okadaph Privacy Policy

1Definitions

In this Privacy Policy, the following terms carry the meanings assigned below unless the context requires otherwise:

• "okadaph", "we", "us", "our" — the operator of the okadaph online gaming platform, duly licensed by PAGCOR to operate online casino and sports betting services in the Philippines.
• "Platform" — the okadaph website accessible at okadaph.co and all associated features, services, tools, and communications.
• "Personal Information" / "Personal Data" — any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained, or when put together with other information would directly and certainly identify an individual, as defined under the Data Privacy Act of 2012.
• "Sensitive Personal Information" — personal information about an individual's race, ethnic origin, marital status, age, colour, and religious, philosophical, or political affiliations; health, education, genetic or sexual life; court proceedings to which the individual is a party; government-issued identifiers; and financial information.
• "Processing" — any operation or set of operations performed on personal data, including collection, recording, organisation, storage, updating, retrieval, use, disclosure, or disposal.
• "Data Subject" — any natural person whose personal data is collected, processed, or stored by okadaph, including registered players and website visitors.
• "NPC" — the National Privacy Commission of the Philippines, the independent body mandated to administer and implement the Data Privacy Act of 2012.
• "PAGCOR" — the Philippine Amusement and Gaming Corporation.
• "KYC" — Know Your Customer identity and age verification procedures.
• "DPO" — Data Protection Officer, the individual designated by okadaph to oversee data privacy compliance.

2Data Controller Identity

okadaph acts as the Personal Information Controller (PIC) in respect of all personal data collected from players and website visitors through the okadaph Platform. As PIC, okadaph determines the purposes and means of processing personal data and is accountable for ensuring that such processing complies with the Data Privacy Act of 2012 and its implementing rules.

okadaph has designated a Data Protection Officer (DPO) responsible for overseeing the implementation of this Privacy Policy and managing data subject rights requests. Contact details for the DPO are provided in Section 16 of this policy.

Where okadaph engages third-party service providers to process personal data on its behalf — including payment processors, game providers, KYC verification vendors, and customer support platforms — such providers act as Personal Information Processors (PIPs). okadaph requires all PIPs to implement data processing agreements that meet the standards required by Philippine law and that bind PIPs to equivalent data protection obligations.

3Personal Data We Collect

okadaph collects the following categories of personal data, depending on the nature of your interaction with the Platform:

okadaph does not knowingly collect biometric data beyond what may be contained in government ID photographs submitted for KYC purposes, which are processed solely for identity verification and retained in accordance with Section 10 of this policy.

4How We Collect Your Personal Data

okadaph collects personal data through the following channels and mechanisms:

4.1 Directly From You

• When you complete the okadaph account registration form;
• When you submit identity documents for KYC verification;
• When you make a deposit or request a withdrawal through the cashier;
• When you contact customer support via live chat, email, or in-Platform messaging;
• When you respond to a survey, promotion, or player feedback request;
• When you update your account profile or contact information;
• When you configure responsible gaming settings in your account dashboard.

4.2 Automatically Through Platform Use

• Log data generated each time you access the Platform, including your IP address, device identifiers, browser characteristics, and session metadata;
• Cookie and local storage data as described in Section 7;
• Game session data recorded by the Platform's gaming systems and third-party game provider systems;
• Fraud detection and security monitoring systems that analyse transaction and login patterns.

4.3 From Third Parties

• Identity verification providers who confirm the authenticity of documents submitted for KYC;
• Payment providers (GCash, Maya, BPI, BDO, Metrobank) who confirm transaction status;
• Anti-money laundering screening providers who cross-reference player data against sanctions lists and politically exposed persons (PEP) databases as required by Philippine law;
• PAGCOR self-exclusion registers, where applicable under regulatory requirements.

5Legal Basis for Processing

okadaph processes personal data on one or more of the following lawful bases, as recognised under the Data Privacy Act of 2012:

• Contractual necessity — processing is necessary to perform the contract between you and okadaph (i.e., to operate your account, process deposits and withdrawals, and provide access to games);
• Legal obligation — processing is required to comply with PAGCOR licence conditions, the Anti-Money Laundering Act (AMLA) of the Philippines, the Data Privacy Act of 2012, and other applicable Philippine laws and regulations;
• Legitimate interests — processing is necessary for okadaph's legitimate interests in fraud prevention, platform security, responsible gaming enforcement, and improving the quality of the Platform, provided such interests are not overridden by your fundamental rights and freedoms;
• Consent — where none of the above bases applies, okadaph will seek your explicit consent before processing. You have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

6How We Use Your Personal Data

okadaph uses the personal data it collects for the following purposes:

