oke8 Privacy
Policy

1 Introduction

This Privacy Policy ("Policy") is issued by oke8 ("oke8", "we", "us", "our") and applies to all personal data collected, stored, used, and shared in connection with your use of the oke8 online casino and sports betting platform accessible at oke8.club ("Platform"), including any related mobile-optimized services.

oke8 is committed to protecting the privacy and personal data of all Members and visitors. We comply with the Republic Act No. 10173 — Data Privacy Act of 2012 (DPA) of the Philippines and its Implementing Rules and Regulations (IRR), as administered by the National Privacy Commission (NPC).

By accessing the oke8 Platform, registering a Member account, or submitting any information to us, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not use the Platform.

2 Data Controller

For the purposes of the Philippine Data Privacy Act, the data controller responsible for your personal information is oke8, operating the Platform at oke8.club.

oke8 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the DPA and this Policy. Members and visitors who wish to exercise their data rights or raise a privacy concern may contact the DPO using the contact details provided in Section 15 of this Policy.

3 Personal Data We Collect

oke8 collects personal data that is necessary for the purposes outlined in Section 5. The categories of data we collect include:

oke8 does not intentionally collect sensitive personal information beyond what is strictly required for identity verification and regulatory compliance. Where sensitive personal information is processed — such as identity document data — it is handled with heightened security measures and processed only for the specific purpose for which it was obtained.

4 How We Collect Your Data

oke8 collects personal data through the following means:

• Directly from you: When you register an account on oke8, complete KYC verification, make a deposit or withdrawal, contact our support team, or update your account profile.
• Automatically through the Platform: When you visit, log in to, or interact with oke8.club, we automatically collect technical and usage data through server logs, session tracking, and cookies as described in Section 9.
• From third-party payment processors: Payment providers such as GCash, Maya, BPI, and BDO may share limited transaction confirmation data with oke8 to facilitate deposit and withdrawal processing.
• From identity verification services: Where oke8 uses third-party KYC service providers to assist in verifying identity documents, those providers may share verification outcomes with oke8.
• From fraud prevention services: oke8 may receive data from anti-fraud and AML screening services to assess the risk profile of transactions or account activity.

5 Purpose & Legal Basis for Processing

oke8 processes your personal data on the following legal bases under the Philippine Data Privacy Act and its IRR:

• Contractual Necessity: Processing required to fulfil the oke8 Member Agreement — including account management, deposit and withdrawal processing, customer support, and game access. Without this processing, oke8 cannot provide the Platform services to you.
• Legal Obligation: Processing required to comply with applicable Philippine law, including PAGCOR regulatory requirements, anti-money laundering (AML) obligations under Republic Act No. 9160 (Anti-Money Laundering Act, as amended), and the Data Privacy Act itself.
• Legitimate Interests: Processing carried out for oke8's legitimate business interests, including fraud detection and prevention, platform security, responsible gaming enforcement, and internal analytics to improve Platform performance — provided these interests are not overridden by your data protection rights.
• Consent: Where oke8 sends optional marketing communications or uses non-essential cookies, we rely on your freely given consent. You may withdraw this consent at any time without affecting the lawfulness of processing prior to withdrawal.

6 Data Sharing & Third-Party Disclosure

oke8 does not sell, rent, or trade your personal data to third parties for their own commercial marketing purposes. Your data may be shared with the following categories of recipients, only to the extent necessary for the stated purpose:

• Payment Processors: GCash (Mynt), Maya (PayMongo), GrabPay, BancNet, and Philippine banking partners receive the minimum data necessary to facilitate deposits and withdrawals on your behalf.
• KYC and Identity Verification Providers: Third-party services that assist oke8 in verifying identity documents as part of the KYC process. These providers process data only under oke8's instructions and applicable data processing agreements.
• Fraud Prevention and AML Services: Specialist services that screen transactions and account activity to detect and prevent fraud, money laundering, and other financial crimes.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and law enforcement agencies in the Philippines, where disclosure is required by law, court order, or regulatory obligation.
• Group Companies: Affiliated entities within the oke8 corporate group, where necessary for shared technology infrastructure, compliance, or customer support operations. All group entities are bound by equivalent data protection standards.
• Professional Advisers: Legal counsel, auditors, and accountants who are bound by confidentiality obligations and who require access to Member data in the course of their professional services to oke8.
• IT Service Providers: Cloud hosting, data storage, and technical infrastructure providers that process data on behalf of oke8 under contractual data processing agreements.

