okplah Privacy Policy

1 About This Privacy Policy

This Privacy Policy describes how okplah collects, uses, stores, shares, and protects the personal data of individuals who access or use the okplah online gaming platform at https://okplah.net. It applies to all registered players, visitors browsing the site as guests, and any individual who contacts okplah's customer support team.

okplah is a PAGCOR-regulated online gaming platform serving Filipino players. As a licensed operator, okplah is subject to both PAGCOR's data handling standards and the requirements of the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy should be read together with the okplah Terms & Conditions and the Responsible Gaming Policy. In the event of any conflict, the Terms & Conditions shall prevail.

2 Data Controller

For the purposes of the Data Privacy Act of 2012 and its implementing regulations, okplah is the personal information controller in respect of all personal data collected through the okplah platform. okplah determines the purposes for which, and the manner in which, personal data is processed.

okplah has designated a Data Protection Officer (DPO) who is responsible for overseeing the platform's compliance with the Data Privacy Act, handling data subject requests, and acting as the primary point of contact for the National Privacy Commission. Contact details for the DPO are provided in Section 16 of this Policy.

3 Personal Data We Collect

3.1 Identity and Registration Data

When you register an account on okplah, we collect your full legal name, date of birth, nationality, and the details of a valid Philippine government-issued identification document (such as a passport, UMID, SSS ID, PhilHealth ID, or driver's license). This information is required to verify your identity, confirm you are at least 21 years of age, and comply with PAGCOR's Know Your Customer (KYC) requirements.

3.2 Contact Data

We collect your email address, Philippine mobile phone number, and residential address in the Philippines. This data is used to communicate with you regarding your account, transactions, and promotions (where applicable), and to deliver support services.

3.3 Financial Data

To process deposits and withdrawals, okplah collects the details of your nominated payment method, which may include your GCash mobile number, PayMaya account identifier, or bank account information for BPI, BDO, or Metrobank. We also maintain records of all financial transactions conducted through your okplah account as required by PAGCOR and Philippine anti-money-laundering regulations.

3.4 Gaming and Transaction Data

okplah records all gaming activity associated with your account, including games played, bets placed, outcomes, session duration, bonus redemptions, and wagering history. This data is used for game settlement, dispute resolution, responsible gaming monitoring, and regulatory reporting to PAGCOR where required.

3.5 Technical and Device Data

When you access the okplah platform, our servers automatically collect technical data including your IP address, device type and model, operating system and version, browser type and version, screen resolution, and session timestamps. This information is used for platform security, fraud detection, and verifying that you are accessing the platform from within the Philippines.

3.6 Communications Data

When you contact okplah's customer support team via email, live chat, or any other channel, we retain records of those communications, including the content of messages and any attachments, for quality assurance, training, and dispute resolution purposes.

4 How We Collect Your Data

okplah collects personal data through the following means:

• Direct collection: Data you provide when completing the registration form, submitting KYC documents, making a deposit or withdrawal request, contacting support, or responding to a survey or promotion.
• Automated collection: Technical and device data collected automatically via server logs, cookies, and similar tracking technologies when you access the okplah website or mobile-optimized platform.
• Third-party sources: Identity verification data from PAGCOR-approved KYC service providers; fraud risk signals from payment processing partners; and, where applicable, publicly available records used to fulfill anti-money-laundering obligations.

5 Legal Basis for Processing

okplah processes your personal data on one or more of the following legal bases as recognized under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to open and maintain your okplah account, process deposits and withdrawals, settle gaming transactions, and provide the services you have contracted with okplah to receive.
• Legal obligation: Processing required to comply with PAGCOR regulatory requirements, the Anti-Money Laundering Act (AMLA), the Data Privacy Act, and other applicable Philippine laws and regulations.
• Legitimate interests: Processing conducted for okplah's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and internal analytics — provided these interests are not overridden by your rights and freedoms.
• Consent: Processing for marketing communications and non-essential cookies, conducted only where you have provided clear, informed, and freely given consent. You may withdraw this consent at any time.

