Privacy Policy – dreajili

1. Who We Are (Data Controller)

dreajili is the data controller responsible for the personal information processed through the dreajili online gaming platform accessible at dreajili.org. dreajili operates under a valid online gaming licence issued by the Philippine Amusement and Gaming Corporation (PAGCOR) and is registered as a personal information controller with the National Privacy Commission (NPC) of the Philippines pursuant to the Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations.

By registering an Account, accessing the dreajili website, or using any of dreajili's services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not consent, you should not register or use the dreajili platform.

2. Personal Data We Collect

dreajili collects the following categories of personal data, depending on how you interact with the platform:

dreajili does not collect or store full payment card numbers (PCI DSS compliance applies where card payments are offered). Sensitive personal information — as defined under RA 10173 — is processed only where strictly necessary for identity verification, regulatory compliance, or responsible gaming obligations.

3. How We Collect Your Data

dreajili collects personal data through the following means:

• Direct submission: Information you provide when registering, completing KYC, making a deposit or withdrawal, contacting support, or setting responsible gaming preferences.
• Automated collection: Technical and gaming data collected automatically through cookies, server logs, and analytics tools when you access and use the dreajili platform.
• Third-party sources: Identity verification data from document verification service providers; fraud and AML screening data from licensed data service providers; payment transaction data from GCash, Maya, and integrated banking partners.
• Regulatory sources: Data received from PAGCOR or other competent authorities in connection with our compliance obligations, including player exclusion register data.

4. Purpose and Legal Basis for Processing

dreajili processes your personal data for the following purposes and on the following legal bases under RA 10173:

• Account registration and management — necessary for the performance of the contract between you and dreajili (provision of gaming services).
• Identity verification (KYC) — required by PAGCOR licensing conditions and Philippine AML law (compliance with a legal obligation).
• Payment processing — necessary for the performance of the contract; also required for AML and financial crime compliance obligations.
• Fraud prevention and security — legitimate interest of dreajili in protecting the platform, its players, and its financial integrity.
• Regulatory reporting — compliance with legal obligations under PAGCOR regulations, the Anti-Money Laundering Act (AMLA), and related Philippine law, including mandatory reporting to the Anti-Money Laundering Council (AMLC).
• Responsible gaming — compliance with PAGCOR responsible gaming requirements; also legitimate interest in protecting player welfare.
• Customer support — necessary for the performance of the contract and dreajili's legitimate interest in resolving player queries efficiently.
• Marketing communications — with your consent only, where you have opted in to receive promotional updates from dreajili. You may withdraw consent at any time.
• Platform analytics and improvement — legitimate interest of dreajili in improving the platform experience for Filipino players.

5. Data Retention

dreajili retains personal data for as long as is necessary for the purposes for which it was collected, subject to applicable legal minimum retention periods. The following general retention periods apply:

• Account and KYC data: Retained for a minimum of five (5) years following Account closure, as required by PAGCOR licensing conditions and Philippine AML law.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction.
• Gaming history: Retained for three (3) years from the date of each gaming session.
• Support communications: Retained for two (2) years from the date of the interaction.
• Marketing consent records: Retained for as long as the consent is active, plus one (1) year following withdrawal of consent.

Upon expiry of the applicable retention period, dreajili will securely delete or anonymise personal data in accordance with its data disposal procedures.

6. Sharing Your Personal Data

dreajili does not sell your personal data to third parties. dreajili may share your personal data with the following categories of recipient, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• PAGCOR and regulatory authorities: As required by dreajili's licence conditions, applicable law, or upon receipt of a lawful request from a competent authority.
• Anti-Money Laundering Council (AMLC): As required by the AMLA and its implementing regulations.
• Payment service providers: GCash, Maya, BPI, BDO, UnionBank, and other integrated payment partners, for the purpose of processing deposits and withdrawals.
• Identity verification providers: Third-party KYC and document verification services used to confirm player identity and age.
• Game providers: Certified gaming studios (e.g., JILI Games, Evolution, Pragmatic Play) receive limited technical session data necessary to deliver game content to your device. These providers do not receive your full identity or financial data.
• IT and hosting providers: Cloud infrastructure and technical service providers operating under strict data processing agreements with dreajili.
• National Privacy Commission (NPC): In the event of a personal data breach, dreajili is obligated to notify the NPC within 72 hours of becoming aware of the breach, as required by RA 10173.