7 Data Retention

oke8 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, and contractual obligations. The following general retention periods apply:

• Active Account Data: Retained for the duration of your oke8 account and for a period of five (5) years following account closure, in accordance with PAGCOR record-keeping requirements and AML obligations.
• KYC and Identity Documents: Retained for a minimum of five (5) years following the end of the Member relationship, as required under the Anti-Money Laundering Act.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction in compliance with AML regulations.
• Support Communications: Retained for two (2) years from the date of the interaction, unless a longer retention period is required in connection with an ongoing dispute or regulatory matter.
• Technical / Log Data: Generally retained for twelve (12) months unless retention beyond this period is required for security or fraud investigation purposes.
• Marketing Consent Records: Retained for as long as you remain on our communications list, plus a period of three (3) years following your withdrawal of consent.

Upon expiry of the applicable retention period, oke8 will securely delete or anonymize personal data so that it can no longer be associated with an identified or identifiable individual.

8 Data Security

oke8 implements technical and organizational security measures appropriate to the sensitivity of the personal data we process. These measures include, but are not limited to:

• SSL/TLS Encryption: All data transmitted between your device and oke8's servers is encrypted in transit using industry-standard Secure Socket Layer / Transport Layer Security protocols.
• Password Hashing: Member account passwords are stored using one-way cryptographic hashing algorithms. oke8 staff cannot retrieve the plaintext value of any Member's password.
• Access Controls: Access to personal data within oke8 is restricted to personnel who require it to perform their specific job functions, governed by role-based access control policies.
• Two-Factor Authentication (2FA): oke8 offers OTP-based two-factor authentication for Member accounts, reducing the risk of unauthorized account access even in the event of credential compromise.
• Regular Security Assessments: oke8 conducts periodic security assessments, vulnerability testing, and penetration testing to identify and remediate security risks proactively.
• Data Breach Response: In the event of a personal data breach that poses a real risk of serious harm to Members, oke8 will notify affected individuals and the National Privacy Commission within seventy-two (72) hours of discovery, in accordance with NPC Circular requirements.

While oke8 takes all reasonable steps to protect your data, no internet-based system is entirely immune from security threats. You are responsible for keeping your oke8 login credentials confidential and for notifying us immediately if you suspect unauthorized access to your account.

9 Cookies & Tracking Technologies

oke8 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, maintain your session state, and analyze Platform usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens and security cookies. These cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies: Remember your language preferences, display settings, and login status. These improve your experience on oke8 but are not essential to core functionality.
• Analytics Cookies: Used to understand how Members interact with the Platform — which pages are visited, how long sessions last, and where errors occur. This data is aggregated and used solely to improve oke8's services. These cookies are anonymized where technically feasible.
• Security Cookies: Detect and prevent fraudulent activity, including bot detection and anomalous login behavior monitoring.

oke8 does not use third-party advertising or behavioral tracking cookies for the purpose of delivering targeted advertising to Members. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will affect Platform functionality.

10 Cross-Border Data Transfers

oke8's primary data processing infrastructure is located within or contractually governed by Philippine data protection standards. Where personal data is transferred to or processed in jurisdictions outside the Philippines — for example, in connection with cloud infrastructure providers — oke8 ensures that such transfers are governed by adequate contractual protections, including data processing agreements that impose data protection obligations equivalent to those under the Philippine DPA.

oke8 does not transfer Member data to jurisdictions where no adequate level of data protection can be ensured without first obtaining appropriate safeguards, such as NPC-approved standard contractual clauses or binding corporate rules.

