okadaph Privacy Policy

This Privacy Policy applies to all personal information collected, processed, and stored by okadaph in connection with your use of the okadaph website at https://okadaph.win, any related mobile applications, and associated sub-domains (collectively, the "Platform").

okadaph is the Personal Information Controller ("PIC") in respect of all personal data collected through the Platform, as defined under Section 3(h) of the Philippine Data Privacy Act of 2012. As PIC, okadaph determines the purposes and means of processing your personal information and is responsible for ensuring that such processing is conducted lawfully and in accordance with this Privacy Policy.

This Policy should be read together with the okadaph Terms & Conditions, which are incorporated herein by reference. In the event of any inconsistency between this Privacy Policy and the Terms & Conditions on a privacy-specific matter, this Privacy Policy shall prevail.

okadaph collects personal information that you provide directly, information generated through your use of the Platform, and in certain circumstances, information obtained from third parties. The categories of personal data collected are set out below.

2.1 Information You Provide Directly

• Registration data: Full name, date of birth (to verify you are 21 or older), Philippine mobile number, username, and password hash.
• KYC / identity verification data: Government-issued Philippine identification document (e.g., UMID, PhilSys ID, passport, driver's licence), including the document number, expiry date, and photograph where required.
• Financial data: GCash number, PayMaya (Maya) account, BPI/BDO/Metrobank account details used for deposits and withdrawals — collected and stored for payment processing and anti-money laundering compliance purposes.
• Support communications: The content of messages, queries, and complaints you submit via live chat, email, or other support channels.

2.2 Information Generated by Your Use of the Platform

• Transaction data: Deposit and withdrawal records, bet history, game session records, bonus usage, and Account balance history.
• Device and technical data: IP address, browser type and version, operating system, device identifier, screen resolution, and mobile network provider.
• Usage and behavioural data: Pages viewed, features accessed, game titles played, session duration, and navigation paths within the Platform.
• Login and security data: Login timestamps, login location (derived from IP address), failed login attempts, and OTP verification records.

2.3 Information from Third Parties

• Payment processors: Transaction confirmation and status information from GCash, PayMaya, BPI, BDO, and Metrobank.
• KYC verification providers: Identity verification results from third-party document verification services used to process KYC submissions.
• Fraud prevention services: Risk scores and flags from fraud detection and anti-money laundering screening providers.

okadaph uses the personal data described in Section 2 for the following purposes:

Where okadaph processes personal data on the basis of your consent, you have the right to withdraw that consent at any time by contacting support or updating your Account preferences. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Under the Philippine Data Privacy Act, okadaph processes your personal data on the following legal grounds:

• Consent (Section 12(a) DPA): Where you have given clear and specific consent to the processing of your personal data for a defined purpose, such as receiving marketing communications. Consent is collected at the time of registration and can be withdrawn at any time.
• Contract Performance (Section 12(b) DPA): Processing necessary for the fulfilment of your agreement with okadaph — including account management, game provision, and payment processing.
• Legal Obligation (Section 12(c) DPA): Processing required for okadaph to comply with applicable Philippine law, including the Anti-Money Laundering Act (AMLA), PAGCOR regulatory requirements, and the Data Privacy Act itself.
• Legitimate Interest (Section 12(f) DPA): Processing necessary for the legitimate interests of okadaph or a third party, where those interests are not overridden by your rights and freedoms — including fraud prevention, platform security, and analytics.

okadaph does not sell, rent, or trade your personal data to any third party. We share personal data only in the circumstances described below, and only to the extent strictly necessary for the stated purpose.

5.1 Service Providers (Personal Information Processors)

okadaph engages third-party service providers who process personal data on our behalf and under our instruction, acting as Personal Information Processors (PIP) under the DPA. These include:

• Payment processors (GCash, PayMaya/Maya, BPI, BDO, Metrobank) — for deposit and withdrawal processing;
• Identity verification and KYC service providers;
• Fraud detection and anti-money laundering screening services;
• Cloud infrastructure and data storage providers operating in the Philippines or under equivalent data protection standards;
• Customer support platform providers;
• Analytics and platform monitoring tools (processing anonymised or pseudonymised data only).

All third-party processors engaged by okadaph are contractually bound to process personal data solely on okadaph's instructions, to maintain appropriate security measures, and to comply with the Philippine Data Privacy Act.

5.2 Regulatory and Law Enforcement Disclosure

okadaph may disclose personal data to government agencies, regulatory authorities, or law enforcement bodies where required or permitted by law, including but not limited to: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and the Bureau of Internal Revenue (BIR).

5.3 Game Providers

Game providers (such as JILI, Pragmatic Play, Evolution Gaming, and others represented on the Platform) may receive anonymised technical data necessary for the delivery of their games and the resolution of game disputes. Game providers do not receive personally identifiable information beyond what is technically required for game delivery and fair-play audit purposes.

okadaph retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following retention periods:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification, unless a longer retention period is required by applicable law or is necessary for the establishment, exercise, or defence of legal claims.

The okadaph Platform uses cookies and similar technologies to support Platform functionality, security, and performance monitoring. A cookie is a small text file placed on your device when you visit the Platform.

7.1 Types of Cookies Used by okadaph

• Strictly Necessary Cookies: Essential for the operation of the Platform — including session management, login authentication, and security functions. These cookies cannot be disabled without affecting Platform functionality.
• Functional Cookies: Used to remember your preferences and settings (e.g., preferred language, game lobby layout) to enhance your experience across sessions.
• Analytical Cookies: Used to collect aggregated, anonymised data about how visitors use the Platform — including pages visited, session duration, and feature usage — to help okadaph improve the Platform's performance and design.
• Security Cookies: Used to detect and prevent fraudulent activity, including cross-site request forgery (CSRF) protection and suspicious session detection.

