okbst Privacy Policy

1 Introduction and Data Controller Identity

okbst operates the online gaming platform accessible at okbst.app, offering casino games, live dealer games, sports betting, bingo, and related services to players in the Philippines. okbst acts as the Data Controller in respect of personal data collected from Players through the Platform.

This Policy applies to all personal data collected by okbst in connection with the operation of the Platform, including data collected during account registration, gameplay, financial transactions, customer support interactions, and marketing communications. This Policy should be read alongside the okbst Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

okbst is committed to processing personal data in a manner that is transparent, lawful, and aligned with the rights of Filipino data subjects under Republic Act No. 10173 (the Data Privacy Act of 2012) and its Implementing Rules and Regulations as enforced by the National Privacy Commission of the Philippines.

2 Definitions

• "Personal Data" means any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained, or when put together with other information would directly and certainly identify an individual.
• "Sensitive Personal Information" means personal data about an individual's race, ethnic origin, marital status, age, color, religious, philosophical or political affiliations, health, education, genetic or sexual life, or any proceeding for any offense committed or alleged to have been committed.
• "Processing" means any operation or set of operations performed upon personal data, including but not limited to collection, recording, organization, storage, updating, retrieval, use, consolidation, blocking, erasure, or destruction.
• "Data Controller" means okbst, which determines the purposes and means of the processing of personal data.
• "Data Processor" means any natural or juridical person or any other body that processes personal data on behalf of okbst.
• "Data Subject" means any registered Player or visitor to the Platform whose personal data is processed by okbst.
• "Consent" means any freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their personal data.
• "KYC" means Know Your Customer procedures including identity and age verification required by okbst and applicable regulations.

3 Personal Data We Collect

okbst collects the following categories of personal data, depending on how you interact with the Platform:

3.1 Registration and Identity Data

• Full legal name (first name and surname);
• Date of birth (to verify 21+ age eligibility);
• Nationality and country of residence;
• Registered Philippine mobile number;
• Email address;
• Username selected by the Player.

3.2 Identity Verification (KYC) Data

• Copies of government-issued Philippine identification documents (PhilSys card, UMID, driver's license, or passport);
• Proof of address documents where required;
• Selfie or live facial verification images where required for enhanced KYC;
• Source of funds declarations for players meeting applicable thresholds.

3.3 Financial Data

• GCash mobile number linked to your registered account;
• Maya (PayMaya) account reference details;
• BPI, BDO, or Metrobank account name and last four digits where provided for bank transfers;
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment method used;
• Wallet balance history.

3.4 Gaming Activity Data

• Games played, wager amounts, results, and session durations;
• Bonus offers claimed and wagering activity associated with promotions;
• VIP tier status and loyalty points history;
• Responsible gaming settings and limits applied to your account.

3.5 Technical and Device Data

• IP address at time of login and account activity;
• Device type, operating system, and browser version;
• Geolocation data (country/city level) derived from IP address;
• Session timestamps and login history;
• Cookies and similar tracking data (see Section 8).

3.6 Communications Data

• Records of live chat conversations with okbst customer support;
• Email correspondence between you and okbst;
• Feedback, complaints, or dispute records;
• Responses to surveys or promotional participation records.

4 How We Collect Your Data

okbst collects personal data through the following means:

• Direct provision by you: Data you enter during account registration, KYC verification, deposit and withdrawal requests, contact form submissions, or live chat interactions;
• Automated technical collection: Data collected automatically by the Platform's servers when you access the site, including device information, IP address, and session data;
• Payment processors: Transaction confirmation data received from GCash, Maya, and banking partners after a deposit or withdrawal is initiated;
• Identity verification services: Verification outcomes and risk scores returned by third-party KYC service providers used to process identity documents;
• Cookies and tracking technologies: Behavioral and session data collected through cookies and similar technologies as described in Section 8;
• Fraud and AML screening services: Risk signals and screening results from anti-fraud and anti-money laundering compliance service providers.

5 How We Use Your Personal Data

okbst uses the personal data we collect for the following purposes:

okbst does not use your personal data for automated individual decision-making that produces significant legal effects, other than automated fraud screening. Where automated fraud screening results in account restriction, you have the right to request human review of the decision by contacting the okbst support team.