• To create, verify, and manage your okadaph Account, including processing your KYC documentation and confirming your eligibility to play;
• To process deposits, withdrawals, and related payment transactions through your chosen payment method (GCash, Maya, BPI, BDO, Metrobank, 7-Eleven, USDT TRC20, Coins.ph);
• To provide access to the Platform's games, sportsbook, promotions, VIP programme, and customer support services;
• To comply with PAGCOR reporting and audit obligations, including player activity reports and responsible gaming data submissions;
• To fulfil AML and counter-terrorism financing (CTF) obligations under the Anti-Money Laundering Act, including transaction monitoring, suspicious transaction reporting to the Anti-Money Laundering Council (AMLC), and customer due diligence;
• To verify your age (21+) and enforce the restriction on underage access to the Platform;
• To administer and enforce responsible gaming tools, including deposit limits, loss limits, self-exclusion, and PAGCOR self-exclusion register checks;
• To detect, investigate, and prevent fraudulent activity, security breaches, duplicate accounts, and bonus abuse;
• To send you transactional communications — including deposit and withdrawal confirmations, account security alerts, KYC status updates, and customer support responses — that are necessary for the operation of your Account;
• To send you promotional communications, personalised offers, and VIP programme updates, where you have not opted out of such communications;
• To improve the Platform's performance, user experience, game selection, and customer support quality through anonymised analytics and aggregated usage data;
• To resolve disputes, enforce our Terms & Conditions, and defend legal claims.

7Cookies & Tracking Technologies

The okadaph Platform uses cookies and similar tracking technologies to provide core functionality, maintain your session while logged in, and gather anonymous analytics data. The categories of cookies used on the Platform are as follows:

• Strictly necessary cookies — essential for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without rendering the Platform unusable;
• Functional cookies — store your preferences (e.g., language, currency display, responsible gaming settings) so you do not need to reconfigure them on each visit;
• Analytics cookies — collect anonymous, aggregated data about how visitors navigate the Platform, which pages are most visited, and how games are accessed. This data is used solely to improve Platform performance and does not identify individual users;
• Fraud prevention cookies — help okadaph identify unusual login patterns and detect bot activity or automated account creation attempts.

okadaph does not use third-party advertising tracking cookies or behavioural retargeting technologies that share your browsing data with external advertising networks. You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the Platform.

8Sharing Your Personal Data

okadaph does not sell, rent, or trade your personal data to third parties. We share personal data only in the following circumstances and only to the extent strictly necessary:

8.1 Service Providers (Personal Information Processors)

okadaph engages trusted third-party processors who act on our documented instructions and are contractually bound to data protection standards at least equivalent to those required by Philippine law. These include: KYC and identity verification providers; payment processors (GCash, Maya, BPI network, BDO network, Metrobank); game software providers (Jili, PG Soft, Pragmatic Play, and others); customer support platform providers; and cloud infrastructure and hosting providers.

8.2 Regulatory and Legal Disclosure

okadaph is required to disclose player data to PAGCOR as part of its licensing obligations, and to the Anti-Money Laundering Council (AMLC) in connection with suspicious transaction reports and covered transaction reports under the AMLA. We may also disclose personal data in response to lawful orders from Philippine courts, the NPC, or other competent government authorities.

8.3 Business Transfers

In the event of a merger, acquisition, or sale of assets involving okadaph, personal data held by the Platform may be transferred to the acquiring entity, subject to that entity assuming equivalent data protection obligations. Players will be notified of any such transfer prior to their data being subject to a materially different privacy policy.

8.4 With Your Consent

For any sharing not covered by the above categories, okadaph will obtain your explicit consent before disclosing your personal data to third parties.

9International Data Transfers

Some of okadaph's third-party service providers — particularly game software providers and cloud infrastructure vendors — operate servers or personnel located outside the Philippines. Where personal data is transferred to recipients in countries that have not been assessed by the NPC as providing adequate data protection, okadaph implements appropriate safeguards, which may include:

• Contractual clauses approved by the NPC or equivalent standard contractual clauses;
• Binding corporate rules applicable to the relevant service provider group;
• Compliance with NPC guidelines on cross-border data flows.

By using the okadaph Platform, you acknowledge that your personal data may be transferred to and processed in countries outside the Philippines in accordance with the safeguards described above. A list of countries to which data may be transferred is available upon request from the DPO.

