okph Privacy Policy — Your Data, Handled With Care

In this Privacy Policy, the following terms have the meanings assigned to them below:

• "okph," "we," "us," "our" — the okph platform operated at https://okph.win and the entity responsible for the processing of personal data collected through it.
• "You," "Player," "Data Subject" — any natural person whose personal data is processed by okph, including registered account holders and visitors to the okph website.
• "Personal Data" or "Personal Information" — any information that directly or indirectly identifies you as an individual, as defined under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.
• "Sensitive Personal Information" — personal data about an individual's race, ethnicity, marital status, age, colour, and religious, philosophical or political affiliations; health, education, genetic or sexual life; or any judicial proceeding for offences, as defined under the DPA.
• "Processing" — any operation performed on personal data including collection, recording, storage, use, disclosure, or destruction.
• "Data Privacy Act" or "DPA" — Republic Act No. 10173 of the Philippines and its Implementing Rules and Regulations, as amended from time to time.
• "National Privacy Commission" or "NPC" — the Philippine government body responsible for administering and implementing the Data Privacy Act.
• "Third-Party Processors" — entities engaged by okph to process personal data on its behalf, including payment processors, KYC verification providers, and game software suppliers.
• "KYC" — Know Your Customer; the identity verification process required before a player's first withdrawal from their okph account balance.

okph collects the following categories of personal data from players during registration, platform use, and the fulfilment of regulatory obligations:

• Philippine mobile number (used as the primary account identifier)
• Full legal name as it appears on a government-issued ID
• Date of birth (for age verification purposes — players must be 21+)
• Gender (optional, for personalisation)
• Email address (optional, for communications)

• Government-issued Philippine identification document (Philippine passport, driver's licence, SSS card, UMID, PhilSys ID, or voter's ID)
• Document number and expiry date
• Scanned or photographed image of the submitted document
• Selfie or photograph submitted for liveness verification, where required

• GCash mobile number or PayMaya account identifier used for deposits or withdrawals
• Bank account details (bank name, account number) where bank transfer is used
• Deposit and withdrawal amounts, dates, and transaction reference numbers
• Account wallet balance history

• Games played, bet amounts, win and loss outcomes, and session duration
• Game preferences and lobby navigation patterns
• Bonus and promotional participation records
• Responsible gaming tool usage (deposit limits set, self-exclusion activations)

• IP address and approximate geographic location (city/region level)
• Device type, operating system, and browser type and version
• Session timestamps and login history
• Cookies and similar tracking technology data (see Section 7)

• Records of live chat conversations with okph support agents
• Support ticket content and resolution records
• Marketing communication preferences and opt-in / opt-out records

okph collects personal data through the following means:

• Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, or update your account settings.
• Automatically through the platform — when you access and use the okph website, technical data including IP address, device identifiers, and session logs are automatically collected by our servers and analytics systems.
• Through cookies and tracking technologies — as described in Section 7 of this Policy, okph uses cookies and similar technologies to collect data about how you interact with the platform.
• From third-party payment providers — when you initiate a deposit or withdrawal, your payment provider (GCash, PayMaya, BPI, BDO, or Metrobank) may share transaction confirmation data with okph to reconcile the transaction.
• From KYC verification service providers — where okph uses a third-party identity verification provider to validate your submitted KYC documents, that provider may share verification results and risk assessments with okph.

okph processes your personal data for the following specific, legitimate purposes:

Under the Philippine Data Privacy Act, okph is required to have a valid legal basis for each processing activity. The legal bases on which okph relies are:

• Contractual necessity — processing is necessary to perform our contract with you, including providing access to your account, processing deposits and withdrawals, and delivering game services.
• Legal obligation — processing is required to comply with obligations under Philippine law, including PAGCOR licensing requirements, the Anti-Money Laundering Act (Republic Act No. 9160, as amended), and the Data Privacy Act itself.
• Legitimate interests — processing is necessary for okph's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and service improvement, where these interests are not overridden by your rights and interests.
• Consent — for optional processing activities such as direct marketing communications, okph relies on your freely given, specific, informed, and unambiguous consent. You may withdraw consent for marketing at any time without affecting the lawfulness of prior processing.

okph does not sell, rent, or trade your personal data. We share your personal information only in the following circumstances and only to the extent necessary for each purpose:

When you make a deposit or withdrawal, transaction details are shared with the relevant payment service provider (GCash, PayMaya, BPI, BDO, or Metrobank) to facilitate the transaction. These providers process your financial data under their own privacy policies and are independently responsible for their data handling practices.

To verify your identity before allowing withdrawals, okph may engage a third-party KYC verification provider. Your submitted identification documents and personal details will be shared with this provider solely for the purpose of identity verification. These providers are contractually bound to handle your data securely and are prohibited from using it for any other purpose.

Live dealer and slot game content on the okph platform is supplied by licensed third-party game providers. To deliver game functionality and maintain game integrity records, limited account and session data may be shared with these providers. Game providers are required to maintain appropriate data security standards.

okph may be required to disclose personal data to the Philippine Amusement and Gaming Corporation (PAGCOR), the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Bureau of Internal Revenue (BIR), or other Philippine government authorities where required by applicable law, court order, or regulatory directive. okph will inform you of any such disclosure to the extent permitted by law.

In connection with legal, audit, or compliance matters, personal data may be accessed by okph's external lawyers, auditors, or accountants. These parties are bound by confidentiality obligations and are prohibited from using data for any purpose beyond the specific professional engagement.

