okpplay Privacy Policy

01 Introduction & Scope

This Privacy Policy ("Policy") describes how okpplay ("we," "us," "our," or "the Platform") collects, uses, stores, protects, and discloses personal information in connection with your use of the okpplay website available at okpplay.net and all related gaming services (collectively, the "Services").

okpplay is deeply committed to protecting the privacy and personal data of every Filipino player on our platform. We recognize that when you share your personal information with us — whether during account registration, identity verification, or day-to-day gaming activity — you are placing genuine trust in us. We take that trust seriously and handle your data responsibly, transparently, and in strict compliance with Philippine law.

By accessing okpplay.net, creating an account, or using any of our Services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, please refrain from using the Platform and contact us to close your account if one exists.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which form part of the overall agreement between you and okpplay.

02 Data Controller Information

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, okpplay is the personal information controller responsible for the data collected through the Platform.

okpplay operates as a PAGCOR-authorized online gaming platform. Our Data Privacy Officer (DPO) is responsible for overseeing compliance with this Policy and applicable data protection laws. The DPO can be reached through the contact details provided in Section 14 of this Policy.

As a personal information controller, okpplay determines the purposes and means of processing your personal data. Our payment processors, KYC verification partners, and other service providers act as personal information processors under our direction and are bound by contractual obligations to process your data only as instructed by okpplay and in compliance with RA 10173.

03 Information We Collect

okpplay collects different categories of personal data depending on your level of interaction with the Platform. The main categories are set out below:

A. Registration & Identity Data

When you create an okpplay account, we collect the personal information necessary to establish your identity and comply with PAGCOR's know-your-customer (KYC) requirements:

• Full legal name (as it appears on a government-issued ID)
• Date of birth (to verify the mandatory 21+ age requirement)
• Residential address in the Philippines
• Mobile phone number and email address
• Government-issued ID number (e.g., PhilSys National ID, passport, driver's licence, UMID)
• Selfie or live photo for facial verification, where required
• Taxpayer Identification Number (TIN), where applicable for high-value transactions

B. Financial & Transaction Data

• GCash mobile number, Maya account details, or bank account information used for deposits and withdrawals
• Deposit and withdrawal history, amounts, dates, and payment method references
• Gaming transaction history including wagers placed, games played, win/loss records, and bonus usage
• Account balance information at any given time

C. Technical & Usage Data

• IP address and approximate geolocation (country and region level)
• Device type, operating system, and browser version
• Session data including login times, duration, and pages visited
• Clickstream and navigation data within the Platform
• Cookies and similar tracking technologies (see Section 9)

D. Communications Data

• Records of live chat conversations and support ticket exchanges
• Email correspondence with okpplay's support or compliance teams
• Voluntary feedback, survey responses, and promotional opt-in records

04 How We Use Your Data

okpplay processes your personal data for the following specific, legitimate purposes:

Where we rely on your consent as the legal basis for processing (for example, for marketing communications), you have the right to withdraw that consent at any time by adjusting your notification preferences in your account settings or by contacting our support team. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

05 Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, okpplay processes your personal data only where a lawful basis exists. The legal bases applicable to our processing activities are:

• Contract Performance: Processing is necessary to fulfill our obligations to you under the Terms & Conditions, including operating your account, processing transactions, and providing gaming services.
• Legal Obligation: okpplay is subject to binding legal and regulatory requirements under Philippine law, including PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), the Cybercrime Prevention Act, and tax reporting obligations. Processing to fulfill these obligations is mandatory and does not require your separate consent.
• Legitimate Interests: Certain processing activities are justified by okpplay's legitimate interests, including fraud prevention, platform security, responsible gaming monitoring, and general business analytics — provided these interests are not overridden by your fundamental rights and freedoms.
• Consent: For activities not covered by the above bases — particularly direct marketing communications and the use of non-essential analytics cookies — we rely on your freely given, specific, informed, and unambiguous consent. You may withdraw this consent at any time as described in Section 10.

06 Sharing & Disclosure

okpplay does not sell, rent, or trade your personal data to third parties for their own commercial or marketing purposes. We share personal data only in the following limited circumstances:

• Payment Processors: We share transaction and identity data with licensed Philippine payment service providers (including those facilitating GCash, Maya, BPI, BDO, Metrobank, InstaPay, and PesoNet transactions) solely to process your deposits and withdrawals. These providers are bound by their own RA 10173 obligations and by contractual data processing agreements with okpplay.
• KYC & Identity Verification Providers: To fulfill PAGCOR's mandatory know-your-customer requirements, we share registration data and ID documents with our accredited identity verification partner. This provider processes your data exclusively for KYC purposes on our behalf.
• PAGCOR & Regulatory Bodies: As a PAGCOR-licensed platform, okpplay is legally required to provide player account and transaction data to PAGCOR upon request and to submit periodic compliance reports. We have no discretion to withhold this data when legitimately requested by our regulator.
• Anti-Money Laundering Council (AMLC): Pursuant to the Anti-Money Laundering Act of 2001 (as amended), okpplay is required to file Covered Transaction Reports (CTRs) and Suspicious Transaction Reports (STRs) with the AMLC where applicable. Philippine law prohibits us from notifying the subject of any such report.
• Law Enforcement & Courts: We will disclose personal data to Philippine law enforcement agencies or in response to a valid court order where we are legally compelled to do so. We will always seek to verify the legitimacy of such requests before complying.
• IT & Platform Service Providers: Our hosting, cloud infrastructure, and cybersecurity service providers may have access to personal data as a necessary part of maintaining platform operations. All such providers are vetted for compliance and bound by strict data processing agreements.

