uujili Privacy Policy

For the purposes of the Philippines Data Privacy Act of 2012 (Republic Act 10173) and its Implementing Rules and Regulations, uujili acts as the Personal Information Controller (PIC) with respect to the personal data of its registered Account holders and Platform visitors.

uujili is the operator of the online casino and sports betting platform accessible at uujili.vip, providing gaming and wagering services to eligible Filipino players aged 21 and above in the Philippines.

All data protection enquiries, access requests, correction requests, and complaints may be directed to the uujili Data Protection Officer (DPO) via the contact details set out in Section 14 of this Policy. uujili has appointed a DPO in line with the requirements of NPC Circular 16-04 applicable to personal information controllers engaged in processing that is likely to involve large-scale data operations.

uujili collects personal data through several channels: directly from you during registration and account use, automatically through platform interactions, and from third parties such as payment processors and identity verification providers. The categories of personal data we collect are set out below.

2.1 Data You Provide Directly

2.2 Data Collected Automatically

When you access the uujili Platform, certain technical data is automatically collected by our systems. This includes:

• Device and Technical Data: IP address, device type (mobile/desktop), operating system, browser type and version, screen resolution, and device language settings.
• Usage Data: Pages visited, games accessed, session duration, features interacted with, links clicked, wagering patterns, and game history.
• Location Data: Approximate geographic location derived from IP address, used for jurisdiction compliance checks. uujili does not access precise GPS location without your express permission.
• Cookie and Tracking Data: Session identifiers, preference cookies, and analytics data. See Section 5 for full cookie details.

2.3 Data Received from Third Parties

uujili may receive personal data about you from third-party sources in the following circumstances:

• Payment Processors (GCash, Maya, BPI, BDO, Metrobank): Transaction confirmation data, including masked payment details sufficient to verify payment ownership.
• Identity Verification Providers: Results of automated identity and age verification checks conducted against your submitted documents.
• Anti-Fraud and AML Screening Services: Watchlist screening results, politically exposed person (PEP) status, and sanctions check outcomes, as required under Republic Act 9160.
• Gaming Exclusion Registries: Self-exclusion status from PAGCOR-affiliated exclusion programmes.

uujili processes your personal data only where a lawful basis for doing so exists under the Data Privacy Act of 2012. The applicable lawful bases for uujili's data processing activities are:

• Contractual Necessity. Processing is necessary to perform the contract between you and uujili — specifically, to provide the gaming and wagering services you have registered for, to process your deposits and withdrawals, and to manage your Account.
• Legal Obligation. Processing is required to comply with legal obligations applicable to uujili, including PAGCOR licensing requirements, Anti-Money Laundering Act (RA 9160) obligations, Know Your Customer (KYC) requirements, and tax reporting obligations.
• Legitimate Interests. Processing is necessary for uujili's legitimate interests, including platform security, fraud prevention, technical improvement of the Platform, and responsible gaming monitoring, provided such interests are not overridden by your rights and interests.
• Consent. For certain processing activities — specifically, direct marketing communications beyond transactional notifications — uujili relies on your freely given, specific, informed, and unambiguous consent. You may withdraw consent for marketing at any time without affecting the lawfulness of prior processing.

uujili uses the personal data we hold about you for the following specific purposes:

• Account Registration and Management: Creating and maintaining your uujili Account, processing your login authentication (including 2FA), and managing account settings and preferences.
• Identity and Age Verification: Verifying that you are at least 21 years of age and that your identity matches the information provided at registration, in compliance with PAGCOR's age restriction requirements and KYC obligations.
• Transaction Processing: Processing deposits, withdrawals, and internal wallet transfers; reconciling transactions; and maintaining accurate financial records.
• Gaming Service Provision: Delivering casino games, live dealer tables, bingo rooms, video poker, and sports betting services; recording game outcomes and wagering history; and calculating and crediting winnings.
• Customer Support: Responding to account queries, processing complaints, resolving disputes, and providing technical assistance via 24/7 live chat and email channels.
• Responsible Gaming: Monitoring for signs of problem gambling, enforcing deposit limits and cooling-off periods, implementing self-exclusion requests, and cross-referencing gaming exclusion registries.
• Anti-Money Laundering Compliance: Monitoring transactions for suspicious patterns, conducting mandatory reporting to the AMLC where required by RA 9160, and maintaining AML records for the legally required retention period.
• Platform Security and Fraud Prevention: Detecting and preventing unauthorized account access, identifying fraudulent activity, preventing multi-accounting, and protecting Platform integrity.
• Platform Improvement: Analysing aggregate usage data to improve Platform performance, game selection, user interface design, and overall user experience.
• Marketing Communications: Sending promotional offers, bonus notifications, and event updates where you have provided consent or where this falls within a permissible legitimate interest category. You may opt out at any time.
• Legal and Regulatory Compliance: Meeting uujili's obligations under Philippine law, including PAGCOR reporting requirements, tax obligations, and any lawful request from competent regulatory authorities.

