penjoy Privacy Policy

Welcome to penjoy — the Philippines' friendly and welcoming online casino and sports betting platform. At penjoy, we believe that every Filipino player deserves to know exactly how their personal information is handled. This Privacy Policy is our commitment to transparency, written in plain English so it is easy to understand for players across Metro Manila, Cebu, Davao, Quezon City, Makati, and every corner of the Philippines.

This Privacy Policy applies to all personal data collected by penjoy through our website at penjoy.net, any related mobile-optimised interfaces, and all communications between penjoy and its registered players. It governs the collection, use, storage, sharing, and protection of your personal information in connection with your use of the penjoy platform.

penjoy processes personal data in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC) of the Philippines. We also operate within the regulatory framework of the Philippine Amusement and Gaming Corporation (PAGCOR), which has its own data governance requirements that we follow as a licensed operator.

By registering an account on penjoy, accessing our platform, or otherwise interacting with our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, please discontinue use of the penjoy platform.

For the purposes of the Data Privacy Act of 2012 and applicable data protection legislation, penjoy acts as the Personal Information Controller (PIC) in respect of the personal data collected from players and website visitors through the penjoy.net platform.

As the Personal Information Controller, penjoy determines the purposes and means by which your personal data is processed. Where penjoy engages third-party service providers to process data on its behalf — such as payment processors, KYC verification providers, and IT infrastructure partners — those parties act as Personal Information Processors (PIPs) and are contractually bound to process data solely under penjoy's documented instructions and in accordance with this Privacy Policy.

penjoy has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act and this Policy. You may contact penjoy's Data Protection Officer directly for any privacy-related concern at [email protected] with the subject line "Data Privacy Concern — Attn: DPO".

penjoy collects several categories of personal data from players and platform users. The table below summarises the types of data we collect and provides examples of each category:

penjoy does not collect sensitive personal information beyond what is necessary for KYC compliance and PAGCOR regulatory obligations. We do not collect data related to racial or ethnic origin, political opinions, religious beliefs, or health information unless specifically required by law enforcement or regulatory authorities and only with the appropriate legal basis.

penjoy collects your personal data through the following channels and mechanisms:

4.1 Directly From You

• Account Registration: When you create a penjoy account, you provide your name, date of birth, email address, mobile number, and residential address.
• KYC Verification: When completing identity verification, you upload government-issued identification documents and, where required, a selfie for liveness checks.
• Deposits & Withdrawals: When initiating transactions via GCash, PayMaya, BPI, BDO, Metrobank, or UnionBank, financial reference data is shared between you, your payment provider, and penjoy.
• Support Interactions: When you contact penjoy via email or live chat, the content of those communications is collected and stored.
• Promotions & Surveys: When you participate in penjoy promotions, bonus activations, or player surveys, the data you provide is collected.

4.2 Automatically From Your Device

• Cookies & Tracking Technologies: penjoy uses cookies and similar technologies to collect technical and usage data as you browse the platform. See Section 8 for full details.
• Server Logs: Our web servers automatically log your IP address, browser type, referring URL, pages visited, and session timestamps each time you access penjoy.net.
• Game Platform Data: When you play games on penjoy, our gaming systems automatically record wager amounts, game outcomes, session data, and responsible gaming tool usage.

4.3 From Third Parties

• Payment Processors: GCash, PayMaya, and banking partners may share transaction confirmation data with penjoy to reconcile deposits and withdrawals.
• KYC / Identity Verification Providers: penjoy uses licensed third-party KYC providers to cross-reference the identity documents you submit against government and credit databases where permitted by Philippine law.
• PAGCOR & Regulatory Authorities: PAGCOR and other Philippine regulatory bodies may share information relevant to your gaming activity or player protection status.

penjoy uses the personal data it collects for specific, legitimate purposes directly related to operating the platform and serving Filipino players. We do not use your data for purposes that are incompatible with the reasons it was originally collected.

