OkaPlay Privacy Policy –
How We Protect Your Data

1. Introduction

OkaPlay ("OkaPlay", "we", "us", "our") is committed to protecting the privacy and personal data of everyone who uses our platform. This Privacy Policy describes how we collect, use, store, share, and protect information about you when you use the OkaPlay website, mobile web platform, games, and any associated services (collectively, the "Platform").

This policy is written in plain, straightforward English because we believe you deserve to understand exactly how your data is handled — not wade through pages of dense legal language. That said, this document is legally binding and forms part of your agreement with OkaPlay alongside our Terms and Conditions.

By registering an account or continuing to use the OkaPlay Platform, you confirm that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described here. If you do not agree, please stop using the Platform and contact us to close your account.

2. Who We Are

OkaPlay is the data controller responsible for your personal information collected through the Platform. As data controller, OkaPlay determines the purposes and means of processing your personal data and is accountable for how it is handled.

We have appointed a Data Protection Officer (DPO) in compliance with the requirements of the National Privacy Commission (NPC). You can contact our DPO directly for any privacy-related concerns at privacy@okaplay.net. The DPO is responsible for overseeing OkaPlay's compliance with data privacy obligations and for handling player data rights requests.

3. Data We Collect

OkaPlay collects several categories of personal data. We only collect what is genuinely necessary for the purposes described in this policy.

3.1 Registration & Identity Data

When you create an OkaPlay account, we collect:

• Full legal name
• Date of birth
• Email address
• Mobile phone number
• Username and password (password stored as a one-way encrypted hash)

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering regulations and verify your eligibility to use OkaPlay, we collect:

• Copies of government-issued Philippine photo ID (PhilSys, Passport, Driver's License, UMID, SSS/GSIS, PRC ID)
• Photographs or screenshots of registered payment accounts (showing name and account number only)
• In some cases, a verification selfie with your ID

3.3 Financial & Transaction Data

We collect records of all deposits, withdrawals, and gaming transactions made through your OkaPlay account. This includes transaction amounts, timestamps, payment methods used, and account balances. OkaPlay does not store full credit or debit card numbers — card payments are processed through PCI-DSS compliant third-party processors.

3.4 Technical & Usage Data

When you access OkaPlay, we automatically collect certain technical data including:

• IP address and approximate geolocation (country/region level)
• Device type, operating system, and browser version
• Pages visited, games played, session duration, and in-game activity logs
• Cookie identifiers and similar tracking data (see Section 9)

4. How We Collect Your Data

OkaPlay collects your personal data through three main channels:

• Directly from you: Information you voluntarily provide when registering, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automatically: Technical and usage data collected through your interaction with the Platform, including cookies, server logs, and analytics tools. See Section 9 for full cookie details.
• From third parties: In limited circumstances, OkaPlay may receive data from payment processors (to confirm transaction status), identity verification services (to validate KYC documents), or fraud detection partners. All third-party data sharing is governed by appropriate data processing agreements.

5. Why We Use Your Data

OkaPlay processes your personal data for the following purposes, each supported by a lawful basis under the Data Privacy Act of 2012:

• To create and manage your account — necessary for performance of your contract with OkaPlay.
• To process deposits and withdrawals — necessary to fulfill our contractual obligations and comply with financial regulations.
• To verify your identity (KYC) — required by Philippine anti-money laundering laws (AMLA) and PAGCOR licensing conditions.
• To detect and prevent fraud, money laundering, and bonus abuse — legitimate interest and legal obligation.
• To provide customer support — necessary to fulfill our service obligations to you.
• To send you transactional communications (deposit confirmations, withdrawal updates, security alerts) — necessary for contract performance.
• To send you promotional communications and personalized offers — based on your consent, which you may withdraw at any time.
• To comply with regulatory and legal obligations — including PAGCOR licensing requirements, AMLA reporting, and NPC compliance.
• To improve the Platform — using aggregated, anonymized analytics data to understand how players use OkaPlay and improve the experience.

6. Sharing Your Data

OkaPlay does not sell your personal data. We share data only in the following controlled, necessary circumstances:

6.1 Payment Processors

To process deposits and withdrawals, OkaPlay shares transaction data with payment service providers including GCash (G-Xchange Inc.), Maya (PayMaya Philippines Inc.), and banking partners. These providers are contractually bound to process data only as instructed by OkaPlay and in compliance with applicable Philippine law.

6.2 Identity Verification Partners

OkaPlay uses third-party KYC verification services to validate government-issued IDs and detect fraudulent documents. These providers process your ID data solely for verification purposes and are prohibited from using it for any other purpose.

6.3 Regulatory and Law Enforcement Authorities

OkaPlay is required to share certain player data with Philippine regulatory bodies — including PAGCOR, the Anti-Money Laundering Council (AMLC), and the National Privacy Commission (NPC) — when required by law or during the course of a regulatory inspection or investigation. We also cooperate with law enforcement when legally required to do so.