10Data Retention

okadaph retains personal data for the periods set out below, after which data is securely deleted, anonymised, or archived in accordance with the applicable legal requirement:

• Account and identity data — retained for the duration of the active Account relationship and for five (5) years after Account closure, consistent with PAGCOR licence conditions and the Anti-Money Laundering Act record-keeping obligations;
• Financial transaction records — retained for five (5) years from the date of each transaction, as required under the AMLA and its implementing regulations;
• KYC documents — retained for five (5) years after Account closure or the date of the relevant transaction, whichever is later;
• Gaming activity logs — retained for two (2) years from the date of the relevant session, unless required for a longer period by PAGCOR or as evidence in an active dispute;
• Customer support communications — retained for two (2) years from the date of the interaction;
• Responsible gaming records — self-exclusion records retained indefinitely to prevent re-registration during an active exclusion period; other responsible gaming tool configurations retained for the duration of the Account.

Where personal data is retained beyond the active account relationship for legal compliance purposes, it is restricted to access by authorised personnel only and is not used for any commercial purpose.

11Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by okadaph. To exercise any of these rights, please contact the okadaph Data Protection Officer using the contact details in Section 16.

okadaph will acknowledge data subject rights requests within 72 hours of receipt and will provide a substantive response within 30 calendar days, as required by the NPC's implementing rules. If a request cannot be fulfilled within that period, we will notify you of the reason for the delay and the expected completion date. okadaph does not charge a fee for the exercise of data subject rights except in cases of manifestly unfounded, excessive, or repetitive requests.

12Security Measures

okadaph implements a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, or destruction. Our current security measures include:

• Encryption in transit — all data transmitted between your device and the okadaph Platform is protected by 256-bit TLS/SSL encryption, the same standard used by major Philippine banks including BPI and BDO;
• Encryption at rest — sensitive data fields including government ID numbers, payment account references, and authentication credentials are encrypted in storage using industry-standard algorithms;
• Access controls — internal access to player personal data is governed by role-based access controls. Staff access to personal data is restricted to those with a documented operational need and is logged for audit purposes;
• Two-factor authentication — OTP verification is applied to player logins from unrecognised devices and to internal administrative access to player data systems;
• Penetration testing — the Platform undergoes regular third-party security assessments and penetration testing to identify and remediate vulnerabilities;
• Incident response — okadaph maintains a documented data breach response procedure. In the event of a personal data breach that poses a real risk of serious harm to data subjects, okadaph will notify affected players and the NPC within the timeframes required by the Data Privacy Act of 2012.

While okadaph takes all reasonable technical and organisational measures to protect your personal data, no security system is completely impenetrable. You are responsible for maintaining the confidentiality of your account credentials and for notifying okadaph immediately of any suspected unauthorised access.

13Children and Minors

The okadaph Platform is strictly intended for adults aged 21 years and above, consistent with the minimum age for casino-style gambling under PAGCOR regulations. okadaph does not knowingly collect personal data from any individual under the age of 21.

Age verification is a mandatory step in the okadaph Account registration and KYC process. If okadaph becomes aware that personal data has been collected from a person under 21 — whether through the registration process, a complaint, or otherwise — the relevant Account will be immediately suspended, the data will be deleted or returned in accordance with applicable law, and the matter will be reported to PAGCOR as required by our licence conditions.

If you are a parent or guardian and believe that your child under 21 has registered an Account at okadaph, please contact our Data Protection Officer immediately using the details in Section 16.

14Third-Party Links

The okadaph Platform may contain references to third-party services, including game providers and payment processors, whose own platforms operate independently of okadaph. This Privacy Policy applies solely to personal data collected and processed by okadaph through the okadaph Platform. okadaph is not responsible for the privacy practices of third-party platforms and encourages you to review the relevant privacy policies of any third-party services you access in connection with your use of the okadaph Platform.

15Amendments to This Policy

okadaph reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, NPC guidance, PAGCOR regulatory requirements, or changes to how we operate the Platform. When material changes are made, we will notify registered players by email to the address on file and by a prominent notice on the Platform, with a minimum of fourteen (14) calendar days' notice before the revised policy takes effect, except where a shorter notice period is required by law.

The current version of this Privacy Policy is always accessible at okadaph.co/privacy-policy. The "Last Updated" date at the top of this document will be revised each time a new version is published. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the revised policy.

16Contact & Data Protection Officer

For all matters relating to this Privacy Policy, including exercising your data subject rights, raising a privacy concern, or reporting a suspected data breach, please contact the okadaph Data Protection Officer:

• Email: [email protected] (plain text — not a clickable link) — subject line: "Privacy / DPO Request"
• Live Chat: Available 24 hours a day, 7 days a week, via the okadaph Account dashboard — identify your request as a data privacy matter
• Response Timeline: Acknowledgement within 72 hours; substantive response within 30 calendar days of receipt

If you are not satisfied with okadaph's response to your data privacy concern, you have the right to escalate the matter to the National Privacy Commission of the Philippines, whose contact details and complaint procedures are available on the NPC's official website.