juan36 Privacy Policy

01Introduction & Scope

This Privacy Policy ("Policy") is issued by juan36 ("we," "our," "us," or "the Company"), the operator of the online gaming platform accessible at juan36.one ("the Platform"). This Policy applies to all personal data collected, processed, stored, and used by juan36 in connection with the Platform and all services provided through it.

juan36 is committed to protecting the privacy and personal data of every individual who interacts with our Platform — whether as a registered player, a visitor browsing the site, or a person who contacts our support team. This Policy is drafted in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) ("DPA"), its Implementing Rules and Regulations, and the relevant issuances of the National Privacy Commission ("NPC").

By registering for an account on the juan36 Platform, accessing the Platform, or otherwise providing us with your personal data, you acknowledge that you have read and understood this Policy and you consent to the collection and processing of your personal data as described herein.

02Data Controller Identity

For the purposes of the Data Privacy Act of 2012 and this Policy, juan36 is the personal information controller ("PIC") responsible for the personal data collected through the Platform. As the PIC, juan36 determines the purposes and means of processing your personal data.

juan36 has appointed a Data Privacy Officer (DPO) responsible for ensuring compliance with the DPA and this Policy, and for receiving and responding to data subject requests and complaints. The DPO can be contacted at [email protected] with the subject line "Data Privacy — DPO Request."

juan36 operates under regulatory oversight of the Philippine Amusement and Gaming Corporation (PAGCOR). As a PAGCOR-regulated operator, certain data processing activities — particularly those related to player identity verification and financial transaction monitoring — are conducted in compliance with PAGCOR's licensing requirements and the Philippine Anti-Money Laundering Act (AMLA), which may impose mandatory data collection and reporting obligations.

03Categories of Personal Data We Collect

juan36 collects the following categories of personal data from players and users of the Platform. The specific data collected depends on the nature of your interaction with juan36.

3.1 Identity and Account Data

• Full legal name as it appears on a government-issued Philippine identification document
• Date of birth and age
• Gender
• Photograph or scanned copy of government-issued ID (e.g., PhilSys card, driver's license, passport, PRC ID)
• Username and account credentials (passwords are stored in hashed form and are never accessible to juan36 staff)

3.2 Contact and Communication Data

• Philippine mobile number (Globe, Smart, DITO, or other network)
• Email address
• Residential address in the Philippines
• Support communications, including emails, chat transcripts, and complaint records

3.3 Financial and Transaction Data

• GCash account number or registered mobile number
• PayMaya (Maya) account identifier
• Bank account details (BPI, BDO, Metrobank, or other Philippine banks) where provided for withdrawals
• Payment card details (encrypted; full card numbers are never stored by juan36)
• Deposit history, withdrawal requests, and transaction amounts in Philippine Peso (₱)
• Bonus claims, wagering records, and game play financial history

3.4 Technical and Usage Data

• IP address and approximate geographic location derived therefrom
• Device type, operating system, browser version, and screen resolution
• Session start and end times, login timestamps, and duration of use
• Game play logs, including game titles accessed, bet amounts, and outcomes
• Clickstream data, navigation patterns, and feature usage within the Platform

3.5 Responsible Gaming Data

• Deposit limits, loss limits, and session time limits set by the player
• Self-exclusion requests and exclusion period records
• Voluntary disclosures made in the context of responsible gaming support interactions

04How We Collect Your Data

juan36 collects personal data through the following means:

• Registration: Data you provide directly when creating a juan36 account, including name, date of birth, contact details, and chosen credentials.
• KYC Verification: Identity and address documents you submit to satisfy our Know Your Customer obligations under PAGCOR requirements and the AMLA.
• Payment Transactions: Data transmitted by your payment provider (GCash, PayMaya, BPI, BDO, etc.) at the time of deposit or withdrawal processing.
• Platform Activity: Data automatically generated as you navigate the Platform, including game logs, session data, and device/browser information collected via cookies and server-side logs.
• Support Interactions: Information you provide when contacting our support team via email or chat, including the content of your communications and any attachments submitted.
• Third-Party Verification: In limited circumstances, we may receive identity verification data from authorised third-party verification service providers acting on our behalf as personal information processors.

