oke8 Privacy Policy

1 Introduction

This Privacy Policy (hereinafter "Policy") describes how oke8 (hereinafter "oke8", "we", "us", or "our"), operator of the online gaming platform accessible at oke8.app, collects, uses, stores, discloses, and protects the personal information of individuals (hereinafter "you", "your", or "Data Subject") who register for, access, or use the oke8 platform and its associated services.

oke8 is committed to conducting all personal data processing activities in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), and all applicable issuances and circulars of the National Privacy Commission (NPC) of the Philippines.

By registering an account with oke8 or using any part of the oke8 platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any provision of this Policy, you must cease use of the platform immediately.

2 Data Controller Information

oke8 acts as the Personal Information Controller (PIC) as defined under Section 3(h) of the Philippine Data Privacy Act of 2012. As PIC, oke8 determines the purposes and means by which your personal data is processed.

oke8 has designated a Data Protection Officer (DPO) in accordance with Section 21 of RA 10173. The DPO oversees oke8's data protection compliance program, serves as the primary point of contact for data subject rights requests, and liaises with the National Privacy Commission.

All data protection and privacy inquiries, data subject rights requests, and concerns regarding this Policy should be directed to oke8's DPO at: [email protected] (subject line: "Data Privacy Request").

3 Personal Data We Collect

oke8 collects the following categories of personal data in connection with the operation of the platform:

3.1 Identity & Registration Data

Collected during account registration and KYC verification. Required by oke8, PAGCOR, and AMLC regulations.

3.2 Contact Data

Used for account authentication, security notifications, withdrawal confirmations, and customer support communications.

3.3 Financial & Transaction Data

Required for payment processing, withdrawal verification, and compliance with AMLC transaction monitoring obligations under RA 9160 as amended.

3.4 Gaming Activity Data

Used for platform operations, responsible gaming monitoring, bonus administration, and regulatory reporting to PAGCOR.

3.5 Technical & Device Data

Collected automatically to ensure platform security, detect fraudulent access, and verify that access originates from permitted jurisdictions.

3.6 Communications Data

Records of your communications with oke8 customer support — including live chat transcripts, support emails, and any documents or information you voluntarily provide — are retained for quality assurance, dispute resolution, and compliance purposes.

4 How We Collect Your Personal Data

oke8 collects personal data through the following methods:

• Direct submission: Information you provide when registering an account, submitting KYC documents, completing your profile, or contacting customer support.
• Automated collection: Technical and device data collected automatically when you access the oke8 platform through cookies, server logs, and similar technologies.
• Payment providers: Transaction confirmation and payment method reference data received from GCash, Maya, BPI, BDO, Metrobank, and other integrated Philippine payment services.
• Identity verification providers: Verification outcomes and document authenticity assessments from oke8's KYC processing partners.
• Fraud prevention systems: Risk signals and device data from oke8's automated fraud detection infrastructure.
• Third-party game providers: Gaming activity data generated by games provided by third-party studios integrated into the oke8 platform (e.g., bet records, game round IDs).

5 Purposes of Processing & Legal Basis

oke8 processes your personal data for the following purposes, each supported by a lawful basis under Section 12 of RA 10173:

6 Data Retention

oke8 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law and regulation. The following retention periods apply:

• Account data and KYC documents: Retained for the duration of the account's active status plus a minimum of five (5) years from account closure, as required by AMLC regulations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, in accordance with AMLA requirements.
• Gaming activity records: Retained for a minimum of two (2) years from the date of the activity, or longer where required by PAGCOR reporting obligations.
• Customer support communications: Retained for two (2) years from the date of the communication.
• Marketing consent records: Retained for the duration of active consent plus one (1) year from withdrawal of consent.
• Technical and device logs: Retained for twelve (12) months from collection, except where flagged as relevant to a security incident or investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized. Data subject to ongoing regulatory investigations, legal proceedings, or audit requests may be retained beyond standard retention periods until resolution.

7 Sharing Your Personal Data

oke8 does not sell, rent, or trade your personal data to third parties for commercial purposes. Your personal data may be disclosed in the following circumstances only:

7.1 Regulatory and Law Enforcement Authorities

oke8 is legally required to disclose personal data to the following Philippine regulatory and law enforcement bodies upon lawful request or as mandated by law: the Philippine Amusement and Gaming Corporation (PAGCOR), the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Bureau of Internal Revenue (BIR), and other competent Philippine government authorities.

7.2 Payment Service Providers

Transaction data is shared with integrated payment providers — including GCash (GXI Inc.), Maya (Voyager Innovations), BPI, BDO, Metrobank, and other Philippine payment service providers — solely for the purpose of processing your deposits and withdrawals. Data shared with payment providers is governed by each provider's own privacy policies and regulatory obligations.

7.3 Identity Verification Partners

Government ID images and identity data are shared with oke8's KYC verification service providers solely for the purpose of verifying your identity as required by PAGCOR's online gaming regulations. All KYC partners are contractually required to maintain data confidentiality and comply with RA 10173.

7.4 Game Content Providers

Limited gaming activity data (player session identifiers, bet amounts, game round IDs) is shared with third-party game providers (such as PG Soft, Jili, Evolution Gaming, and others) as necessary to operate the games and resolve disputes. No personally identifiable information beyond session identifiers is shared with game providers.

7.5 Fraud Prevention and Security Partners

Technical and device data may be shared with oke8's fraud prevention and cybersecurity service providers for the purpose of detecting and preventing unauthorized account access, identity fraud, and money laundering.

