Privacy
Policy

1. About This Policy

This Privacy Policy ("Policy") describes how okcard ("we," "us," or "our") collects, uses, discloses, stores, and protects the personal information of individuals ("you," "Player," or "User") who visit, register on, or use the okcard platform, including the website at okcard.app and all associated products and services.

By accessing the okcard platform or creating an account, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, you should discontinue use of the okcard platform.

This Policy is intended to be read alongside the okcard Terms & Conditions. Capitalised terms not defined in this Policy have the meanings given to them in the Terms & Conditions.

2. Data Controller

For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, okcard acts as the personal information controller in respect of all personal data collected through the okcard platform. As personal information controller, okcard determines the purposes and means of processing your personal data.

Where okcard engages third-party service providers to process personal data on its behalf — for example, payment processors, KYC verification providers, or cloud hosting services — those providers act as personal information processors and are contractually obligated to process your data only on okcard's instructions and in accordance with this Policy and applicable Philippine law.

3. Personal Data We Collect

3.1 Registration & Identity Data

When you create an okcard account, we collect the following information:

• Full legal name (as it appears on your government-issued ID)
• Date of birth (to verify you are 21 years of age or older)
• Gender
• Philippine mobile number
• Email address
• Username and encrypted password
• Residential address (province, city/municipality, barangay, postal code)

3.2 Identity Verification (KYC) Data

To comply with Philippine regulatory requirements, we collect and process the following KYC documentation when you request a withdrawal or when triggered by our compliance protocols:

• Copies of government-issued photo identification (e.g., PhilSys National ID, LTO Driver's License, Philippine Passport, UMID, SSS Card, GSIS eCard, Voter's ID, PRC ID)
• Proof of address documents (e.g., utility bill, bank statement, barangay certificate)
• Selfie photographs taken alongside a presented ID
• Source of funds documentation where required by our AML procedures

3.3 Financial & Transaction Data

We collect information related to deposits, withdrawals, and gaming activity on the okcard platform, including:

• Deposit and withdrawal amounts and timestamps
• Payment method identifiers (e-wallet account references, bank account details where applicable — we do not store full card numbers or full bank account numbers)
• Transaction reference numbers issued by payment providers such as GCash, Maya, GrabPay, BPI, BDO, Metrobank, InstaPay, and QR Ph
• Wagering history, game session data, and betting records
• Bonus and promotion redemption records

3.4 Technical & Device Data

When you access the okcard platform, we automatically collect certain technical information, including:

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser type and version
• Unique device identifiers
• Session start and end times and duration
• Pages viewed, features accessed, and click-path data
• Referral URL (the page from which you arrived at the okcard platform)

3.5 Communications Data

If you contact okcard's customer support team, we will collect and retain records of that communication, including the content of live chat transcripts, support ticket exchanges, and email correspondence. This allows us to track the history of your interactions and provide consistent, effective assistance.

3.6 Responsible Gaming Data

Where you use okcard's responsible gaming tools — such as deposit limits, loss limits, session time limits, cooling-off periods, or self-exclusion — we record those elections and the dates on which they were made. This data is processed to give effect to your choices and is treated with an additional layer of sensitivity.

4. How We Collect Your Data

okcard collects personal data through the following channels:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, participate in promotions, or update your account profile.
• Automatically — through cookies, web beacons, pixel tags, and similar tracking technologies when you browse the okcard platform (see Section 8 for full details).
• From third-party service providers — including KYC and identity verification partners, payment processors, fraud detection services, and analytics providers, who may share information about you with us as part of the services they provide to okcard.
• From publicly available sources — including Philippine government registries, court records, and sanctions lists consulted as part of our AML and compliance screening processes.

