Privacy Policy

Introduction

okplau ("we," "us," "our," or "the Company") is committed to protecting the privacy and personal data of all users ("you," "Player," or "User") of the okplau platform, including the website and mobile application (collectively, the "Platform"). This Privacy Policy ("Policy") describes how okplau collects, uses, stores, shares, and protects personal information in connection with your use of the Platform.

This Policy is drafted in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC). It applies to all personal data processed by okplau in connection with the Platform, regardless of the medium through which such data is collected.

This Policy should be read alongside the okplau Terms & Conditions, which govern your use of the Platform. Capitalized terms not defined in this Policy have the meanings given to them in the Terms & Conditions.

Data Controller

For the purposes of applicable data protection law, okplau is the personal information controller responsible for the personal data collected through the Platform. As the personal information controller, okplau determines the purposes and means of processing your personal data.

If you have any questions about how okplau handles your personal data, or if you wish to exercise any of your data subject rights, you may contact our Data Protection Officer (DPO) using the contact details set out in Section 14 of this Policy.

Personal Data We Collect

okplau collects personal data that is necessary for the operation of the Platform, the provision of gaming services, and compliance with legal and regulatory obligations. The categories of personal data we collect include:

okplau does not collect sensitive personal information beyond what is strictly necessary for identity verification and regulatory compliance. We do not collect biometric data, health information, or political affiliations.

How We Collect Your Data

okplau collects personal data through the following means:

• Direct Collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or submitting feedback through the Platform.
• Automated Collection: Technical and usage data collected automatically when you access and interact with the Platform, including through cookies, log files, and session tracking technologies.
• Payment Processors: Transaction reference data received from payment providers such as GCash, PayMaya, BPI, BDO, and Metrobank when you initiate deposits or withdrawals.
• Identity Verification Services: Data received from third-party KYC and identity verification service providers engaged by okplau to assist with age and identity verification.
• Fraud Prevention Services: Risk signals and device fingerprint data received from fraud detection service providers to protect the integrity of the Platform.

okplau does not purchase personal data from third-party data brokers or marketing lists. All personal data collected by okplau is obtained through the channels described above in connection with your use of the Platform.

Purposes of Processing & Legal Basis

okplau processes your personal data only for specified, legitimate purposes. The following table sets out the primary purposes for which we process personal data and the legal basis for each:

• Account Registration & Management: To create and maintain your okplau account, verify your identity, and manage your account settings. Legal basis: performance of a contract.
• Age & Identity Verification (KYC): To verify that you meet the minimum age requirement of 21 years and to confirm your identity in accordance with regulatory requirements. Legal basis: legal obligation and legitimate interest.
• Payment Processing: To process deposits and withdrawals through your chosen payment method and to maintain accurate financial records. Legal basis: performance of a contract and legal obligation.
• Game Provision: To deliver the games and services available on the Platform, including live dealer games, arcade games, and the Rewards program. Legal basis: performance of a contract.
• Anti-Money Laundering (AML) Compliance: To monitor transactions, detect suspicious activity, and fulfill reporting obligations under Philippine AML regulations. Legal basis: legal obligation.
• Responsible Gaming: To monitor gaming activity for signs of problem gambling and to administer responsible gaming tools including deposit limits and self-exclusion. Legal basis: legitimate interest and legal obligation.
• Customer Support: To respond to your inquiries, resolve disputes, and improve the quality of our support services. Legal basis: performance of a contract and legitimate interest.
• Platform Security & Fraud Prevention: To detect, investigate, and prevent fraudulent activity, unauthorized access, and other security threats to the Platform. Legal basis: legitimate interest and legal obligation.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have provided consent or where permitted by applicable law. Legal basis: consent. You may withdraw consent at any time through your account settings.
• Legal Compliance & Regulatory Reporting: To comply with applicable Philippine laws, regulations, and orders from competent authorities including the National Privacy Commission. Legal basis: legal obligation.

okplau will not process your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your consent or establishing another lawful basis for processing.

Sharing Your Personal Data

okplau does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment Service Providers: GCash, PayMaya, BPI, BDO, Metrobank, and other payment processors engaged to facilitate deposits and withdrawals. These providers receive only the data necessary to process your transaction.
• Identity Verification Providers: Third-party KYC service providers engaged to assist with age verification and identity checks as required by applicable regulations.
• Game Technology Providers: Software providers and platform operators whose games are made available through okplau, including live dealer game providers. These providers may receive session and gameplay data necessary to deliver the game service.
• Fraud Prevention & Security Providers: Third-party services engaged to detect and prevent fraudulent activity, unauthorized access, and abuse of the Platform.
• Regulatory Authorities: Government agencies, law enforcement bodies, and regulatory authorities in the Philippines where disclosure is required by law, court order, or regulatory direction, including the National Privacy Commission and relevant financial intelligence units.
• Professional Advisers: Legal counsel, auditors, and other professional advisers engaged by okplau in connection with the operation of the Platform, subject to professional confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of okplau's business, your personal data may be transferred to the acquiring entity, subject to equivalent data protection commitments.

