okbaet Privacy Policy — How We Handle Your Data

This Privacy Policy ("Policy") is issued by okbaet ("okbaet", "we", "us", "our"), the operator of the online gaming platform accessible at https://okbaet.net and all associated pages, subdomains, and mobile interfaces (collectively, the "Platform"). This Policy governs the collection, use, storage, disclosure, and protection of personal data relating to all registered players, visitors, and prospective users of the Platform (collectively, "you", "your").

okbaet processes personal data in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA") and its Implementing Rules and Regulations, as enforced by the National Privacy Commission ("NPC") of the Philippines. Where applicable, okbaet also adheres to the data-related requirements imposed by the Philippine Amusement and Gaming Corporation ("PAGCOR") as part of its regulatory framework for online gaming operators serving Filipino players.

This Policy applies to all personal data collected through the Platform, whether submitted directly by you during registration or obtained through your use of the Platform's features, games, financial transactions, and communications with our support team. It does not apply to third-party websites or services that may be linked to or from the Platform, which are governed by their own privacy policies.

By registering an account on okbaet or continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must not use the Platform.

okbaet collects personal data across several categories depending on how you interact with the Platform. The specific data collected at each stage is outlined in the table below.

Special Categories of Data. okbaet does not intentionally collect sensitive personal information as defined under Section 3(l) of the DPA (such as health data, religious beliefs, or political affiliations) unless strictly required by applicable regulation — for example, where a responsible gaming assessment necessitates recording a player's self-declared vulnerability status. Any such data is processed with additional safeguards and only to the extent legally required.

okbaet collects personal data through the following channels and methods:

• Direct Submission: Data you actively provide when creating an account, completing KYC verification, submitting payment details, contacting support, participating in promotions, or updating your account profile.
• Automated Technical Collection: Data collected automatically when you access the Platform, including IP address, device identifiers, browser characteristics, and session behavior, through server logs, cookies, and similar tracking technologies.
• Payment Processors: Transaction confirmation data received from GCash, PayMaya, BPI, BDO, Metrobank, and cryptocurrency network providers when you deposit or withdraw funds. okbaet does not store full payment credentials — these are handled by the respective payment service providers under their own security frameworks.
• Identity Verification Partners: Where third-party KYC verification services are used to validate government-issued IDs, okbaet may receive confirmation results and verification scores from those partners. Document images are handled by the KYC provider under their own data processing terms.
• Fraud Prevention and Anti-Money Laundering Systems: Data received from fraud detection and AML screening services as part of our regulatory compliance obligations under RA 9160 (Anti-Money Laundering Act) as amended.
• Communications with Our Team: Any personal data included in live chat messages, emails, or support tickets you send to the okbaet team.

okbaet processes personal data for the following specific purposes. We do not use your data for any purpose that is incompatible with those listed below without first obtaining your separate consent or establishing a new lawful basis for processing.

• Account Creation and Management: To register your okbaet account, verify your identity, manage your profile and preferences, and provide you with access to the Platform's features.
• Financial Transactions: To process deposits and withdrawals via GCash, PayMaya, bank transfer, and cryptocurrency; to maintain accurate records of your transaction history; and to facilitate the correct application of bonuses and promotional credits.
• KYC and Age Verification: To verify that you are at least 21 years of age and to confirm your identity in compliance with PAGCOR regulatory requirements and our legal obligations under Philippine gaming and financial crime laws.
• Regulatory Compliance: To fulfill obligations under PAGCOR's licensing framework, the Anti-Money Laundering Act (RA 9160 as amended), the Data Privacy Act (RA 10173), and other applicable Philippine laws and regulations. This includes filing reports with the Anti-Money Laundering Council (AMLC) where legally required.
• Fraud Prevention and Platform Security: To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, multi-accounting, cheating, and other prohibited conduct; to protect the integrity of the Platform and the interests of all players.
• Customer Support: To respond to your inquiries, resolve complaints, process responsible gaming requests such as self-exclusion, and provide assistance with technical or account-related issues.
• Responsible Gaming: To monitor gaming behavior for indicators of problem gambling, to apply self-imposed limits and exclusions you have elected, and to comply with responsible gaming obligations under the PAGCOR-regulated environment.
• Marketing and Promotions (where you have opted in): To send you information about okbaet bonuses, promotions, new games, and events via your preferred communication channels. You may opt out at any time through your account settings.
• Platform Improvement: To analyze usage patterns, identify technical issues, improve game performance, and enhance the overall player experience on the Platform.

