1
About This Policy
This Privacy Policy ("Policy") describes how okeyplay ("okeyplay," "we," "us," or "our") — the operator of the online gaming platform accessible at okeyplay.club — collects, uses, stores, shares, and protects the personal information of players and visitors ("you," "your," or "data subject") in connection with the use of our platform and services.
This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR), as overseen by the National Privacy Commission (NPC) of the Philippines. Where applicable, this Policy also reflects obligations under PAGCOR's licensing framework and the Anti-Money Laundering Act (RA 9160) as it relates to the collection and retention of personal information.
Scope: This Policy applies to all personal data collected through the okeyplay website, mobile-browser interface, customer support channels, and any other service operated under the okeyplay brand. By using okeyplay and creating an account, you acknowledge that you have read and understood this Policy.
This Policy should be read together with the okeyplay Terms & Conditions and Responsible Gaming Policy, both of which are available on the okeyplay platform.
2
Data Controller
For the purposes of the Data Privacy Act of 2012 and this Policy, okeyplay acts as the Personal Information Controller (PIC) in respect of the personal data it collects and processes in connection with its platform and services.
okeyplay has appointed a Data Protection Officer (DPO) responsible for overseeing the okeyplay data protection programme and serving as the point of contact for data subject rights requests and privacy-related concerns. Contact details for the DPO are set out in Section 14 of this Policy.
Where okeyplay engages third-party service providers — such as payment processors, identity verification services, or game providers — those parties may act as Personal Information Processors (PIPs) and process personal data only on okeyplay's documented instructions and under contractual arrangements that meet RA 10173 requirements.
3
Personal Data We Collect
3.1 Registration Data
When you create an okeyplay account, we collect:
- Full legal name
- Date of birth (to verify the 21+ age requirement)
- Philippine mobile number (+63 format)
- Password (stored in hashed form — never in plain text)
- Preferred language and region (Philippines)
3.2 Identity Verification (KYC) Data
To comply with PAGCOR licensing obligations and Republic Act No. 9160 (Anti-Money Laundering Act), okeyplay may collect:
- Government-issued photo identification (PhilSys ID, passport, driver's license, SSS/GSIS/PRC/voter's ID)
- Proof of address (if required for enhanced due diligence)
- Source of funds declaration for transactions exceeding applicable thresholds
- Selfie or liveness verification images for identity confirmation
3.3 Financial & Transaction Data
In connection with deposits and withdrawals via GCash, PayMaya, BPI, BDO, or Metrobank, okeyplay collects:
- Partial payment identifiers (e.g., last four digits of a mobile number registered to a GCash account)
- Transaction amounts and timestamps in Philippine Peso (PHP)
- Deposit and withdrawal history
Payment Security Note: okeyplay does not store full GCash wallet credentials, PayMaya account credentials, or complete bank account numbers. All payment transactions are processed through secure, PCI-compliant third-party payment gateways.
3.4 Gameplay & Activity Data
okeyplay automatically collects data about your activity on the platform:
- Game session logs (game name, duration, bet amounts, outcomes)
- Sports betting transaction records
- Login timestamps and device identifiers
- IP address and approximate geographic location
- Browser or device type, operating system, screen resolution
3.5 Communications Data
When you contact okeyplay's customer support team, we retain records of the communication, including live chat transcripts, the nature of the enquiry, and any resolutions provided. This data is used for quality assurance, dispute resolution, and service improvement purposes.
3.6 Marketing Preferences
Where you have opted in to marketing communications, okeyplay records your consent and the channel preferences you have selected (SMS, in-app notifications). We do not send marketing communications to players who have not consented or who have subsequently withdrawn their consent.
4
How We Use Your Personal Data
okeyplay uses personal data collected from players and visitors for the following purposes:
| Purpose |
Data Used |
Basis |
| Account creation & management |
Registration data, mobile number |
Contract performance |
| Age & identity verification |
KYC documents, date of birth |
Legal obligation |
| Payment processing |
Transaction data, payment identifiers |
Contract performance |
| AML / fraud prevention |
Transaction patterns, KYC data, IP address |
Legal obligation |
| Gameplay & dispute resolution |
Game session logs, bet records |
Contract performance / Legitimate interest |
| Responsible gaming monitoring |
Activity data, self-exclusion records |
Legal obligation / Legitimate interest |
| Customer support |
Communications data, account data |
Contract performance |
| Marketing & promotions |
Contact data, marketing preferences |
Consent |
| Platform security & analytics |
Device data, IP, session logs |
Legitimate interest |
| Regulatory reporting |
KYC data, transaction records |
Legal obligation |
5
Legal Basis for Processing
Under the Data Privacy Act of 2012, okeyplay processes your personal data on one or more of the following lawful bases:
- Contractual necessity: Processing required to enter into or perform our contract with you, including operating your account, processing deposits and withdrawals via GCash or PayMaya, and providing access to games.