6 Legal Basis for Processing

okbst processes personal data on the following legal bases under the Data Privacy Act of 2012:

• Consent: For marketing communications and optional data uses. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Performance of a Contract: Processing necessary to create and manage your account, provide gaming services, and process financial transactions.
• Compliance with a Legal Obligation: Processing required by PAGCOR regulations, anti-money laundering laws, tax reporting obligations, and other applicable Philippine legislation.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and internal analytics — provided such interests are not overridden by your privacy rights.

7 Data Sharing and Third Parties

7.1 Categories of Recipients

okbst does not sell your personal data. We share data only with the following categories of recipients, strictly limited to what is necessary for the stated purpose:

• Payment Processors: GCash (operated by Globe Telecom), Maya (operated by Voyager Innovations), GrabPay, BPI, BDO, Metrobank, and InstaPay/BSP network operators, for the purpose of processing deposits and withdrawals;
• KYC and Identity Verification Providers: Third-party service providers that process identity document images and perform biometric verification on okbst's behalf;
• Fraud Prevention and AML Services: Compliance technology providers that screen transactions for fraud indicators and anti-money laundering red flags;
• Game Providers and Studios: To the extent required for the delivery of specific games, game providers may receive a session token and the minimum data required to authenticate your game session. They do not receive your financial data;
• Regulatory Authorities: PAGCOR and other competent Philippine government authorities where disclosure is required by law, regulation, court order, or regulatory demand;
• Cloud Infrastructure and Hosting Providers: Technology infrastructure providers that host the Platform and its associated databases, under strict data processing agreements;
• Professional Advisors: Legal, accounting, or auditing firms engaged by okbst, subject to professional confidentiality obligations.

7.2 Data Processing Agreements

All third-party Data Processors engaged by okbst are bound by written data processing agreements that require them to process personal data only on okbst's documented instructions, to maintain appropriate security measures, and to support okbst's obligations to Data Subjects under applicable privacy law.

8 Cookies and Tracking Technologies

8.1 What We Use

The okbst Platform uses cookies and similar tracking technologies including browser localStorage and session storage. These technologies serve the following functions:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, security tokens, and load-balancing cookies. These cannot be disabled without impairing Platform functionality;
• Functional Cookies: Remember your preferences such as language settings, game lobby display preferences, and "Remember Me" login settings;
• Analytics Cookies: Collect anonymized data about how Players navigate the Platform, which pages are visited most frequently, and where players encounter errors. This data is used to improve the Platform;
• Security Cookies: Help detect fraudulent login attempts, unusual session patterns, and other account security risks.

8.2 Managing Cookies

You may control non-essential cookies through your browser settings. Note that disabling functional cookies may affect your experience on the Platform. okbst does not currently use third-party advertising cookies or retargeting pixels.

9 Data Retention

okbst retains personal data for as long as is necessary to fulfill the purposes set out in this Policy, subject to the following minimum retention periods:

• Account and Identity Data: For the duration of your active account, plus a minimum of five (5) years following account closure, as required by PAGCOR regulations and anti-money laundering law;
• KYC Documents: Five (5) years from the date of verification, or from the date of account closure, whichever is later;
• Financial Transaction Records: Five (5) years, consistent with Bureau of Internal Revenue and BSP/AMLC record-keeping requirements;
• Gaming Activity Logs: Three (3) years from the date of the activity;
• Customer Support Records: Three (3) years from the date of the interaction;
• Technical and Device Data: Ninety (90) days, except where a longer period is required for ongoing security investigations;
• Self-Exclusion Records: The full duration of the exclusion period plus five (5) years thereafter, to prevent premature re-registration.

At the end of the applicable retention period, personal data is securely deleted or permanently anonymized in accordance with okbst's data disposal procedures.