Under the Data Privacy Act of 2012, okbaet relies on one or more of the following lawful bases for each processing activity:

• Contractual Necessity: Processing required to perform our contractual obligations to you under the okbaet Terms & Conditions — including account management, payment processing, and game operation.
• Legal Obligation: Processing required to comply with applicable Philippine laws — including KYC and age verification under PAGCOR requirements, AML reporting under RA 9160, and data retention requirements.
• Legitimate Interests: Processing necessary for okbaet's legitimate business interests, including fraud prevention, platform security, and responsible gaming monitoring — provided these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications and for any processing of sensitive personal information. You may withdraw consent at any time without affecting the lawfulness of prior processing.

okbaet does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only in the circumstances described below, and only to the extent necessary for the stated purpose.

• Payment Service Providers: GCash (G-Xchange, Inc.), PayMaya (Voyager Innovations), BPI, BDO, Metrobank, and cryptocurrency payment processors — to facilitate deposits and withdrawals and to comply with payment network rules.
• Identity Verification and KYC Providers: Third-party KYC and identity verification service providers engaged by okbaet to verify government-issued IDs and confirm player age and identity.
• Fraud Prevention and AML Services: External fraud screening and AML compliance service providers used to meet our obligations under RA 9160 and to protect the integrity of the Platform.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies — where disclosure is required by law, regulation, court order, or official directive.
• IT Infrastructure and Cloud Service Providers: Hosting, database, and IT infrastructure providers who process data on okbaet's behalf under written data processing agreements that require them to maintain appropriate security standards.
• Legal and Professional Advisers: Lawyers, accountants, auditors, and other professional advisers engaged by okbaet in connection with legal proceedings, regulatory audits, or compliance reviews, subject to professional confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of okbaet's business, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. You will be notified of any such transfer in advance.

okbaet retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with okbaet's data disposal procedures. Anonymized data — which can no longer be linked back to an individual — may be retained indefinitely for statistical and analytical purposes.

okbaet implements a range of technical and organizational security measures designed to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include, but are not limited to:

• Encryption: All data transmitted between your device and the okbaet Platform is encrypted using TLS 1.2 or higher (256-bit SSL). Sensitive data stored in our databases — including financial details and identity document references — is encrypted at rest.
• Access Controls: Access to personal data within okbaet's systems is restricted on a strict need-to-know basis. Staff access is governed by role-based access controls, and all access to sensitive data is logged and audited.
• Two-Factor Authentication (2FA): okbaet supports and encourages the use of SMS-based two-factor authentication for player accounts, compatible with Smart, Globe, and DITO mobile numbers.
• Penetration Testing and Security Audits: okbaet conducts periodic security assessments of the Platform to identify and remediate vulnerabilities before they can be exploited.
• Staff Training: okbaet personnel who handle personal data receive regular data privacy training in line with NPC guidelines and the requirements of the DPA.
• Incident Response: okbaet maintains a data breach response procedure. In the event of a personal data breach that is likely to result in serious harm, okbaet will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and affected individuals will be notified in accordance with NPC requirements.

okbaet uses cookies and similar tracking technologies (including local storage, session tokens, and device fingerprinting) to operate the Platform, maintain your session, and analyze usage patterns. The following cookie categories are used:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, anti-CSRF tokens, and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings, responsible gaming tool configurations, and display preferences, so you do not need to reconfigure them on each visit.
• Analytics Cookies: Used to collect aggregated, anonymized data about how players use the Platform — which pages are visited most, where sessions end, and how features are used — to help okbaet improve the Platform experience.
• Security Cookies: Used for fraud detection and to support our obligation to prevent unauthorized access, multi-accounting, and bonus abuse. These cookies help identify devices and sessions associated with prohibited conduct.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the Platform. okbaet does not use third-party advertising or retargeting cookies.

