okpeso Privacy Policy — How We Collect, Use, and Protect Your Personal Data

1 Introduction & Scope

1.1 — okpeso operates as a PAGCOR-licensed online gaming platform serving Filipino players across the Philippines. In the course of providing gaming, sports betting, bingo, live dealer, and related financial services to our members, okpeso necessarily collects and processes personal data.

1.2 — This Privacy Policy governs all personal data processing activities carried out by okpeso in connection with: the okpeso.cam website; account registration, verification, and management; financial transactions including deposits, withdrawals, and bonus processing; customer support interactions; gameplay and wagering activities; and marketing communications where consent has been given.

1.3 — This Policy applies to all current and former okpeso account holders, prospective registrants who have provided data during a registration process they did not complete, and visitors to the okpeso.cam website. It does not apply to third-party websites or services linked from the Platform, each of which operates under their own privacy policies.

1.4 — okpeso processes personal data in accordance with the following Philippine legal frameworks: the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations; the Anti-Money Laundering Act (AMLA) as amended; PAGCOR's licensing requirements and data governance guidelines; the Cybercrime Prevention Act of 2012 (Republic Act No. 10175); and all applicable National Privacy Commission (NPC) issuances and circulars.

2 Data Controller Identity

2.1 — For the purposes of the Data Privacy Act of 2012, okpeso is the Personal Information Controller (PIC) in respect of all personal data collected and processed through the Platform.

2.2 — okpeso has registered its data processing activities with the National Privacy Commission (NPC) as required under Section 46 of the Implementing Rules and Regulations of the Data Privacy Act. A designated Data Protection Officer (DPO) has been appointed and their contact details are provided in Section 16 of this Policy.

2.3 — Where okpeso engages third-party service providers to process personal data on its behalf — including payment processors, game providers, and cloud infrastructure providers — those parties act as Personal Information Processors (PIPs) under written data processing agreements that bind them to confidentiality, security, and purpose-limitation obligations consistent with this Policy and Philippine law.

3 Categories of Personal Data We Collect

3.1 — okpeso collects the following categories of personal data from players and Platform visitors:

3.2 — okpeso does not intentionally collect sensitive personal information as defined under Section 3(l) of the Data Privacy Act (such as health, religious, or political information) unless such information is voluntarily provided by a player in a support context or is incidentally included in identity documents. Where sensitive information is received, it is treated with heightened security and access controls.

4 How We Collect Personal Data

4.1 — okpeso collects personal data through the following means:

• Direct provision by you: Data submitted during account registration, KYC verification, deposit or withdrawal requests, support communications, or marketing opt-in forms.
• Automated technical collection: Data collected automatically when you access the Platform, including IP address, device identifiers, session data, and cookie-derived usage information.
• Payment providers: Transaction confirmation data shared by GCash, PayMaya, BPI, BDO, Metrobank, and other Philippine payment providers upon processing of deposit or withdrawal instructions.
• Game providers: Gameplay result data and session logs shared by licensed third-party game studios integrated into the Platform.
• Regulatory sources: Where required by law, data received from PAGCOR, the AMLC, or other Philippine regulatory bodies in connection with licensing, compliance, or investigation obligations.
• Third-party identity verification services: Confirmation responses from accredited KYC and document verification providers engaged to validate government-issued ID documents submitted during registration.

5 Purpose of Processing & Legal Basis

5.1 — okpeso processes personal data only where a lawful basis exists under Section 12 or Section 13 of the Data Privacy Act. The primary lawful bases applicable to our processing activities are:

• Contractual necessity: Processing required to create and manage your okpeso Account, process deposits and withdrawals, deliver game services, and fulfill all obligations under the Terms & Conditions.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, AMLA customer due diligence and record-keeping requirements, NPC registration obligations, and other applicable Philippine law.
• Legitimate interests: Processing for fraud detection, security monitoring, platform improvement, and responsible gaming monitoring, where these interests do not override your data subject rights.
• Consent: Processing for marketing communications and non-essential analytics, where you have provided express opt-in consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5.2 — okpeso does not use personal data for purposes incompatible with those stated at the time of collection without obtaining fresh consent or establishing a new lawful basis.