5. How We Use Your Personal Data

okcard uses your personal data for the following purposes:

Purpose	Description
Account management	Creating, maintaining, and administering your okcard account; authenticating your identity when you log in.
KYC & age verification	Verifying that you are at least 21 years of age and confirming your identity in compliance with PAGCOR and AML regulations.
Payment processing	Processing deposits, withdrawals, and refunds via GCash, Maya, GrabPay, BPI, BDO, Metrobank, InstaPay, and QR Ph.
Fraud & security	Detecting, investigating, and preventing fraudulent activity, money laundering, and unauthorised account access.
Legal & regulatory compliance	Meeting our obligations under Philippine law, including AML reporting, PAGCOR compliance, and responding to lawful requests from government authorities.
Customer support	Responding to your queries, resolving disputes, and providing technical assistance.
Responsible gaming	Giving effect to your responsible gaming elections; monitoring for signs of problem gambling where our platform tools permit.
Platform improvement	Analysing anonymised usage data to improve platform features, game selection, performance, and user experience.
Marketing	Sending promotional communications about bonuses, new games, and okcard news — but only where you have given your consent or where we have a legitimate interest, and always with an easy opt-out.

6. Legal Basis for Processing

Under the Data Privacy Act of 2012, okcard processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and okcard, including account creation, gameplay, and payment processing.
• Legal obligation: Processing required to comply with applicable Philippine law, including AML legislation, PAGCOR regulatory requirements, and tax obligations.
• Legitimate interests: Processing necessary for okcard's legitimate business interests, such as fraud prevention, platform security, and improving our products — provided those interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — for example, for direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Sharing Your Personal Data

okcard does not sell, rent, or trade your personal data. We may share your personal information with third parties only in the following circumstances:

7.1 Service Providers

We engage trusted third-party service providers to assist in operating the okcard platform. These providers process personal data solely on our instructions and under binding data processing agreements. Categories of service providers include:

• KYC and identity verification providers
• Payment processors and e-wallet providers (GCash, Maya, GrabPay, BPI, BDO, Metrobank)
• Cloud hosting and infrastructure providers
• Fraud detection and cybersecurity services
• Customer support platform providers
• Email and SMS communication services
• Analytics and platform optimisation tools

7.2 Regulatory & Law Enforcement Authorities

okcard may disclose personal data to the Anti-Money Laundering Council (AMLC), PAGCOR, the National Privacy Commission (NPC), the National Bureau of Investigation (NBI), the Philippine National Police (PNP), or other competent government authorities where required by law, court order, or regulatory mandate — or where we reasonably believe disclosure is necessary to protect the rights, safety, or property of okcard, its players, or the public.

7.3 Business Transfers

In the event of a merger, acquisition, sale of substantially all assets, or other corporate restructuring involving okcard, personal data held by okcard may be transferred to the successor entity, subject to at least equivalent privacy protections. Affected Players will be notified in advance where practicable.

7.4 With Your Consent

okcard may share your personal data with other third parties in cases not described above where you have given your explicit prior consent to such sharing.

8. Cookies & Tracking Technologies

The okcard platform uses cookies, web beacons, pixel tags, and similar technologies to operate core platform functions, personalise your experience, and understand how players interact with the site.

8.1 Types of Cookies We Use

Cookie Type	Purpose	Can Be Disabled?
Essential	Required for login sessions, security tokens, and core platform functions.	No — disabling these will break the platform.
Functional	Remember your language preference, display settings, and responsible gaming elections.	Yes — but some features may not work as expected.
Analytics	Collect anonymised data on how players use the platform to help us improve it.	Yes — opt out via your browser settings.
Marketing	Track the effectiveness of promotional campaigns and deliver relevant okcard offers.	Yes — opt out via your browser settings or account preferences.

You can manage or delete cookies at any time through your browser's privacy or settings menu. Please note that disabling essential cookies will impair your ability to use the okcard platform. For detailed guidance on managing cookies in your specific browser, refer to the browser's official support documentation.

9. Data Retention

okcard retains personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by Philippine law.