The uujili Platform uses cookies and similar tracking technologies to operate the Platform, maintain your logged-in session, remember your preferences, and collect aggregate analytics data. The categories of cookies used by uujili are:

Strictly necessary cookies cannot be disabled without materially impairing the functionality of the uujili Platform, including your ability to log in and access your Account. All other cookie categories may be managed through your browser settings. Note that disabling functional cookies may affect your user experience on the Platform.

uujili does not deploy cookies for real-time behavioural advertising to third-party platforms. Analytics data collected via cookies is used exclusively for internal Platform improvement purposes and is not sold or transferred to third-party advertising networks.

uujili does not sell, rent, or otherwise commercially transfer your personal data to third parties. We may share your personal data only in the following limited and controlled circumstances:

6.1 Payment Service Providers

To process your deposits and withdrawals, uujili shares necessary financial data with licensed Philippine payment service providers including GCash (G-Xchange Inc.), Maya (PayMaya Philippines Inc.), BPI, BDO, and Metrobank. These processors act as independent data controllers for payment data and are subject to their own privacy policies and BSP regulations.

6.2 Identity and KYC Verification Providers

uujili engages licensed third-party identity verification service providers to perform automated KYC checks. These providers process submitted identification documents solely for the purpose of verifying identity and age on uujili's instruction and are contractually bound by strict data processing agreements.

6.3 Anti-Money Laundering and Regulatory Bodies

uujili is legally obligated under Republic Act 9160 (Anti-Money Laundering Act) to disclose certain transaction information and suspicious activity reports to the Anti-Money Laundering Council (AMLC) of the Philippines. uujili may also disclose information to PAGCOR in fulfilment of its licensing and regulatory reporting obligations.

6.4 Law Enforcement and Legal Proceedings

uujili may disclose personal data to Philippine law enforcement agencies, courts, or regulatory bodies where required by a lawful court order, subpoena, regulatory direction, or other legally compelled process. uujili will notify affected Account holders of such disclosure requests where permitted by law.

6.5 Gaming Exclusion Programmes

Where required to enforce self-exclusion or where mandated by PAGCOR's exclusion framework, uujili may share limited Account status information with PAGCOR-affiliated gaming exclusion registries to protect players who have self-excluded from re-registering at the same or affiliated platforms.

6.6 Technology and Infrastructure Providers

uujili engages third-party technology providers for Platform hosting, content delivery, customer support software, and cybersecurity services. These providers act as data processors under binding data processing agreements and are prohibited from using your personal data for any purpose other than the specific service they provide to uujili.

Some of uujili's technology and service providers operate infrastructure outside of the Philippines. Where personal data is transferred to a country that has not been assessed by the National Privacy Commission (NPC) as providing an adequate level of data protection, uujili implements appropriate safeguards including:

• Standard contractual clauses approved by the NPC or equivalent data protection authorities;
• Binding corporate rules where applicable to intra-group transfers;
• Transfer impact assessments to evaluate the risk environment in the recipient country;
• Technical and organisational safeguards including end-to-end encryption for all data in transit.

uujili's primary data storage infrastructure is located within the Philippines where operationally feasible. For game streaming and content delivery network (CDN) operations, data may be routed through regional servers including locations in Southeast Asia to optimise Platform performance for Philippine users.

uujili retains personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal retention requirements. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised using methods that prevent reconstruction of the original personal data. Anonymised aggregate data may be retained indefinitely for statistical and business analysis purposes.

uujili implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Transport Encryption: All data transmitted between your device and uujili servers is protected using TLS 1.3 (Transport Layer Security). Connections over plain HTTP are automatically redirected to HTTPS.
• Data Encryption at Rest: Sensitive personal data — including identity documents, financial data, and authentication credentials — is encrypted at rest using AES-256 encryption in uujili's data storage systems.
• Password Hashing: User passwords are never stored in plain text. They are hashed using a modern one-way hashing algorithm with per-user salting before storage.
• Access Controls: Access to personal data by uujili employees and contractors is governed by a principle of least privilege. Access is granted only to the minimum extent necessary to perform specific job functions and is subject to multi-factor authentication.
• Two-Factor Authentication: uujili offers 2FA to all Account holders. For internal administrative access to systems containing personal data, 2FA is mandatory.
• Penetration Testing and Vulnerability Management: uujili engages independent security firms to conduct regular penetration testing of the Platform. Identified vulnerabilities are addressed on a priority basis aligned with their severity rating.
• Data Breach Response: uujili maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, uujili will notify the National Privacy Commission within 72 hours of becoming aware of the breach and will notify affected individuals without undue delay in accordance with NPC requirements.