8 Cross-Border Data Transfers

Certain service providers engaged by oke8 — including cloud infrastructure providers, KYC verification partners, and game content providers — may process or store data outside the Republic of the Philippines. Where personal data is transferred to a jurisdiction outside the Philippines, oke8 ensures that such transfers are lawful by implementing appropriate safeguards as prescribed by the NPC, including:

• Contractual obligations requiring the receiving party to maintain data protection standards equivalent to those required under RA 10173;
• Transfers only to jurisdictions with data protection laws recognized as providing adequate protection by the NPC; and
• Where required, obtaining your explicit consent to the transfer of your personal data outside the Philippines.

oke8's primary data storage infrastructure is located within the Asia-Pacific region. Specific transfer destinations are documented in oke8's Data Processing Register maintained by the Data Protection Officer.

9 Cookies & Tracking Technologies

oke8 uses cookies and similar technologies to operate the platform, maintain your session, and collect technical data as described in Section 3.5 of this Policy. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies, CSRF protection tokens, and load balancing cookies. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Remember your preferences such as language settings, game display options, and responsible gaming tool configurations.
• Analytics Cookies: Collect anonymized data about how players use the platform to help oke8 improve the user experience. No personal gaming history is exported to external analytics services.
• Security Cookies: Used by oke8's fraud detection systems to recognize trusted devices and flag unusual login patterns.

oke8 does not use third-party advertising or retargeting cookies. You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from logging into or using the oke8 platform.

10 Data Security Measures

oke8 implements a comprehensive set of technical, organizational, and physical security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit Transport Layer Security (TLS/SSL) encryption for all data in transit between your device and oke8's servers
• AES-256 encryption for personal data and financial data stored at rest in oke8's databases
• Password hashing using industry-standard bcrypt with unique salts — oke8 staff cannot access your plain-text password
• Multi-factor authentication options for player accounts and mandatory two-factor authentication for all oke8 administrative personnel
• Role-based access controls ensuring that oke8 staff can only access personal data necessary for their specific job function
• Regular security audits and penetration testing by independent cybersecurity professionals
• Secure data centers with physical access controls, CCTV monitoring, and environmental protection systems
• Comprehensive staff training on data protection obligations under RA 10173 and oke8's internal data handling policies

11 Minors & Age Policy

The oke8 platform is strictly restricted to individuals who are twenty-one (21) years of age or older, in accordance with PAGCOR's online gaming regulations. oke8 does not knowingly collect personal data from individuals under the age of 21.

Age verification is conducted as part of oke8's registration process and is confirmed through KYC identity verification. Where oke8 becomes aware that personal data has been collected from an individual under 21 years of age, such data will be deleted immediately and the associated account will be permanently closed.

If you are a parent or guardian and believe that your child has accessed the oke8 platform, please contact oke8's Data Protection Officer at [email protected] immediately. oke8 recommends the use of parental control software on household devices to prevent minors from accessing online gaming platforms.

12 Your Data Subject Rights

As a Data Subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by oke8. All rights requests should be submitted to the Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request."

13 Personal Data Breach Protocol

In the event of a personal data breach that poses a real risk of serious harm to Data Subjects, oke8 will comply fully with the mandatory breach notification requirements of the Philippine Data Privacy Act and NPC Circular No. 16-03:

• Notification to the National Privacy Commission (NPC) within seventy-two (72) hours of discovering a qualifying breach;
• Direct notification to affected Data Subjects as promptly as practicable, using registered email addresses or other contact information on file;
• Notification will include a description of the nature of the breach, categories of data affected, likely consequences, and measures taken or proposed by oke8 to address the breach;
• A post-incident review and remediation report to be filed with the NPC as required by applicable NPC circulars.

oke8 maintains a documented Incident Response Plan for data security incidents, regularly tested and updated by the Data Protection Officer in coordination with oke8's Information Security team.

14 Marketing Communications

oke8 may send you promotional and marketing communications — including information about new games, bonus offers, reload promotions, and platform features — via SMS, email, or push notifications, where you have provided explicit consent to receive such communications.

You may withdraw your consent to marketing communications at any time by:

• Clicking the "Unsubscribe" link included in every marketing email;
• Adjusting your notification preferences in the oke8 account settings dashboard; or
• Contacting oke8 support at [email protected] with the request to opt out of marketing communications.

Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to withdrawal. You will continue to receive transactional communications — such as deposit confirmations, withdrawal processing notifications, and account security alerts — as these are necessary for the operation of your account and do not require separate consent.

15 Changes to This Privacy Policy

oke8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable Philippine data protection law, NPC issuances, oke8's business practices, or operational changes in how personal data is processed.

Material changes to this Privacy Policy will be communicated to registered oke8 players via:

• A notification displayed prominently on the oke8 platform upon your next login following the update;
• An email notification to your registered email address, where the change is material and affects your rights as a Data Subject.

The "Effective Date" at the top of this Policy reflects the date on which the current version took effect. We encourage you to review this Policy periodically. Your continued use of the oke8 platform after the effective date of any amendment constitutes your acknowledgment of the revised Policy.

16 Contact the Data Protection Officer

For all data privacy inquiries, data subject rights requests, complaints regarding oke8's data handling practices, or questions about this Privacy Policy, please contact oke8's designated Data Protection Officer:

• Email: [email protected] (Subject: "Data Privacy Request")
• Live Chat: Available 24/7 via the oke8 platform — request "Data Protection Officer" in the chat
• Platform: oke8.app

If you are not satisfied with oke8's response to your data privacy concern, you have the right to escalate the matter to the National Privacy Commission of the Philippines (NPC) at privacy.gov.ph. oke8 is registered with the NPC as a Personal Information Controller.

Effective Date: This Privacy Policy is effective as of 1 January 2026. It supersedes all prior versions of the oke8 Privacy Policy.