as required by PAGCOR regulations and Philippine AML laws.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AML and tax record-keeping requirements.
• Support communications: Retained for three (3) years from the date of the communication, or longer if related to an unresolved dispute or legal proceeding.
• Technical and usage logs: Retained for twelve (12) months for security and fraud monitoring purposes, after which they are anonymised or deleted.
• Marketing consent records: Retained for the duration of your account and for three (3) years after account closure as evidence of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with nojili's data disposal procedures.

9. Data Security

nojili implements appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and nojili's servers.
• Encryption of sensitive data at rest, including KYC documents and financial information.
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis.
• Multi-factor authentication for all internal systems that process personal data.
• Regular security audits, penetration testing, and vulnerability assessments conducted by independent third parties.
• 24/7 automated monitoring for suspicious access patterns and potential data breaches.
• Incident response procedures aligned with NPC breach notification requirements (72-hour notification for high-risk breaches).

While nojili takes all reasonable steps to protect your data, no internet transmission or electronic storage system is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying nojili immediately if you suspect unauthorised access to your account.

10. Cookies & Tracking Technologies

nojili uses cookies and similar technologies (local storage, session tokens) to operate and improve the Platform. The following types of cookies are used:

nojili does not use third-party advertising or cross-site tracking cookies. You can manage or disable non-essential cookies through your browser settings. Note that disabling essential cookies may affect Platform functionality.

11. Your Data Privacy Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by nojili:

• Right to be informed: The right to know what personal data nojili collects and how it is processed — as set out in this Policy.
• Right of access: The right to request a copy of the personal data nojili holds about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure: The right to request deletion of your personal data, subject to nojili's legal retention obligations under PAGCOR regulations and AML laws.
• Right to object: The right to object to processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.
• Right to data portability: The right to receive your personal data in a structured, commonly used format where technically feasible.
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

12. Minors & Age Restriction

The nojili Platform is strictly intended for individuals aged 21 years and above, in compliance with Philippine gaming regulations. nojili does not knowingly collect personal data from individuals under the age of 21.

If nojili discovers that personal data has been collected from a person under 21, the account will be immediately suspended, all data will be deleted, and any funds will be returned to the depositing payment method after verification. If you believe a minor has registered on the Platform, please contact our support team immediately.

nojili implements age verification as a mandatory step during account registration and KYC processes to enforce this restriction.

13. Cross-Border Data Transfers

nojili primarily stores and processes your personal data within the Philippines. In limited circumstances, data may be processed outside the Philippines — for example, where nojili uses cloud infrastructure or KYC service providers with servers in other jurisdictions.

Any cross-border transfer of personal data is conducted only where:

• The recipient country provides an adequate level of data protection as recognised by the NPC; or
• Appropriate safeguards are in place, such as contractual clauses approved by the NPC; or
• The transfer is necessary for the performance of our contract with you or for compliance with a legal obligation.

You may request information about the specific safeguards applicable to any cross-border transfer of your data by contacting our Data Protection Officer.

14. Changes to This Policy

nojili reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. Where changes are material, we will notify you by email to your registered address or via an in-platform notification at least seven (7) days before the changes take effect.

The "Last Updated" date at the top of this Policy indicates when it was most recently revised. We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Policy.

15. Contact & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or nojili's data practices, please contact our Data Protection Officer:

• DPO Email: privacy@nojili.net
• General Support: support@nojili.net
• Response Time: Within 30 calendar days of receiving your written request
• Languages: English and Filipino

If you are not satisfied with nojili's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines through their official channels.