You may exercise any of the rights described in Section 2 of this Policy (and summarised in the feature cards above) by submitting a written request to uujili's Data Protection Officer using the contact details in Section 14. Requests may be submitted by email or via the live chat facility on the Platform.

To protect your personal data, uujili will verify your identity before processing any data rights request. Verification will typically require you to confirm account details from your registered uujili Account. We may request additional documentation for requests involving sensitive data categories.

uujili aims to respond to all data rights requests within 30 calendar days of receipt of a verified request. Where a request is particularly complex or where multiple requests are received, this period may be extended by a further 30 days, and you will be notified of the extension and its reason.

Data rights requests are processed free of charge. However, uujili reserves the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests, or to refuse such requests where permitted by law.

Note that certain rights — including erasure and objection — may be limited where uujili is required to retain or process your personal data to comply with legal obligations, including PAGCOR licensing requirements and AML obligations under RA 9160. uujili will inform you of any applicable limitations at the time of processing your request.

uujili implements mandatory age verification at the point of registration through date of birth collection and, prior to first withdrawal, through KYC document verification. Where uujili becomes aware that personal data has been collected from a person under 21 years of age, that data will be deleted and the associated Account will be permanently terminated. Any Real Money Balance in an underage Account will be returned to the payment source after investigation.

If you are a parent or guardian and believe that an individual under 21 in your care has registered an Account with uujili, please contact the uujili Data Protection Officer immediately at the details in Section 14. uujili will act on such reports promptly.

Where you have consented to receive marketing communications from uujili, or where uujili otherwise has a lawful basis to contact you with promotional content, we may send you information about bonuses, promotions, new games, sporting events, and other offers relevant to the uujili Platform via:

• Email to your registered email address;
• SMS to your registered Philippine mobile number;
• Push notifications via the uujili Platform if you have enabled these;
• In-platform banners and notification centre messages.

You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email from uujili;
• Replying "STOP" to any marketing SMS;
• Adjusting your notification preferences in Account Settings;
• Contacting the uujili support team via live chat or email.

Opting out of marketing communications will not affect your receipt of transactional and account-related notifications — including deposit confirmations, withdrawal status updates, security alerts, and account verification messages — which are sent on the basis of contractual necessity and cannot be disabled while your Account is active.

uujili will not send marketing communications to Account holders who have an active cooling-off period or self-exclusion in place. Marketing suppression is applied within 24 hours of a responsible gaming restriction being set.

uujili reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. The "Effective Date" at the top of this Policy will be updated to reflect the date on which any revised version takes effect.

For material changes — those that significantly affect your privacy rights or the way we process your personal data — uujili will provide advance notice of at least fourteen (14) days before the changes take effect, via a prominent notice on the Platform and by email to your registered address.

Your continued use of the uujili Platform following the effective date of a revised Privacy Policy constitutes your acknowledgment of the changes. We encourage you to review this Policy periodically. The most current version is always accessible at uujili.vip/privacy-policy.

For all data privacy enquiries, access requests, correction requests, erasure requests, objections to processing, or complaints related to uujili's handling of your personal data, please contact the uujili Data Protection Officer through the following channels:

• Email: [email protected] — mark your subject line with "Data Privacy Request" or "DPO Enquiry" to ensure your message is routed correctly.
• 24/7 Live Chat: Available on the uujili Platform — suitable for initial queries and obtaining the appropriate submission format for formal requests.

uujili acknowledges all data privacy requests within 5 business days and provides a substantive response within 30 calendar days in most cases. For complex requests involving large volumes of data or multiple categories of personal information, this period may be extended by up to a further 30 days with notification to you.

If you are not satisfied with uujili's response to a data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the competent supervisory authority for data protection matters under Republic Act 10173. Information on how to file an NPC complaint is available through official NPC channels.

// This Privacy Policy was last updated 1 January 2026 and supersedes all prior versions. uujili © 2026. All rights reserved.