okpl Privacy Policy

This Privacy Policy applies to all personal data collected, processed, or stored by okpl in connection with the operation of the okpl Platform accessible at okpl.app — including registration, account management, payment processing, gameplay, customer support, and marketing activities.

This Policy is issued in compliance with Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and the applicable issuances of the National Privacy Commission of the Philippines. It should be read in conjunction with the okpl Terms & Conditions, which form part of the complete agreement between okpl and its registered players.

By registering an account with okpl or continuing to use the okpl Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

For the purposes of the Data Privacy Act of 2012, okpl is the personal information controller in respect of the personal data collected through the Platform. okpl determines the purposes and means of processing personal data collected from players and Platform visitors.

okpl has designated a Data Privacy Officer (DPO) responsible for ensuring the Platform's ongoing compliance with RA 10173. The DPO may be contacted at:

• Email: [email protected] (Subject: Data Privacy Officer)
• Platform: okpl.app — live chat available after account login

okpl collects the following categories of personal data from players and Platform visitors:

okpl does not collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) except where strictly required for responsible gaming assessments and only with your explicit consent.

okpl collects personal data through the following means:

• Direct Collection: Data you provide during account registration, KYC verification, payment transactions, support interactions, and promotional participation.
• Automated Collection: Technical data collected automatically when you access the Platform, including IP address, device identifiers, and session data through cookies and server logs.
• Third-Party Sources: Identity verification data may be supplemented through licensed KYC and identity verification service providers where required to satisfy regulatory obligations. okpl only uses third-party data sources that comply with applicable Philippine data privacy standards.
• Payment Processors: Transaction confirmation data is shared with and received from GCash, PayMaya, and Philippine bank partners for the purposes of processing deposits and withdrawals.

okpl processes personal data only for the lawful purposes described in this Policy. The legal bases for processing under RA 10173 include contractual necessity, legal obligation, legitimate interests, and consent. Processing activities and their corresponding bases include:

• Account Registration and Management: Processing your identity and contact data is necessary to create and maintain your okpl Account and deliver the services you have contracted for.
• KYC and Age Verification: Processing of identity documents is required by PAGCOR regulations and Philippine law to verify that all players are aged 21 or above and to prevent underage gambling.
• Payment Processing: Financial data is processed to facilitate deposits, withdrawals, and the maintenance of your PHP Balance in compliance with your account agreement.
• Anti-Money Laundering Compliance: Transaction monitoring and reporting is conducted as required by Republic Act No. 9160 (Anti-Money Laundering Act) as amended and AMLC regulations.
• Fraud Prevention and Security: Technical and gaming data is analysed to detect, prevent, and investigate fraudulent activity, account compromise, and prohibited conduct.
• Responsible Gaming: Gaming behaviour data is monitored to support responsible gaming tools including deposit limit tracking, session time monitoring, and the identification of patterns that may indicate problem gambling.
• Customer Support: Communication data is processed to respond to your enquiries, resolve disputes, and improve service quality.
• Marketing Communications: With your explicit consent, contact data and marketing preferences are used to send promotional offers, new game announcements, and VIP programme communications. You may withdraw consent at any time.
• Platform Improvement: Aggregated and anonymised usage data is analysed to improve the Platform's functionality, game selection, and user experience.

okpl does not sell, rent, or commercially transfer your personal data to third parties. Your data is shared only in the following strictly defined circumstances:

• Payment Service Providers: GCash, PayMaya, BPI, BDO, Metrobank, and UnionBank receive the financial data necessary to process your requested transactions. These providers operate under their own privacy policies and are bound by applicable Philippine data privacy regulations.
• KYC Verification Providers: Licensed identity verification service providers process identity documents submitted for KYC purposes. These providers are contractually bound to process data solely for verification purposes and to maintain data security standards equivalent to those of okpl.
• Game Software Providers: Certified game providers receive the minimum session data required to deliver game content, record outcomes, and calculate winnings. Providers are bound by data processing agreements consistent with RA 10173.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other competent Philippine authorities may receive personal data where disclosure is required by law, court order, or regulatory direction.
• Professional Advisors: Legal, accounting, and audit professionals engaged by okpl may access relevant data in the course of providing professional services, subject to strict confidentiality obligations.

okpl uses cookies and similar tracking technologies to operate the Platform, ensure security, and analyse usage. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function, including session authentication, security tokens, and login state management. These cannot be disabled without preventing Platform use.
• Functional Cookies: Store your preferences such as language settings, game display options, and deposit method selections to improve your experience on return visits.
• Analytical Cookies: Collect anonymised data on how players navigate and use the Platform to identify areas for improvement. This data does not identify individual players.
• Security Cookies: Used for fraud detection and to identify suspicious login patterns or automated access attempts.

okpl does not use third-party advertising or behavioural targeting cookies. You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from accessing your okpl Account.

okpl implements comprehensive technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the okpl Platform.
• Encryption at rest for all personal data and KYC documents stored on okpl servers.
• Role-based access controls limiting data access to personnel with a documented operational need.
• Two-factor authentication required for all administrative and support staff access to systems containing personal data.
• Annual third-party security audits and penetration testing.
• Segregated storage of player funds and financial data from operational systems.
• Formal data incident response procedures in accordance with NPC Circular No. 16-03.