6 Data Sharing & Third-Party Disclosure

6.1 — okpeso may share your personal data with the following categories of recipients:

• PAGCOR and regulatory authorities: Player identity and activity data disclosed in response to lawful regulatory requests, audit procedures, license review processes, or AMLA suspicious transaction reporting obligations. Such disclosures are mandatory and do not require your consent.
• Licensed game providers: Pseudonymized player session identifiers shared with integrated game studios (JILI, Pragmatic Play, PG Soft, Evolution Gaming, and others) solely for the purpose of delivering and recording gameplay outcomes. Game providers are contractually prohibited from using this data for any independent purpose.
• Payment processors: Identity and financial data shared with GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, Visa, and Mastercard to the minimum extent necessary to process deposit and withdrawal transactions. Each payment provider operates under its own privacy policy as an independent data controller in respect of payment transaction data.
• KYC verification providers: Identity document data shared with accredited third-party KYC platforms for the purpose of age and identity verification. These providers are engaged as Personal Information Processors under written agreements.
• Cloud infrastructure and security providers: Technical data processed by cloud hosting, security monitoring, and DDoS protection providers engaged to maintain Platform availability and security. All providers operate under data processing agreements restricting use to contracted services only.
• Professional advisors: Legal counsel, auditors, and compliance consultants may access account data on a strictly need-to-know basis and are bound by professional confidentiality obligations.
• Law enforcement: Where okpeso is required by a valid Philippine court order, subpoena, or lawful law enforcement request to disclose personal data, we will comply with the minimum disclosure required by that legal obligation.

7 Cross-Border Data Transfers

7.1 — Where game providers, cloud infrastructure partners, or other service providers process personal data outside the Philippines, okpeso ensures that such transfers comply with Section 21 of the Data Privacy Act, which requires that the receiving country provide a comparable level of data protection or that appropriate safeguards are in place.

7.2 — Safeguards implemented for cross-border transfers include: standard contractual clauses approved by or consistent with NPC guidance; binding corporate rules where applicable; and contractual restrictions limiting the receiving party's ability to use transferred data for any purpose beyond the contracted service.

7.3 — By using the okpeso Platform, you acknowledge that your personal data may be transferred to and processed in countries outside the Philippines as described above, subject to the safeguards outlined in this section.

8 Data Retention Periods

8.1 — okpeso retains personal data for the periods set out below, after which data is securely deleted or anonymized:

8.2 — Where a legal dispute, regulatory investigation, or law enforcement matter is ongoing, okpeso may retain relevant data beyond standard retention periods for the duration of the matter, deleting it within a reasonable period following final resolution.

9 Security Measures

9.1 — okpeso implements technical, organizational, and physical security measures proportionate to the risks associated with processing personal data on a financial gaming platform. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between player devices and okpeso servers;
• AES-256 encryption for sensitive personal data stored at rest in okpeso databases;
• Two-factor authentication (2FA) via SMS to registered Philippine mobile numbers, available to all account holders;
• Role-based access control (RBAC) restricting employee access to personal data on a strict need-to-know basis;
• Automated intrusion detection and real-time security monitoring of Platform infrastructure;
• Regular penetration testing and vulnerability assessments by independent security professionals;
• Automated session timeout for idle login sessions to reduce unauthorized access risk on shared devices.

9.2 — In the event of a personal data breach that is likely to result in a real risk of serious harm to affected individuals, okpeso will notify the National Privacy Commission within 72 hours of becoming aware of the breach, as required under NPC Circular No. 16-03. Affected players will be notified without undue delay where the breach creates a high risk to their rights and interests.

10 Cookies & Tracking Technologies

10.1 — The okpeso Platform uses cookies and similar tracking technologies to deliver core Platform functionality and, where consent has been provided, to improve user experience and deliver relevant content.

Strictly Necessary Cookies

These cookies are essential for the Platform to function. They maintain your login session, preserve your language preferences, and support security features including CSRF protection. These cookies cannot be disabled without impairing Platform functionality and do not require consent under the Data Privacy Act.

Functional Cookies

These cookies remember your preferences — such as game display settings, table stake defaults, and notification preferences — to provide a more personalized experience on return visits. Functional cookies are placed with your consent and may be disabled without affecting core Platform access.

Analytics Cookies

Where you have provided consent, anonymized usage data is collected to help okpeso understand how players navigate the Platform, which features are most used, and where technical or UX improvements can be made. Analytics data is not used to build individual advertising profiles and is not sold to third parties.

