okbeat Privacy Policy

1. Introduction & Controller Identity

1.1 okbeat is the personal information controller responsible for your personal data processed through the okbeat Platform. As a PAGCOR-licensed operator, okbeat is subject to the National Privacy Commission's registration and compliance requirements applicable to personal information controllers operating in the Philippines.

1.2 okbeat has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy, the Data Privacy Act, and applicable NPC regulations. Contact details for the DPO are set out in Section 14 of this Policy.

1.3 Where okbeat engages third-party service providers who process personal data on our behalf (such as payment processors, cloud hosting providers, and game content providers), those parties act as personal information processors under written data processing agreements that bind them to the same standards of data protection required of okbeat under Philippine law.

2. Scope of This Policy

2.1 This Policy applies to all personal data collected from or about you in connection with your access to and use of the okbeat Platform, including:

• Registration and account management;
• Identity verification (KYC) and age verification processes;
• Financial transactions, including deposits via GCash, Maya, bank transfer, and other accepted payment channels;
• Gameplay activity on any okbeat Casino game, sports betting market, bingo room, or other wagering product;
• Customer support interactions via live chat, email, or any other support channel;
• Participation in promotions, loyalty programs, and VIP schemes;
• Visits to the okbeat website, including data collected automatically through cookies and similar technologies.

2.2 This Policy applies to all players accessing the Platform from within the Philippines. Players accessing the Platform from outside the Philippines should be aware that their data will still be processed in accordance with Philippine law as the governing jurisdiction of okbeat's operations.

3. Personal Data We Collect

3.1 okbeat collects the following categories of personal data:

3.1.1 Identity and Registration Data

• Full legal name, date of birth, gender;
• Philippine residential address (barangay, city/municipality, province);
• Mobile number (Globe, Smart, DITO, or other Philippine network);
• Email address;
• Government-issued identification: passport number, driver's license number, SSS/UMID number, PhilSys reference number, or other identifiers from acceptable Philippine ID documents;
• Photograph or selfie image submitted for identity confirmation;
• Tax Identification Number (TIN) where required for regulatory reporting.

3.1.2 Financial and Transaction Data

• GCash account number linked to your okbeat wallet;
• Maya or PayMaya account details where used for deposits or withdrawals;
• Bank account details (account name, account number, bank name) for bank transfer transactions;
• Transaction history: all deposits, withdrawals, wagers, wins, and losses recorded under your okbeat account;
• Source of funds documentation submitted in connection with enhanced due diligence (EDD) reviews.

3.1.3 Gameplay and Behavioral Data

• Game session logs, including game type, duration, bet sizes, and outcomes;
• Sports betting selections, odds accepted, and settlement results;
• Responsible gaming tool usage: deposit limit settings, session timers, self-exclusion requests;
• Promotional participation records;
• VIP tier history and loyalty point balances.

3.1.4 Technical and Device Data

• IP address and approximate geographic location derived therefrom;
• Device type, operating system, browser type and version;
• Session timestamps, login and logout records;
• Cookie identifiers and similar tracking technology data as described in Section 7;
• Referral URL or source through which you first accessed the Platform.

3.1.5 Communications Data

• Records of customer support interactions, including chat transcripts and email correspondence;
• Feedback, survey responses, and complaints submitted to okbeat;
• Marketing communication preferences and opt-in/opt-out records.

3.2 okbeat does not collect or process sensitive personal information (as defined under Section 3(l) of the Data Privacy Act) except where strictly necessary for regulatory compliance — specifically, health-related information that may arise in the context of responsible gaming assessments and problem gambling support.

4. Legal Bases for Processing

4.1 okbeat processes your personal data on one or more of the following legal bases under the Data Privacy Act:

Processing Purpose	Legal Basis
Account registration and management	Performance of contract (account agreement)
KYC and age verification	Legal obligation (PAGCOR licensing conditions; RA 9160 AMLA)
Processing deposits and withdrawals	Performance of contract; legal obligation
AML transaction monitoring and reporting	Legal obligation (RA 9160 and amendments; PAGCOR directive)
Fraud detection and security monitoring	Legitimate interest; legal obligation
Responsible gaming monitoring and support	Legal obligation (PAGCOR responsible gaming standards); legitimate interest
Customer support communications	Performance of contract
Promotional and marketing communications	Consent (opt-in required; opt-out available)
Analytics and platform improvement	Legitimate interest (privacy-preserving aggregated analysis)

4.2 Where okbeat relies on your consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. To withdraw consent, contact the okbeat DPO as described in Section 14.