As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by okbaet. To exercise any of these rights, contact our Data Protection Officer using the details in Section 14.

• Right to be Informed: The right to know that your personal data is being processed and to receive clear, accessible information about how it is used — which this Policy provides.
• Right of Access: The right to request a copy of the personal data okbaet holds about you, along with information about how it is being processed.
• Right to Rectification: The right to request correction of any personal data that is inaccurate, incomplete, or outdated. You may update many data fields directly within your account settings.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent, or where processing is unlawful — subject to our legal retention obligations under RA 9160 and PAGCOR requirements.
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes at any time. You also have the right to object to processing based on legitimate interests, subject to our ability to demonstrate compelling grounds for continued processing.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe okbaet has violated your data privacy rights. NPC contact information is available at the NPC's official website.

okbaet will respond to data rights requests within thirty (30) calendar days of receipt. In complex cases, this period may be extended by a further thirty (30) days, and you will be notified of the extension and the reason for it. Requests are handled free of charge unless they are manifestly unfounded, repetitive, or excessive.

The okbaet Platform is strictly restricted to persons aged 21 years and above, in line with PAGCOR's requirements for online gaming in the Philippines. okbaet does not knowingly collect, process, or retain personal data of individuals under the age of 21.

During the registration process, okbaet collects date of birth information and applies age verification checks. Where our KYC process identifies that an account holder is below the required age, the account will be immediately closed, all balances forfeited, and any collected data deleted or anonymized to the extent not required to be retained under applicable law.

If you are a parent or guardian and believe that a person under 21 years of age has registered an account on okbaet without authorization, please contact our support team immediately. We will investigate and take appropriate action, including closure of the underage account and deletion of associated personal data, as promptly as possible.

Some of okbaet's service providers and infrastructure partners may be located outside the Philippines. Where personal data is transferred to a country that has not been assessed by the NPC as providing an adequate level of data protection, okbaet ensures that appropriate safeguards are in place, including contractual data transfer agreements that incorporate the NPC's standard contractual clauses or equivalent protections.

Cross-border transfers of okbaet player data are limited to the minimum data necessary for the relevant service (e.g., cloud hosting, fraud screening, KYC verification) and are governed by data processing agreements that impose obligations on the recipient consistent with the requirements of the Philippine Data Privacy Act.

You may request information about the specific safeguards in place for cross-border transfers of your personal data by contacting our Data Protection Officer.

okbaet reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the features and services offered on the Platform. The "Last Updated" date at the top of this Policy will be revised each time a change is made.

Where changes to this Policy are material — for example, a change to the categories of data collected, a new purpose for processing, or a change in the identity of key data processors — okbaet will provide advance notice to registered players via the email address associated with their account and/or via a prominent notice on the Platform at least seven (7) days before the change takes effect.

Your continued use of the Platform after the effective date of any amended Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you must stop using the Platform and may request account closure in accordance with our Terms & Conditions.

okbaet has appointed a Data Protection Officer ("DPO") responsible for overseeing compliance with the Data Privacy Act and this Policy. If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact the DPO using the details below.

• Live Chat: Available directly within the Platform — average response time under 2 minutes, 24/7 Philippine Standard Time.
• Email: [email protected] — please include "Privacy Request" or "DPO Inquiry" in the subject line.
• Response Time: We acknowledge all privacy-related inquiries within forty-eight (48) hours and provide a substantive response within thirty (30) calendar days.

If you are not satisfied with okbaet's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, the supervisory authority responsible for enforcing the Data Privacy Act of 2012. Information about the NPC's complaint procedure is available through the NPC's official government website.