Privacy Policy – How okbat Protects Your Personal Data

1Introduction

okbat ("the Company", "we", "us", "our") operates the online gambling platform accessible at okbat.one, providing casino games, sports betting, live dealer tables, and related entertainment services to players in the Philippines. In the course of operating this platform, we collect and process personal information from registered players and website visitors.

This Privacy Policy ("Policy") describes our practices with respect to the collection, use, storage, sharing, and protection of personal data. It is written in compliance with Republic Act No. 10173 — the Data Privacy Act of 2012 — and its Implementing Rules and Regulations, as administered by the National Privacy Commission of the Philippines.

We encourage all okbat players to read this Policy in its entirety. If you have questions about any provision, our Data Protection Officer ("DPO") is reachable through the contact details in Section 14 of this document.

2Data Controller Identity

The data controller responsible for your personal information collected through the okbat platform is:

• Platform Name: okbat
• Website: okbat.one
• Regulatory Authority: PAGCOR (Philippine Amusement and Gaming Corporation)
• Data Protection Contact: [email protected]

As the data controller, okbat determines the purposes and means of processing your personal data and bears primary accountability for ensuring that processing is lawful, fair, and transparent in accordance with applicable Philippine law.

3Categories of Personal Data We Collect

The following categories of personal data are collected and processed by okbat:

• Identity Data: Full legal name, date of birth, nationality, gender, and government-issued identification details (UMID number, driver's licence number, PhilSys ID number, or passport number).
• Contact Data: Philippine mobile number (used as primary account identifier), email address (optional), and residential address.
• Financial Data: GCash mobile number, Maya account details, bank account information (BPI, BDO, Metrobank) used for deposits and withdrawals, and transaction history.
• KYC Documentation: Scanned or photographed copies of government-issued identification documents and selfie photographs submitted for identity verification.
• Technical Data: IP address, device type, browser type, operating system, screen resolution, session timestamps, and approximate geolocation derived from IP.
• Usage Data: Game session records, bet amounts, win/loss outcomes, bonus participation, and navigation patterns within the platform.
• Communications Data: Records of your interactions with okbat customer support, including live chat transcripts and email correspondence.

okbat does not collect sensitive personal data categories such as health information, political opinions, or biometric data beyond what is necessary for standard KYC facial matching purposes.

4How We Collect Your Personal Data

okbat collects personal data through the following channels:

• Account Registration: Information you provide directly when creating your okbat account, including mobile number, name, and date of birth.
• KYC Verification: Identity documents and selfie photographs submitted to complete the mandatory verification process required before withdrawal.
• Financial Transactions: Payment details captured at the time of deposit or withdrawal initiation through integrated payment gateways.
• Platform Usage: Automatically collected technical and usage data as you interact with the platform, games, and support channels.
• Device and Browser Data: Technical information collected via standard web server logs and browser APIs when you access okbat.one.
• Customer Support Interactions: Information you voluntarily provide when contacting okbat via live chat or email.

5Purposes and Legal Basis for Processing

okbat processes your personal data for the following specific purposes, each underpinned by a lawful basis under RA 10173:

• Account Management: To create, authenticate, and maintain your okbat player account. Legal basis: contractual necessity.
• Age and Identity Verification: To confirm that you meet the 21+ minimum age requirement and to prevent identity fraud. Legal basis: legal obligation (PAGCOR compliance) and legitimate interest.
• Payment Processing: To facilitate deposits, withdrawals, and related financial reconciliation. Legal basis: contractual necessity and legal obligation (AML compliance).
• Regulatory Compliance: To comply with PAGCOR licensing requirements, anti-money laundering obligations under RA 9160, and financial reporting requirements. Legal basis: legal obligation.
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance. Legal basis: contractual necessity and legitimate interest.
• Responsible Gaming Monitoring: To identify patterns of behaviour associated with problem gambling and to provide protective interventions. Legal basis: legitimate interest and public interest.
• Platform Security: To detect and prevent fraud, cheating, money laundering, and unauthorised account access. Legal basis: legitimate interest and legal obligation.
• Service Improvement: To analyse aggregated usage patterns and improve platform features and game offerings. Legal basis: legitimate interest (data used in aggregate form only).
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have provided consent. Legal basis: consent (withdrawable at any time).

6Disclosure and Data Sharing

okbat does not sell, rent, or commercially transfer your personal data to third parties. We may share your data with the following categories of recipients for the purposes described in this Policy:

• PAGCOR and Regulatory Authorities: Mandatory disclosure of player account data and transaction records as required by our PAGCOR operating licence and applicable Philippine gaming regulations.
• Payment Service Providers: GCash (Globe Fintech Innovations, Inc.), Maya (PayMaya Philippines, Inc.), and banking partners solely for the purpose of processing your financial transactions. These providers have their own independent data protection obligations.
• Game Content Providers: Certified third-party game studios (e.g., JILI, PG Soft, Pragmatic Play) may receive anonymised session and game outcome data strictly for technical support and RNG audit purposes. No personally identifiable information is shared with game providers.
• KYC Verification Partners: Identity verification service providers engaged to assist with document authentication. These providers act as data processors under written data processing agreements that bind them to RA 10173 standards.
• Law Enforcement and Government Agencies: Where we are legally compelled to disclose information in response to a valid court order, subpoena, or directive from a Philippine government authority.
• Professional Advisers: External legal counsel, auditors, and compliance consultants engaged on a confidential basis where necessary for the operation of the business.