7.2 Managing Cookies

You may control the use of non-essential cookies through your browser settings. Most modern browsers allow you to block, delete, or be notified when cookies are set. Please note that disabling cookies may affect the functionality and security of the okadaph Platform. Detailed instructions for managing cookies are available in the help documentation of your browser.

okadaph does not use cookies or similar technologies for cross-site behavioural advertising or to share browsing data with advertising networks.

okadaph implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and okadaph's servers is encrypted using 256-bit SSL encryption.
• Data-at-rest encryption: Personal data stored in okadaph's databases is encrypted using AES-256 encryption.
• Access controls: Access to personal data is restricted to okadaph personnel and authorised third-party processors who require access to perform their designated functions, subject to role-based access controls and audit logging.
• Two-factor authentication: Available on all Player Accounts and mandatory for administrative access to data systems.
• Intrusion detection and monitoring: Continuous monitoring of systems for suspicious access patterns, with automated alerting and response protocols.
• Regular security assessments: Periodic vulnerability assessments and security reviews of data processing systems.

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by okadaph. To exercise any of these rights, please contact our Data Protection Officer at [email protected]. okadaph will acknowledge your request within five (5) business days and respond substantively within fifteen (15) business days, or within the period prescribed by the NPC for complex requests.

• Right to be informed: The right to be informed whether okadaph holds personal data about you and, if so, to receive a description of the data held, the purposes for processing, and information about disclosures made to third parties.
• Right of access: The right to obtain a copy of your personal data held by okadaph in a commonly used electronic format.
• Right to rectification: The right to have inaccurate or incomplete personal data corrected or completed. You may update certain data directly through your Account settings.
• Right to erasure (right to be forgotten): The right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where consent has been withdrawn, or where processing is unlawful — subject to okadaph's legal obligation to retain certain data.
• Right to object: The right to object to the processing of your personal data on grounds of legitimate interest, including profiling, or to object to processing for direct marketing purposes.
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe okadaph has violated your data privacy rights. The NPC is contactable at www.privacy.gov.ph.

okadaph will not charge a fee for reasonable requests to exercise the above rights. Where requests are manifestly unfounded or excessive, okadaph may charge a reasonable administrative fee or decline to act on the request, with written reasons provided.

The okadaph Platform and all associated services are strictly intended for individuals who are twenty-one (21) years of age or older. okadaph does not knowingly collect personal data from any individual under the age of 21.

Parents and guardians who believe their child under the age of 21 may have registered on the okadaph Platform should contact our support team immediately via live chat or at [email protected]. We will investigate and act promptly upon any such report.

okadaph's primary data processing operations are conducted within the Philippines. Where okadaph engages third-party service providers whose data processing infrastructure is located outside the Philippines — such as cloud hosting providers or game providers with international operations — such transfers are conducted only where:

• The recipient country has been assessed to provide an adequate level of data protection, substantially equivalent to the standards under the Philippine Data Privacy Act; or
• Appropriate contractual safeguards have been implemented, including data processing agreements that impose DPA-equivalent obligations on the recipient; or
• The transfer is necessary for the performance of your agreement with okadaph (such as delivering a game from a provider's international servers).

Where personal data is transferred outside the Philippines, okadaph ensures that all such transfers are conducted in accordance with the Data Privacy Act and the regulations and guidelines issued by the National Privacy Commission.

The okadaph Platform may contain links to third-party websites or services (such as game provider studios or payment gateways). This Privacy Policy applies solely to the okadaph Platform and does not govern the data practices of any third-party website or service that you may access through the Platform.

okadaph has no control over, and accepts no responsibility for, the privacy practices or content of any third-party website. We recommend that you review the privacy policy of any third-party site before providing your personal information to that site.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, okadaph will:

• Notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, as required under the Data Privacy Act and NPC Circular No. 16-03;
• Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and interests;
• Document all personal data breaches, including the facts relating to the breach, its effects, and the remedial actions taken;
• Implement immediate containment and remediation measures to prevent further unauthorised access or disclosure.

Breach notification communications to affected okadaph players will be delivered via the mobile number or email address registered on their Account. okadaph will provide clear, plain-language information about the nature of the breach, the data affected, the likely consequences, and the steps being taken to address it.

okadaph reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. The "Last Updated" date at the top of this document reflects the date of the most recent revision.

Where changes to this Privacy Policy are material, okadaph will provide reasonable advance notice to Players through an in-Platform notification, or by communication to the contact details registered on your Account. Your continued use of the Platform after the publication of any amendment constitutes your acknowledgment of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically. If you do not agree to any amendment, you should cease using the Platform and may request Account closure by contacting our support team.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by okadaph, please contact us through the following channels:

• Data Protection Officer (DPO) Contact: [email protected] — please include "Privacy / DPO Request" in the subject line of your communication.
• Live Chat: Available 24 hours a day, 7 days a week, directly on the okadaph Platform. Live chat is the fastest channel for account-related privacy queries.

okadaph has designated a Data Protection Officer (DPO) in compliance with Section 21 of the Data Privacy Act and NPC Circular No. 17-01. The DPO is responsible for overseeing okadaph's data privacy compliance programme and serves as the primary point of contact for data subjects and the National Privacy Commission.