Privacy Policy – 18gl Casino

This Privacy Policy (hereinafter "Policy") governs the collection, use, storage, sharing, and protection of personal information by 18gl Casino (hereinafter "18gl," "We," "Us," or "Our"), the operator of the online gaming platform accessible at 18gl.cam and its associated subdomains and mobile-optimized interfaces.

18gl is committed to upholding the privacy rights of every individual who interacts with our platform, in full compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines. Where applicable, 18gl also adheres to data protection obligations arising from the regulatory framework established by the Philippine Amusement and Gaming Corporation (PAGCOR) for licensed online gaming operators.

By accessing the 18gl website, creating an account, depositing funds, or using any service offered through the 18gl platform, you acknowledge that you have read, understood, and consented to the data processing practices described in this Policy. If you do not agree with this Policy, please discontinue use of the 18gl platform immediately.

For the purposes of Republic Act No. 10173 and its Implementing Rules and Regulations, the personal information controller responsible for the processing of your data in connection with the 18gl platform is:

• Platform Name: 18gl Casino
• Website: 18gl.cam
• Primary Market: Republic of the Philippines
• Data Protection Officer Contact: [email protected] (subject line: DATA PRIVACY)

18gl has designated a Data Protection Officer (DPO) in accordance with the requirements of the National Privacy Commission. The DPO is responsible for overseeing 18gl's compliance with RA 10173, handling data subject rights requests, responding to NPC inquiries, and advising on data protection impact assessments where applicable. Contact details for the DPO are provided in Section 14 of this Policy.

18gl collects personal data through several channels: directly from you when you register, verify, or transact on the platform; automatically through your use of the platform (technical and behavioral data); and from third-party sources where necessary and lawful, such as payment processors and identity verification services. The categories of personal data we collect include the following:

18gl does not collect sensitive personal information — as defined under Section 3(l) of RA 10173 — beyond what is strictly necessary for identity verification and age verification purposes required by PAGCOR regulations. Where sensitive personal information is collected, additional consent is sought and heightened security measures are applied.

18gl processes your personal data only for specific, explicit, and legitimate purposes. The purposes for which we process personal data include, but are not limited to:

• Account Registration and Management: Creating and maintaining your 18gl account, authenticating your identity at login, and managing your account settings and preferences.
• Age and Identity Verification (KYC): Verifying that you are 21 years of age or older and confirming your identity in compliance with PAGCOR KYC requirements and anti-money laundering (AML) regulations under the Anti-Money Laundering Act (AMLA) and its amendments.
• Financial Transaction Processing: Processing deposits via GCash, PayMaya, and bank transfers; processing withdrawals; and maintaining accurate financial records of all transactions on your 18gl account.
• Platform Service Delivery: Providing access to casino games, live dealer tables, sports betting, bingo, fishing arcade games, and other platform features; personalizing your in-platform experience based on your preferences and activity.
• Promotions and Bonus Administration: Administering bonuses, loyalty points, and promotional offers; verifying eligibility for specific promotions; and tracking wagering requirement compliance.
• Responsible Gaming: Monitoring gaming activity for patterns indicative of problem gambling; enforcing self-imposed limits and exclusions; and facilitating referrals to responsible gaming resources where appropriate.
• Fraud Prevention and Security: Detecting and preventing fraudulent activity, account takeovers, collusion, bonus abuse, and money laundering; conducting AML screening; and complying with PAGCOR reporting obligations.
• Customer Support: Responding to account queries, payment disputes, technical issues, and formal complaints submitted through 18gl support channels.
• Legal and Regulatory Compliance: Complying with applicable Philippine laws, PAGCOR directives, NPC requirements, and court or regulatory orders requiring disclosure of personal data.
• Platform Improvement: Analyzing aggregated and anonymized usage data to improve platform performance, user interface design, and game catalog curation.

