okkt Privacy Policy

Introduction

okkt ("we," "us," "our") is committed to protecting the privacy and personal data of every Filipino player who registers and uses the okkt online gaming platform accessible at okkt.app. This Privacy Policy is issued in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, its Implementing Rules and Regulations, and the relevant issuances of the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy applies to all personal data collected through the okkt website, mobile-optimised interface, customer support channels, and any other touchpoint through which you interact with okkt. It governs data collected from registered players, prospective users who browse the platform without registering, and individuals who contact our support team.

By creating an okkt account or continuing to use the platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not register an account or continue using the okkt platform.

Data Controller

For the purposes of the Data Privacy Act of 2012 and its Implementing Rules and Regulations, okkt is the personal information controller in respect of all personal data collected through the okkt platform. okkt operates under a license issued by the Philippine Amusement and Gaming Corporation (PAGCOR) and is subject to the data governance obligations applicable to PAGCOR-licensed operators.

okkt has appointed a Data Protection Officer (DPO) in accordance with the requirements of the NPC. The DPO is responsible for overseeing okkt's compliance with data privacy laws, managing data subject rights requests, and acting as the primary point of contact for the NPC on data protection matters. The DPO can be reached through the contact channels described in Section 16 of this Policy.

Where okkt engages third-party service providers who process personal data on our behalf — such as KYC verification partners, payment processors, and fraud prevention providers — those parties act as personal information processors under binding data processing agreements that require them to handle your data in accordance with this Policy and applicable Philippine law.

Personal Data We Collect

okkt collects the following categories of personal data from users of the platform:

okkt does not collect sensitive personal information (as defined by Section 3(l) of the Data Privacy Act) unless it is strictly necessary for legal compliance purposes — for example, where a government-issued ID incidentally discloses religious affiliation or civil status as part of standard KYC documentation. In such cases, that sensitive information is used solely for identity verification and is not further processed for any other purpose.

How We Collect Your Data

okkt collects personal data through the following means:

• Direct collection: Information you provide when you register an account, complete KYC verification, make deposits or withdrawal requests, contact customer support, or participate in promotions.
• Automated collection: Technical and device data collected automatically when you access the okkt platform, including through cookies, web beacons, log files, and similar tracking technologies as described in Section 8.
• Third-party sources: Identity verification data cross-referenced with government-issued ID databases through our licensed KYC partners; fraud risk signals from our third-party fraud prevention providers; and payment verification data from our payment processor partners including GCash, Maya, BPI, BDO, and Metrobank.
• Publicly available sources: In limited circumstances relating to AML compliance, okkt may cross-reference your name against publicly available sanctions lists, politically exposed persons (PEP) databases, and adverse media sources, as required by the Anti-Money Laundering Act of 2001 (RA 9160) and its amendments.

Legal Basis for Processing

okkt processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to create and manage your account, verify your identity, process transactions, and provide the gaming services you have contracted for when you registered with okkt.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act, Republic Act No. 9160 as amended, the Data Privacy Act itself, and other applicable Philippine legislation. This includes KYC verification, transaction monitoring, suspicious transaction reporting, and regulatory record-keeping.
• Legitimate interests: Processing carried out to protect okkt and its users from fraud, cheating, and abuse of the platform; to maintain the security and integrity of the platform; and to improve our services through analysis of aggregated, anonymised usage data. We only rely on legitimate interests where those interests are not overridden by your data protection rights.
• Consent: For marketing communications by email or SMS — where consent is required and has been obtained from you at the time of registration or through your account marketing preferences settings. You may withdraw this consent at any time as described in Section 14.