10 Your Data Subject Rights

As a Data Subject under the Philippine Data Privacy Act of 2012, you have the following rights in respect of your personal data held by okbst:

• Right to be Informed: To be notified of how your personal data is collected and processed, as set out in this Policy;
• Right of Access: To obtain a copy of the personal data okbst holds about you, and information about how it is processed;
• Right to Rectification: To have inaccurate or incomplete personal data corrected. You may update most account information directly through your account settings;
• Right to Erasure or Blocking: To request the deletion or blocking of personal data where it is no longer necessary for the purpose it was collected, subject to okbst's legal retention obligations;
• Right to Object: To object to the processing of your personal data on grounds of legitimate interest, including direct marketing;
• Right to Data Portability: To receive your personal data in a structured, commonly used, machine-readable format;
• Right to Damages: To claim compensation for any damage suffered as a result of unlawful processing of your personal data;
• Right to File a Complaint: To file a complaint with the National Privacy Commission of the Philippines if you believe your rights have been violated.

To exercise any of the above rights, please contact the okbst Data Protection Officer using the details provided in Section 15. okbst will respond to verified data subject requests within fifteen (15) calendar days. Complex requests may require up to thirty (30) calendar days, in which case you will be notified of the extended timeframe.

11 Data Security Measures

okbst implements a multi-layered security framework to protect personal data against unauthorized access, disclosure, alteration, or destruction:

• Encryption in Transit: All data transmitted between your device and the Platform is protected by TLS 1.2/1.3 with 256-bit SSL encryption;
• Encryption at Rest: Sensitive stored data including identity documents and financial records is encrypted using AES-256;
• Access Controls: Personal data is accessible only to okbst staff whose roles require it, on a need-to-know basis. All staff access is logged and subject to periodic review;
• Two-Factor Authentication: okbst staff accessing systems containing personal data use multi-factor authentication. Players are encouraged to enable SMS-based login verification on their accounts;
• Intrusion Detection: The Platform is monitored for anomalous activity patterns that may indicate unauthorized access attempts;
• Data Breach Response: In the event of a personal data breach that poses a risk to Data Subjects, okbst will notify affected players and the National Privacy Commission within 72 hours of discovery, as required under RA 10173.

No security system is impenetrable. While okbst takes all reasonable measures to protect your data, we cannot guarantee absolute security. You are also responsible for maintaining the security of your account credentials.

12 Children's and Minors' Privacy

The okbst Platform is strictly intended for individuals who are at least twenty-one (21) years of age. okbst does not knowingly collect personal data from persons under 21. The registration process requires users to confirm their date of birth, and KYC verification requires submission of a valid Philippine government-issued ID confirming age eligibility.

If okbst discovers that personal data has been collected from a person under 21 years of age, the account will be immediately suspended, all data will be deleted, and any balance will be handled in accordance with the okbst Terms & Conditions. If you believe a minor has registered an account on the Platform, please contact the okbst support team immediately at [email protected].

13 Cross-Border Data Transfers

The okbst Platform is operated primarily within the Philippines and for Filipino players. However, some third-party service providers engaged by okbst — including cloud hosting, fraud screening, and identity verification providers — may process data on servers located outside the Philippines.

Where personal data is transferred outside the Philippines, okbst ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to Philippine Data Privacy Act requirements. These safeguards include contractual clauses in data processing agreements and, where applicable, transfers to jurisdictions recognized by the National Privacy Commission as providing an adequate level of data protection.

14 Changes to This Privacy Policy

okbst may update this Privacy Policy from time to time to reflect changes in the Platform, applicable law, or our data processing practices. Material changes to this Policy will be communicated to registered Players via the email address or mobile number registered on their account, at least fifteen (15) days before the changes take effect.

The updated Policy will be published on this page with a revised Effective Date. Continued use of the Platform after the effective date of an amendment constitutes acceptance of the updated Policy. If you do not accept the changes, you may request account closure in accordance with the Terms & Conditions.

We recommend reviewing this Policy periodically, particularly if you are a regular okbst player. The most current version is always accessible at okbst.app/privacy-policy.

15 Contact Us and Data Protection Officer

okbst has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Policy. If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the okbst DPO through the following channels:

• Email (Privacy Enquiries): [email protected] — please include "Privacy Request" in the subject line
• Live Chat: Available 24/7 through the Platform — identify your query as a privacy-related matter to ensure routing to the correct team
• Response Commitment: Acknowledgement within 24 hours; substantive response within 15 calendar days
• Operating Timezone: Philippine Standard Time (UTC+8)

You also have the right to file a complaint directly with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated. Information on filing a complaint is available through the National Privacy Commission's official channels.