• Account Creation & Management: To register your penjoy account, authenticate your login sessions, and maintain accurate account records.
• KYC & Age Verification: To verify that you are at least 21 years of age and to confirm your identity in compliance with PAGCOR licensing requirements and Philippine anti-money laundering obligations.
• Processing Transactions: To process your deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and UnionBank, and to maintain accurate financial records of all transactions.
• Anti-Money Laundering (AML) Compliance: To monitor transactions and account activity for patterns consistent with money laundering or terrorist financing, and to fulfil mandatory reporting obligations to the Anti-Money Laundering Council (AMLC) where required.
• Responsible Gaming: To operate deposit limits, self-exclusion tools, reality checks, and session reminders in accordance with PAGCOR's responsible gaming requirements.
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance.
• Platform Improvement: To analyse usage patterns, fix bugs, optimise game performance, and improve the overall penjoy player experience.
• Promotions & Loyalty Program: To administer bonuses, free spins, cashback offers, and penjoy Loyalty Program points, and to communicate relevant offers to eligible players.
• Fraud Prevention & Security: To detect and prevent unauthorised access, account fraud, multi-accounting, bonus abuse, and other prohibited activities.
• Legal & Regulatory Compliance: To comply with all applicable Philippine laws, PAGCOR regulations, court orders, and directions from regulatory authorities including the NPC and AMLC.

Under the Data Privacy Act of 2012, penjoy must have a lawful basis for processing your personal data. The following table outlines the legal bases on which penjoy relies for each major processing activity:

Where penjoy relies on your consent as the legal basis for processing — specifically for marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

penjoy does not sell your personal data. We do not share your personal information with third parties for their own marketing purposes. Your data is shared only in the specific circumstances set out below, and only to the minimum extent necessary for each purpose.

7.1 Service Providers (Personal Information Processors)

penjoy engages trusted third-party service providers who process personal data solely on penjoy's behalf, under written data processing agreements that comply with the Data Privacy Act:

• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, and UnionBank — for processing deposits and withdrawals
• KYC & Identity Verification Providers: Licensed identity verification services used to authenticate government-issued Philippine IDs
• Cloud Infrastructure Providers: Secure server and database hosting services operating within appropriate data protection standards
• Customer Support Software: Live chat and ticketing system providers used to manage player support interactions
• Fraud Detection & Security Services: Tools used to detect account compromise, bonus abuse, and multi-accounting

7.2 Regulatory & Law Enforcement Authorities

penjoy is legally required to share personal data with the following authorities when mandated by Philippine law:

• PAGCOR — for licensing compliance, player dispute resolution, and regulatory audits
• Anti-Money Laundering Council (AMLC) — for covered and suspicious transaction reporting under RA 9160
• National Privacy Commission (NPC) — for data breach notifications and compliance investigations
• Philippine law enforcement agencies — in response to valid court orders, subpoenas, or other lawful legal process

7.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of penjoy's business assets, personal data held by penjoy may be transferred to the acquiring entity as part of that transaction. penjoy will notify affected players of any such transfer and the acquiring entity will be bound by the terms of this Privacy Policy or an equivalent standard of protection.

penjoy uses cookies and similar tracking technologies on the penjoy.net platform to ensure the site functions correctly, improve the player experience, and analyse usage patterns. This section explains what cookies we use and how you can manage your preferences.

8.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the platform to function. These include session cookies that keep you logged in, cookies that remember your responsible gaming settings, and security cookies that protect against cross-site request forgery. These cannot be disabled without significantly impairing your ability to use penjoy.
• Functional Cookies: Remember your preferences such as language settings and game display options to personalise your experience across sessions.
• Analytics Cookies: Used by penjoy to understand how players navigate the platform, which games are most popular, and where technical issues occur. This data is aggregated and anonymised wherever possible.
• Security & Fraud Detection Cookies: Help identify suspicious login attempts, detect bot activity, and flag unusual account behaviour for investigation.

8.2 Managing Your Cookie Preferences

You can control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies, though doing so may affect your ability to log in or use certain platform features. Note that strictly necessary cookies cannot be disabled through browser settings without breaking core platform functionality.

penjoy retains your personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable Philippine law and PAGCOR regulations. The table below outlines penjoy's standard data retention periods by category:

At the end of the applicable retention period, penjoy will securely delete or anonymise your personal data in a manner that prevents its reconstruction or re-identification. Data that is subject to an active legal hold — such as records relevant to an ongoing investigation or court proceeding — will be retained until the hold is lifted, regardless of the standard retention period.

penjoy implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:

• Encryption in Transit: All data transmitted between your device and penjoy.net is encrypted using TLS (Transport Layer Security) 1.2 or higher.
• Encryption at Rest: Sensitive data — including KYC documents and financial records — is encrypted at rest using industry-standard encryption.
• Access Controls: Personal data is accessible only to penjoy staff and authorised service providers on a strict need-to-know basis. All staff with data access undergo data privacy training and background verification.
• Two-Factor Authentication (2FA): penjoy strongly encourages all players to enable 2FA on their accounts and provides this feature at no cost.
• Vulnerability Management: penjoy's technical infrastructure undergoes regular security assessments and penetration testing to identify and remediate vulnerabilities.
• Fraud Monitoring: Real-time transaction monitoring and anomaly detection systems are in place to identify and respond to suspicious account activity.

