okkt Casino Privacy Policy

1. Introduction

This Privacy Policy governs the collection, use, disclosure, storage, and protection of personal information by okkt Casino Philippines ("okkt", "the Company", "we", "us", "our") in connection with the operation of the online gaming platform available at okkt.cam ("the Platform").

okkt is committed to safeguarding the privacy of all individuals whose personal data it processes, including registered players, prospective players, and website visitors. This commitment is grounded in compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations, as enforced by the National Privacy Commission ("NPC") of the Republic of the Philippines.

This Policy applies to all personal data collected through the Platform, its related mobile applications, customer support channels, and any other touchpoints through which okkt interacts with data subjects. By accessing or using the Platform, you confirm that you have read, understood, and agreed to the terms of this Policy.

Where okkt processes personal data in the context of its obligations under the Anti-Money Laundering Act (RA 9160, as amended) or PAGCOR regulatory requirements, such processing may be mandatory and cannot be avoided as a condition of using the Platform.

2. Personal Data We Collect

okkt collects personal data across several categories, depending on how you interact with the Platform. The table below summarises the categories of personal data we collect and their primary purpose at the point of collection.

okkt does not knowingly collect sensitive personal information — such as biometric data, religious beliefs, political affiliations, or health records — except where such collection is expressly required by applicable law (e.g., facial recognition for identity verification where mandated by regulation). Where sensitive personal information must be collected, you will be separately informed and your explicit consent obtained.

3. How We Collect Your Data

okkt collects personal data through the following means:

3.1 Direct Collection

You provide personal data directly to okkt when you: register an account; complete KYC verification; make a deposit or withdrawal; contact customer support via live chat or email; respond to surveys or promotions; or use any interactive feature of the Platform that requires data input.

3.2 Automated Collection

When you visit or use the Platform, okkt automatically collects certain technical and usage data through the use of cookies, server log files, pixel tags, and similar technologies. This includes data about your device, browser, IP address, and interactions with Platform features. For full details, refer to Section 7 (Cookies & Tracking Technologies) of this Policy.

3.3 Third-Party Sources

okkt may receive personal data about you from third-party sources including: payment service providers (e.g., GCash, Maya, BPI) in connection with deposit and withdrawal transactions; identity verification service providers; fraud prevention and AML screening agencies; and, where applicable, data enrichment services used to verify contact information accuracy. All such third-party data sharing is governed by appropriate data processing agreements.

4. How We Use Your Personal Data

okkt processes your personal data for specific, legitimate purposes. We do not process personal data in a manner incompatible with the purposes for which it was collected. The primary purposes for which okkt uses your personal data include:

• Account Management: To create, maintain, and administer your okkt player account, including authentication and account security;
• Service Delivery: To provide access to casino games, sports betting, and other Platform features you have requested;
• Payment Processing: To process deposits and withdrawals through your chosen payment method, and to maintain accurate transaction records;
• Identity Verification: To conduct KYC checks, verify your age (must be 21+), and fulfil our obligations under applicable Philippine gaming regulations and PAGCOR licensing requirements;
• Legal and Regulatory Compliance: To meet obligations under the Data Privacy Act, Anti-Money Laundering Act, PAGCOR regulations, and other applicable laws;
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, money laundering, multiple account abuse, and other prohibited activities;
• Responsible Gaming: To monitor gaming patterns and implement responsible gaming tools, including deposit limits, cooling-off periods, and self-exclusion requests;
• Customer Support: To respond to your inquiries, resolve disputes, and provide technical assistance;
• Marketing Communications: To send you promotional offers, bonus notifications, and personalised content where you have given consent or where a legitimate interest applies — always with a clear opt-out mechanism;
• Platform Improvement: To analyse usage patterns, conduct research, and develop new features to improve the okkt player experience.

5. Legal Basis for Processing

Under the Data Privacy Act of 2012 and its Implementing Rules, okkt relies on the following legal bases for the processing of your personal data:

• Contractual Necessity: Processing required to perform our obligations under the Terms and Conditions you have accepted, including account administration, game access, and payment processing;
• Legal Obligation: Processing necessary to comply with Philippine law, including KYC requirements under PAGCOR regulations, AML obligations under RA 9160, and data breach notification requirements under RA 10173;
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where such interests do not override your fundamental rights and freedoms;
• Consent: Processing for direct marketing, optional personalisation features, and any processing that falls outside the above bases — where you may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Data Sharing & Disclosure

6.1 Service Providers

okkt engages carefully selected third-party service providers who process personal data on our behalf under binding Data Processing Agreements. These include payment processors, identity verification providers, cloud hosting services, cybersecurity vendors, game providers, and customer support software platforms. All such providers are contractually bound to process data only on okkt's documented instructions and to implement appropriate technical and organisational security measures.

6.2 Regulatory and Legal Authorities

okkt may disclose personal data to PAGCOR, the Anti-Money Laundering Council ("AMLC"), the National Privacy Commission ("NPC"), law enforcement agencies, and courts of competent jurisdiction where such disclosure is required by applicable Philippine law, regulation, court order, or lawful authority. Such disclosures are made only to the extent required and with appropriate safeguards where possible.