6.4 Game Providers

To deliver games on the OkaPlay Platform, we share limited technical data (such as a pseudonymous player session identifier) with licensed game software providers. These providers do not receive your name, contact details, or payment information.

6.5 Group Companies and Service Providers

OkaPlay may share data with affiliated companies or contracted service providers (such as cloud hosting providers, analytics platforms, and email delivery services) who support the operation of the Platform. All such parties are bound by data processing agreements that restrict their use of your data.

7. Data Security

Protecting your data is one of OkaPlay's most important operational priorities. We implement the following security measures:

• Transport Encryption: All communication between your device and OkaPlay uses 256-bit SSL/TLS encryption, ensuring your login credentials, payment details, and personal information cannot be intercepted in transit.
• At-Rest Encryption: Sensitive data stored in OkaPlay's databases — including KYC documents and payment account references — is encrypted at rest using industry-standard AES-256 encryption.
• Access Controls: Access to personal data within OkaPlay is restricted on a strict need-to-know basis. Staff who handle player data are subject to confidentiality obligations and background checks.
• Regular Security Audits: OkaPlay's technical infrastructure undergoes periodic third-party security reviews and penetration testing.
• Fraud Detection: OkaPlay uses automated systems to monitor for suspicious account activity, unauthorized login attempts, and potential fraud in real time.
• Incident Response: In the event of a data security incident that affects your personal data, OkaPlay will notify you and the National Privacy Commission within the timeframes required by the Data Privacy Act of 2012.

8. Data Retention

OkaPlay retains your personal data for as long as your account remains active and for a period afterward as required by Philippine law and regulatory obligations. The key retention periods are:

• Account and identity data: For the duration of your account plus 5 years after account closure, as required by PAGCOR licensing conditions and AMLA regulations.
• KYC documents: Retained for 5 years from the date of verification or account closure, whichever is later.
• Transaction records: Retained for 5 years in compliance with AMLA requirements.
• Customer support communications: Retained for 3 years from the date of the interaction.
• Technical/log data: Typically retained for 12–24 months for security monitoring purposes, then deleted or anonymized.

Where retention is no longer legally required, OkaPlay will securely delete or permanently anonymize your personal data so it can no longer be associated with you as an individual.

9. Cookies & Tracking Technologies

OkaPlay uses cookies and similar tracking technologies to operate the Platform effectively and improve your experience. Here's what we use and why:

• Essential Cookies: Required for the Platform to function. These include session cookies that keep you logged in, security cookies that protect against cross-site request forgery (CSRF), and cookies that remember your language and basic preferences. These cannot be disabled without breaking the Platform.
• Analytics Cookies: We use anonymized analytics data to understand how players use OkaPlay — which pages are most visited, where players encounter difficulty, and how the overall experience can be improved. Analytics data is aggregated and does not identify you as an individual.
• Preference Cookies: These remember your settings on OkaPlay (such as preferred game view or notification settings) so you don't have to re-configure them each session.

You can manage cookie preferences through your browser settings. Note that disabling essential cookies will prevent you from logging in or using core Platform features. Non-essential cookies can be disabled without affecting Platform functionality.

10. Your Data Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights regarding your personal data held by OkaPlay. We take all of these seriously and will respond to any request within 15 business days (and usually much faster).

To exercise any of these rights, contact our Data Protection Officer at privacy@okaplay.net or reach our support team at support@okaplay.net. Please include your registered email address and a description of your request. We may need to verify your identity before processing the request. If you believe your rights have not been respected, you may lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

11. Protection of Minors

OkaPlay strictly prohibits the use of its Platform by anyone under 21 years of age. We do not knowingly collect personal data from minors. If OkaPlay becomes aware that a person under 21 has registered an account or submitted personal data, we will immediately suspend the account, delete the relevant data, and report the matter to appropriate authorities where required by law.

If you believe a minor has registered on OkaPlay or that we have inadvertently collected a minor's data, please contact us immediately at support@okaplay.net so we can take prompt corrective action.

12. Changes to This Privacy Policy

OkaPlay may update this Privacy Policy from time to time to reflect changes in our data practices, new regulatory requirements, or improvements to Platform features. When we make material changes, we will notify registered players by email at least 7 days before the revised policy takes effect, and we will update the "Last Updated" date at the top of this page.

Your continued use of OkaPlay after a revised Privacy Policy takes effect constitutes your acceptance of those changes. If you have concerns about any changes, please contact our DPO before the new policy takes effect. For minor or non-material clarifications, we may update the policy without advance notice.

13. Contact Us & Data Protection Officer

OkaPlay takes its data protection obligations seriously. If you have any questions, concerns, or requests related to this Privacy Policy or the handling of your personal data, please reach out:

• Data Protection Officer: privacy@okaplay.net
• General Support: support@okaplay.net
• Live Chat: Available on the OkaPlay Platform (when logged in)
• Response Time: DPO requests within 5 business days; support queries typically within 4 hours

For complaints that you feel have not been adequately addressed by OkaPlay, you have the right to escalate to the National Privacy Commission of the Philippines. Details on how to file a complaint are available on the NPC's official website.