The following general retention periods apply:

• Account and identity data: Retained for the duration of the account and for a minimum of five (5) years after account closure, in line with AML record-keeping requirements under the Anti-Money Laundering Act (Republic Act No. 9160, as amended).
• Transaction and financial records: Retained for a minimum of five (5) years from the date of the transaction.
• KYC documentation: Retained for a minimum of five (5) years following account closure or the completion of the relevant transaction.
• Customer support records: Retained for two (2) years from the date of the last interaction, unless longer retention is required for dispute resolution or regulatory purposes.
• Marketing consent records: Retained for as long as we rely on that consent, plus a reasonable additional period for compliance purposes.
• Cookies and analytics data: Retained in accordance with the applicable third-party analytics platform's retention settings, typically between 14 months and 26 months.

When personal data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with you.

10. Data Security

okcard implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Encryption in transit: All communications between your device and the okcard platform are encrypted using Transport Layer Security (TLS).
• Encryption at rest: Sensitive personal data and payment information stored in our systems is encrypted at rest using industry-standard algorithms.
• Access controls: Access to personal data within okcard is restricted to employees and contractors who have a legitimate need to process that data for their assigned roles. Access is governed by role-based permissions and subject to regular review.
• Password security: Account passwords are stored as salted cryptographic hashes; okcard does not store plaintext passwords.
• Penetration testing: The okcard platform undergoes periodic security assessments and vulnerability testing by qualified security professionals.
• Incident response: okcard maintains a data breach response procedure. In the event of a breach that is likely to result in risk to your rights and freedoms, we will notify the National Privacy Commission and affected Players in accordance with the Data Privacy Act of 2012 and its Implementing Rules.

11. Your Data Rights

Under the Data Privacy Act of 2012 (Republic Act No. 10173), you have the following rights in relation to your personal data held by okcard:

To exercise any of the above rights, please contact the okcard Data Privacy Officer at the email address provided in Section 15. We will respond to all verified requests within fifteen (15) working days, or within any shorter period mandated by applicable law. We may ask you to verify your identity before processing your request.

Please note that certain rights are subject to exceptions. For example, okcard may be required by law to retain certain records for AML or regulatory purposes even if you request erasure.

12. Children's Privacy

The okcard platform is strictly intended for adults aged 21 years and older. We do not knowingly collect personal data from individuals under the age of 21. If you are under 21, you must not register for or use the okcard platform.

If okcard becomes aware that it has inadvertently collected personal data from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. If you believe that a minor has registered on the okcard platform, please notify us immediately at the contact address in Section 15.

13. International Data Transfers

The okcard platform primarily processes data within the Philippines. However, some of our third-party service providers — including cloud infrastructure, analytics, and security vendors — may process personal data outside the Philippines.

Where personal data is transferred outside the Philippines, okcard ensures that appropriate safeguards are in place to provide a level of protection at least equivalent to that required under the Data Privacy Act of 2012. Such safeguards may include:

• Data processing agreements incorporating the National Privacy Commission's standard contractual clauses or equivalent protections
• Transfer to recipients in jurisdictions recognised as providing adequate data protection standards
• Binding corporate rules where applicable

By using the okcard platform, you acknowledge and consent to such transfers where necessary for the purposes described in this Policy.

14. Changes to This Policy

okcard reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable Philippine law, or regulatory guidance from the National Privacy Commission.

When material changes are made, we will provide advance notice to registered Players via email to the address on file and/or via an in-platform notification. The updated Policy will display the revised effective date at the top of this page.

Your continued use of the okcard platform following the effective date of a revised Policy constitutes your acceptance of that revised Policy. If you do not agree with any changes, you should stop using the platform and may request account closure in accordance with the Terms & Conditions.

15. Contact & Complaints

15.1 Data Privacy Officer

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by okcard, please contact our Data Privacy Officer:

Email: [email protected]

Please include "Data Privacy Request" in the subject line of your email, along with your full registered name and a description of your request. We will acknowledge receipt within three (3) working days and provide a substantive response within fifteen (15) working days.

15.2 Right to Complain

If you believe that okcard has not handled your personal data in accordance with the Data Privacy Act of 2012 or this Privacy Policy, and you are not satisfied with our response to your complaint, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. Information about how to file a complaint with the NPC is available through official Philippine government channels.

This Privacy Policy was last reviewed and updated on 1 January 2026. Previous versions are available upon written request submitted to the email address above.