Under the Data Privacy Act of 2012, 18gl relies on the following lawful bases for processing personal data:

• Consent (Section 12(a), RA 10173): Where you have given free, specific, informed, and unambiguous consent to the processing of your personal data for a stated purpose, including consent to marketing communications and optional data sharing with affiliated entities.
• Contractual Necessity (Section 12(b), RA 10173): Processing necessary for the performance of the contract between you and 18gl — specifically, the account agreement established when you register and accept the 18gl Terms and Conditions.
• Legal Obligation (Section 12(c), RA 10173): Processing required to comply with applicable Philippine law, including PAGCOR licensing conditions, AMLA reporting obligations, and NPC registration and compliance requirements.
• Legitimate Interests (Section 12(f), RA 10173): Processing necessary for the purposes of the legitimate interests pursued by 18gl, including fraud prevention, platform security, and responsible gaming monitoring, where such interests are not overridden by your fundamental rights and freedoms.

18gl does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your personal data with the following categories of recipients under strictly controlled conditions:

• Payment Processors: GCash (GXI), PayMaya (Voyager Innovations), BPI, BDO, Metrobank, UnionBank, and other Philippine payment service providers — for the purpose of processing deposits and withdrawals. Data shared is limited to what is strictly necessary to complete the financial transaction.
• Identity Verification Providers: Third-party KYC and liveness detection service providers engaged to assist in verifying government-issued Philippine identification documents. All KYC partners are bound by data processing agreements consistent with RA 10173 requirements.
• Game Software Providers: Providers of casino game software (e.g., RNG slot providers, live dealer studio operators) may receive limited technical data — such as a hashed player identifier — necessary to deliver gameplay sessions. Game providers do not receive your full identity or financial data.
• Regulatory and Law Enforcement Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies or courts where disclosure is required by law, regulatory directive, or valid legal process.
• Fraud Prevention Networks: Industry-wide responsible gaming and fraud prevention registries where participation is required or permitted under applicable PAGCOR regulations, including self-exclusion registries.
• IT Service Providers: Cloud hosting, data center, cybersecurity, and technical infrastructure providers engaged by 18gl under contractual data processing agreements that impose obligations consistent with RA 10173.

All third-party data processors engaged by 18gl are required to process personal data only on 18gl's documented instructions, to maintain appropriate technical and organizational security measures, and to notify 18gl without undue delay of any personal data breach affecting data entrusted to them.

The 18gl platform uses cookies and similar tracking technologies to deliver, maintain, and improve platform services. The types of cookies used on 18gl are:

• Strictly Necessary Cookies: Essential for the operation of the 18gl platform, including session management, authentication tokens, and security functions. These cookies cannot be disabled without disrupting core platform functionality.
• Functional Cookies: Used to remember your preferences, such as preferred language settings, remembered login, and responsible gaming configuration settings you have applied to your account.
• Analytical Cookies: Used to collect aggregated, anonymized data about how users interact with the 18gl platform — page visits, session duration, game category preferences — to support platform improvement.
• Security Cookies: Used for fraud detection, device fingerprinting, and login anomaly detection to protect your account from unauthorized access.

18gl does not use third-party advertising cookies or behavioral profiling cookies for cross-site advertising targeting. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will impair your ability to use the 18gl platform.

18gl retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, regulatory, or reporting obligations. The following general retention principles apply:

• Active Account Data: Personal data associated with an active 18gl account is retained for the duration of the account relationship and for a minimum period of five (5) years following account closure, in accordance with PAGCOR record-keeping requirements and AMLA obligations.
• Financial Transaction Records: Records of all deposits, withdrawals, and wagers are retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act and PAGCOR regulations.
• KYC and Verification Documents: Identity verification documents are retained for the duration of the account relationship and for a minimum of five (5) years after account closure.
• Customer Support Records: Communications and support ticket records are retained for a minimum of two (2) years from the date of the interaction.
• Self-Exclusion Records: Records of self-exclusion and responsible gaming tool usage are retained for a minimum of seven (7) years to support responsible gaming continuity and regulatory reporting.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in a manner that prevents reconstruction of the original data. Where anonymization is not technically feasible, data will be destroyed using industry-standard secure deletion methods.