05Purposes of Processing & Legal Basis

Juan36 processes your personal data only for specified, explicit, and legitimate purposes. The following table summarises our key processing activities and their lawful basis under the DPA:

juan36 does not process your personal data for purposes incompatible with those listed above. Where we rely on consent as the legal basis for processing, you have the right to withdraw that consent at any time by contacting our DPO or adjusting your account preferences. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

06Data Sharing & Disclosure

juan36 does not sell, rent, or trade your personal data to any third party. We may disclose your personal data to the following categories of recipients, strictly on a need-to-know basis and only to the extent necessary for the specified purpose:

• PAGCOR: As our regulatory authority, PAGCOR may require access to player records as part of licensing compliance reviews, audits, or regulatory investigations. Disclosure to PAGCOR is a legal obligation.
• Anti-Money Laundering Council (AMLC): juan36 is required by the AMLA to file Suspicious Transaction Reports (STRs) and Covered Transaction Reports (CTRs) with the AMLC. Such reports include relevant player identity and transaction data.
• Payment Processors: GCash (operated by G-Xchange Inc.), PayMaya (Maya Philippines), BPI, BDO, Metrobank, and other payment providers receive the minimum personal and financial data necessary to process your deposit or withdrawal transaction.
• Game Providers: Certified third-party game providers may receive a pseudonymised player identifier and relevant session data to facilitate game delivery and audit functions. Full identity data is not shared with game providers.
• KYC Verification Providers: Authorised identity verification service providers acting as our personal information processors may receive identity documents for verification purposes. These providers are contractually bound to handle data only as instructed by juan36.
• IT and Security Providers: Hosting, infrastructure, and cybersecurity service providers who process data on our behalf under strict data processing agreements and are prohibited from using data for their own purposes.
• Law Enforcement and Courts: Where required by a valid legal order, subpoena, or court directive issued under Philippine law.

07Data Retention

juan36 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, and to comply with applicable legal and regulatory retention obligations. The following retention periods apply:

• Account Data: Retained for the duration of your active juan36 account and for a period of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements.
• Transaction and Financial Records: Retained for a minimum of five (5) years from the date of the transaction, as required by the AMLA and PAGCOR regulations.
• KYC Documents: Retained for five (5) years from the date of submission or from the date of account closure, whichever is later, in accordance with AMLA obligations.
• Support Communications: Retained for three (3) years from the date of the relevant interaction, unless the communication forms part of an ongoing dispute or regulatory matter.
• Technical and Usage Logs: Retained for up to twelve (12) months from the date of generation, unless retention is extended by a specific investigation or security requirement.
• Marketing Preferences: Retained until you withdraw consent for marketing communications or for three (3) years of account inactivity, whichever occurs first.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with juan36's data disposal procedures.

08Cookies & Tracking Technologies

The juan36 Platform uses cookies and similar tracking technologies to enable Platform functionality, remember your preferences, analyse usage patterns, and support security monitoring. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function correctly, including session management, authentication, and security features. These cookies cannot be disabled without impairing core Platform functionality.
• Functional Cookies: Enable the Platform to remember your preferences (e.g., language settings, remembered login details if you opt in to "Remember Me") and personalise your experience.
• Analytics Cookies: Used to collect anonymised data about how users navigate the Platform — which pages are visited most frequently, where users encounter difficulties, and how game lobby browsing patterns flow. This data informs Platform improvements.
• Security and Fraud Prevention Cookies: Used to detect and prevent fraudulent activity, multiple account creation, and bot activity on the Platform.

juan36 does not use third-party advertising or behavioural targeting cookies. All cookies set by the Platform are either first-party (set by juan36.one) or strictly necessary third-party cookies from service providers operating under data processing agreements with juan36.