5. How We Use Your Data

5.1 okbeat uses your personal data for the following purposes:

• Account Operations: Creating, maintaining, and closing your okbeat account; authenticating your identity at login; processing password resets and two-factor authentication;
• Regulatory Compliance: Fulfilling PAGCOR licensing conditions, including player registration records, game integrity monitoring, and mandatory reporting; filing Covered Transaction Reports and Suspicious Transaction Reports with the AMLC as required under RA 9160;
• Payment Processing: Facilitating deposits from and withdrawals to your GCash, Maya, GrabPay, or bank account; reconciling wallet balances; processing refunds where applicable;
• Responsible Gaming: Monitoring gameplay patterns for indicators of problem gambling consistent with PAGCOR's responsible gaming program; administering deposit limits, session timers, and self-exclusion requests; maintaining exclusion records to enforce self-exclusion commitments;
• Security and Fraud Prevention: Detecting and investigating unauthorized account access, bonus abuse, collusion, money laundering, and other prohibited conduct; maintaining security logs;
• Customer Support: Responding to inquiries, complaints, and dispute escalations; maintaining records of support interactions for quality assurance;
• Marketing Communications: Sending promotional offers, bonus notifications, and news about new okbeat games or features — but only to Players who have opted in and have not subsequently withdrawn consent;
• Analytics: Understanding how Players use the Platform in aggregate, to improve the user experience, game selection, and technical performance.

6. Disclosure to Third Parties

6.1 okbeat discloses your personal data to the following categories of third parties:

6.1.1 Regulatory and Law Enforcement Bodies

PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Bureau of Internal Revenue (BIR), and any other Philippine government authority where disclosure is required by law, court order, or regulatory directive. Such disclosures are made without prior notice to you where notification would impair the regulatory or enforcement purpose.

6.1.2 Payment Processors

GCash (G-Xchange, Inc.), Maya Philippines, GrabPay, and the Philippine banking institutions (BPI, BDO, Metrobank, and others) through which your deposits and withdrawals are processed. These entities receive only the data strictly necessary to complete your transaction, consistent with their own NPC-registered privacy policies.

6.1.3 Game Content Providers

PAGCOR-certified game providers who supply slot games, live dealer systems, sportsbook engines, and other gaming products to the okbeat Platform. These providers receive anonymized or pseudonymized gameplay data necessary for game integrity monitoring and RNG certification purposes. They do not receive your full identity or financial data unless required for a specific regulatory audit.

6.1.4 Technology and Infrastructure Providers

Cloud hosting providers, content delivery networks, cybersecurity services, and identity verification platforms operating under data processing agreements with okbeat. These providers process data solely on okbeat's documented instructions and are prohibited from using your data for their own purposes.

6.1.5 Professional Advisors

Legal counsel, auditors, and compliance consultants engaged by okbeat, who are bound by professional confidentiality obligations under Philippine law.

6.2 okbeat does not disclose your personal data to any other third party without your prior consent, except as required by applicable law.

7. Cookies & Tracking Technologies

7.1 The okbeat Platform uses cookies and similar technologies to provide core functionality, improve user experience, and support security monitoring. The following categories of cookies are used:

Cookie Category	Purpose	Retention
Strictly Necessary	Session authentication, security tokens, fraud detection, load balancing	Session / up to 24 hours
Functional	Remembering your language preference, game settings, and last-used payment method	Up to 12 months
Analytics	Aggregated, anonymized page traffic and feature usage statistics for platform improvement	Up to 24 months
Marketing	Tracking promotional campaign performance and personalizing bonus offers for opted-in players	Up to 12 months

7.2 Strictly necessary cookies cannot be disabled as they are essential to the Platform's operation. You may manage your preferences for functional, analytics, and marketing cookies through your browser settings or via the cookie preference center in your okbeat account settings.

7.3 Disabling analytics or marketing cookies will not affect your ability to play games, make deposits or withdrawals, or access any other core okbeat service. It may, however, result in less relevant promotional offers being shown to you.

8. Data Retention

8.1 okbeat retains your personal data for the following periods, applying whichever is longest where multiple retention obligations apply:

• Identity and KYC documents: 5 years from your last transaction or account closure, as required by PAGCOR licensing conditions and Section 9 of RA 9160 (AMLA);
• Financial transaction records: 5 years from each transaction date, consistent with AMLC record retention requirements and BIR tax record obligations;
• Gameplay and session logs: 2 years from the date of each session, for game integrity and dispute resolution purposes;
• Self-exclusion records: Retained for the full duration of the exclusion period plus 5 years thereafter, to prevent circumvention of exclusion commitments;
• Customer support records: 2 years from closure of each support ticket;
• Marketing consent records: For the duration of your account plus 2 years after account closure, to demonstrate compliance with consent obligations.

8.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymized such that it can no longer be attributed to an identified or identifiable individual.

8.3 Where a regulatory investigation, legal proceeding, or dispute is ongoing at the expiry of the standard retention period, relevant data will be retained until the matter is finally resolved and any applicable appeal period has lapsed.

