okeyplay Privacy Policy

For the purposes of the Data Privacy Act of 2012, okeyplay is the Personal Information Controller in respect of personal data collected through the okeyplay platform. okeyplay is responsible for determining the purposes and means of processing personal data obtained from Data Subjects who use or register with the platform.

okeyplay operates under a license issued by the Philippine Amusement and Gaming Corporation (PAGCOR). Our data processing activities are subject to both the Data Privacy Act requirements applicable to all Philippine-licensed entities and to the specific data governance obligations imposed under our PAGCOR operating conditions.

All inquiries regarding this Privacy Policy, requests to exercise data subject rights, and data-related complaints should be directed to our Data Protection Officer (DPO) using the contact details set out in Section 15 of this Policy.

This Policy applies to all personal data collected by okeyplay in connection with:

• The registration and maintenance of player accounts on the okeyplay platform;
• Deposits, withdrawals, and other financial transactions conducted through the platform;
• Gameplay activity on all games offered through the okeyplay platform;
• Communications between players and the okeyplay support team via live chat, email, or any other channel;
• Participation in promotions, loyalty programs, or surveys offered by okeyplay;
• Visits to the okeyplay website by individuals who have not yet registered an account;
• Know Your Customer (KYC) and Anti-Money Laundering (AML) verification processes.

This Policy does not apply to the data practices of third-party game providers, payment processors, or other external services accessible through links from the okeyplay platform. okeyplay encourages Data Subjects to review the privacy policies of any third-party services they access.

okeyplay collects the following categories of personal data, depending on your interaction with the platform:

Identity and Registration Data

Contact Data

Financial and Transaction Data

Gameplay and Platform Activity Data

Technical and Device Data

Communications Data

okeyplay does not collect sensitive personal information as defined under the Data Privacy Act (such as religious beliefs, political affiliations, or health information) except where this is specifically required by PAGCOR responsible gaming obligations or where you have voluntarily disclosed such information in a support context (for example, health information relevant to a self-exclusion request).

okeyplay collects personal data through the following methods:

• Direct provision by you: Data you actively submit during account registration, identity verification, deposit and withdrawal processes, support interactions, and participation in promotions;
• Automated platform collection: Technical and device data collected automatically when you access the okeyplay website or platform, including data collected through cookies and similar tracking technologies (see Section 8);
• Payment processors: Transaction confirmation data shared by payment service providers such as GCash and PayMaya upon completion of a deposit or withdrawal;
• Identity verification providers: Data returned by third-party KYC verification services in the course of identity and age verification;
• Publicly available sources: Where permitted by law, information from public registries or databases used to supplement identity verification or AML screening processes.

okeyplay processes personal data on the following legal bases as recognized under the Data Privacy Act of 2012 and its Implementing Rules:

okeyplay uses your personal data for the following purposes:

• To create, manage, and maintain your okeyplay account, including processing login sessions and account security;
• To verify your identity, age (minimum 21 years), and eligibility to use the platform in accordance with PAGCOR requirements;
• To process your deposits and withdrawals through GCash, PayMaya, BPI, BDO, Metrobank, and other authorized payment methods;
• To provide access to games, calculate game outcomes, and record gameplay history;
• To administer bonuses, promotions, and loyalty program benefits;
• To detect and prevent fraud, collusion, money laundering, and other prohibited conduct;
• To monitor gameplay for responsible gaming indicators and administer responsible gaming tools including deposit limits, session limits, and self-exclusion;
• To respond to your support queries, process complaints, and resolve disputes;
• To send you service-related communications (account confirmations, transaction receipts, security alerts) — these are not optional as they are necessary for platform operation;
• To send you promotional and marketing communications where you have opted in to receive these — you may withdraw this consent at any time by contacting support;
• To comply with PAGCOR licensing conditions, the Data Privacy Act, the Anti-Money Laundering Act, and other applicable Philippine law;
• To improve the okeyplay platform based on aggregated and anonymized usage analytics.

okeyplay does not sell your personal data. We share personal data with third parties only in the following circumstances:

• Payment service providers: GCash, PayMaya, BPI, BDO, Metrobank, and other authorized payment processors receive transaction data necessary to process your deposits and withdrawals;
• KYC and AML service providers: Third-party identity verification and AML screening services receive identity document data necessary to perform age and identity verification;
• Game software providers: Licensed game studios such as Pragmatic Play and other platform partners receive the minimum data necessary to deliver game content and calculate outcomes;
• IT and infrastructure providers: Cloud hosting, data storage, and security providers who process data on okeyplay's behalf under data processing agreements;
• PAGCOR: okeyplay is required to provide PAGCOR with player activity data, financial reports, and other information pursuant to its license conditions on a periodic or on-demand basis;
• National Privacy Commission and law enforcement: okeyplay will disclose personal data where required to do so by a valid legal order, court process, or regulatory direction under applicable Philippine law;
• Anti-Money Laundering Council (AMLC): Where okeyplay is obligated to report suspicious transactions under the Anti-Money Laundering Act.

