Privacy Policy – okph Platform

1 Who We Are — Data Controller Identity

okph is the Personal Information Controller responsible for personal data processed through the okph platform at okph.one. okph is a PAGCOR-licensed online gaming operator serving the Philippine market. Our Data Protection Officer ("DPO") can be contacted through the contact details provided in Section 14 of this Policy.

For the purposes of this Policy, "processing" covers any operation or set of operations performed upon personal data, whether or not by automated means, including collection, recording, organisation, storage, updating, retrieval, use, disclosure, or erasure.

2 Categories of Personal Data We Collect

okph collects the following categories of personal data in connection with the provision and administration of its gaming platform and related services:

3 How We Collect Personal Data

okph collects personal data through the following means:

• Direct collection — Information you provide when registering an Account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated collection — Technical data collected automatically when you access the Platform, including through cookies, log files, and session tracking technologies described in Section 8.
• Third-party collection — Information received from payment processors (GCash, PayMaya, BPI, BDO) in connection with transaction confirmation, and from identity verification service providers used in our KYC process.
• Regulatory sources — Information received from PAGCOR or other Philippine government authorities in connection with licensing compliance, self-exclusion registers, or law enforcement requests.

4 Legal Basis for Processing

okph processes personal data on the following legal bases as provided under the Data Privacy Act of 2012:

• Contractual necessity — Processing required to fulfil our obligations under the Terms and Conditions you accept when registering an Account, including account management, game provision, and payment processing.
• Legal obligation — Processing required to comply with applicable Philippine laws, including PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160), the Data Privacy Act of 2012, and directions from competent regulatory authorities.
• Legitimate interests — Processing for fraud prevention, security monitoring, platform improvement, and responsible gaming monitoring, where these interests are not overridden by your rights as a Data Subject.
• Consent — Processing for optional purposes such as marketing communications, where we have obtained your prior, specific, and informed consent. You may withdraw consent for such processing at any time through your Account settings.

5 How We Use Your Personal Data

5.1 Core Platform Operations

okph uses your personal data to create and manage your Account, verify your identity and age (21+ requirement), process deposits and withdrawals, deliver game services, administer bonuses and promotions, and provide customer support. These uses are necessary to perform our contractual obligations to you.

5.2 Regulatory Compliance

We use identity, financial, and gaming activity data to fulfil our obligations under PAGCOR licensing conditions and Philippine AML law, including transaction monitoring, suspicious transaction reporting to the Anti-Money Laundering Council (AMLC), and maintaining records for the periods specified by regulation.

5.3 Responsible Gaming

Gaming activity data — including session duration, wager frequency, deposit patterns, and self-exclusion status — is used to monitor for problem gambling indicators and to administer responsible gaming tools including deposit limits, cooling-off periods, and self-exclusion. This processing is carried out in the interest of player welfare and in compliance with PAGCOR's responsible gaming requirements.

5.4 Security and Fraud Prevention

Technical data including IP addresses, device identifiers, and login records are processed to detect and prevent unauthorised account access, fraudulent activity, bonus abuse, and multi-accounting. This processing is carried out on the basis of our legitimate interests in protecting our platform and other players.

5.5 Marketing Communications

With your consent, we may use your contact data to send you promotional communications about okph games, bonuses, and offers. You may opt out of marketing communications at any time through your Account settings. Withdrawing consent for marketing does not affect the lawfulness of prior processing or your right to use the Platform.

6 Data Sharing & Disclosure

okph does not sell, rent, or trade your personal data. We share personal data only in the following circumstances and with the following categories of recipients:

• Payment processors — GCash, PayMaya, BPI, BDO, Metrobank, Landbank, UnionBank, and other payment service providers receive transaction data necessary to process deposits and withdrawals. These providers are contractually bound to protect data and may only use it for the specified payment purpose.
• KYC and identity verification providers — Third-party identity verification services receive identity documents solely for the purpose of confirming your identity as required by PAGCOR. These providers operate under data processing agreements that restrict their use of your data.
• Game software providers — Technical session data may be shared with certified game studios to deliver live dealer games and resolve technical disputes. Game providers do not receive your full identity profile.
• Regulatory authorities — okph discloses personal data to PAGCOR, the Anti-Money Laundering Council, the National Privacy Commission, and other competent Philippine government authorities where required by law, court order, or legitimate regulatory request.
• Professional advisers — Legal counsel, auditors, and compliance consultants may access personal data on a need-to-know basis under strict professional confidentiality obligations.
• Self-exclusion registries — Where a player self-excludes from the okph Platform, that player's details are shared with PAGCOR's self-exclusion registry to prevent re-registration with other PAGCOR-licensed operators, in the interest of responsible gaming.