All third parties who receive personal data from okbat are required to implement appropriate technical and organisational safeguards and to process the data only for the specified purpose.

7International Data Transfers

Some of the third-party service providers engaged by okbat — including certain game content providers and cloud infrastructure vendors — may process data outside of the Philippines. Where personal data is transferred to jurisdictions outside the Philippines, okbat ensures that appropriate safeguards are in place, including:

• Standard contractual clauses binding the recipient to data protection standards equivalent to RA 10173.
• Transfer to countries recognised by the National Privacy Commission as providing adequate data protection.
• Data minimisation practices ensuring only the minimum necessary personal data is transferred for the specific processing purpose.

8Data Retention Periods

okbat retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to minimum retention requirements imposed by law:

• Active account data: Retained for the duration of the account relationship and for 5 years following account closure, in accordance with PAGCOR record-keeping requirements and Philippine anti-money laundering regulations.
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction, as required by the Anti-Money Laundering Act (RA 9160, as amended).
• KYC documentation: Retained for 5 years from the date of submission or account closure, whichever is later.
• Customer support records: Retained for 3 years from the date of the interaction.
• Technical and usage logs: Retained for up to 12 months in identifiable form, after which they are anonymised or deleted.
• Marketing consent records: Retained for the duration of the account relationship and for 3 years following withdrawal of consent.

Following the applicable retention period, personal data is securely deleted or irreversibly anonymised.

9Security Measures and Data Protection

okbat implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:

• Encryption in transit: All data exchanged between your browser and okbat servers is protected by 256-bit TLS encryption.
• Encryption at rest: Sensitive personal data fields stored in okbat databases — including payment account identifiers and identity document data — are encrypted at rest using AES-256 standards.
• Access controls: Strict role-based access controls ensure that okbat personnel access personal data only on a need-to-know basis. All access is logged and regularly audited.
• Penetration testing: The platform undergoes periodic security assessments and penetration testing by independent security professionals.
• Incident response: okbat maintains a data breach response plan. In the event of a breach that creates a real risk of serious harm, affected players and the National Privacy Commission will be notified within 72 hours of confirmed discovery, as required by RA 10173.
• Player account security: Two-factor authentication via OTP is enforced for logins from new devices. Players are encouraged to use strong unique passwords for their accounts.

10Cookies and Tracking Technologies

okbat uses cookies and similar browser-based technologies on okbat.one for the following purposes:

• Essential cookies: Required for the platform to function, including session authentication tokens and security cookies. These cannot be disabled without impairing your ability to use the platform.
• Functional cookies: Remember your preferences (such as language settings and preferred lobby view) between sessions. These enhance convenience but are not strictly essential.
• Analytics cookies: Collect anonymised data about how players navigate the platform, which games are most popular, and where users encounter difficulties. This helps us improve the platform experience. Data collected through analytics cookies is not linked to individual identities.
• Anti-fraud cookies: Used to detect suspicious or unusual account access patterns that may indicate fraud or unauthorised use.

Non-essential cookies can be managed through your browser settings. Disabling certain functional or analytics cookies will not prevent you from accessing and using the okbat platform but may affect your experience.

11Your Data Subject Rights

As a data subject under RA 10173, you are entitled to the following rights with respect to your personal data held by okbat:

To exercise any of the above rights, submit a written request to our Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request". We will acknowledge your request within 5 business days and respond substantively within 30 calendar days, consistent with RA 10173 requirements.

12Minors and Age Restriction

The okbat platform is strictly for individuals aged 21 years and above, consistent with PAGCOR's minimum legal age requirements for online gambling in the Philippines. okbat does not knowingly collect personal data from individuals under the age of 21.

All accounts are subject to mandatory age verification through KYC documentation review. Any account found to have been created by a person under 21 will be immediately suspended, real-money game access will be revoked, and any balance attributable to underage play will be handled in accordance with PAGCOR regulatory guidelines.

If you have reason to believe that a minor has registered on the okbat platform, please notify us immediately at [email protected] so that appropriate action can be taken without delay.

13Changes to This Privacy Policy

okbat may revise this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or platform features. Material changes — those that significantly affect how we process your personal data or your rights as a data subject — will be communicated to registered players via email notification or a prominent notice on the platform at least 7 days before the change takes effect.

The effective date displayed at the top of this Policy will be updated to reflect the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the okbat platform after any revision constitutes your acknowledgement of the updated Policy.

14Contact and Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or okbat's data processing practices, please contact our Data Protection Officer through the following channels:

• Email (DPO): [email protected] — please include "Privacy / DPO" in the subject line
• Live Chat: Available 24/7 on the okbat platform — average response under 3 minutes
• Response Time: DPO email enquiries acknowledged within 2 business days; substantive responses within 30 calendar days

Players who believe their data privacy rights have been violated and who are not satisfied with okbat's response may also file a complaint with the National Privacy Commission of the Philippines through its official website and complaints process.