okplaay Privacy Policy

1About This Policy

This Privacy Policy applies to all personal data collected and processed by okplaay in connection with the okplaay website located at okplaay.net, the okplaay mobile application (where available), and all related gaming services, promotional communications, and customer support interactions (collectively, the "Platform").

okplaay is the data controller responsible for the personal data of all registered players and website visitors in the Philippines. As a PAGCOR-regulated online gaming operator, okplaay is required by law to collect and retain certain categories of personal data for identity verification, anti-money laundering (AML) compliance, responsible gaming enforcement, and regulatory reporting purposes.

This Policy should be read together with okplaay's Terms & Conditions and Responsible Gaming policy, both of which form part of the overall agreement between you and okplaay. Where this Privacy Policy conflicts with any other document, this Policy prevails with respect to data privacy matters.

2Data We Collect

okplaay collects personal data from you directly when you register an account, make deposits or withdrawals, contact customer support, or interact with the Platform in any way. We also collect certain data automatically through your use of the Platform. The categories of data we collect are set out below.

3How We Use Your Data

okplaay uses your personal data only for specific, legitimate purposes directly connected to the operation of the Platform and our legal obligations as a PAGCOR-licensed operator. We do not sell your personal data to third parties. The primary purposes for which we process your data are as follows:

• Account Registration and Management: To create, maintain, and administer your okplaay account, verify your identity, and authenticate your login sessions.
• KYC and Age Verification: To verify that you are at least 21 years of age and to confirm your identity in compliance with PAGCOR requirements and Philippine AML law. This is a mandatory legal obligation and cannot be opted out of.
• Payment Processing: To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and other supported payment channels, and to maintain accurate financial records in Philippine pesos (₱).
• Gaming Services: To provide access to slots, live casino, sports betting, sabong, bingo, arcade, and all other game verticals available on the Platform.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, bonus abuse, money laundering, and other Platform integrity violations.
• Responsible Gaming: To monitor gaming behaviour for signs of problem gambling, enforce player-set limits and self-exclusion requests, and comply with PAGCOR's responsible gaming directives.
• Customer Support: To respond to your enquiries, resolve disputes, and improve the overall quality of our support services.
• Marketing Communications: To send you promotional offers, tournament announcements, and reload bonus notifications — but only where you have given explicit consent. You may withdraw your marketing consent at any time via your account settings.
• Regulatory Reporting: To prepare and submit reports to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine authorities as required by law.
• Platform Improvement: To analyse aggregated, anonymised usage data for the purposes of improving game offerings, website performance, and the overall user experience on the Platform.

4Legal Basis for Processing

Under the Data Privacy Act of 2012 (RA 10173), okplaay processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you accepted upon registration — including operating your account, processing payments, and providing gaming services.
• Legal Obligation: Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160 as amended), the Data Privacy Act (RA 10173), and other applicable Philippine laws and regulations.
• Legitimate Interests: Processing necessary for fraud prevention, Platform security, responsible gaming monitoring, and internal analytics — where these interests are not overridden by your privacy rights.
• Consent: Processing for direct marketing communications, non-essential cookies, and optional promotional features — where you have given freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5Data Sharing & Disclosure

okplaay does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only in the following limited circumstances and always subject to appropriate data protection safeguards:

• Game Providers and Platform Suppliers: Third-party software providers who supply casino games, live dealer studios, sports betting engines, and other Platform components may receive limited technical data (such as session tokens and bet identifiers) strictly as necessary to deliver their services to you via the okplaay Platform.
• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers receive the financial data necessary to process your deposit and withdrawal transactions. These providers operate under their own privacy policies and are bound by applicable Philippine financial regulations.
• KYC and Identity Verification Partners: Specialist identity verification service providers may process your identity documents and biometric data on okplaay's behalf for the purpose of completing mandatory KYC checks. These providers are bound by strict data processing agreements.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies where disclosure is required by law, court order, or regulatory directive.
• Law Enforcement: Philippine law enforcement authorities where disclosure is required in connection with a criminal investigation or legal proceeding involving the Platform or its players.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of okplaay's assets, your personal data may be transferred to the acquiring entity, subject to the same data protection standards set out in this Policy.

6Cookies & Tracking Technologies

The okplaay Platform uses cookies and similar tracking technologies (including web beacons and local storage objects) to operate the Platform securely and to improve your experience. The types of cookies we use are as follows:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They manage your login session, maintain your account authentication, and enable core Platform features such as game loading and payment processing. These cookies cannot be disabled without severely impairing Platform functionality.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, display settings, and responsible gaming limit configurations — so that you do not need to re-enter them on every visit.
• Analytics Cookies: These cookies collect anonymised, aggregated data about how players navigate and use the Platform, helping us identify popular games, detect performance bottlenecks, and prioritise product improvements. This data does not identify you personally.
• Marketing and Personalisation Cookies: These cookies (used only with your consent) enable us to display personalised bonus offers and promotional content based on your gaming preferences and Platform activity. You may opt out of marketing cookies at any time via your account preferences.

You can manage or delete cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to your okplaay account. For full details on the cookies currently in use on the Platform, please refer to our Cookie Settings panel accessible from the Platform footer.

7Data Retention

okplaay retains your personal data only for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable Philippine law. The key retention periods are as follows:

• Account and Identity Data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, in accordance with PAGCOR licensing requirements and the Anti-Money Laundering Act.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, as required by Philippine AML regulations and PAGCOR's record-keeping directives.
• Gaming History: Retained for a minimum of three (3) years from the date of each gaming session for regulatory audit, dispute resolution, and responsible gaming monitoring purposes.
• Customer Support Records: Retained for three (3) years from the date of the last interaction, for dispute resolution and service quality improvement purposes.
• Marketing Consent Records: Retained for the duration of your account plus two (2) years following account closure, to demonstrate compliance with consent requirements.
• Self-Exclusion Records: Retained permanently (or for the duration of the exclusion period plus five years) to prevent re-registration by self-excluded players in compliance with okplaay's responsible gaming obligations.

Upon expiry of the applicable retention period, your personal data will be securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for statistical and analytical purposes, as it can no longer be used to identify you.

8Data Security

okplaay implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:

• Encryption: All data transmitted between your device and the okplaay Platform is protected using industry-standard TLS (Transport Layer Security) encryption. Sensitive data at rest — including identity documents and financial records — is encrypted using AES-256 encryption.
• Access Controls: Access to personal data within okplaay's internal systems is strictly limited to personnel who require it to perform their authorised job functions. Role-based access controls and multi-factor authentication are enforced across all internal systems.
• Penetration Testing: The Platform undergoes regular independent security assessments, including penetration testing and vulnerability scanning, to identify and remediate potential weaknesses before they can be exploited.
• Incident Response: okplaay maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, okplaay will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with the Data Privacy Act of 2012.
• Employee Training: All okplaay personnel with access to personal data receive mandatory data privacy and security training at the time of onboarding and on an ongoing annual basis.

9Your Rights Under Philippine Data Privacy Law

Under the Data Privacy Act of 2012 (RA 10173) and the regulations of the National Privacy Commission, you have the following rights with respect to your personal data held by okplaay. You may exercise any of these rights by contacting our Data Protection Officer (DPO) via the contact details provided in Section 13 of this Policy.

okplaay will respond to all verified data rights requests within thirty (30) days of receipt. We may ask you to verify your identity before processing your request. Requests can be submitted via live chat or by writing to our DPO at the email address in Section 13.

10Children & Minors

The okplaay Platform is strictly for persons aged 21 years and above. okplaay does not knowingly collect personal data from any individual under the age of 21. In the Philippines, PAGCOR regulations set the minimum legal age for casino-style online gambling at 21 years.

If okplaay discovers or has reason to believe that an account has been registered by or on behalf of a person under 21 years of age, the account will be immediately suspended, all pending withdrawals cancelled, and the matter escalated for review. Any personal data collected in connection with an underage account will be securely deleted following the conclusion of any regulatory reporting obligations.

If you are a parent or guardian and believe that a minor in your care has registered an account with okplaay, please contact our support team immediately via 24/7 live chat so that we can take prompt action.

11Cross-Border Data Transfers

As a Philippine-facing gaming operator, the majority of okplaay's data processing activities are conducted within the Philippines. However, some of our technology infrastructure, third-party game providers, and cloud service providers may be located in other countries. Where your personal data is transferred outside the Philippines, okplaay ensures that such transfers are made in compliance with the Data Privacy Act of 2012 and NPC regulations, including by requiring recipient entities to provide an equivalent level of data protection through contractual safeguards such as standard data protection clauses.

okplaay does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate technical and contractual safeguards as required by the NPC.

12Policy Updates

okplaay reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. When material changes are made to this Policy, okplaay will notify registered players by email to their registered address and/or by a prominent notice on the Platform, no less than seven (7) days before the changes take effect.

The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Privacy Policy periodically. Your continued use of the Platform following the effective date of any amended Privacy Policy constitutes your acknowledgement of the revised terms.

13Contact & Data Protection Officer

okplaay has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. If you have any questions, concerns, or requests relating to your personal data, or if you wish to exercise any of your data rights under Section 9, you may contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the live chat widget on the okplaay Platform. This is the fastest way to raise an urgent data privacy concern.
• Email (DPO): [email protected] — please include "Data Privacy Request" in the subject line. This address is shown as plain text and is not a clickable link.

okplaay aims to respond to all data privacy enquiries within five (5) business days and to fully resolve data rights requests within thirty (30) days of receipt of a verified request.