You may manage cookie preferences through your browser settings. Disabling all cookies may impair the functionality of certain Platform features, including login persistence and game session continuity.

09Data Security Measures

juan36 implements technical and organisational security measures appropriate to the nature and sensitivity of the personal data we process. Our security framework includes:

• Encryption in Transit: All data transmitted between your device and the juan36 Platform is protected by 256-bit SSL/TLS encryption, preventing interception of your credentials, payment data, and personal information in transit.
• Encryption at Rest: Sensitive personal data stored in juan36's systems — including payment details and identity documents — is encrypted at rest using industry-standard algorithms.
• Password Hashing: Account passwords are stored using a one-way cryptographic hash function. Juan36 staff members cannot access your password in plain text under any circumstances.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Internal access is controlled through role-based permissions, multi-factor authentication for staff accounts, and comprehensive audit logging of all data access events.
• Security Monitoring: juan36 operates continuous monitoring of Platform access patterns, transaction behaviour, and login activity to detect and respond to anomalies indicating unauthorised access or data breach attempts.
• Incident Response: In the event of a personal data breach that poses a real risk to data subjects, juan36 will notify the National Privacy Commission (NPC) within seventy-two (72) hours of discovery, as required by the DPA, and will notify affected data subjects as appropriate.

While juan36 employs robust security measures, no online platform can guarantee absolute security against all threats. We encourage players to practise good personal security hygiene — including using a strong, unique password for their juan36 account and enabling two-factor authentication.

10Children's Privacy

The juan36 Platform is strictly intended for adults aged 21 years and above, as required by PAGCOR's licensing conditions for online gambling in the Philippines. juan36 does not knowingly collect personal data from individuals under the age of 21.

If juan36 discovers or receives credible information that a user is under the age of 21, the relevant account will be suspended immediately, any deposits will be refunded to the originating payment method, and all personal data collected in connection with that account will be deleted in accordance with our data disposal procedures and applicable legal obligations.

11Your Rights as a Data Subject

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights in relation to your personal data held by juan36. These rights may be exercised by submitting a written request to our Data Privacy Officer at [email protected]:

• Right to Be Informed: The right to be informed of how your personal data is being processed by juan36, including the purposes, legal bases, and recipients of your data. This Policy serves as juan36's primary disclosure in exercise of this right.
• Right to Access: The right to request a copy of the personal data juan36 holds about you, together with information about how it is being processed.
• Right to Rectification: The right to request correction of any inaccurate or incomplete personal data held by juan36. We encourage players to keep their account information current; incorrect information may affect your ability to withdraw funds.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to juan36's legal obligations to retain certain data under the AMLA, PAGCOR regulations, and the DPA's own retention provisions.
• Right to Data Portability: The right to receive a copy of certain personal data you have provided to juan36 in a structured, commonly used, and machine-readable format, where technically feasible.
• Right to Object: The right to object to the processing of your personal data for legitimate interest purposes or for direct marketing. Where you object to marketing, we will cease processing your data for that purpose immediately.
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated. Information on the NPC complaints process is available through the NPC's official channels.

Juan36 will respond to substantiated data subject requests within thirty (30) calendar days of receipt. We may request additional information to verify your identity before processing a request.

12Changes to This Privacy Policy

juan36 reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law or NPC issuances, PAGCOR regulatory requirements, or Platform services.

When we make material changes to this Policy, we will notify registered players by email to the address on file and/or by a prominent notice displayed upon your next login to the juan36 Platform. The "Last Updated" date at the top of this document will be revised accordingly.

Your continued use of the juan36 Platform following notification of changes constitutes your acceptance of the revised Policy. If you do not agree with the changes, you may request account closure and we will process your request in accordance with our data retention obligations.

13Contact & Data Privacy Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or juan36's personal data processing practices, please contact our Data Privacy Officer through the following channel: