okbat Privacy Policy

1 Introduction

okbat ("okbat," "we," "us," "our") is an online gaming platform operating in the Philippine market and accessible at okbat.asia. okbat is committed to protecting the privacy and personal data of all users of the Platform, including registered players, visitors, and customer support contacts (collectively, "Data Subjects").

This Privacy Policy ("Policy") describes the types of personal information that okbat collects, the purposes for which that information is used, the persons or entities to whom it may be disclosed, the period for which it is retained, and the rights available to Data Subjects under applicable Philippine law.

This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 (the "DPA"), its Implementing Rules and Regulations (the "IRR"), and applicable issuances of the National Privacy Commission (the "NPC"). This Policy is incorporated by reference into the okbat Terms and Conditions, which can be reviewed on the Terms & Conditions page.

2 Data Controller

2.1 For the purposes of the Data Privacy Act of 2012, okbat acts as the Personal Information Controller (PIC) with respect to the personal data collected through the Platform. As a PIC, okbat determines the purposes and means of processing the personal data of its Data Subjects.

2.2 okbat may engage third-party service providers who process personal data on behalf of okbat in their capacity as Personal Information Processors (PIPs). okbat ensures, by contract, that all PIPs processing personal data on its behalf apply data protection standards consistent with this Policy and the DPA.

2.3 Enquiries related to the processing of personal data by okbat, including the exercise of data subject rights, may be directed to the okbat Data Protection Officer (DPO) through the contact channels described in Section 16 of this Policy.

3 Personal Data We Collect

okbat collects the following categories of personal data, depending on how you interact with the Platform:

Records of your communications with okbat, including live chat transcripts, email correspondence, and support ticket history, are retained for quality assurance, dispute resolution, and regulatory compliance purposes.

4 How We Collect Personal Data

okbat collects personal data through the following channels and mechanisms:

• Direct provision by you — data you enter during registration, KYC submission, deposit or withdrawal forms, support communications, or promotional opt-in processes;
• Automated technical collection — data collected automatically when you access or use the Platform, including IP address, device identifiers, session data, and cookie-based tracking as described in Section 8;
• Payment service providers — transaction confirmation and payment method verification data received from GCash, Maya, banks, and card processors when you initiate a financial transaction;
• Identity verification services — data received from third-party KYC and identity document verification providers engaged to confirm the authenticity of identity documents submitted;
• Fraud and AML screening services — data received from third-party compliance screening tools used to detect fraud, verify sanctions status, and fulfill anti-money laundering obligations;
• Regulatory bodies — information received in response to regulatory enquiries, court orders, or law enforcement requests.

5 Purposes of Personal Data Processing

okbat processes your personal data for the following purposes:

• Account creation and management — to register, verify, and maintain your okbat account, including authentication, password management, and account security;
• Identity and age verification (KYC) — to confirm that you are who you say you are, that you meet the 21+ age requirement, and that your account is not being used fraudulently;
• Payment processing — to facilitate deposits, withdrawals, and the crediting or debiting of your okbat wallet balance;
• Responsible gaming compliance — to enforce deposit limits, self-exclusions, and other responsible gaming restrictions elected by you or required by okbat's responsible gaming policies;
• Regulatory compliance and AML — to satisfy legal obligations under PAGCOR regulations, the Anti-Money Laundering Act (AMLA), and the DPA, including record-keeping, transaction monitoring, and regulatory reporting;
• Fraud prevention and platform integrity — to detect and prevent fraud, collusion, cheating, multi-accounting, and other prohibited conduct;
• Customer support — to respond to your enquiries, resolve disputes, and provide assistance with your account, payments, or games;
• Platform improvement — to analyze usage patterns, diagnose technical issues, and develop and test improvements to the Platform's features, games, and interface;
• Marketing communications — to send you promotional offers, bonus notifications, and platform updates, subject to your consent and marketing preferences as described in Section 14;
• Legal proceedings — to establish, exercise, or defend legal claims arising from or related to your use of the Platform.

6 Legal Basis for Processing

Under the Data Privacy Act of 2012, okbat processes personal data on the following legal bases:

• Consent — Processing for marketing communications and non-essential cookies is based on your freely given, informed, and specific consent. You may withdraw consent at any time as described in Sections 8 and 14.
• Performance of a contract — The majority of processing at okbat is necessary for the performance of the player agreement entered into when you register an account. This includes account management, payment processing, and game delivery.
• Legal obligation — Processing for KYC, AML monitoring, regulatory reporting, and responsible gaming record-keeping is required by applicable Philippine law, including the DPA, AMLA, and PAGCOR regulatory requirements.
• Legitimate interests — Processing for fraud prevention, platform security, product analytics, and dispute resolution is carried out on the basis of okbat's legitimate interests in operating a secure and compliant platform, where those interests are not overridden by your data protection rights.

7 Data Sharing and Disclosure

okbat does not sell or rent your personal data. We may share your personal data with the following categories of recipients under the conditions described below:

okbat engages third-party service providers who process personal data on our behalf as Personal Information Processors (PIPs). These include KYC and identity verification providers, payment processors, fraud detection services, cloud hosting providers, email and SMS communication services, and analytics platform providers. All PIPs are contractually bound to process data only on okbat's documented instructions and to maintain security standards no less stringent than those maintained by okbat.

Game and live dealer content on the okbat Platform is delivered by licensed third-party game providers. Certain technical identifiers (such as anonymized session tokens) are shared with game providers to facilitate game delivery and result verification. Game providers do not receive your name, contact details, or payment information.

okbat may disclose personal data to PAGCOR, the AMLC (Anti-Money Laundering Council), the NPC, the NBI, the PNP, or other government bodies where required by law, court order, or lawful regulatory demand. Where permitted by applicable law, okbat will notify you of such disclosures; however, okbat may be legally prohibited from providing such notice in certain circumstances.

In the event of a merger, acquisition, restructuring, or sale of all or substantially all assets of okbat, personal data held by okbat may be transferred to the acquiring or successor entity, subject to that entity honoring the data protection commitments described in this Policy. Players will be notified of any such transfer in advance where practicable.

8 Cookies and Tracking Technologies

8.1 The okbat Platform uses cookies and similar tracking technologies (collectively, "Cookies") to operate the Platform, improve user experience, maintain session security, and analyze usage patterns. A "cookie" is a small data file placed on your device when you visit a website.

• Strictly Necessary Cookies — Essential for the Platform to function. These include session authentication cookies, load-balancing cookies, and security tokens. These cannot be disabled without impairing core Platform functionality.
• Functional Cookies — Remember your preferences (such as game settings, language, and responsible gaming limit elections) to personalize your experience. Disabling these will not prevent access to the Platform but may reduce functionality.
• Analytics Cookies — Used to collect aggregate information about how players use the Platform, including pages visited, session duration, and error reports. This data is used in anonymized or pseudonymized form to improve Platform performance and content.
• Marketing Cookies — Used to deliver promotional content relevant to your interests and to measure the effectiveness of marketing campaigns. These cookies require your prior consent and are only activated where consent has been obtained.

8.3 You may manage your cookie preferences through the okbat cookie consent tool presented on your first visit to the Platform, or through your browser settings. Blocking strictly necessary cookies will impair your ability to use the Platform. Withdrawing consent for marketing cookies will not affect your ability to access the Platform but will prevent okbat from delivering personalized promotional content based on your browsing activity.

9 Data Retention

9.1 okbat retains personal data for as long as necessary to fulfill the purposes described in this Policy, subject to minimum retention periods required by applicable Philippine law.

• Account and transaction records — Retained for a minimum of five (5) years from the date of the last transaction, in accordance with AMLA and PAGCOR record-keeping requirements. Following account closure and expiry of the mandatory retention period, records are securely deleted or anonymized.
• KYC documentation — Retained for a minimum of five (5) years from the date of verification. Where regulatory investigation or legal proceedings are ongoing at the end of this period, retention is extended until final resolution.
• Communications and support records — Retained for three (3) years from the date of the last communication, or until resolution of any related dispute.
• Marketing preferences and consent records — Retained until you withdraw consent and for a period thereafter sufficient to demonstrate compliance.
• Technical and session logs — Typically retained for twelve (12) months for security and fraud detection purposes, after which they are deleted or aggregated anonymously.

9.2 At the end of applicable retention periods, personal data is securely destroyed or anonymized using methods appropriate to the sensitivity of the data and the medium on which it is stored.

10 Data Security

10.1 okbat implements technical, organizational, and physical security measures designed to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption — 256-bit SSL/TLS encryption for all data in transit; encryption at rest for sensitive data fields including passwords, government ID numbers, and financial data;
• Access controls — Role-based access controls limiting employee access to personal data on a strict need-to-know basis; multi-factor authentication for administrative systems;
• Network security — Firewalls, intrusion detection systems, and regular penetration testing of Platform infrastructure;
• Password hashing — Player passwords are stored as cryptographic hashes using industry-standard algorithms; okbat staff cannot read stored passwords;
• Incident response — A documented data breach response procedure, including NPC notification within 72 hours of becoming aware of a personal data breach affecting the rights and freedoms of Data Subjects, as required under the DPA;
• Staff training — Regular data privacy and security training for all employees with access to personal data.

10.2 Notwithstanding these measures, no data transmission over the internet or electronic storage system is completely secure. okbat cannot guarantee the absolute security of your data against all threats. Players are encouraged to use strong, unique passwords and to enable two-factor authentication on their okbat accounts.

11 Cross-Border Data Transfers

11.1 As an online platform, okbat may engage service providers whose systems are hosted in or accessible from countries outside the Philippines. Where personal data is transferred outside the Philippines, okbat ensures that adequate safeguards are in place to protect the data in a manner consistent with the standards of the DPA.

11.2 Such safeguards may include contractual data processing agreements incorporating the NPC's standard data transfer clauses, transfer to jurisdictions whose data protection laws have been assessed as providing adequate protection, or specific consent to the transfer obtained from the Data Subject where required.

11.3 Players who wish to obtain further information about the specific safeguards applied to cross-border transfers of their personal data may contact the okbat DPO at the details provided in Section 16.

12 Minors and Age Restriction

12.1 okbat applies mandatory age verification during the registration process and may conduct enhanced KYC checks to confirm age where there is reason to suspect a player may be under 21 years of age.

12.2 Where okbat identifies or is notified that an Account has been registered or accessed by a minor, the Account will be immediately suspended, any balance returned where ownership can be confirmed, and the data of the minor securely deleted from okbat's systems in accordance with the DPA.

13 Your Data Subject Rights

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, all Filipino players whose personal data is processed by okbat have the following rights:

To exercise any of the rights described above, please contact the okbat Data Protection Officer using the contact details in Section 16. okbat will respond to all data subject requests within thirty (30) days. Complex requests may require an extension of up to an additional thirty (30) days, of which you will be notified.

14 Marketing Communications

14.1 With your consent, okbat may send you promotional communications regarding Platform offers, bonuses, new game launches, and other marketing content via SMS, email, or in-Platform notification.

14.2 You may withdraw your consent to marketing communications at any time by:

• Updating your communication preferences in your okbat account settings;
• Clicking the "unsubscribe" link in any marketing email received from okbat;
• Contacting okbat customer support through the 24/7 live chat or via the email address in Section 16.

14.3 Withdrawal of consent to marketing communications does not affect your ability to continue using the Platform, your account status, or your eligibility for bonuses that do not depend on marketing opt-in. Certain account-critical communications (such as security alerts, OTP messages, and transaction confirmations) are not marketing communications and cannot be disabled through marketing preference settings.

14.4 okbat does not share your contact data with unaffiliated third parties for their own marketing purposes.

15 Updates to This Privacy Policy

15.1 okbat may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal or regulatory requirements, or improvements to Platform services. When material changes are made, okbat will provide notice through the Platform and/or by email to the registered address of existing account holders, with reasonable advance notice before the changes take effect.

15.2 The "Last reviewed" date at the top of this Policy and in the table of contents sidebar indicates when the Policy was last substantively reviewed. Your continued use of the Platform after the effective date of a revision constitutes your acceptance of the updated Policy.

15.3 If you do not accept the revised Policy, you must cease using the Platform and may request account closure in accordance with the process described in the okbat Terms and Conditions.

15.4 This Privacy Policy was last reviewed in January 2026. The version published at okbat.asia/privacy-policy is the current operative version.

16 Contact the DPO & Complaints

For all data privacy enquiries, data subject right requests, or complaints regarding okbat's handling of personal data, please contact the okbat Data Protection Officer through the following channels:

• 24/7 Live Chat — Available on the okbat Platform. For data privacy matters, please identify your request as a "DPO Enquiry" at the start of the chat session.
• Email — support@okbat.asia — Please include "Data Privacy Request" in the subject line. Formal data subject right requests submitted by email will receive a written response within thirty (30) days.

If you are not satisfied with okbat's response to a data privacy complaint, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC), the supervisory authority responsible for the enforcement of the Data Privacy Act of 2012. Information about how to file a complaint with the NPC is available through official Philippine government information channels.