While penjoy takes all reasonable precautions to secure your personal data, no internet-based system is 100% immune to security risks. You are encouraged to maintain a strong, unique password for your penjoy account and to enable 2FA. Contact [email protected] immediately if you suspect your account has been compromised.

As a data subject under the Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by penjoy. To exercise any of these rights, contact penjoy's Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request".

• Right to Be Informed: You have the right to know how your personal data is being collected, processed, and used — which is the purpose of this Privacy Policy.
• Right of Access: You may request a copy of the personal data penjoy holds about you, along with information about how it is processed. penjoy will respond within 15 business days of receiving a verifiable request.
• Right to Rectification: If any personal data penjoy holds about you is inaccurate or incomplete, you have the right to have it corrected. You may update basic account details directly in your penjoy account settings; for KYC-related corrections, contact support.
• Right to Erasure (Right to be Forgotten): You may request deletion of your personal data where there is no longer a lawful basis for its retention. Note that penjoy is legally required to retain certain data for a minimum of 5 years under AML and PAGCOR regulations, even after account closure — such data cannot be deleted before the statutory retention period expires.
• Right to Data Portability: You may request that penjoy provide your personal data in a structured, commonly used, machine-readable format, so that it can be transferred to another service provider where technically feasible.
• Right to Object: You may object to the processing of your personal data where penjoy relies on legitimate interests as the legal basis. You also have an absolute right to object to processing for direct marketing purposes at any time.
• Right to Lodge a Complaint: If you believe penjoy has processed your personal data in violation of the Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission (NPC) at privacy.gov.ph.

penjoy is strictly an adults-only platform. In accordance with Philippine law and PAGCOR licensing requirements, all players must be at least 21 years of age to register an account and participate in any gaming activity on penjoy.net. This age restriction is a legal requirement, not a preference — it is non-negotiable and uniformly enforced.

penjoy does not knowingly collect, store, or process the personal data of individuals under 21 years of age. Age verification is a mandatory step in our KYC process. If penjoy discovers or has reasonable grounds to believe that a registered account belongs to a person under 21, we will:

• Immediately suspend the account pending investigation
• Withhold any withdrawals pending the investigation outcome
• Permanently close the account if the age violation is confirmed
• Report the matter to PAGCOR as required by our licensing obligations
• Securely delete all personal data associated with the underage account, except where retention is required by law

If you are a parent or guardian and believe your child may have registered on penjoy.net, please contact us immediately at [email protected] so we can investigate and take appropriate action without delay.

penjoy reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, new legal or regulatory requirements, or improvements to our platform. When we make material changes to this Policy, we will:

• Update the "Last Updated" date at the top of this page
• Post a prominent notice on the penjoy.net homepage for a minimum of 30 days following any material change
• Where required by the Data Privacy Act or NPC guidelines, seek fresh consent from affected data subjects before implementing changes that would result in a more intrusive use of personal data
• Send a notification to your registered email address for changes that significantly affect your privacy rights

Your continued use of the penjoy platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the revised terms. If you do not agree with the changes, you should close your account and cease using the platform before the revised Policy takes effect. Requests to close your account may be submitted to [email protected].

We encourage you to review this Privacy Policy periodically to stay informed about how penjoy protects your personal information. The most current version of this Policy is always available at penjoy.net/privacy-policy.

penjoy is committed to resolving any privacy concerns or data subject rights requests promptly and transparently. If you have any questions about this Privacy Policy, how your personal data is used, or wish to exercise any of your rights under the Data Privacy Act of 2012, please reach out to us through the following channel:

If you are not satisfied with penjoy's response to your privacy concern, or if you believe your data rights under RA 10173 have been violated, you have the right to escalate your complaint to the National Privacy Commission (NPC), the official data protection authority of the Philippines.

penjoy takes all privacy complaints seriously. Every complaint received is logged, investigated by our Data Protection Officer, and responded to in writing. We are committed to resolving concerns fairly and in accordance with the Data Privacy Act, with the goal of maintaining the trust of every Filipino player on our platform.