How We Use Your Personal Data

okkt uses the personal data we collect for the following purposes:

• Creating, verifying, and managing your okkt player account throughout the lifetime of your registration.
• Conducting mandatory identity and age verification (21+) as required by PAGCOR regulations and Philippine law.
• Processing deposits and withdrawals through your chosen payment method — GCash, Maya, BPI, BDO, Metrobank, 7-Eleven Cliqq, USDT TRC20, or Coins.ph.
• Monitoring account activity for signs of problem gambling and administering responsible gaming tools including deposit limits, session reminders, and self-exclusion.
• Detecting, investigating, and preventing fraud, money laundering, collusion, and other prohibited activities in accordance with our Terms and Conditions and applicable law.
• Resolving disputes and responding to complaints through our internal complaints process and, where applicable, PAGCOR's dispute resolution mechanisms.
• Maintaining accurate records of all gaming transactions as required by PAGCOR and the AMLC for the mandatory retention period.
• Sending you transactional communications relating to your account — deposit confirmations, withdrawal notifications, security alerts, and important service updates.
• Where you have opted in, sending you promotional communications about okkt bonuses, new games, and special offers relevant to Filipino players.
• Improving the okkt platform through analysis of aggregated, anonymised usage patterns — this does not involve processing individually identifiable data for this purpose.
• Complying with requests from PAGCOR, the NPC, the AMLC, or other competent Philippine regulatory or law enforcement authorities.

Sharing Your Personal Data

okkt does not sell, rent, or trade your personal data to third parties for commercial purposes. We share your personal data only in the following circumstances and with the following categories of recipients:

• Payment processors: GCash (G-Xchange, Inc.), Maya (PayMaya Philippines, Inc.), BPI, BDO Unibank, Metrobank, 7-Eleven Cliqq, and cryptocurrency processing partners — for the sole purpose of executing and verifying your deposit and withdrawal transactions.
• KYC and identity verification partners: Licensed third-party providers that cross-reference your submitted identity documents against authoritative identity databases to complete the mandatory PAGCOR KYC verification process.
• Fraud prevention and security providers: Third-party providers that supply risk scoring, device fingerprinting, and transaction monitoring services to protect the integrity of the okkt platform and its users.
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine regulatory and law enforcement bodies where disclosure is required by law, court order, or valid regulatory demand.
• Legal and professional advisers: Lawyers, auditors, and compliance consultants retained by okkt, who are bound by professional confidentiality obligations.
• Business successors: In the event of a merger, acquisition, or sale of the okkt business or its assets, personal data may be transferred to the acquiring entity, subject to the same data protection obligations as set out in this Policy. Affected users will be notified.

All third-party processors engaged by okkt are required to enter into data processing agreements that obligate them to handle your personal data in accordance with the Data Privacy Act of 2012, implement appropriate technical and organisational security measures, and process your data only for the specific purposes for which they have been engaged.

Cookies and Tracking Technologies

okkt uses cookies and similar tracking technologies on the okkt.app platform. Cookies are small text files stored on your device when you visit our website. They enable the platform to recognise your device, maintain your session, and remember your preferences between visits.

okkt uses the following categories of cookies:

• Strictly necessary cookies: These are essential for the platform to function. They enable core features including session management, account authentication, and security features. These cookies cannot be disabled without impairing your ability to use the platform.
• Functional cookies: These remember your preferences — such as your selected language, preferred deposit method, and platform display settings — to provide a more personalised experience.
• Analytical cookies: These collect aggregated, anonymised data about how users navigate the platform, which pages are visited most frequently, and where users encounter errors. This data is used solely to improve platform performance and user experience.
• Security and fraud prevention cookies: These assist our fraud detection systems in identifying suspicious activity, bot traffic, and other security threats to the platform and its users.

okkt does not use third-party advertising cookies or allow external advertising networks to place tracking cookies on the okkt platform. You can manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect your ability to log in and use the platform.

Data Retention

okkt retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the minimum retention periods required by applicable Philippine law and PAGCOR regulations. The following retention periods apply:

• Account data and KYC documents: Retained for a minimum of five (5) years from the date of account closure or the date of your last gaming transaction, whichever is later. This period is mandated by PAGCOR regulations and the Anti-Money Laundering Act.
• Transaction records: All deposit, withdrawal, and gaming transaction records are retained for a minimum of five (5) years from the date of each transaction, in line with AML record-keeping requirements.
• Customer support communications: Retained for three (3) years from the date of each interaction, to support dispute resolution and quality assurance purposes.
• Marketing consent records: Retained for the duration of your account plus three (3) years following account closure, to maintain an auditable record of consent and opt-out history.
• Technical and device logs: Retained for twelve (12) months from the date of collection for fraud prevention and security purposes, after which they are automatically purged.

