oojl Privacy Policy

01 Introduction

oojl is committed to the responsible and transparent processing of your personal data. We collect only the information we genuinely need to provide you with a safe, compliant, and enjoyable gaming experience on the oojl platform. This Policy explains the full lifecycle of personal data at oojl — from initial collection at registration through to secure deletion upon account closure.

By creating an oojl account or otherwise using the oojl platform, you acknowledge that you have read and understood this Policy. If you do not agree with how oojl processes personal data as described herein, you should not use the oojl platform. For privacy-related questions, please contact us at the details provided in Section 15.

02 Who We Are (Data Controller)

For the purposes of the Data Privacy Act of 2012, oojl is the Personal Information Controller (PIC) in respect of all personal data collected through the oojl platform at oojl.club.

oojl operates under the regulatory oversight of the Philippine Amusement and Gaming Corporation (PAGCOR). As a PAGCOR-regulated operator, oojl is subject to Anti-Money Laundering (AML) reporting obligations under Republic Act No. 9160, as amended, and the regulations of the Anti-Money Laundering Council (AMLC). Some data processing activities are therefore mandatory by law rather than discretionary.

03 Personal Data We Collect

The categories of personal data oojl collects are set out in the table below. We do not collect data beyond what is necessary for the purposes described in Section 5.

oojl does not collect sensitive personal information as defined under Section 3(l) of the Data Privacy Act (such as health data, political affiliations, or racial/ethnic origin) unless specifically required by law or expressly provided by the Player for responsible gaming purposes (e.g., self-exclusion requests citing a gambling disorder).

04 How We Collect Personal Data

oojl collects personal data through the following channels:

• Direct collection: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or updating account settings on the oojl platform.
• Automated collection: Technical and device data collected automatically when you access the oojl platform, including via cookies, server logs, and analytics tools (see Section 10).
• Third-party sources: Identity verification data from KYC service providers; payment data from GCash, PayMaya, BPI, BDO, Metrobank, and other payment processors; fraud and AML screening data from compliance service providers.
• Regulatory sources: Information received from PAGCOR, the AMLC, or other government authorities in connection with our regulatory obligations.

05 Purposes & Legal Basis for Processing

oojl processes personal data only where a valid legal basis exists under the Data Privacy Act. The primary processing purposes and their corresponding legal bases are:

• Account creation and management — Necessary for the performance of the contract between oojl and the Player (DPA §12(b)).
• Identity and age verification (KYC) — Compliance with PAGCOR regulations and the Anti-Money Laundering Act (DPA §12(c)).
• Payment processing and fraud prevention — Necessary for contract performance and compliance with financial regulations (DPA §12(b), §12(c)).
• AML monitoring and suspicious transaction reporting — Mandatory legal obligation under Republic Act No. 9160 (DPA §12(c)).
• Responsible gaming monitoring — Legitimate interest of oojl in player welfare, and compliance with PAGCOR responsible gaming requirements (DPA §12(f)).
• Customer support — Necessary for contract performance (DPA §12(b)).
• Platform security and fraud detection — Legitimate interest of oojl in protecting the platform and its users (DPA §12(f)).
• Marketing communications — Consent of the Player (DPA §12(a)). You may withdraw marketing consent at any time via account settings or by contacting support.
• Platform analytics and improvement — Legitimate interest (DPA §12(f)), subject to cookie consent preferences.

06 Data Sharing with Third Parties

oojl does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only in the following circumstances:

• KYC and identity verification providers: Third-party services that assist in verifying the identity, age, and document authenticity of Players, as required by PAGCOR.
• Payment processors: GCash (Mynt), Maya Philippines, BPI, BDO, Metrobank, and other payment service providers, for the purpose of processing deposits and withdrawals. Each processor operates under its own privacy policy and Philippine financial regulations.
• Game content providers: Licensed gaming software providers whose games are hosted on the oojl platform. These providers may receive anonymised session data for game performance and RTP auditing purposes.
• Regulatory and law enforcement authorities: PAGCOR, the AMLC, the NPC, and other competent Philippine government authorities, where disclosure is required by law, court order, or regulatory directive.
• IT and security service providers: Cloud hosting, cybersecurity, and fraud detection providers engaged by oojl as Personal Information Processors (PIPs) under data processing agreements consistent with DPA requirements.
• Professional advisors: Legal counsel, auditors, and insurers, subject to confidentiality obligations.

All third-party processors engaged by oojl are required to process personal data only on oojl's documented instructions and to implement security measures commensurate with the sensitivity of the data involved.

07 International Data Transfers

Where oojl transfers personal data outside the Philippines — for example, to cloud service providers or game content providers whose infrastructure is located abroad — we ensure that such transfers comply with Section 21 of the Data Privacy Act and the NPC's rules on cross-border data transfers.

Transfer safeguards may include: binding data processing agreements incorporating NPC-approved standard contractual clauses; transfers to jurisdictions recognised by the NPC as providing adequate data protection; or other appropriate safeguards as required. Details of specific transfer safeguards are available upon request from our Data Protection Officer (see Section 15).