6 How We Use Your Personal Data

okplah uses your personal data for the following specific purposes:

• Creating, verifying, and managing your okplah player account.
• Conducting identity, age, and address verification as required by PAGCOR's KYC standards.
• Processing deposits and withdrawals via GCash, PayMaya, BPI, BDO, and Metrobank.
• Settling gaming outcomes and resolving disputes arising from gameplay.
• Detecting, investigating, and preventing fraud, money laundering, and other prohibited activities on the platform.
• Monitoring gaming behavior for responsible gaming purposes and applying mandatory protective measures where player risk indicators are detected.
• Providing customer support via live chat and email.
• Sending transactional communications, such as deposit confirmations, withdrawal status updates, and account security alerts.
• Sending promotional communications and bonus offers, where you have opted in to marketing.
• Improving the okplah platform through aggregated, anonymized analytics.
• Fulfilling PAGCOR reporting obligations and cooperating with lawful requests from competent Philippine authorities.

7 Sharing Your Personal Data

okplah does not sell your personal data. We share your data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• KYC and identity verification providers: Third-party services engaged by okplah to verify government-issued identification documents and confirm eligibility criteria under PAGCOR requirements.
• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, and their respective technical service providers, for the purpose of processing financial transactions.
• Game providers: Licensed game studios whose content is hosted on the okplah platform. Game providers receive only the data technically necessary to deliver gameplay and settle results.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other Philippine government bodies, where okplah is under a legal obligation to disclose.
• IT and infrastructure providers: Cloud hosting, cybersecurity, and platform monitoring vendors engaged by okplah under strict data processing agreements that prohibit them from using your data for any purpose beyond providing those services.
• Professional advisers: Legal, accounting, and compliance professionals engaged by okplah on a confidential basis.

8 Cookies & Tracking Technologies

The okplah platform uses cookies, web beacons, and similar tracking technologies to deliver certain essential functions and to help us understand how players use the platform. Below is a summary of the cookie categories used:

• Strictly necessary cookies: Required for the platform to function. These include session cookies that keep you logged into your okplah account and security tokens that protect against cross-site request forgery. These cookies cannot be disabled.
• Functional cookies: Used to remember your preferences, such as your preferred language or display settings. These enhance your experience but are not essential to platform operation.
• Analytical cookies: Used to collect anonymized data about how players navigate the platform, which pages are most visited, and where errors occur. This data helps okplah identify performance issues and improve the user experience.
• Marketing cookies: Used to track whether you arrived at okplah from a referring source, and to measure the effectiveness of okplah's own promotional campaigns. These cookies are activated only with your consent.

You may manage your cookie preferences at any time through your browser settings. Please note that disabling strictly necessary cookies will prevent you from accessing your okplah account. Disabling other cookie categories will not affect your ability to play but may reduce platform functionality.

9 Data Security

okplah implements a layered security framework to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• Transport Layer Security (TLS 1.2 or higher) encryption for all data transmitted between your device and the okplah platform.
• AES-256 encryption for sensitive personal data stored in okplah's databases.
• Role-based access controls that restrict internal access to personal data to authorized personnel who require it to perform their specific job functions.
• Multi-factor authentication requirements for all okplah administrative system access.
• Regular penetration testing and vulnerability assessments conducted by independent security firms.
• Comprehensive audit logging of all access to personal data records.
• An incident response plan that includes mandatory breach notification to the National Privacy Commission within 72 hours of discovery of a qualifying personal data breach, consistent with NPC Circular 2016-03.

10 Data Retention

okplah retains personal data for only as long as is necessary to fulfill the purpose for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The principal retention periods that apply to okplah player data are as follows:

• Identity and KYC documents: Retained for the full duration of the account plus five (5) years following permanent account closure, as required by PAGCOR's licensing standards and AMLA obligations.
• Financial transaction records: Retained for the full duration of the account plus seven (7) years following account closure, consistent with the Anti-Money Laundering Act's record-keeping requirements.
• Gaming activity records: Retained for the full duration of the account plus five (5) years following account closure for dispute resolution and regulatory audit purposes.
• Technical and device logs: Retained on a rolling 12-month basis, after which older logs are automatically purged.
• Support communications: Retained for three (3) years from the date of the communication, unless the content is relevant to an ongoing dispute or investigation.
• Marketing consent records: Retained until consent is withdrawn and for a reasonable period thereafter to evidence compliance with consent requirements.

Upon expiry of the applicable retention period, personal data is securely deleted from okplah's systems or, where deletion is not technically feasible, anonymized such that it can no longer be attributed to any identifiable individual.