7 Data Retention

okph retains personal data for as long as is necessary to fulfil the purposes described in this Policy, subject to the following minimum retention periods required by Philippine law and PAGCOR regulations:

• Account and identity records — Retained for a minimum of five (5) years following Account closure, as required by AML regulations.
• Financial transaction records — Retained for a minimum of five (5) years following the date of each transaction, as required by the Anti-Money Laundering Act and PAGCOR directives.
• Gaming activity logs — Retained for a minimum of three (3) years following Account closure for regulatory audit and dispute resolution purposes.
• Customer support records — Retained for two (2) years following resolution of a support interaction or complaint.
• KYC documentation — Retained in accordance with AML minimum retention requirements; not less than five (5) years following Account closure.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual. Data retained solely for anonymised statistical analysis does not constitute personal data processing for the purposes of this Policy.

8 Cookies & Tracking Technologies

8.1 Types of Cookies Used

okph uses the following categories of cookies and similar tracking technologies on the Platform:

• Strictly necessary cookies — Required for the Platform to function. These include session authentication cookies that keep you logged in during a gaming session. These cannot be disabled without preventing Platform access.
• Performance cookies — Used to collect anonymised data about how players navigate the Platform, which pages are most visited, and where errors occur. This data helps us improve Platform performance.
• Functional cookies — Store your preferences such as language settings, responsible gaming limit configurations, and game lobby filters, so you do not need to reconfigure them on each visit.
• Security cookies — Used to detect and prevent fraudulent login attempts, bot activity, and account takeover attempts by linking login sessions to specific device fingerprints.

8.2 Cookie Control

You may manage non-essential cookies through your browser settings. Most modern browsers allow you to refuse, delete, or be notified of new cookies. Disabling functional or performance cookies may affect your Platform experience but will not prevent access to core gaming services. Strictly necessary and security cookies cannot be disabled without terminating your session.

9 Data Security

okph implements a multi-layered approach to personal data security, consistent with the security standards required by the Data Privacy Act of 2012 and NPC Circular No. 16-01 on Security of Personal Data in Government Agencies (adapted for licensed private operators):

• Encryption in transit — All data transmitted between your browser or app and the okph platform is encrypted using TLS 1.2 or higher (256-bit AES).
• Encryption at rest — Sensitive personal data, including identity documents and financial records, is encrypted at rest in our database infrastructure.
• Access controls — Access to personal data is restricted on a strict need-to-know basis. Employees and contractors with data access undergo background screening and are bound by confidentiality agreements.
• Two-factor authentication — Available to all players for Account login; mandatory for employee access to internal systems containing personal data.
• Penetration testing and security audits — The Platform undergoes regular independent security assessments. Critical vulnerabilities are remediated within timelines consistent with industry best practice.
• Incident response — okph maintains a documented data breach response plan. In the event of a confirmed breach, the NPC will be notified within 72 hours and affected Data Subjects will be notified without undue delay, as required by the Data Privacy Act of 2012.

10 Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by okph. You may exercise these rights by contacting our DPO using the details in Section 14:

okph will respond to verified Data Subject requests within fifteen (15) calendar days of receipt. Where a request requires additional time to fulfil, you will be informed of the reason for the delay and the expected completion date.

11 Children's Privacy and the 21+ Requirement

The okph Platform is not directed at individuals under 21 years of age. okph does not knowingly collect personal data from individuals under the age of 21. The 21-year minimum age requirement is enforced by PAGCOR regulation and strictly applied at registration and at the point of identity verification before withdrawals are processed.

If okph becomes aware that personal data of a person under 21 years of age has been collected, that data will be deleted, the associated Account will be permanently closed, and deposited funds will be returned to the original payment source. If you believe okph has inadvertently collected data from an underage individual, please contact our DPO immediately using the details in Section 14.

12 International Data Transfers

okph primarily processes personal data within the Republic of the Philippines. In limited circumstances, personal data may be transferred to or processed by service providers operating outside the Philippines — for example, international game software studios operating live dealer studios, or cloud infrastructure providers.

Where personal data is transferred outside the Philippines, okph ensures that appropriate safeguards are in place, including: contractual data processing agreements that impose obligations consistent with the Data Privacy Act of 2012; and, where applicable, reliance on the adequacy determination of the destination jurisdiction or standard contractual clauses approved by the National Privacy Commission.

No personal data is transferred to a third country unless okph is satisfied that adequate protection of Data Subject rights is guaranteed in that country or by the transfer mechanism employed.

13 Changes to This Privacy Policy

okph reserves the right to update or amend this Privacy Policy at any time. Material changes — such as new categories of personal data collected, new purposes for processing, or new third-party recipients — will be communicated to registered players via their registered email address or via an in-platform notification, with at least fourteen (14) calendar days' notice before the change takes effect.

Non-material changes, such as typographical corrections or reorganisation of content without substantive impact, may be made without advance notice. The "Effective Date" at the top of this Policy will always reflect the date the current version came into force.

Your continued use of the okph Platform after a notified Policy update constitutes acceptance of the revised Policy. If you do not accept a material change to this Policy, you may close your Account by contacting support prior to the effective date of the change, and your remaining balance will be returned to your verified payment method.

14 Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by okph, you may contact our Data Protection Officer through the following channels:

If you are not satisfied with okph's response to your data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines, the supervisory authority responsible for data protection in the Philippines.