All third-party service providers engaged by okeyplay to process personal data are bound by data processing agreements requiring them to maintain appropriate data security standards and to process personal data only for the purposes specified by okeyplay.

okeyplay uses cookies and similar tracking technologies on the platform to ensure proper functionality, maintain your login session, and gather analytics data. The categories of cookies used by okeyplay are as follows:

• Strictly necessary cookies: Essential for the platform to function. These enable login sessions, maintain account security settings, and ensure core platform features operate correctly. These cookies cannot be disabled without impairing platform functionality;
• Functional cookies: Remember your preferences such as language settings, responsible gaming tool configurations, and game preferences to improve your experience;
• Analytics cookies: Collect aggregated, anonymized data about how players use the platform — which features are most used, how navigation flows work, and where technical issues occur. This data is used solely for platform improvement purposes;
• Security cookies: Help detect and prevent fraudulent activity, account takeover attempts, and other security threats by identifying unusual session patterns.

okeyplay does not use third-party advertising or behavioral profiling cookies. You may manage cookie preferences through your browser settings, though disabling strictly necessary cookies will impair platform functionality. A cookie consent mechanism is presented on first access to the platform for non-essential cookie categories.

okeyplay retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to legal and regulatory retention obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in accordance with PAGCOR record-keeping requirements and AML obligations under Philippine law;
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act;
• Gameplay history: Retained for the duration of the account relationship and for a minimum of three (3) years following account closure, in accordance with PAGCOR audit requirements;
• Support communications: Retained for three (3) years from the date of the most recent interaction, or longer where a complaint or dispute remains unresolved;
• Self-exclusion records: Where a self-exclusion has been applied to an account, the record of that exclusion is retained indefinitely to prevent circumvention through re-registration.

Upon expiry of the applicable retention period, personal data is securely destroyed or permanently anonymized in accordance with okeyplay's data disposal procedures.

okeyplay implements a layered security architecture to protect personal data against unauthorized access, disclosure, alteration, and destruction. Key technical and organizational measures include:

• Transport Layer Security (TLS 1.3) and 256-bit SSL encryption for all data in transit between your device and the okeyplay platform;
• AES-256 encryption for sensitive personal data stored at rest in okeyplay's database systems;
• Role-based access controls ensuring that okeyplay employees can only access personal data to the extent necessary for their specific role;
• Multi-factor authentication for all internal system access by okeyplay staff;
• Comprehensive audit logging of all access to personal data records;
• Regular third-party penetration testing and vulnerability assessments;
• Incident response procedures designed to detect, contain, and report data breaches in accordance with NPC requirements within 72 hours of discovery.

Notwithstanding okeyplay's security measures, no online system is entirely immune from security threats. okeyplay recommends that all players maintain strong, unique passwords for their accounts and enable two-factor authentication to maximize account security.

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by okeyplay. These rights may be exercised by contacting our Data Protection Officer as described in Section 15:

If a parent or guardian becomes aware that a person under 21 has attempted to register with or use okeyplay, they should contact our Data Protection Officer immediately. okeyplay takes underage access attempts seriously and will cooperate with applicable authorities where required.

The okeyplay platform is operated primarily within the Philippines and personal data is stored on servers located within or proximate to Philippine jurisdiction. In some cases, data may be transferred to servers or service providers located outside the Philippines where this is necessary for the delivery of specific platform services — for example, where a game provider's content delivery infrastructure is hosted outside the Philippines.

Where personal data is transferred outside the Philippines, okeyplay ensures that such transfers are conducted in compliance with the cross-border transfer provisions of the Data Privacy Act of 2012 and NPC guidelines. Specifically, okeyplay ensures either that an adequacy finding exists for the recipient jurisdiction, or that appropriate contractual safeguards (such as data processing agreements incorporating NPC-approved standard contractual clauses) are in place before any transfer is made.

okeyplay reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, NPC guidance, PAGCOR requirements, or platform data processing practices. Material amendments — those that meaningfully affect how your personal data is collected or used — will be communicated to registered players via email or in-platform notification at least seven (7) days before taking effect.

The current version of this Policy is always accessible at https://okeyplay.app/privacy-policy. The effective date at the top of this Policy reflects the date of the most recent revision. Continued use of the okeyplay platform following the effective date of any amendment constitutes acknowledgment of the amended Policy.

Where any amendment requires your consent under the Data Privacy Act, okeyplay will obtain that consent before the amendment applies to your data. Where consent is withheld, the prior version of the Policy will continue to govern processing of your existing data until the account relationship is concluded.

okeyplay has designated a Data Protection Officer (DPO) as required under the Data Privacy Act of 2012. The DPO is responsible for overseeing okeyplay's data protection compliance program, handling data subject rights requests, and managing communications with the National Privacy Commission.

To exercise your data subject rights, submit a data-related complaint, or make any inquiry regarding this Privacy Policy, please contact us through the following channels:

• Data Protection Officer: [email protected] (subject line: "DPO / Privacy Request")
• Live Chat Support: Available 24 hours a day, 7 days a week via the okeyplay platform (select "Privacy & Data" category)
• Response Time: Data subject rights requests are acknowledged within 3 business days and fulfilled within 15 business days as required by NPC regulations

If you are not satisfied with okeyplay's response to a data-related complaint or rights request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. Guidance on filing a complaint with the NPC is available on the NPC's official website.