Upon expiry of the applicable retention period, personal data is securely and irreversibly deleted or anonymised in accordance with okkt's data disposal procedures. Where a legal hold is in place — for example, in connection with ongoing litigation or a regulatory investigation — data subject to that hold will be retained until the hold is lifted, regardless of the standard retention period.

Security Measures

okkt takes the security of your personal data seriously and implements the following technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction:

• Encryption in transit: All data transmitted between your device and the okkt platform is encrypted using TLS 1.2 or higher, providing 256-bit SSL encryption across all platform touchpoints.
• Encryption at rest: Personal data stored in okkt's databases — including KYC documents and financial records — is encrypted at rest using AES-256 encryption.
• Access controls: Strict role-based access controls ensure that only authorised okkt personnel with a legitimate operational need can access personal data. Access is logged and audited regularly.
• Two-factor authentication: okkt offers two-factor authentication (2FA) for player accounts and enforces 2FA for all internal staff accounts with access to personal data systems.
• Regular security audits: okkt conducts periodic third-party penetration testing and security audits of its platform infrastructure. Identified vulnerabilities are remediated in accordance with okkt's vulnerability management policy.
• Staff training: All okkt personnel who handle personal data receive mandatory data privacy and security training upon onboarding and on an annual basis thereafter.
• Incident response: okkt maintains a documented data breach response plan. In the event of a personal data breach that poses a real risk to your rights and freedoms, okkt will notify the NPC within seventy-two (72) hours of becoming aware of the breach, and will notify affected data subjects without undue delay, in accordance with the Data Privacy Act and NPC regulations.

Your Data Subject Rights

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights in relation to the personal data okkt holds about you:

• Right to be Informed: The right to be informed of what personal data okkt collects and processes about you, and the purposes and legal bases for that processing — which this Privacy Policy fulfils.
• Right of Access: The right to request a copy of the personal data okkt holds about you, along with information about how it is being used. okkt will respond to access requests within fifteen (15) business days of receipt.
• Right to Rectification: The right to request correction of any inaccurate or incomplete personal data we hold about you. You may update most of your account information directly through your account dashboard; for data that cannot be self-edited (such as KYC documents), contact our support team.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and there is no other legal basis for continued processing. This right is subject to okkt's legal obligations to retain certain data under PAGCOR regulations and the Anti-Money Laundering Act, which override erasure requests for the mandatory retention periods described in Section 9.
• Right to Object: The right to object to the processing of your personal data based on legitimate interests, or for direct marketing purposes. Where you object to direct marketing, we will cease that processing immediately. For other legitimate-interests processing, we will assess whether our legitimate interests are overridden by your rights.
• Right to Data Portability: The right to receive a copy of the personal data you have provided to okkt in a structured, commonly used, machine-readable format, where processing is based on consent or contractual necessity and is carried out by automated means.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe okkt has violated your rights under the Data Privacy Act. The NPC's contact information is publicly available at privacy.gov.ph.

To exercise any of these rights, please contact okkt through the channels described in Section 16. We will respond to all rights requests within fifteen (15) business days. We may need to verify your identity before processing your request to protect against fraudulent access to other persons' data.

Children and Minors — 21+ Policy

The okkt platform is strictly restricted to persons who are twenty-one (21) years of age or older. This age restriction is mandated by PAGCOR regulations and Philippine law applicable to casino-style gaming and online sports betting. okkt does not knowingly collect or process personal data from any person under the age of 21.

Age verification is enforced through mandatory KYC identity verification, which requires submission of a valid Philippine government-issued photo ID confirming date of birth. Any account found to belong to a person under 21 years of age will be immediately closed, all deposits will be returned to the originating payment method, and the KYC documents submitted will be securely deleted in accordance with our data disposal procedures.

okkt does not direct any marketing or communications at persons under 21, and our promotional materials are designed and targeted exclusively at adults of legal gaming age in the Philippines.

