vvji Privacy Policy

1 About This Policy

This Privacy Policy ("Policy") describes how vvji ("vvji," "we," "us," or "our"), the operator of the online gaming platform at https://vvji.app, collects, uses, stores, shares, and protects the personal information of users ("Player," "you," or "your") who access or use the vvji Platform.

This Policy is issued in compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC) of the Philippines. It also reflects our obligations under PAGCOR regulations and the Anti-Money Laundering Act (AMLA) as amended.

By registering for a vvji account or using any part of the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, please do not use the vvji Platform.

2 Personal Data We Collect

vvji collects personal data that is necessary for the operation of the Platform, compliance with legal obligations, and the delivery of a safe and personalized gaming experience. The categories of personal data we collect include:

We do not collect sensitive personal information (as defined under the DPA, such as health data, political opinions, or religious beliefs) unless specifically required for responsible gaming assessments or legal compliance, and only with your explicit consent where required.

3 How We Collect Your Data

vvji collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions;
• Automated collection: Technical data collected automatically when you access the Platform, including through cookies, log files, and similar tracking technologies (see Section 7);
• Third-party sources: Identity verification providers, payment processors (such as GCash and Maya), fraud prevention services, and publicly available sources where permitted by law;
• Regulatory sources: Information received from PAGCOR, the Anti-Money Laundering Council (AMLC), or other Philippine regulatory bodies in connection with our compliance obligations.

4 How We Use Your Personal Data

vvji uses your personal data for the following purposes:

1. Account management: Creating, maintaining, and securing your vvji account, including identity verification and password recovery;
2. Platform operation: Enabling you to access and use all features of the vvji Platform, including games, deposits, withdrawals, and promotions;
3. Payment processing: Facilitating deposits and withdrawals through your chosen payment method and maintaining accurate financial records;
4. Legal and regulatory compliance: Meeting our obligations under the DPA, AMLA, PAGCOR regulations, and other applicable Philippine laws, including filing suspicious transaction reports where required;
5. Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, unauthorized account access, and other security threats;
6. Responsible gaming: Monitoring gaming behavior to identify potential problem gambling patterns and administering self-exclusion, deposit limits, and other responsible gaming tools;
7. Customer support: Responding to your inquiries, resolving disputes, and providing technical assistance;
8. Marketing and promotions: Sending you information about vvji offers, bonuses, and new games where you have consented to receive such communications (see Section 13);
9. Platform improvement: Analyzing usage patterns and player feedback to improve the performance, features, and user experience of the vvji Platform.

5 Legal Basis for Processing

Under the Data Privacy Act of 2012, vvji processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our obligations under the vvji Terms & Conditions, including account management, payment processing, and game operation;
• Legal obligation: Processing required to comply with applicable Philippine laws, including AMLA, PAGCOR regulations, and NPC requirements;
• Legitimate interests: Processing necessary for fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by your privacy rights;
• Consent: Processing for marketing communications and certain optional features, where we have obtained your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing & Disclosure

vvji does not sell your personal data to third parties. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment processors: GCash, PayMaya (Maya), and Philippine banking partners (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank) for the purpose of processing deposits and withdrawals;
• Identity verification providers: Third-party KYC and AML screening services used to verify your identity and comply with regulatory requirements;
• Game content providers: Licensed game studios and software providers whose games are available on the vvji Platform, to the extent necessary for game operation and dispute resolution;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies where disclosure is required by law or court order;
• IT and security service providers: Cloud hosting, cybersecurity, and fraud detection vendors who process data on our behalf under strict data processing agreements;
• Professional advisers: Legal counsel, auditors, and compliance consultants, subject to professional confidentiality obligations.

All third-party service providers who process personal data on behalf of vvji are required to implement appropriate technical and organizational security measures and to process data only in accordance with our documented instructions.

7 Cookies & Tracking Technologies

The vvji Platform uses cookies and similar tracking technologies to enhance your experience, maintain session security, and analyze Platform usage. The types of cookies we use include:

• Essential cookies: Required for the Platform to function correctly, including session management, login authentication, and security features. These cannot be disabled without affecting Platform functionality;
• Functional cookies: Remember your preferences such as language settings, game favorites, and responsible gaming limits to provide a personalized experience;
• Analytics cookies: Collect aggregated, anonymized data about how players use the Platform to help us identify areas for improvement. No personally identifiable information is shared with analytics providers;
• Security cookies: Used to detect and prevent fraudulent activity, unauthorized access attempts, and bot traffic.