11 Your Data Subject Rights

As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to the personal data that okplah holds about you:

• Right to be informed: You have the right to be told what personal data okplah collects, why it is collected, and how it is used — which is the primary purpose of this Privacy Policy.
• Right of access: You may request a copy of the personal data okplah holds about you, including information on its source, the purposes of processing, and the categories of recipients with whom it has been shared.
• Right to rectification: If any personal data held by okplah is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to erasure: You may request that okplah delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (for consent-based processing), or where there is no overriding legal basis for its continued retention.
• Right to object: You may object at any time to the processing of your personal data for direct marketing purposes. You may also object to processing conducted on the basis of legitimate interests, although okplah may continue processing where it can demonstrate compelling legitimate grounds that override your interests.
• Right to data portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive a copy of the data you provided to okplah in a structured, commonly used, and machine-readable format.
• Right to file a complaint: If you believe your data privacy rights have been violated, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

To exercise any of the above rights, please contact the okplah Data Protection Officer using the contact details in Section 16 of this Policy. okplah will respond to all data subject requests within thirty (30) days of receipt. For complex or multiple requests, this period may be extended by a further thirty (30) days with notice to you.

12 Marketing Communications

okplah may send you promotional communications about bonuses, new games, events, and special offers by email or SMS if you have opted in to receive marketing at the time of registration or subsequently through your account settings.

You may opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email, adjusting your communication preferences in your okplah account settings, or contacting the okplah support team directly.

Opting out of marketing communications will not affect your receipt of transactional communications, such as deposit confirmations, withdrawal notifications, account security alerts, or mandatory responsible gaming messages. These operational communications are sent on the basis of contractual necessity and legal obligation, not marketing consent, and cannot be disabled while your account remains active.

13 Children & Minors

The okplah platform is strictly intended for adults aged 21 years and above residing in the Philippines. This age restriction reflects both the minimum legal gambling age under Philippine law and the standards set by PAGCOR for licensed online gaming operators.

okplah does not knowingly collect personal data from individuals under the age of 21. As part of the account registration process, all applicants are required to submit valid proof of age in the form of a government-issued Philippine identification document, and all accounts are subject to KYC verification before deposits or withdrawals are processed.

If okplah discovers or is credibly notified that personal data has been collected from an individual who is under 21 years of age, okplah will immediately suspend the relevant account, delete all associated personal data to the extent not required to be retained by law, and report the matter to PAGCOR in accordance with our licensing obligations.

14 Cross-Border Data Transfers

okplah is a Philippines-focused platform. The primary storage of okplah player data is maintained on servers located within the Philippines or within jurisdictions that the National Privacy Commission has recognized as providing an adequate level of data protection.

In certain limited circumstances, personal data may be transferred to or accessed from jurisdictions outside the Philippines — for example, where a game provider's infrastructure or a KYC verification partner operates from another country. In all such cases, okplah ensures that appropriate safeguards are in place, which may include:

• Written contracts containing standard data protection clauses approved by or consistent with NPC guidance.
• Binding corporate rules where the recipient is part of the same corporate group as a service provider engaged by okplah.
• Transfers to countries or territories recognized by the NPC as providing an adequate level of personal data protection.

By using the okplah platform, you acknowledge that your personal data may be transferred internationally in the limited circumstances described above, subject always to the safeguards outlined in this Policy.

15 Changes to This Privacy Policy

okplah reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or the nature of the okplah platform. The effective date at the top of this Policy reflects the date of the most recent revision.

Where changes are material — meaning they significantly affect your rights, the categories of data we collect, or the purposes for which we use your data — okplah will notify registered players by email to their registered address at least seven (7) days before the changes take effect. Non-material changes, such as typographical corrections or clarifications of existing practices, may be made without advance notice and will take effect immediately upon publication.

Your continued use of the okplah platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with the revised Policy, you must discontinue use of the platform and may request account closure in accordance with the Terms & Conditions.

16 Contact & Data Protection Officer

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or need to report a potential data privacy concern, please contact the okplah Data Protection Officer using the details below:

• Email: [email protected] — use subject line "Data Privacy Request"
• Live Chat: Available 24 hours a day, 7 days a week, within your signed-in okplah account dashboard
• Languages: English and Tagalog
• Response Time: All data privacy requests will be acknowledged within 5 business days and resolved within 30 days

If you are not satisfied with okplah's response to a data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines. The NPC can be reached through the official channels published on the NPC's website. okplah will cooperate fully with any NPC inquiry or investigation.