okpey Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how okpey ("we", "us", "our", "the Platform") collects, processes, stores, shares, and protects the personal information of Players ("you", "your") who register and use the okpey online gaming platform at okpey.club.

okpey is committed to processing personal data in compliance with the Republic of the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, the Anti-Money Laundering Act (Republic Act No. 9160, as amended), PAGCOR's data handling requirements for licensed operators, and all other applicable Philippine laws governing the collection and use of personal information.

By creating an okpey account or using any part of the Platform, you acknowledge that you have read this Policy and consent to the processing of your personal data as described herein. If you do not consent, you must not register or continue using the okpey Platform.

This Policy should be read in conjunction with okpey's Terms & Conditions and Responsible Gaming page.

2. Data Controller

okpey acts as the Personal Information Controller (PIC) as defined under the Data Privacy Act of 2012 with respect to the personal data of Players processed through the Platform.

okpey has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and with applicable data privacy laws. The DPO may be contacted at [email protected] with the subject line "Data Privacy Enquiry". The DPO will acknowledge all valid data privacy requests within five (5) business days.

okpey is registered with the National Privacy Commission (NPC) of the Philippines as required for personal information controllers processing sensitive personal information in the ordinary course of business.

3. Personal Data We Collect

okpey collects personal data from Players in the following categories. We collect only what is necessary for the purposes described in this Policy.

okpey does not collect or store full payment card numbers. All payment processing is handled by PCI-DSS compliant third-party payment processors. okpey receives only transaction confirmation references and partial account identifiers.

4. How We Use Your Personal Data

okpey processes personal data for the following specific purposes:

• Account Registration and Management: To create, maintain, and secure your okpey account, including authentication and access control;
• KYC and Identity Verification: To verify your identity and age (21+) as required by PAGCOR regulations and to comply with Philippine AML laws;
• Payment Processing: To facilitate deposits and withdrawals to and from your okpey Wallet via your chosen Philippine payment method (GCash, Maya, BPI, BDO, etc.);
• Regulatory Compliance: To fulfil okpey's legal obligations under PAGCOR's operating licence conditions, the Anti-Money Laundering Act, and applicable Philippine financial regulations, including transaction monitoring and suspicious activity reporting;
• Platform Operation and Game Provision: To deliver the games, features, and services you access on the okpey Platform, including recording game outcomes and maintaining your play history;
• Responsible Gaming: To monitor gaming patterns for signs of problem gambling behaviour, to apply self-imposed limits you have set, and to fulfil okpey's duty of care obligations under PAGCOR's responsible gaming framework;
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance;
• Fraud Prevention and Security: To detect and prevent fraudulent transactions, account takeovers, bonus abuse, and other prohibited activities on the Platform;
• Communications: To send transactional notifications (deposit confirmations, withdrawal updates, security alerts) and, where you have consented, promotional communications about okpey offers and new game releases;
• Platform Improvement: To analyse aggregated, anonymised usage data to improve the okpey Platform's performance, game library curation, and user experience.

okpey does not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you, except where such processing is required for regulatory compliance (e.g., AML transaction screening).

5. Legal Basis for Processing

Under the Data Privacy Act of 2012, okpey processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfil the agreement between you and okpey (account operation, payment processing, game delivery);
• Legal Obligation: Processing required to comply with PAGCOR's regulatory requirements, AMLA obligations, KYC mandates, and other applicable Philippine laws;
• Consent: Processing for marketing communications and certain optional personalisation features, where you have given specific, informed, freely given consent. You may withdraw marketing consent at any time by contacting [email protected];
• Legitimate Interests: Processing for fraud prevention, platform security, and aggregated analytics — where okpey's legitimate interests in platform integrity do not override your fundamental rights and freedoms.

6. Data Sharing & Third Parties

okpey does not sell, rent, or trade your personal data to third parties for their own marketing purposes. Personal data may be shared with the following categories of third parties only to the extent necessary for the purposes described in this Policy:

• PAGCOR and Regulatory Authorities: okpey is obligated to share Player data with PAGCOR upon request and to submit required regulatory reports including transaction monitoring reports, suspicious activity reports, and audit data under the AMLA;
• Payment Service Providers: GCash (G-Xchange Inc.), Maya (Paymaya Philippines Inc.), banks, and other payment processors receive limited transactional data necessary to process your deposits and withdrawals. These providers are bound by their own privacy policies and applicable BSP regulations;
• KYC / Identity Verification Providers: Third-party identity verification services used to authenticate government-issued IDs as part of PAGCOR-required KYC processes;
• Game Content Providers: Licensed game software providers whose games are available on the okpey Platform may receive anonymised session data for RNG auditing and game performance purposes. No personally identifiable information is shared with game providers;
• IT Infrastructure and Cloud Providers: Hosting, data storage, and cybersecurity service providers who process data on okpey's behalf under contractual data processing agreements that impose equivalent data protection standards;
• Legal and Law Enforcement: okpey may disclose personal data to Philippine courts, law enforcement agencies, or other competent authorities where required by law, court order, or in connection with the prevention or investigation of fraud or criminal activity.

All third-party processors engaged by okpey are contractually required to handle personal data in accordance with the Data Privacy Act of 2012 and to implement appropriate technical and organisational security measures.