18gl implements technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Key security measures include:

• Transport Encryption: All data transmitted between your device and 18gl servers is encrypted using TLS 1.3 with AES-256-bit SSL certificates — the same encryption standard used by Philippine banks for online transactions.
• Data-at-Rest Encryption: Personal data stored in 18gl databases is encrypted at rest using industry-standard encryption protocols. Financial data and KYC documents are subject to additional encryption layers.
• Access Controls: Access to personal data within 18gl's systems is restricted on a strict need-to-know basis. Employee access is governed by role-based access controls, with access logs maintained and reviewed regularly.
• Two-Factor Authentication: Internal access to 18gl administrative systems requires multi-factor authentication. Players are strongly encouraged to enable 2FA on their accounts.
• Penetration Testing and Security Audits: 18gl conducts regular security assessments, vulnerability scans, and penetration tests to identify and remediate potential weaknesses in the platform's security posture.
• Data Breach Response: In the event of a personal data breach that poses a real risk to your rights and freedoms, 18gl will notify affected data subjects and the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, in compliance with NPC Circular No. 16-03 on Personal Data Breach Management.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by 18gl. To exercise any of these rights, please contact 18gl's Data Protection Officer using the contact details provided in Section 14.

18gl will respond to verified data subject rights requests within fifteen (15) business days of receipt, in accordance with NPC guidelines. Where a request cannot be fulfilled within that period due to complexity or volume, 18gl will notify you of the reason for the delay and provide an estimated completion date. Requests that are manifestly unfounded or excessive may be refused, with reasons provided in writing.

If you believe that 18gl has violated your data privacy rights, you have the right to lodge a complaint with the National Privacy Commission of the Philippines at privacy.gov.ph. We encourage you to contact our DPO first so that we have the opportunity to address your concern directly before a formal NPC complaint is filed.

The 18gl platform is strictly intended for use by individuals aged 21 years and older, in compliance with PAGCOR regulations governing online gambling in the Philippines. 18gl does not knowingly collect personal data from individuals under 21 years of age.

If 18gl becomes aware, through age verification processes or otherwise, that personal data has been collected from an individual under 21 years of age, the affected account will be immediately suspended, the personal data in question will be deleted in accordance with our data retention and deletion procedures, any funds deposited will be returned via the original payment method, and the matter will be referred to appropriate regulatory authorities where required by PAGCOR rules.

Where 18gl engages third-party service providers whose data processing infrastructure is located outside the Republic of the Philippines — such as cloud hosting providers or internationally operated game software providers — cross-border transfers of personal data may occur. Such transfers are conducted only where:

• The recipient country, territory, or international organization provides an adequate level of data protection as determined by the National Privacy Commission; or
• Appropriate safeguards are in place, such as contractual data processing agreements that impose obligations consistent with RA 10173 requirements on the recipient; or
• The transfer is necessary for the performance of a contract between you and 18gl (e.g., processing a payment via an international payment network); or
• You have given explicit consent to the transfer after being informed of the possible risks arising from the absence of an adequacy decision or appropriate safeguards.

18gl maintains records of all cross-border data transfers and ensures that appropriate contractual safeguards are in place prior to transferring any personal data outside Philippine jurisdiction.

18gl reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, NPC guidance, or PAGCOR regulatory requirements. Material changes to this Policy will be communicated to registered 18gl members via the email address or mobile number on file, and will be posted prominently on the 18gl website at least fourteen (14) days before they take effect.

The "Effective Date" shown at the top of this Policy reflects the date on which the current version came into force. Your continued use of the 18gl platform after the effective date of a revised Policy constitutes your acknowledgment and acceptance of the updated data processing practices. If you do not agree with material changes to this Policy, you should cease using the 18gl platform and may request account closure in accordance with our Terms and Conditions.

The most current version of this Privacy Policy is always accessible at 18gl.cam/privacy-policy. We recommend reviewing this page periodically to stay informed about how 18gl protects your personal data.

For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data by 18gl, please contact the Data Protection Officer through the following:

• Platform: 18gl Casino
• Website: 18gl.cam
• DPO Email: [email protected] (subject line: DATA PRIVACY)
• Support Availability: 24 hours a day, 7 days a week, Philippine Standard Time (PST, UTC+8)
• Response Timeframe: Data subject rights requests acknowledged within 3 business days; resolved within 15 business days

All data subject rights requests must be submitted in writing and must include sufficient information to verify your identity as the data subject (or as an authorized representative of the data subject). 18gl will not process data subject rights requests submitted anonymously, as identity verification is necessary to protect against unauthorized disclosure of personal data.