All third parties with whom dreajili shares personal data are contractually required to maintain confidentiality and implement appropriate technical and organisational security measures consistent with dreajili's obligations under Philippine data privacy law.

7. Cookies and Tracking Technologies

dreajili uses cookies and similar tracking technologies on its website and platform for the following purposes:

• Essential cookies: Required for the platform to function — including session management, login state persistence, and OTP trusted-device recognition. These cannot be disabled without affecting platform functionality.
• Analytics cookies: Used to collect anonymised data on how players interact with the dreajili platform, enabling dreajili to improve navigation and game discovery. dreajili uses privacy-compliant analytics tools.
• Preference cookies: Used to remember your platform preferences, such as language settings and recently played games.
• Security cookies: Used to detect suspicious login activity and enforce dreajili's account security measures.

You may manage cookie preferences through your browser settings. Disabling essential cookies will impair your ability to log in and use the dreajili platform. dreajili does not use cookies for cross-site advertising tracking or share cookie data with advertising networks.

8. Data Security

dreajili implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and dreajili's servers.
• Encryption of sensitive data at rest, including identity documents and financial information.
• OTP-based multi-factor authentication for Account login from new devices and for withdrawal requests.
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis.
• Regular security assessments and penetration testing of the dreajili platform infrastructure.
• Data breach response procedures, including mandatory NPC notification within 72 hours for reportable breaches under RA 10173.

While dreajili takes all reasonable precautions to secure your personal data, no online system is entirely immune from security risk. You are encouraged to use a unique, strong password for your dreajili Account and to enable OTP verification on all devices.

9. Your Rights as a Data Subject

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by dreajili:

• Right to be informed: The right to know what personal data dreajili holds about you and how it is processed — as set out in this Privacy Policy.
• Right of access: The right to request a copy of the personal data dreajili holds about you, subject to identity verification.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure (right to be forgotten): The right to request deletion of your personal data, subject to dreajili's legal retention obligations under PAGCOR regulations and Philippine AML law.
• Right to object: The right to object to certain types of processing, including direct marketing. dreajili will cease marketing communications promptly upon receipt of a valid objection.
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, where technically feasible.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe dreajili has processed your personal data unlawfully.

To exercise any of the above rights, contact dreajili's Data Protection Officer at [email protected] with the subject line "Data Privacy Request". dreajili will acknowledge your request within five (5) business days and provide a substantive response within fifteen (15) business days, extendable by a further fifteen (15) days where the request is complex.

10. Children and Minors

dreajili's gaming services are strictly for individuals aged 21 years or older as mandated by PAGCOR. dreajili does not knowingly collect personal data from persons under the age of 21. If dreajili discovers that personal data has been collected from a person under 21, the relevant Account will be immediately closed, the personal data deleted (subject to mandatory retention obligations for AML compliance), and the matter escalated to dreajili's compliance team.

Parents and guardians who believe their child has accessed the dreajili platform or provided personal data should contact dreajili support immediately at [email protected].

11. Cross-Border Data Transfers

dreajili's primary data processing infrastructure is located in the Philippines. Certain service providers engaged by dreajili — including cloud hosting partners and game providers — may process personal data in servers located outside the Philippines (including Singapore, Hong Kong, and other jurisdictions in Southeast Asia and Europe).

Where personal data is transferred outside the Philippines, dreajili ensures that such transfers are made only to jurisdictions that provide an adequate level of data protection, or under contractual safeguards (such as standard data processing agreements) that require the receiving party to protect your personal data to a standard equivalent to that required under RA 10173.

12. Changes to This Privacy Policy

dreajili reserves the right to update this Privacy Policy at any time. The date of the most recent revision is displayed at the top of this page. Where changes are material, dreajili will notify registered players via the mobile number or email address on record at least fourteen (14) days before the changes take effect.

Your continued use of the dreajili platform following the effective date of any amended Privacy Policy constitutes your acknowledgement of and agreement to the revised terms. If you disagree with the amended Privacy Policy, you should cease using the platform and contact dreajili to close your Account.

13. Data Protection Officer & Contact

dreajili has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with RA 10173 and this Privacy Policy. For any privacy-related queries, data subject rights requests, or to report a suspected data breach, contact:

• Data Protection Officer, dreajili
• Email: [email protected] (subject: "Data Privacy Request")
• Live Chat: Available 24/7 on the dreajili platform
• Languages: English and Filipino

Players also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines at privacy.gov.ph if they are unsatisfied with dreajili's handling of their personal data.