08 Data Retention

oojl retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention guidelines apply:

• Account and KYC data: Retained for a minimum of five (5) years from the date of account closure, in accordance with PAGCOR requirements and the Anti-Money Laundering Act.
• Financial transaction records: Retained for a minimum of five (5) years, as required by the AMLC and PAGCOR.
• Gaming activity logs: Retained for a minimum of three (3) years for dispute resolution and responsible gaming monitoring purposes.
• Communications records: Retained for three (3) years from the date of the interaction.
• Marketing consent records: Retained for the duration of the Player's active relationship with oojl plus one (1) year, or until consent is withdrawn.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised using industry-standard data destruction methods. Anonymised or aggregated data (which cannot be re-identified) may be retained indefinitely for statistical and analytical purposes.

09 Security Measures

oojl implements technical, organisational, and physical security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key measures include:

• SSL/TLS encryption on all data transmitted between your device and the oojl platform.
• Encryption at rest for sensitive personal data stored in oojl's databases.
• Bcrypt or equivalent password hashing — oojl does not store passwords in plain text.
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis.
• Multi-factor authentication for administrative access to systems holding personal data.
• Regular security audits and penetration testing conducted by independent security professionals.
• Incident response procedures aligned with the NPC's mandatory breach notification requirements under NPC Circular 16-03.

In the event of a personal data breach that is likely to result in serious harm to affected Players, oojl will notify the NPC within seventy-two (72) hours of discovery and will inform affected Players as required under Philippine data breach notification rules.

10 Cookies & Tracking Technologies

The oojl platform uses cookies and similar tracking technologies to operate core platform functions, improve user experience, and — where you have consented — to deliver relevant promotional content. The categories of cookies used are:

• Strictly Necessary Cookies: Required for platform functionality such as session management, login authentication, and security. These cannot be disabled without materially impairing platform operation.
• Functional Cookies: Remember your preferences such as language settings and responsible gaming limit configurations.
• Analytics Cookies: Collect anonymised data on platform usage patterns to help oojl improve performance. Used only with your consent.
• Marketing Cookies: Track interactions with oojl promotional content to measure campaign effectiveness. Used only with your express consent.

You can manage your cookie preferences at any time through your browser settings or the oojl cookie preference centre. Disabling analytics or marketing cookies does not affect your access to the oojl gaming platform. Note that disabling strictly necessary cookies may prevent you from logging in or using core platform features.

11 Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you hold the following rights in respect of your personal data processed by oojl:

• Right to be Informed: The right to know that your personal data is being processed, the purposes of processing, and the recipients of your data. This Policy satisfies oojl's obligation under this right.
• Right of Access: The right to obtain confirmation of whether oojl holds personal data about you, and to receive a copy of that data.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected. You may update most account data directly through your oojl account settings.
• Right to Erasure ("Right to be Forgotten"): The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to oojl's legal retention obligations (Section 8).
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to Object: The right to object to processing based on legitimate interest, including direct marketing. Withdrawal of marketing consent can be effected at any time via account settings.
• Right to File a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe oojl has violated your data privacy rights.

To exercise any of the above rights, please submit a written request to oojl's Data Protection Officer at the contact details in Section 15. We will respond within thirty (30) calendar days. Complex requests may be extended by an additional thirty (30) days with notice. Identity verification may be required before processing certain rights requests.

12 Children and Minors

oojl employs mandatory KYC age verification for all accounts prior to enabling real-money gameplay. If oojl discovers that personal data has been collected from a person under the age of 21, the relevant Account will be immediately suspended, real-money balances will be returned in accordance with PAGCOR guidelines, and all personal data associated with the Account will be deleted as soon as legally permissible.

If you are a parent or guardian and believe your child has registered on the oojl platform, please contact us immediately at [email protected].

13 Third-Party Links

The oojl platform may contain links to third-party game provider interfaces or payment processor pages. These third-party environments are governed by their own privacy policies, which are independent of this Policy. oojl is not responsible for the data practices of third-party platforms accessed through the oojl interface. We encourage you to review the privacy policies of any third-party service you interact with.

14 Amendments to This Policy

oojl may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. Material changes will be communicated to registered Players via email or a prominent notice on the oojl platform at least seven (7) calendar days before the changes take effect.

The "Last Updated" date at the top of this Policy indicates the date of the most recent revision. The current version of the Policy is always available at oojl.club/privacy-policy. Continued use of the oojl platform following the effective date of an amended Policy constitutes acceptance of the revised terms.

15 Contact & Data Protection Officer

oojl has appointed a Data Protection Officer (DPO) in compliance with Section 21 of the Implementing Rules and Regulations of the Data Privacy Act. For all data privacy matters, including rights requests, breach notifications, or general inquiries, please contact:

You also have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights under the Data Privacy Act have been violated. Information on how to file a complaint with the NPC is available through official Philippine government channels.