Data Retention

okplau retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law and regulation. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with AML and regulatory record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, as required under Philippine financial regulations.
• KYC Verification Documents: Retained for the duration of your account and for five (5) years following account closure or the completion of the relevant transaction, whichever is later.
• Customer Support Communications: Retained for three (3) years from the date of the last communication, or longer where the communication relates to an unresolved dispute or legal matter.
• Technical and Usage Data: Retained for up to twelve (12) months from collection, unless required for longer periods for security investigation or legal purposes.
• Marketing Consent Records: Retained for the duration of your consent and for three (3) years following withdrawal of consent, as evidence of the consent given.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with okplau's data disposal procedures. Anonymized data that can no longer be linked to an identifiable individual may be retained indefinitely for analytical purposes.

Data Security

okplau implements a comprehensive set of technical and organizational security measures designed to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption of personal data in transit using industry-standard TLS/SSL protocols.
• Encryption of sensitive data at rest, including financial data and identity documents.
• Access controls limiting personal data access to authorized personnel on a strict need-to-know basis.
• Regular security assessments, vulnerability scanning, and penetration testing of Platform infrastructure.
• Multi-factor authentication requirements for administrative access to systems containing personal data.
• Staff training on data protection obligations and security best practices.
• Incident response procedures for the detection, containment, and notification of personal data breaches.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, okplau will notify the National Privacy Commission and, where required, affected individuals in accordance with the timelines prescribed by the Data Privacy Act of 2012 and its Implementing Rules.

Cookies & Tracking Technologies

okplau uses cookies and similar tracking technologies to operate the Platform, enhance your user experience, and gather analytical data about Platform usage. The following types of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that maintain your login state and security cookies that protect against cross-site request forgery. These cookies cannot be disabled without affecting Platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings and display options, to provide a more personalized experience on the Platform.
• Analytical Cookies: Used to collect aggregated, anonymized data about how users interact with the Platform, including pages visited, session duration, and navigation paths. This data helps okplau improve Platform performance and user experience.
• Security & Fraud Prevention Cookies: Used to detect and prevent fraudulent activity, identify suspicious login patterns, and protect the integrity of the Platform.

You may manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. okplau does not use cookies to serve third-party advertising or to track your activity across unrelated websites.

Your Data Subject Rights

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights with respect to your personal data held by okplau:

• Right to be Informed: The right to be informed of how your personal data is being collected and processed, as set out in this Policy.
• Right of Access: The right to request a copy of the personal data okplau holds about you, along with information about how it is being processed.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data. You may update certain account information directly through your account settings.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to okplau's legal retention obligations.
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interest.
• Right to Data Portability: The right to receive a copy of your personal data in a structured, commonly used, and machine-readable format where technically feasible.
• Right to Withdraw Consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission if you believe your data protection rights have been violated.

To exercise any of the above rights, please contact okplau's Data Protection Officer using the contact details in Section 14. okplau will respond to all data subject requests within fifteen (15) business days of receipt, in accordance with the timelines prescribed by applicable law. We may request proof of identity before processing your request.

Minors & Age Policy

The okplau Platform is strictly intended for individuals who are 21 years of age or older, in accordance with the minimum legal age for participation in casino-style gambling activities in the Philippines. okplau does not knowingly collect personal data from individuals under the age of 21.

As part of the registration process, okplau requires all users to confirm that they meet the minimum age requirement and to submit to identity and age verification. Where okplau discovers or has reasonable grounds to believe that personal data has been collected from a person under 21 years of age, we will take immediate steps to suspend the relevant account and delete the associated personal data, subject to any legal retention obligations.

If you are a parent or guardian and believe that a minor has registered on the okplau Platform, please contact our support team immediately so that we can investigate and take appropriate action.

International Data Transfers

okplau primarily processes personal data within the Philippines. However, some of our third-party service providers — including game technology providers, cloud infrastructure providers, and fraud prevention services — may process personal data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, okplau ensures that appropriate safeguards are in place to protect your data, including:

• Transferring data only to countries or organizations that provide an adequate level of data protection as recognized by the National Privacy Commission.
• Implementing contractual clauses with third-party recipients that require them to protect personal data to standards equivalent to those required under Philippine law.
• Conducting due diligence on third-party recipients to verify their data protection practices prior to any transfer.

By using the okplau Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside the Philippines, subject to the safeguards described above.

Changes to This Privacy Policy

okplau reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. The date of the most recent revision is displayed at the top of this page.

When material changes are made to this Policy, okplau will notify registered users through the Platform or via the email address associated with your account, providing reasonable advance notice before the changes take effect. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgment of the revised Policy.

We encourage you to review this Policy periodically to stay informed about how okplau protects your personal data. If you disagree with any changes to this Policy, you should cease using the Platform and may request account closure in accordance with the Terms & Conditions.

Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by okplau, please contact our Data Protection Officer:

Data Protection Officer – okplau
Email: [email protected]
General Support: [email protected]

okplau will acknowledge receipt of your inquiry within three (3) business days and will endeavor to provide a substantive response within fifteen (15) business days. Complex requests may require additional time, in which case we will notify you of the expected timeline.

If you are not satisfied with okplau's response to your data protection inquiry, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). Information about how to file a complaint with the NPC is available through official Philippine government channels.