07 Data Retention

okpplay retains your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following retention periods apply as a general guide:

Once the applicable retention period has elapsed and no legal hold or ongoing investigation requires further retention, okpplay will securely delete or anonymize your personal data so that it can no longer be associated with you as an individual.

08 Security Measures

okpplay implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures are reviewed and updated regularly in line with evolving industry best practices and the security standards prescribed under RA 10173's Implementing Rules and Regulations.

Technical Safeguards:

• TLS/SSL Encryption: All data transmitted between your browser or device and okpplay's servers is encrypted using Transport Layer Security (TLS 1.2 or higher). You can verify this by the padlock icon in your browser's address bar.
• At-Rest Encryption: Sensitive data stored in our databases — including KYC documents, financial records, and password hashes — is encrypted using AES-256 encryption at rest.
• Password Hashing: User passwords are never stored in plain text. We use strong one-way cryptographic hashing algorithms with salting to store password credentials.
• Two-Factor Authentication (2FA): We offer optional 2FA for player accounts and enforce mandatory 2FA for all okpplay internal staff with access to player data.
• Firewalls & Intrusion Detection: Our infrastructure is protected by enterprise-grade firewalls, web application firewalls (WAF), and real-time intrusion detection and prevention systems (IDS/IPS).
• Regular Security Audits: We conduct periodic third-party penetration testing and vulnerability assessments of our platform infrastructure.

Organizational Safeguards:

• Access to player personal data is restricted on a strict need-to-know basis. Staff access is role-based, logged, and regularly reviewed.
• All staff with access to personal data undergo data privacy training upon onboarding and annually thereafter.
• We maintain a documented incident response plan for data breaches, consistent with the breach notification requirements under RA 10173 and NPC regulations.

While we take every reasonable precaution to protect your data, no online system can guarantee absolute security. You also play a role in keeping your account secure — please use a strong, unique password and enable 2FA where available. If you suspect your account has been compromised, contact our support team immediately.

09 Cookies & Tracking Technologies

okpplay uses cookies and similar technologies (such as web beacons and local storage objects) on its website. This section explains what types of cookies we use and how you can manage your preferences.

Essential Cookies — These cookies are strictly necessary for the Platform to function. They enable core features such as maintaining your login session, processing transactions, and applying responsible gaming limits. These cookies cannot be disabled without severely impairing your ability to use the Platform.

Functional Cookies — These cookies remember your preferences (such as language settings and game lobby display options) to provide a more personalized experience. Disabling these will not break core functionality but may reduce convenience.

Analytics Cookies — With your consent, we use anonymized analytics data to understand how players navigate our platform, which features are most used, and where technical improvements are needed. This data is aggregated and does not identify you as an individual.

Security Cookies — Certain cookies are used to detect and prevent fraud, bot activity, and multiple account creation from the same device. These are considered essential cookies and are active by default.

10 Your Rights Under RA 10173

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by okpplay. You may exercise any of these rights by submitting a written request to our Data Privacy Officer at the contact details in Section 14.

We will respond to all verified rights requests within 30 calendar days of receipt. If we are unable to fulfill a request (for example, because retention is legally mandated), we will explain the reason in writing. If you are dissatisfied with our response, you have the right to lodge a complaint with the National Privacy Commission (NPC) at privacy.gov.ph.

11 Protection of Minors

okpplay is an online gaming and gambling platform. Under Philippine law and PAGCOR regulations, participation in real-money gaming is strictly restricted to individuals who are 21 years of age or older. This age restriction is a fundamental requirement — not a recommendation — and we enforce it rigorously through our KYC and identity verification processes.

If you are a parent or guardian and believe your child (or a minor in your care) has accessed or registered on the okpplay platform, please contact our Data Privacy Officer immediately at [email protected] so that we can take swift action to close the account and purge any data collected.

We encourage parents and guardians to use parental control software and to have open conversations with young people about responsible internet use and the legal age requirements for online gambling in the Philippines.

12 Cross-Border Data Transfers

okpplay primarily stores and processes personal data within the Philippines. However, some of our third-party service providers — including cloud infrastructure and cybersecurity vendors — may process data in other jurisdictions as part of delivering their services.

Whenever personal data is transferred outside the Philippines, okpplay ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to the protections provided under RA 10173. These safeguards may include:

• Executing data processing agreements and standard contractual clauses with recipient processors;
• Ensuring that the recipient country has been assessed as providing an adequate level of data protection; and
• Implementing additional technical safeguards such as end-to-end encryption for data in transit.

13 Changes to This Policy

okpplay reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or our business operations. We are committed to keeping this Policy current and accurate.

When we make material changes to this Policy, we will:

• Update the "Effective Date" at the top of this page;
• Display a prominent notice on the okpplay website for a reasonable period after the change takes effect; and
• Where the changes significantly affect how we process your personal data, send a direct notification to your registered email address before the changes come into effect.

Your continued use of the okpplay platform after the updated Policy becomes effective constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you should stop using the Platform and may request account closure by contacting our support team.

We encourage you to review this Privacy Policy periodically to stay informed about how okpplay protects your data. The most current version of this Policy is always available at okpplay.net/privacy-policy.

14 Contact Our Data Privacy Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by okpplay, please reach out to our designated Data Privacy Officer. We are committed to addressing all inquiries promptly and transparently.

When submitting a rights request, please include your full name, registered email address, account username (if applicable), and a clear description of the right you wish to exercise. We may request additional information to verify your identity before processing the request — this is to protect you from unauthorized access to your data.

If you are not satisfied with our response, you have the right to file a complaint with the National Privacy Commission (NPC), the Philippine government agency responsible for overseeing compliance with RA 10173. Information on how to file a complaint is available through the NPC's official channels.