While okpl applies industry-standard security measures, no system is completely immune to breach. Players are responsible for maintaining the security of their own Account credentials and should report any suspected unauthorised access immediately.

okpl retains personal data for the minimum period necessary to fulfil each stated purpose, subject to applicable regulatory and legal retention obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where data is subject to a legal hold due to ongoing regulatory investigation or dispute, retention is extended until the matter is fully resolved.

Some of okpl's third-party service providers — including game software providers and technical infrastructure partners — may process data outside the Philippines. Where such transfers occur, okpl ensures that appropriate safeguards are in place, including:

• Data processing agreements that impose data protection obligations equivalent to those under RA 10173.
• Transfer only to providers in jurisdictions that maintain adequate data protection standards recognised by the National Privacy Commission.
• Contractual clauses requiring offshore processors to notify okpl of any data breach affecting Philippine player data within 24 hours of discovery.

Player financial data processed by Philippine payment providers (GCash, PayMaya, BPI, BDO, Metrobank, UnionBank) is processed within the Philippines and is subject to Bangko Sentral ng Pilipinas (BSP) regulations in addition to RA 10173.

The okpl Platform is strictly restricted to individuals aged 21 years and above. okpl does not knowingly collect personal data from any individual under the age of 21. Where okpl discovers that personal data has been submitted by a person under 21 years of age, the following steps are taken immediately:

• The associated Account is permanently closed without notice.
• Any deposited funds are returned in full to the originating payment method after identity verification.
• Any winnings generated are voided in their entirety.
• All personal data collected in connection with the underage account is securely deleted, except where retention is required for regulatory reporting purposes.
• The incident may be reported to PAGCOR and relevant Philippine authorities where required.

If you believe a minor has submitted personal data to okpl, please contact the DPO immediately at [email protected].

okpl sends marketing communications — including promotional offers, new game announcements, VIP programme updates, and bonus notifications — only to players who have provided explicit consent during registration or through their account settings. The following conditions apply:

• Marketing communications are sent via SMS to your registered Philippine mobile number and/or via email to your registered address, as per your stated channel preferences.
• You may withdraw marketing consent at any time by updating your preferences in the account dashboard or by contacting okpl support. Withdrawal of consent does not affect transactional communications (such as deposit confirmations, withdrawal notifications, and account security alerts), which are sent regardless of marketing preferences.
• okpl does not share your contact data with third-party marketing organisations for the purposes of marketing their own products or services.
• All marketing messages include a clear opt-out mechanism. SMS communications include reply instructions; email communications include an unsubscribe link in the message footer.

The okpl Platform integrates with third-party services to deliver its full range of features, including game software providers, payment processors, identity verification services, and customer support infrastructure. Each third-party provider operates under their own privacy policies and data processing agreements with okpl.

okpl conducts due diligence on all third-party providers to ensure their data processing practices meet the standards required under RA 10173. All providers are contractually bound by data processing agreements that:

• Restrict the use of player data to the specific purposes for which it was shared.
• Require implementation of security measures consistent with industry standards.
• Obligate immediate notification to okpl in the event of any data breach affecting player data.
• Prohibit further sub-processing without okpl's prior written consent.

In the event of a personal data breach, okpl will follow the procedures mandated by NPC Circular No. 16-03 (Security of Personal Data in Government Agencies and Private Entities) and the Data Privacy Act of 2012:

1. Containment: Upon discovery of a suspected breach, okpl's security team will immediately implement containment measures to prevent further unauthorised access or disclosure.
2. Assessment: A formal impact assessment will be conducted within 24 hours to determine the scope of affected data, the categories of data subjects involved, and the likely consequences of the breach.
3. Notification to NPC: Where a breach is likely to give rise to a real risk of serious harm, okpl will notify the National Privacy Commission within 72 hours of confirming the breach, in the format prescribed by NPC regulations.
4. Notification to Affected Players: Where the breach creates a high risk to affected players, okpl will notify them directly in clear, plain language describing the nature of the breach, what data was involved, and the steps okpl is taking in response.
5. Review: Following resolution of the breach, okpl will conduct a full root cause analysis and implement remedial measures to prevent recurrence.

okpl reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, NPC regulations, Platform services, or processing activities. Material changes — meaning changes that significantly affect your rights or how your data is processed — will be communicated via:

• A prominent notice on the okpl Platform for a minimum of 14 days prior to the change taking effect.
• Direct email notification to your registered email address where the change materially affects your data subject rights.

The "Last Updated" date at the top of this document indicates when the most recent revision was made. Your continued use of the okpl Platform after the effective date of any amendment constitutes acceptance of the revised Privacy Policy. If you do not agree to an amendment, you should close your Account before the amendment takes effect and contact the DPO to request deletion of your data.

For all data privacy enquiries, data subject requests, consent withdrawals, or complaints relating to the processing of your personal data by okpl, please contact:

• Data Privacy Officer, okpl
• Email: [email protected] (Subject: Data Privacy Officer)
• Live Chat: Available 24/7 through the okpl account dashboard after login
• Response Time: okpl will acknowledge all data subject requests within 2 business days and provide a substantive response within 15 business days, as required by RA 10173.

If you are not satisfied with okpl's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines through the NPC's official complaint channels.