11 Minors & Age Policy

The oke8 Platform is strictly restricted to individuals aged twenty-one (21) years and above. oke8 does not knowingly collect personal data from individuals below this age. The minimum gambling age of 21 is mandated under applicable Philippine gaming regulations administered by PAGCOR.

During registration and KYC verification, oke8 collects and verifies date of birth information to enforce this restriction. Where oke8 discovers — through KYC review or other means — that a Member is or was below the age of 21 at the time of registration, the account will be immediately suspended, all gameplay records voided, any deposits returned to the source payment method (net of any amount already paid out), and the personal data of the underage individual handled in accordance with special protections for minors under the DPA.

12 Your Data Rights Under the DPA

As a data subject under the Philippine Data Privacy Act, you hold the following rights with respect to your personal data held by oke8. You may exercise any of these rights by contacting our Data Protection Officer at the details provided in Section 15.

• Right to be Informed: The right to be told what personal data oke8 holds about you, the purposes for which it is processed, and the persons or entities to whom it has been disclosed.
• Right of Access: The right to obtain a copy of the personal data we hold about you and to receive information about how it is processed.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected or completed. You may update basic account information directly through your oke8 account settings.
• Right to Erasure / Right to be Forgotten: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to oke8's legal retention obligations.
• Right to Object: The right to object to the processing of your personal data on the basis of legitimate interests, including direct marketing. Where you object to direct marketing, oke8 will cease that processing immediately.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to have that data transmitted to another controller where technically feasible.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to Damages: The right to claim compensation for damages sustained as a result of a violation of your data privacy rights under the DPA.

oke8 will respond to data rights requests within thirty (30) calendar days of receipt. In complex cases, this period may be extended by a further thirty (30) days with prior notification to you. There is no fee for exercising data rights unless your request is manifestly unfounded or excessive, in which case oke8 may charge a reasonable administrative fee.

13 Complaints to the National Privacy Commission

If you are not satisfied with oke8's response to a data rights request or if you believe that your personal data has been processed in violation of the Philippine Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

oke8 encourages Members to contact us directly in the first instance, as we are committed to resolving privacy concerns promptly and fairly. However, your right to escalate to the NPC is unconditional and does not require you to have contacted oke8 first.

The National Privacy Commission's contact details and complaint procedures are publicly available through official Philippine government channels. oke8 will cooperate fully with any NPC investigation.

14 Changes to This Privacy Policy

oke8 may update this Privacy Policy periodically to reflect changes in our data processing practices, legal requirements, or Platform operations. Material changes — meaning changes that significantly affect your rights or how we handle your data — will be communicated to you through a notice displayed prominently on the Platform and, where technically feasible, via a notification to your registered mobile number.

The "Last Updated" date at the top of this page will always reflect the most recent revision. Non-material changes (such as formatting or typographic corrections) will be updated without separate notification. We encourage you to review this Policy periodically to remain informed.

Continued use of the oke8 Platform following notification of material changes constitutes your acceptance of the revised Policy. If you object to any changes, you should cease using the Platform and may request account closure in accordance with the Terms & Conditions.

15 Contact Our Data Protection Officer

To exercise your data rights, raise a privacy concern, or request further information about how oke8 processes your personal data, please contact our Data Protection Officer through the following channels:

• Email (DPO): [email protected] — please include "Privacy / DPO Request" in the subject line.
• Live Chat: Available 24/7 on the oke8 Platform in English and Filipino — ask for the Data Protection Officer or a privacy-related enquiry.
• Account Support Centre: Log in to your oke8 account, navigate to Support, and submit a ticket referencing your data rights request.

Please include your full name, registered mobile number, and a clear description of your request or concern to help us locate your data and respond efficiently. oke8 may require identity verification before processing certain data rights requests to protect against unauthorized access to Member data.

For general questions about the Platform, our FAQ page may already have the answer you need. For information on responsible gaming tools, please visit our Responsible Gaming page.