Cross-Border Data Transfers

The okkt platform primarily stores and processes personal data within the Republic of the Philippines. In certain circumstances, personal data may be transferred to or accessed from servers or service providers located outside the Philippines — for example, where our KYC verification technology partner or fraud prevention provider operates data processing infrastructure in another jurisdiction.

In all cases where personal data is transferred outside the Philippines, okkt ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections afforded under the Data Privacy Act of 2012. These safeguards include contractual data transfer clauses approved by the NPC, binding corporate rules, or transfers to countries assessed to provide an adequate level of data protection.

No personal data is transferred to a jurisdiction for the purpose of circumventing your rights under Philippine data privacy law. If you have questions about cross-border data transfers relating to your personal data, please contact our Data Protection Officer through the channels in Section 16.

Marketing Communications

okkt may send you promotional communications by email or SMS about our bonuses, new game releases, sports betting promotions, seasonal offers, and other news relevant to your okkt account — but only where you have given your explicit consent to receive such communications at the time of registration or through your account marketing preferences settings.

You may withdraw your consent to receive marketing communications at any time through any of the following methods:

• Clicking the unsubscribe link included in any marketing email sent by okkt.
• Updating your communication preferences in the notifications section of your okkt account dashboard.
• Contacting our support team via 24/7 live chat and requesting removal from our marketing list.

Withdrawal of marketing consent will be processed within five (5) business days. Withdrawal of consent does not affect the lawfulness of any marketing communications sent prior to the withdrawal. Please note that withdrawal of marketing consent does not affect transactional communications — okkt will continue to send you account-related notifications such as deposit confirmations, withdrawal updates, and security alerts regardless of your marketing preferences, as these are necessary for the operation of your account.

okkt does not share your personal data with third parties for their own direct marketing purposes, and does not engage in unsolicited cold outreach via telephone, SMS, or email to persons who have not registered an okkt account.

Changes to This Privacy Policy

okkt reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable Philippine law or NPC regulations, updates to PAGCOR licensing requirements, changes in the way okkt collects or processes personal data, or improvements to our data protection practices. We will always publish the most current version of this Privacy Policy on the okkt.app website with the effective date clearly stated at the top of the document.

Where a proposed change is material — meaning it significantly affects your rights or the way we use your personal data — okkt will provide advance notice of the change by sending a notification to the email address registered to your account at least fourteen (14) days before the change takes effect. Your continued use of the okkt platform following the effective date of any updated Privacy Policy constitutes your acceptance of the updated terms.

If you do not agree with any material changes to this Privacy Policy, you may close your account by contacting our support team prior to the effective date of the changes. Closing your account does not affect okkt's right to retain your data for the mandatory periods required by PAGCOR regulations and the Anti-Money Laundering Act, as described in Section 9.

We encourage you to review this Privacy Policy periodically so that you remain informed about how okkt protects your personal data. Archived versions of previous Privacy Policies are available upon request from our Data Protection Officer.

Contact Us & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way okkt handles your personal data, you may contact our Data Protection Officer through the following channels:

• 24/7 Live Chat: Available directly through your okkt account dashboard — the fastest way to reach our support and data privacy team for day-to-day queries.
• Email (plain text): [email protected] — for formal data subject rights requests, please include "Data Privacy Request" in the subject line along with your registered account email address and a description of your request.

If you are not satisfied with okkt's response to your data privacy concern, or if you believe that okkt has violated your rights under the Data Privacy Act of 2012, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Philippines. The NPC is the independent government authority responsible for enforcing the Data Privacy Act and protecting the data privacy rights of all Filipinos.

okkt aims to acknowledge all data privacy queries within two (2) business days and to resolve substantive requests within fifteen (15) business days. For complex requests — such as large-scale data access requests or requests requiring coordination with third-party processors — we will inform you if additional time is needed and provide a revised timeline.