- Legal obligation: Processing required to comply with applicable Philippine law, including RA 9160 (AMLA), PAGCOR licensing conditions, the National Internal Revenue Code, and any other applicable regulation.
- Legitimate interests: Processing necessary for okeyplay's legitimate business interests — such as fraud detection, platform security, dispute resolution, and responsible gaming monitoring — where those interests are not overridden by your rights and interests.
- Consent: Processing based on your freely given, specific, informed, and unambiguous consent — principally for marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
6
Sharing Your Personal Data
6.1 Third-Party Service Providers
okeyplay shares personal data with trusted third-party service providers who process data on our behalf as Personal Information Processors. These include:
- Payment processors: GCash (GXI), PayMaya (Voyager Innovations), BancNet, and banking partners for the processing of PHP deposits and withdrawals
- Identity verification providers: KYC and document verification services operating under confidentiality obligations and RA 10173-compliant data processing agreements
- Game content providers: JILI Games, Pragmatic Play, PG Soft, and other providers receive anonymised session tokens to facilitate gameplay — they do not receive your full personal profile
- Customer support infrastructure: Live chat and helpdesk software providers bound by data processing agreements restricting use of data to support delivery only
- Analytics and security: Platform analytics and fraud detection providers operating under strict confidentiality and limited data access controls
6.2 Legal and Regulatory Disclosure
okeyplay may disclose personal data to competent Philippine authorities — including PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), the National Privacy Commission (NPC), or law enforcement agencies — where required by law, court order, or regulatory direction. Such disclosures are made only to the extent required and are not within okeyplay's discretion to withhold.
6.3 No Sale of Personal Data
okeyplay does not sell, rent, license, or otherwise transfer your personal data to third parties for their own commercial purposes. Any data sharing described in this Policy is solely for the purposes of delivering and improving our services to you, or complying with our legal obligations.
Business Transfers: In the event of a merger, acquisition, or sale of okeyplay's business or assets, personal data may be transferred to the acquiring entity. Players will be notified of any such transfer and of any material changes to this Privacy Policy that result from the transaction.
7
Cookies & Tracking Technologies
The okeyplay platform uses cookies and similar tracking technologies to deliver its services, maintain your login session, personalise your experience, and analyse platform usage. A cookie is a small text file placed on your device by a web server.
7.1 Types of Cookies Used
- Strictly necessary cookies: Required for the okeyplay platform to function — including authentication, session management, and security. These cannot be disabled without impairing platform functionality.
- Functional cookies: Remember your preferences, such as language settings and whether you have accepted the cookie notice. These enhance your experience but are not essential.
- Analytics cookies: Collect aggregated, anonymised data about how players interact with the okeyplay platform — page views, session duration, game category navigation. This data helps us improve the platform.
- Security cookies: Used to detect and prevent fraudulent login attempts, suspicious activity, and automated bot access.
7.2 Managing Cookies
You may control non-essential cookies through your browser settings or the okeyplay cookie preference centre, accessible from the platform's cookie notice banner. Note that disabling strictly necessary cookies may prevent you from accessing certain parts of the okeyplay platform, including the okeyplay login and game lobby.
Philippine Mobile Users: If you access okeyplay through a mobile browser on Android or iOS, cookie settings are managed within your browser application (Chrome, Safari). Clearing your browser data will also clear stored cookies, which may affect your saved login preferences on okeyplay.
8
Data Retention
okeyplay retains personal data for no longer than is necessary for the purposes for which it was collected, subject to the following minimum retention periods imposed by Philippine law and licensing obligations:
| Data Category |
Retention Period |
Basis |
| Account registration data |
Duration of account + 5 years post-closure |
PAGCOR / AMLA |
| KYC / identity documents |
Duration of account + 5 years post-closure |
RA 9160 (AMLA) |
| Transaction records |
5 years from transaction date |
AMLA / BIR |
| Game session logs |
2 years |
Dispute resolution / PAGCOR |
| Customer support records |
3 years |
Legitimate interest |
| Self-exclusion records |
Duration of exclusion + 5 years |
Responsible gaming obligation |
| Marketing consent records |
Until withdrawal of consent + 3 years |
NPC guidelines |
Once the applicable retention period expires and no legal obligation requires further retention, okeyplay will securely delete or anonymise the personal data in accordance with its data lifecycle management procedures.
9
Data Security
okeyplay implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:
- Transport Layer Security (TLS/SSL): All data transmitted between your device and the okeyplay platform is encrypted using industry-standard TLS protocols. This applies to the okeyplay login process, gameplay, and payment transactions.
- Password hashing: Passwords are never stored in plain text. okeyplay uses cryptographic hashing with salt to store password credentials securely.
- Access controls: Access to personal data within okeyplay's systems is restricted on a role-based, need-to-know basis. Administrative access is logged and audited.