9. International Data Transfers

9.1 Some of okbeat's technology infrastructure providers and game content providers operate servers located outside the Philippines. Where your personal data is transferred to a country outside the Philippines, okbeat ensures that appropriate safeguards are in place consistent with Section 21 of the Data Privacy Act, including:

• Standard contractual clauses approved or recognized by the National Privacy Commission;
• Binding corporate rules where applicable;
• The recipient country or organization having an adequate level of data protection as recognized under Philippine law.

9.2 In all cases, international transfers are limited to the minimum data necessary for the specific operational purpose, and recipient processors are contractually prohibited from using the data for any purpose other than the one specified by okbeat.

10. Exercising Your Rights

10.1 To exercise any of the data subject rights described in Section 1 of this Policy and in the summary cards above, you may submit a written request to okbeat's Data Protection Officer using the contact details in Section 14. Your request should include:

• Your full name and registered okbeat account email address or mobile number;
• A clear description of the right you wish to exercise and the specific data it relates to;
• A copy of a valid government-issued identification document for identity verification purposes.

10.2 okbeat will acknowledge your request within five (5) business days and provide a substantive response within fifteen (15) business days. Complex requests may require an extension of up to an additional fifteen (15) business days, in which case you will be notified of the extension and the reason for it.

10.3 Exercising your data subject rights is free of charge. If requests are manifestly unfounded or excessive — particularly if repetitive — okbeat reserves the right to charge a reasonable fee or decline to act on the request, and will explain the basis for doing so.

10.4 If you are not satisfied with okbeat's response to your data subject rights request, you have the right to lodge a complaint directly with the National Privacy Commission of the Philippines.

11. Security Measures

11.1 okbeat implements organizational, technical, and physical security measures appropriate to the nature of the personal data processed and the risks of unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit TLS encryption for all data in transit between your device and okbeat servers;
• Encryption at rest for databases containing personal and financial data;
• Role-based access controls restricting internal access to personal data to authorized personnel only, on a need-to-know basis;
• Multi-factor authentication for all okbeat staff and contractor access to systems containing personal data;
• Regular third-party penetration testing and vulnerability assessment of the Platform and supporting infrastructure;
• Formal personal data breach response procedures consistent with NPC Circular No. 16-03 (Personal Data Breach Management) and its successors;
• Staff training on data privacy obligations under the Data Privacy Act and okbeat's internal data protection policies.

11.2 Despite these measures, no internet-based system can guarantee absolute security. okbeat cannot warrant that unauthorized third parties will never defeat these measures. In the event of a breach, okbeat will comply with its notification obligations under the Data Privacy Act and NPC regulations as described in Section 4 (Data Subject Rights — Right to Be Notified of Breach).

12. Children's Privacy

12.1 The okbeat Platform is strictly prohibited for persons under 21 years of age. okbeat does not knowingly collect personal data from any person under 21. Age verification is a mandatory component of the okbeat registration process, and accounts found to belong to underage individuals are immediately closed consistent with Section 3.3 of the okbeat Terms & Conditions.

12.2 If okbeat becomes aware that personal data has been collected from a person under 21 without verifiable parental or guardian consent, that data will be deleted immediately, and any associated deposits will be returned in full less any bonuses credited, consistent with the okbeat Terms & Conditions and PAGCOR's age restriction requirements.

12.3 If you are a parent or guardian who believes that your child (under 21) has created an okbeat account or provided personal data without your consent, please contact the okbeat DPO immediately using the contact details in Section 14.

13. Changes to This Policy

13.1 okbeat may update this Privacy Policy from time to time to reflect changes in our data processing practices, new regulatory requirements, or improvements to the Platform. Material changes will be communicated to registered Players via Account notification or email at least seven (7) days before the updated Policy takes effect.

13.2 The current version of this Policy, with its effective date, is always available on the okbeat Platform. Players are encouraged to review this Policy periodically to stay informed of how their personal data is being handled.

13.3 Continued use of the okbeat Platform after the effective date of any updated Policy constitutes acceptance of the revised Policy. If you do not accept the changes, you must cease using the Platform and may request Account closure.

14. Contact & DPO Details

14.1 For all data privacy inquiries, data subject rights requests, or complaints relating to okbeat's processing of your personal data, please contact the okbeat Data Protection Officer:

14.2 If you are not satisfied with okbeat's handling of your data privacy concern, you may lodge a complaint with the National Privacy Commission of the Philippines. The NPC accepts complaints through its official website and designated offices in the Philippines. Information about the NPC complaints procedure is publicly available from the National Privacy Commission.

14.3 This Privacy Policy was last updated and is effective as of January 1, 2026. It supersedes all previous versions of the okbeat Privacy Policy. The authoritative version is in English. okbeat is operated under a license granted by the Philippine Amusement and Gaming Corporation (PAGCOR).