10.2 — You may manage your cookie preferences through your browser settings at any time. Note that disabling strictly necessary cookies will impair your ability to log in and use the Platform normally.

11 Minors & Age Protection

11.1 — All accounts undergo mandatory age verification through KYC document submission. Where okpeso discovers that personal data has been collected from an individual under the age of 21, the account will be immediately suspended, all personal data associated with the minor's account will be deleted from active systems as promptly as practicable, and the matter will be escalated to okpeso's compliance team for reporting to PAGCOR as required.

11.2 — Parents and guardians who have reason to believe that a minor in their care has registered on the okpeso Platform should contact our support team immediately so that the account may be identified and closed without delay.

12 Your Data Subject Rights

12.1 — As a data subject under the Data Privacy Act of 2012, you have the following rights in relation to personal data held by okpeso. You may exercise any of these rights by submitting a Data Subject Request to our DPO at the contact details in Section 16.

12.2 — okpeso will respond to Data Subject Requests within thirty (30) calendar days of receipt. Where a request is complex or involves a large volume of data, okpeso may extend this period by a further 30 days with written notice to you stating the reasons for the extension, consistent with NPC guidelines.

12.3 — Requests will be processed free of charge for the first instance. For manifestly unfounded, excessive, or repetitive requests, okpeso reserves the right to charge a reasonable administrative fee or decline to act, with written reasons provided.

13 Marketing Communications

13.1 — okpeso will only send promotional communications — including bonus offers, VIP programme updates, sports betting tips, and new game announcements — to players who have provided express opt-in consent during registration or through their Account communication preferences.

13.2 — You may withdraw marketing consent at any time by: (a) updating your communication preferences in Account Settings; (b) clicking the unsubscribe link in any marketing email; or (c) sending a written request to [email protected]. Withdrawal of marketing consent does not affect the lawfulness of processing based on consent prior to withdrawal and does not affect your ability to use the Platform or receive transactional communications necessary for account management.

13.3 — Transactional communications — including deposit confirmations, withdrawal notifications, KYC verification requests, security alerts, and Terms & Conditions update notices — are sent to all account holders regardless of marketing consent status, as they are necessary for the performance of our contractual obligations.

14 Complaints to the National Privacy Commission

14.1 — If you believe that okpeso has processed your personal data in violation of the Data Privacy Act of 2012, you have the right to file a complaint with the National Privacy Commission (NPC), the regulatory body responsible for enforcing data privacy law in the Philippines.

14.2 — Before escalating a matter to the NPC, we encourage you to first contact okpeso's Data Protection Officer at the details provided in Section 16 to allow us the opportunity to resolve your concern directly and promptly.

14.3 — Information on how to file an NPC complaint, including contact details and the prescribed complaint form, is available through the NPC's official channels. okpeso will cooperate fully with any NPC investigation or inquiry.

15 Amendments to This Policy

15.1 — okpeso may update this Privacy Policy periodically to reflect changes in our data processing practices, applicable law, regulatory guidance, or Platform features. The "Last Updated" date at the top of this document reflects the most recent revision.

15.2 — Where amendments are material — meaning they significantly affect how we collect, use, or share your personal data, or alter your rights as a data subject — we will notify you via the email address registered to your Account at least fourteen (14) days before the changes take effect.

15.3 — Non-material amendments, such as typographical corrections or clarifications that do not alter the substance of processing or your rights, may take effect immediately upon publication without advance notice. Continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Privacy Policy.

16 Contact Information & Data Protection Officer

16.1 — For all privacy-related inquiries, Data Subject Requests, consent withdrawals, or concerns about okpeso's data processing practices, please contact the okpeso Data Protection Officer through the following channels:

• Data Subject Request Email: [email protected]  (subject line: "Data Subject Request — [Your Name]")
• General Privacy Inquiries: [email protected]  (subject line: "Privacy Inquiry")
• Live Chat: Available 24 hours a day, 7 days a week via the okpeso Platform

16.2 — All Data Subject Request emails should include: your full name as registered on your okpeso Account; a description of the right you wish to exercise or the concern you wish to raise; and a copy of a government-issued Philippine ID to allow us to verify your identity before processing the request. Identity verification is required to prevent unauthorized access to, or manipulation of, another person's account data.

16.3 — okpeso undertakes to acknowledge receipt of all privacy-related communications within three (3) Philippine business days and to provide a substantive response within thirty (30) calendar days of confirmed receipt.