okbat Privacy Policy — Your Data Rights as a Filipino Player

1. Data Controller

okbat ("okbat", "we", "us", "our") is the data controller of the personal information collected through the okbat platform accessible at okbat.bio. okbat operates under a current PAGCOR license and processes personal data in accordance with Republic Act No. 10173, known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations.

For all data protection enquiries, you may contact our designated Data Protection Officer (DPO) using the contact details provided in Section 14 of this Policy.

2. Personal Data We Collect

okbat collects the following categories of personal data from Players:

• Identity Data: Full legal name, date of birth, gender, nationality, and government-issued identification numbers (e.g., Philippine National ID, passport, SSS/GSIS number where required for KYC);
• Contact Data: Registered Philippine mobile number, email address, and residential address;
• Financial Data: GCash account number, PayMaya/Maya account details, bank account details (BPI, BDO, Metrobank, or other supported banks), transaction history, deposit amounts, withdrawal amounts, and Wallet balances — all denominated in Philippine Peso (₱PHP);
• Account Data: Username, encrypted password, account settings, bonus usage history, game preferences, and responsible gaming tool configurations (deposit limits, self-exclusion status);
• Technical Data: IP address, device type, operating system, browser type and version, session duration, login timestamps, and geographic location data derived from IP;
• Gameplay Data: Bet history, game session logs, wager amounts, game outcomes, and related transactional records generated during gameplay;
• Communications Data: Records of your interactions with okbat customer support, including live chat transcripts and email correspondence.

okbat does not collect sensitive personal information beyond what is strictly necessary for identity verification, regulatory compliance, and fraud prevention purposes.

3. How We Collect Your Personal Data

okbat collects personal data through the following channels:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions;
• Automated technologies: Cookies, session identifiers, and server logs that collect technical and usage data as you navigate the platform — see Section 9 for details;
• Third-party payment providers: Transaction confirmation data received from GCash, PayMaya/Maya, BPI, BDO, Metrobank, and other payment networks when you initiate deposits or withdrawals;
• Identity verification providers: Where okbat engages third-party KYC service providers to verify government-issued documents, those providers may share verification outcomes with okbat.

4. Legal Basis for Processing

okbat processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform our contract with you — opening and maintaining your account, processing deposits and withdrawals, and delivering gaming services;
• Legal obligation: Processing required to comply with PAGCOR licensing requirements, Anti-Money Laundering Act (AMLA) obligations, and other applicable Philippine laws;
• Legitimate interests: Processing necessary for fraud prevention, platform security, responsible gaming monitoring, and service improvement — where these interests are not overridden by your data protection rights;
• Consent: Processing for marketing communications and non-essential cookies, where your prior consent has been obtained and can be withdrawn at any time.

5. How We Use Your Personal Data

okbat uses collected personal data for the following purposes:

• Creating, verifying, and maintaining your okbat account;
• Processing deposits and withdrawals in Philippine Peso via supported payment channels;
• Complying with PAGCOR KYC and Anti-Money Laundering Act requirements;
• Detecting, investigating, and preventing fraud, money laundering, and other prohibited conduct;
• Administering bonuses, promotions, and loyalty programmes;
• Monitoring gameplay to enforce responsible gaming tools such as deposit limits, loss limits, and self-exclusion;
• Providing customer support and resolving disputes;
• Sending transactional communications (account verification, deposit confirmations, withdrawal status updates);
• Sending marketing communications — only where you have opted in and only through the communication channel(s) you have authorised;
• Analysing aggregate, anonymised platform usage data to improve the okbat product.

6. Data Sharing & Disclosure

okbat does not sell your personal data. We share personal data only in the following circumstances:

• Payment processors: GCash (G-Xchange Inc.), PayMaya/Maya Bank, and bank networks receive the minimum transaction data necessary to process your deposit or withdrawal;
• KYC/Identity verification providers: Government-issued ID images and personal details are shared with licensed identity verification service providers for document validation;
• Game providers: Your account identifier and transaction data are shared with third-party game software providers (e.g., JILI, Pragmatic Play, PG Soft) to the extent necessary to deliver and settle game sessions;
• Regulatory authorities: PAGCOR and other competent Philippine government authorities, including the Anti-Money Laundering Council (AMLC), when required by law or lawful order;
• Professional advisors: Lawyers, auditors, and insurers under obligations of confidentiality, where necessary for legal proceedings, compliance, or insurance purposes;
• Business transfers: In the event of a merger, acquisition, or asset sale, personal data may be transferred to the successor entity, with reasonable notice provided to affected Players.

All third parties with whom okbat shares personal data are required to maintain its confidentiality and to use it only for the disclosed purpose.