You can manage cookie preferences through your browser settings. Please note that disabling essential cookies may prevent you from accessing certain features of the vvji Platform. vvji does not use third-party advertising cookies or behavioral tracking cookies for cross-site advertising purposes.

8 Data Retention

vvji retains your personal data for as long as necessary to fulfill the purposes described in this Policy, subject to the following retention guidelines:

• Active account data: Retained for the duration of your account and for a period of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and AMLA obligations;
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, as required by the AMLA and its implementing rules;
• KYC and identity verification documents: Retained for the period required by applicable regulations, typically five (5) years from the end of the business relationship;
• Customer support records: Retained for three (3) years from the date of the last interaction, for dispute resolution and quality assurance purposes;
• Marketing consent records: Retained until you withdraw consent, plus a reasonable period thereafter to demonstrate compliance.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in accordance with our data disposal procedures.

9 Data Security

vvji implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Our security measures include:

• Encryption: All data transmitted between your device and the vvji Platform is encrypted using TLS (Transport Layer Security). Sensitive data at rest, including financial records and identity documents, is encrypted using AES-256 or equivalent standards;
• Access controls: Personal data is accessible only to authorized vvji personnel and service providers who require it for their specific role. Role-based access controls and multi-factor authentication are enforced for all internal systems;
• Security monitoring: Continuous monitoring of Platform infrastructure for suspicious activity, intrusion attempts, and anomalous behavior;
• Penetration testing: Regular independent security assessments and vulnerability testing of the Platform and supporting infrastructure;
• Incident response: A documented data breach response plan that includes notification to the NPC and affected players within the timeframes required by the DPA in the event of a qualifying personal data breach.

While vvji takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying vvji immediately if you suspect unauthorized access to your account.

10 Your Data Privacy Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by vvji:

To exercise any of these rights, please contact our Data Protection Officer (see Section 15). vvji will respond to all verified data privacy requests within thirty (30) calendar days of receipt, as required by the DPA. We may request proof of identity before processing your request.

11 Children's Privacy

The vvji Platform is strictly intended for individuals who are 21 years of age or older, in accordance with Philippine law and PAGCOR regulations governing casino-style online gaming. vvji does not knowingly collect personal data from persons under the age of 21.

If we become aware that personal data has been collected from a person under 21 years of age, we will immediately suspend the associated account, delete the personal data, and forfeit any associated account balance in accordance with our Terms & Conditions.

If you are a parent or guardian and believe that your child has registered on the vvji Platform, please contact us immediately at the details provided in Section 15 so that we can take prompt action.

12 Cross-Border Data Transfers

vvji primarily stores and processes personal data within the Philippines. In certain circumstances, personal data may be transferred to or accessed from servers or service providers located outside the Philippines — for example, where we use internationally hosted cloud infrastructure or game content providers based abroad.

Any cross-border transfer of personal data is conducted in compliance with Section 21 of the Data Privacy Act and the NPC's guidelines on cross-border data flows. We ensure that recipient countries or organizations provide an adequate level of data protection, or that appropriate contractual safeguards (such as standard contractual clauses) are in place before any transfer occurs.

13 Marketing Communications

With your consent, vvji may send you promotional communications about new games, bonuses, special offers, and platform updates via email, SMS, or in-app notifications. You can opt in to marketing communications during registration or at any time through your account notification settings.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your notification preferences in your vvji account settings;
• Clicking the "unsubscribe" link in any marketing email;
• Contacting vvji customer support and requesting removal from marketing lists.

Withdrawal of marketing consent will not affect your ability to use the vvji Platform or receive essential service communications such as account security alerts, transaction confirmations, and regulatory notices.

14 Updates to This Policy

vvji reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will notify registered players via email or through a prominent notice on the Platform at least seven (7) days before the changes take effect, where practicable.

The effective date at the top of this Policy indicates when it was last revised. We encourage you to review this Policy periodically. Your continued use of the vvji Platform after the effective date of any revision constitutes your acceptance of the updated Policy.

The current version of this Policy is always available at https://vvji.app/privacy-policy.

15 Contact & Data Protection Officer

vvji has appointed a Data Protection Officer (DPO) in accordance with the requirements of the Data Privacy Act of 2012. If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact our DPO through the following channels:

• DPO Email: [email protected]
• General Support: [email protected]
• Mailing Address: Data Protection Officer, vvji Operations, Metro Manila, Philippines
• Live Chat: Available on the Platform, 8AM – 12MN PHT, seven days a week

If you are not satisfied with our response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act.