6.3 No Sale of Personal Data

okkt does not sell, rent, trade, or otherwise transfer your personal information to third parties for commercial purposes. Any data shared with service providers is solely for the purpose of delivering and improving the okkt Platform services.

6.4 Business Transfers

In the event of a merger, acquisition, asset sale, restructuring, or other corporate transaction involving okkt, personal data held by the Company may be transferred to the relevant successor entity. You will be notified of any such transfer and any material changes to data processing practices that result from it.

7. Cookies & Tracking Technologies

The okkt Platform uses cookies and similar tracking technologies to enhance your experience, maintain session state, and gather analytics data. Cookies are small data files stored on your device. Below are the categories of cookies used by okkt:

• Strictly Necessary Cookies: Essential for Platform functionality — these enable login sessions, payment flows, and security features. They cannot be disabled without impairing Platform use;
• Analytics Cookies: Collect anonymised data about how players navigate the Platform, which pages are most visited, and where technical errors occur. Used to improve Platform performance;
• Preference Cookies: Remember your settings and preferences, such as language, timezone, and deposit defaults, so you don't have to reset them on every visit;
• Security Cookies: Support fraud detection and account security features, including device fingerprinting used to identify suspicious login attempts.

8. Data Retention

okkt retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention schedule is as follows:

• Account Data: Retained for the duration of your active account relationship with okkt, plus a minimum of five (5) years following account closure, in accordance with PAGCOR requirements and the Anti-Money Laundering Act;
• KYC and Identity Documents: Retained for a minimum of five (5) years after the conclusion of your business relationship with okkt, or longer if required by AMLC regulations;
• Transaction Records: Retained for a minimum of five (5) years, consistent with Philippine financial record-keeping obligations;
• Support Communications: Retained for up to three (3) years for quality assurance and dispute resolution purposes;
• Marketing Preferences: Retained until you withdraw consent or request deletion, subject to legal holds.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with okkt's data lifecycle management procedures.

9. Your Data Subject Rights

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by okkt. To exercise any of these rights, contact our Data Protection Officer as detailed in Section 14.

10. Security Measures

okkt implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include, but are not limited to:

• AES-256 encryption for all data in transit (TLS 1.3) and data at rest;
• SMS-based and authenticator app two-factor authentication ("2FA") for player accounts;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Regular penetration testing and vulnerability assessments by independent cybersecurity specialists;
• ISO 27001-aligned information security management practices;
• Automated anomaly detection and real-time alerting for suspicious login attempts and unusual account activity;
• Incident response procedures aligned with NPC breach notification requirements under RA 10173.

Notwithstanding the above, no method of transmission over the internet or electronic storage is one hundred percent secure. While okkt uses commercially reasonable measures to protect your data, we cannot guarantee absolute security. You are encouraged to use a strong, unique password for your okkt account and to enable 2FA where available.

11. Minors and Age Restriction

The okkt Platform is strictly restricted to individuals who are at least twenty-one (21) years of age in compliance with applicable Philippine gaming regulations. okkt does not knowingly collect or process personal data from individuals under 21 years of age.

Where okkt discovers that personal data has been collected from an individual who is under the applicable age threshold, we will promptly close the associated account, delete the personal data in question, and return any deposits made using that account in accordance with applicable regulations. If you are a parent or guardian and believe your child may have provided personal data to okkt, please contact our Data Protection Officer immediately using the contact details in Section 14.

12. Cross-Border Data Transfers

Some of the service providers engaged by okkt may be located in jurisdictions outside the Republic of the Philippines, including but not limited to data centre facilities, cloud hosting providers, and certain game providers. Where personal data is transferred outside the Philippines, okkt ensures that such transfers are made in compliance with Section 21 of the Data Privacy Act and NPC regulations on cross-border data transfers.

Specifically, okkt implements appropriate safeguards for cross-border transfers, which may include: binding contractual clauses approved by the NPC; adequacy determinations recognising the recipient country's data protection standards as comparable to Philippine law; or other lawful transfer mechanisms. Details of the safeguards applicable to specific transfers are available from the DPO upon request.

13. Changes to This Privacy Policy

okkt reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, regulatory requirements, or Platform features. The effective date at the top of this Policy will be updated to reflect the date of the most recent revision.

Where changes to this Policy are material — meaning they significantly affect your rights or the manner in which okkt processes your personal data — we will provide advance notice via the email address or mobile number associated with your account, or by displaying a prominent notice on the Platform, no less than fourteen (14) days prior to the changes taking effect. Your continued use of the Platform following the effective date of the revised Policy constitutes your acceptance of the updated terms.

14. Contact Our Data Protection Officer

okkt has appointed a dedicated Data Protection Officer ("DPO") responsible for overseeing compliance with this Policy and applicable data privacy laws. If you wish to exercise any of your data subject rights, have questions about this Policy, or wish to raise a privacy concern, you may contact the DPO through the following channels:

• Live Chat: Available 24/7 through the okkt Platform — mark your query as "Data Privacy / DPO Request" for prioritised routing
• Email (plain text — not a link): [email protected] — Subject line: "Data Privacy Request"
• Response Time: okkt will acknowledge all DPO requests within two (2) working days and provide a substantive response within fifteen (15) working days, consistent with NPC guidelines