7. International Data Transfers

7.1 Some of okbat's third-party service providers — including game software providers and certain technical infrastructure vendors — may be located outside the Philippines. Where personal data is transferred internationally, okbat implements appropriate safeguards to ensure a standard of protection equivalent to that required under the Data Privacy Act of 2012.

7.2 Such safeguards may include standard contractual clauses, data processing agreements, or reliance on adequacy determinations by the National Privacy Commission (NPC). Details of specific international transfers and applicable safeguards are available from our DPO on written request.

8. Data Retention

okbat retains personal data for as long as is necessary for the purposes described in this Policy, subject to the following minimum retention periods:

• Account and identity data: For the duration of the account relationship plus a minimum of five (5) years after account closure, as required by AMLA and PAGCOR retention obligations;
• Financial and transaction data: Minimum of five (5) years from the date of the transaction, in compliance with AMLA record-keeping requirements;
• Gameplay and session logs: Minimum of two (2) years from the date of the session, or longer if required for an ongoing investigation or dispute;
• Customer support communications: Two (2) years from the date of the last interaction, or as long as a related dispute remains open.

Where retention beyond these periods is not required by law or legitimate business purpose, okbat will securely delete or anonymise the personal data concerned.

9. Cookies & Tracking Technologies

9.1 The okbat platform uses cookies and similar technologies (collectively, "cookies") to enable core platform functionality, maintain your login session, remember your preferences, and analyse platform usage.

9.2 The following categories of cookies are used:

• Strictly necessary cookies: Required for the platform to function — including session management, login authentication, and security tokens. These cannot be disabled without impairing platform functionality.
• Functional cookies: Remember your preferences, such as language settings and responsible gaming tool configurations.
• Analytical cookies: Collect anonymised data about how Players navigate the platform, used to improve the product. These are subject to your consent.

9.3 You may control non-essential cookies through your browser settings. Disabling analytical cookies will not affect your ability to use the okbat platform but will reduce our ability to improve the product based on usage patterns.

10. Your Data Protection Rights

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by okbat:

• Right to be informed: The right to know that your personal data is being collected and processed, which this Policy fulfils;
• Right of access: The right to obtain a copy of your personal data held by okbat;
• Right to rectification: The right to have inaccurate or incomplete personal data corrected;
• Right to erasure: The right to have personal data deleted where retention is no longer legally required or justified — subject to PAGCOR and AMLA retention obligations, which may limit this right;
• Right to object: The right to object to processing based on legitimate interests, including direct marketing — with immediate effect for marketing objections;
• Right to data portability: The right to receive your personal data in a structured, commonly used format for transfer to another controller, where technically feasible;
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data protection rights have been violated.

To exercise any of these rights, submit a written request to our DPO at the contact details in Section 14. okbat will respond within fifteen (15) calendar days of receiving a valid request.

11. Security Measures

okbat implements technical and organisational security measures proportionate to the risks associated with the processing of your personal data. These include:

• TLS/SSL encryption for all data transmitted between your browser and the okbat platform;
• Encrypted storage of passwords using industry-standard hashing algorithms — okbat staff cannot read your password in plain text;
• Two-factor authentication (OTP via Philippine mobile number) for new device logins;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Regular security assessments and vulnerability testing of platform infrastructure;
• Incident response procedures including mandatory NPC notification within 72 hours in the event of a personal data breach that poses a real risk of serious harm.

No security system is impenetrable. In the event of a data breach affecting your personal data, okbat will notify you and the NPC in accordance with the DPA and NPC Circular 16-03.

12. Minors and Age Verification

The okbat platform is strictly for individuals aged 21 years and older. okbat does not knowingly collect personal data from persons below 21 years of age. Age verification is conducted during the registration process and as part of KYC. If okbat becomes aware that personal data has been collected from a person below the minimum age requirement, that account will be suspended immediately and the data concerned will be deleted — subject to any legal retention obligations related to the age verification failure.

13. Amendments to This Privacy Policy

okbat may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or PAGCOR requirements. Material changes will be communicated to registered Players by email or prominent platform notice at least seven (7) days before taking effect. The effective date at the top of this Policy reflects the most recent revision. Continued use of the okbat platform after the effective date constitutes your acknowledgment of the updated Policy.

14. Contact & Data Protection Officer

For all data protection enquiries — including requests to exercise your rights, complaints, or questions about this Policy — please contact okbat's designated Data Protection Officer:

• Email: [email protected] (subject line: "Data Privacy Request")
• Live Chat: Available on the okbat platform, 8:00 AM – 2:00 AM PHT daily
• Regulatory Oversight: National Privacy Commission (NPC), Republic of the Philippines

okbat will acknowledge all written data privacy requests within five (5) business days and will endeavour to resolve them within fifteen (15) calendar days.