If okph undergoes a merger, acquisition, restructuring, or sale of all or part of its business, personal data held by okph may be transferred to the acquiring entity as part of that transaction, subject to the acquiring entity agreeing to honour the commitments set out in this Privacy Policy.

The okph platform uses cookies and similar tracking technologies to enable core platform functionality, improve your experience, and understand how players interact with the site. A cookie is a small text file stored on your device when you visit a website.

• Strictly Necessary Cookies — required for the okph platform to function. These include session authentication cookies that keep you logged in to your account during a visit, and security cookies that protect against cross-site request forgery. These cannot be disabled without preventing the platform from functioning.
• Functional Cookies — remember your preferences such as language settings, game lobby layout, and whether you have acknowledged the age verification notice. These improve your experience but are not essential to platform operation.
• Analytics Cookies — collect anonymised or aggregated data about how players navigate the okph platform. This data helps us understand which features are most used, where players experience difficulty, and how to improve the overall platform. We do not share raw analytics data with third parties.
• Marketing Cookies — where you have consented, these cookies allow okph to track whether you arrived at the platform via a specific promotional campaign or partner link, for attribution purposes only.

You can control cookies through your browser settings. Most browsers allow you to view, delete, or block cookies. Please be aware that disabling strictly necessary cookies will prevent the okph platform from functioning correctly. Instructions for managing cookies are available in the help documentation of your specific browser.

okph implements technical and organisational security measures appropriate to the nature of the personal data we process. These measures include but are not limited to:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and the okph platform is encrypted using industry-standard TLS encryption. Any attempt to access okph over an unencrypted HTTP connection is automatically redirected to HTTPS.
• Encrypted Data Storage: Sensitive personal data and financial records stored in okph's databases are encrypted at rest using AES-256 encryption standards.
• Access Controls: Access to personal data held by okph is restricted to authorised personnel with a verified need to access that data for their job function. Access permissions are reviewed periodically and revoked upon change of role or departure.
• Penetration Testing and Security Audits: okph engages qualified third-party security professionals to conduct periodic penetration tests and vulnerability assessments of the platform and its infrastructure.
• Multi-Factor Authentication: Administrative access to okph systems containing personal data is protected by multi-factor authentication requirements.
• Incident Response: okph maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in risk to affected individuals, okph will notify the National Privacy Commission within 72 hours of becoming aware of the breach and will notify affected players within a reasonable timeframe as required by the DPA.

okph retains personal data for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable Philippine law, whichever period is longer. The following general retention guidelines apply:

Upon expiry of the applicable retention period, okph will securely delete or irreversibly anonymise your personal data so that it can no longer be associated with you as an identified individual.

Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), you have the following rights in respect of your personal data held by okph. To exercise any of these rights, contact okph's Data Protection Officer as described in Section 14.

okph is a real-money gaming platform operated exclusively for individuals who are 21 years of age or older, as required by the PAGCOR regulatory framework applicable to online gaming in the Philippines. okph does not knowingly collect, process, or retain any personal data from individuals under the age of 21.

During registration, okph collects date of birth information for age verification purposes. okph reserves the right to request documentary proof of age at any time and to suspend accounts where age verification cannot be satisfactorily completed. Where okph discovers that personal data has been collected from an individual under the age of 21 without parental consent or in breach of these requirements, it will take immediate steps to delete that data and close the associated account.

Some of okph's third-party service providers — including game software providers and KYC verification providers — may be located outside the Philippines. Where personal data is transferred to processors or controllers located in other countries, okph ensures that appropriate safeguards are in place to provide a standard of data protection substantially equivalent to that required by the Philippine Data Privacy Act.

Such safeguards may include contractual obligations requiring the receiving party to maintain appropriate technical and organisational security measures, restricting the use of your data to the specific purpose for which it was shared, and ensuring that data is not retained longer than necessary. okph will not transfer personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate additional safeguards.

For information about the specific international transfers applicable to your data and the safeguards in place, contact okph's Data Protection Officer using the details in Section 14.

okph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, regulatory requirements, or platform features. When we make material changes to this Policy, we will provide you with notice through your registered contact details and/or by displaying a prominent notice on the platform.

The effective date at the top of this page will be updated each time the Policy is revised. We encourage you to review this page periodically to stay informed of how okph handles your personal data. Your continued use of the okph platform after the effective date of a revised Privacy Policy constitutes your acknowledgment of the changes.

The most current version of this Privacy Policy will always be available at https://okph.win/privacy-policy. If you have concerns about any proposed changes to this Policy, please contact our Data Protection Officer before the effective date of the amendment.

okph has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Philippine Data Privacy Act and this Privacy Policy. If you have questions about this Policy, wish to exercise your data privacy rights, or have concerns about how okph handles your personal data, you may contact the DPO through the following channels:

• Email: [email protected] (subject line: "Data Privacy — [your request]")
• Live Chat: Available 24/7 on the okph platform — ask for escalation to the Data Privacy team.

All data privacy requests and complaints are handled by okph's dedicated privacy compliance team. Formal complaints or requests for access, rectification, or erasure will be acknowledged within 3 business days and responded to fully within the timeframes required under the DPA.

For complaints that cannot be resolved directly with okph, you may contact the National Privacy Commission of the Philippines through their official channels. Information about NPC complaint procedures is available through Philippine government information resources.