- Two-factor authentication: okeyplay supports 2FA for player accounts and mandates multi-factor authentication for staff access to systems containing personal data.
- Penetration testing and vulnerability management: okeyplay conducts regular security assessments of its platform and infrastructure to identify and remediate vulnerabilities.
- Data breach response: In the event of a personal data breach that is likely to result in risk to affected individuals, okeyplay will notify the National Privacy Commission within 72 hours of becoming aware of the breach and will communicate directly with affected players as required by RA 10173.
Your Role in Security: The security of your okeyplay account also depends on you. Please use a strong, unique password, enable two-factor authentication, and never share your login credentials or OTP codes with anyone — including anyone claiming to represent okeyplay support. Our agents will never ask for your password.
10
Your Rights Under RA 10173
As a data subject under the Data Privacy Act of 2012, you have the following rights in respect of personal data held by okeyplay. You may exercise any of these rights by contacting our Data Protection Officer as described in Section 14:
Right to Access
Obtain confirmation of whether okeyplay processes your personal data and receive a copy of that data, along with information about how it is used.
Right to Correction
Request correction of inaccurate, incomplete, or outdated personal data held by okeyplay. Account-level corrections can often be made through your account settings.
Right to Erasure
Request deletion of personal data that is no longer necessary for the purposes for which it was collected, subject to okeyplay's legal retention obligations under AMLA and PAGCOR requirements.
Right to Object
Object to okeyplay's processing of your personal data where that processing is based on legitimate interests. Processing for legal obligations cannot be objected to under RA 10173.
Right to Data Portability
Receive a copy of personal data you have provided to okeyplay in a structured, commonly used, machine-readable format, where technically feasible and applicable under RA 10173.
Right to be Informed
Be informed before your personal data is entered into a processing system, including the purpose of collection, scope, method of processing, and identity of the Personal Information Controller.
How to Exercise Your Rights: Submit your data subject rights request to the okeyplay Data Protection Officer via the live chat support channel at okeyplay.club, or by email at
[email protected] with the subject line "Data Subject Rights Request." okeyplay will respond within 30 calendar days of receiving a valid, verified request.
If you believe okeyplay has not adequately addressed your data privacy concern, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines at privacy.gov.ph.
11
Children's Privacy
The okeyplay platform is strictly intended for adults who are 21 years of age or older. okeyplay does not knowingly collect personal data from individuals under 21 years of age. The 21+ age limit reflects PAGCOR's minimum age requirement for online gambling participation in the Philippines.
During registration, okeyplay collects date of birth and reserves the right to request age-verifying documentation at any time. Where okeyplay determines that personal data has been collected from an individual under the minimum age, that data will be promptly deleted and the account will be closed. Any funds associated with an underage account will be returned via the original payment method after identity confirmation.
If you have reason to believe that a minor has created an okeyplay account, please notify our support team immediately via live chat at okeyplay.club.
12
Cross-Border Data Transfers
okeyplay's primary data infrastructure is located within or accessible to the Philippines. However, certain service providers — including game content providers, analytics platforms, and support software vendors — may process personal data in other countries or territories.
Where personal data is transferred outside of the Philippines, okeyplay ensures that such transfers are conducted in compliance with RA 10173, including by:
- Entering into data processing agreements with recipient parties that impose RA 10173-equivalent data protection obligations;
- Ensuring recipient parties implement appropriate technical and organisational security measures; and
- Limiting the scope of data transferred to what is strictly necessary for the purpose of the transfer.
By using the okeyplay platform, you acknowledge and consent to the transfer of your personal data to third-party processors in other jurisdictions where necessary for service delivery, subject to the protections described above.
13
Changes to This Privacy Policy
okeyplay reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, okeyplay will:
- Post the revised Policy on okeyplay.club with an updated "Last Updated" date;
- Notify registered players via their registered Philippine mobile number or through a prominent notice on the platform at least 7 calendar days before the changes take effect; and
- Where required by RA 10173, seek fresh consent for any new processing activities that require it.
Your continued use of the okeyplay platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with a material change, you may close your account by contacting our support team before the effective date.
14
Contact & Data Protection Officer
For questions, concerns, or requests relating to this Privacy Policy or okeyplay's data processing practices, you may contact the okeyplay Data Protection Officer through the following channels:
Data Protection Officer
Platform: okeyplay.club — Live chat (available 24/7, English and Filipino)
Email:
[email protected] — Subject line: "Privacy Enquiry" or "Data Subject Rights Request"
Response time: Within 30 calendar days for formal data subject rights requests; within 24 hours for general privacy enquiries via live chat.
For matters relating to personal data breaches or NPC filings, the okeyplay DPO is the designated point of contact with the National Privacy Commission of the Philippines.
okeyplay's general player support is also available 24/7 via live chat at okeyplay.club in both English and Filipino for account-level queries including marketing opt-out requests, cookie preference changes, and account closure.