7. Cookies & Tracking Technologies

The okpey Platform uses cookies and similar tracking technologies to provide a functional and personalised user experience. Cookies are small text files stored on your device when you access the Platform.

okpey uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function — session authentication, security tokens, and load balancing. These cannot be disabled without impairing Platform functionality;
• Functional Cookies: Remember your preferences such as language settings, lobby filters, and last-played games to provide a more convenient experience on return visits;
• Analytics Cookies: Collect aggregated, anonymised data about how Players navigate the Platform, which game categories are most visited, and where technical errors occur. This data helps okpey improve the Platform. No personally identifiable information is included in analytics data;
• Security Cookies: Support fraud detection and platform security systems by helping to identify anomalous login patterns and device fingerprinting for account protection.

You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent login and use of the Platform. okpey does not use third-party advertising cookies or behavioural tracking for the purpose of serving advertisements on external websites.

8. Data Retention

okpey retains personal data for the minimum period necessary to fulfil the purposes described in this Policy or as required by applicable law. The following retention periods apply:

• Account and KYC Data: Retained for a minimum of five (5) years from the date of account closure, as required under PAGCOR's record-keeping requirements and the AMLA's record retention obligations;
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLA and BSP reporting requirements;
• Gaming Activity Logs: Retained for three (3) years from the date of each session for RNG audit and dispute resolution purposes;
• Support Communications: Retained for two (2) years from the date of last interaction;
• Technical Logs (IP, device data): Retained for twelve (12) months for security and fraud investigation purposes;
• Marketing Consent Records: Retained until consent is withdrawn, plus one (1) year as a compliance record.

Following the expiry of applicable retention periods, okpey will securely delete or anonymise personal data in a manner that prevents reconstruction of the original information.

9. Data Security

okpey implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the okpey Platform;
• AES-256 encryption for personal data stored in okpey's databases at rest;
• Bcrypt hashing of all Player passwords — okpey cannot read your password, and our support staff will never ask for it;
• Role-based access controls restricting employee access to personal data to those with a legitimate operational need;
• Regular penetration testing and independent security audits of the Platform's infrastructure;
• Two-factor authentication (2FA) options for Players and mandatory 2FA for all okpey staff accessing systems containing personal data;
• Data breach detection and incident response procedures aligned with the NPC's mandatory breach notification requirements.

While okpey applies industry-standard security measures, no system is completely immune from security threats. Players are responsible for maintaining the security of their own account credentials and should report any suspected unauthorised access immediately to [email protected].

10. Your Data Privacy Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by okpey:

• Right to be Informed: The right to know how your personal data is being collected and processed — fulfilled by this Privacy Policy;
• Right to Access: The right to request a copy of the personal data okpey holds about you, including information on how it is being used;
• Right to Rectification: The right to correct inaccurate or incomplete personal data. Players may update most account details directly through their okpey account settings;
• Right to Erasure: The right to request deletion of personal data that is no longer necessary for the purposes for which it was collected, subject to okpey's legal retention obligations under PAGCOR regulations and the AMLA;
• Right to Object: The right to object to processing based on legitimate interests or for direct marketing purposes. Withdrawal of marketing consent can be requested at any time;
• Right to Data Portability: The right to receive a copy of your personal data in a structured, commonly used format where technically feasible;
• Right to Damages: The right to claim compensation for actual damages suffered as a result of a violation of your data privacy rights under the Data Privacy Act of 2012;
• Right to Complain: The right to file a complaint with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated.

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Privacy Rights Request". okpey will acknowledge all valid requests within five (5) business days and respond substantively within thirty (30) calendar days. Identity verification may be required before processing certain requests to protect against unauthorised data access.

11. Children & Minors

The okpey Platform is strictly restricted to individuals who are 21 years of age or older, in accordance with PAGCOR's minimum gaming age requirements. okpey does not knowingly collect personal data from any person under the age of 21.

If okpey becomes aware that personal data has been collected from an individual under 21 years of age, that data will be deleted promptly and the associated account will be permanently closed. Any funds in the account at the time of closure will be returned to the payment source used for deposits, subject to applicable AML verification.

If you are a parent or guardian and believe that a minor may have registered an account on okpey, please contact [email protected] immediately.

12. Updates to This Policy

okpey may update this Privacy Policy from time to time to reflect changes in the Platform's data processing activities, updates to applicable Philippine law, or PAGCOR regulatory guidance. Where changes are material — affecting your rights or significantly altering how we process your data — okpey will provide advance notice via a Platform notification and/or email to your registered address at least seven (7) days before the updated Policy takes effect.

The date of the most recent update is always displayed at the top of this page. Continued use of the okpey Platform following the effective date of an updated Policy constitutes acceptance of the revised terms. Players who do not accept the updated Policy should cease using the Platform and may request account closure in accordance with okpey's Terms & Conditions.

13. Contact & Data Protection Officer

For all data privacy enquiries, access requests, correction requests, or complaints relating to the processing of your personal data by okpey, please contact the okpey Data Protection Officer.

If you are not satisfied with okpey's response to a data privacy complaint, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC) at [email protected] or through the NPC's official complaints portal.