Privacy Policy

1. Introduction

okllay ("okllay", "we", "us", "our") operates the online gaming platform accessible at https://okllay.net and takes the privacy of every player seriously. This Privacy Policy describes how okllay collects, processes, stores, shares, and protects personal information provided by or collected from users ("Player", "you", "your") when accessing or using the okllay website, mobile experience, games, promotions, and support services.

This Privacy Policy is issued in accordance with the Philippine Data Privacy Act of 2012 (Republic Act 10173), its Implementing Rules and Regulations, and the guidelines issued by the National Privacy Commission (NPC) of the Philippines. okllay is committed to full compliance with these requirements and treats data protection as a core operational obligation — not just a legal checkbox.

By registering an account with okllay, making a deposit, or using any okllay service, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with this Privacy Policy, please do not use the okllay platform.

Note: This Privacy Policy should be read in conjunction with okllay's Terms & Conditions. Defined terms used in the Terms & Conditions carry the same meaning when used in this Privacy Policy unless otherwise stated.

2. Data Controller

For the purposes of the Philippine Data Privacy Act of 2012, okllay is the Personal Information Controller (PIC) in respect of all personal data collected from players and site visitors through the okllay platform. As a Personal Information Controller, okllay determines the purposes and means of processing personal data and is accountable for ensuring that such processing complies with applicable Philippine law.

okllay has designated a Data Protection Officer (DPO) responsible for overseeing data protection compliance across the platform. The DPO may be contacted through okllay's official support channels, details of which are set out in Section 15 of this Policy.

3. Personal Data We Collect

okllay collects several categories of personal data depending on your interaction with the platform. The table below summarizes the main categories and specific data points collected:

Category	Data Points Collected	Purpose
Identity Data	Full name, date of birth, gender, nationality, government-issued ID type and number	Account registration, KYC verification, age verification
Contact Data	Email address, mobile number, residential address (city, province, region)	Account communications, support, fraud prevention
Financial Data	GCash number, bank account details (BPI, BDO, Metrobank), payment method ownership documents	Deposit processing, withdrawal verification, AML compliance
Transaction Data	Deposit history, withdrawal history, game stakes, bet records, bonus claims, account balance changes	Account management, regulatory reporting, dispute resolution
Technical Data	IP address, device type, browser type and version, operating system, screen resolution, session duration	Platform security, fraud detection, responsible gaming monitoring
Behavioral Data	Pages visited, games played, time spent per session, click patterns, search queries within platform	Platform improvement, personalization, responsible gaming
Communication Data	Live chat transcripts, email correspondence, support ticket content	Customer support, quality assurance, dispute resolution

okllay does not collect sensitive personal information (as defined under the Data Privacy Act, such as health records, racial or ethnic origin, or religious beliefs) except where strictly required for regulatory compliance purposes, in which case such collection will be clearly disclosed to you at the time of collection.

4. How We Collect Your Data

okllay collects personal data through the following channels and methods:

Direct Submission: Information you voluntarily provide when creating an account, completing KYC verification, contacting support, or participating in promotions.
Automated Technical Collection: Data collected automatically when you visit or interact with the okllay platform, including through cookies, web beacons, log files, and session tracking technologies.
Third-Party Service Providers: Identity verification providers, payment processors (GCash, bank payment gateways), and fraud detection services may share data with okllay as part of the services they provide.
Regulatory Bodies: In limited circumstances, okllay may receive data from PAGCOR or other Philippine regulatory authorities in connection with licensing obligations or compliance inquiries.
Publicly Available Sources: okllay may verify account information against publicly available databases where permitted by law and required for KYC or AML compliance purposes.

5. Why We Use Your Data

okllay processes personal data for the following specific purposes:

To create, manage, and maintain your okllay player account and verify your identity and age (21+ requirement).
To process deposits, withdrawals, and other financial transactions in Philippine Peso (PHP) using your selected payment method.
To comply with PAGCOR regulatory requirements, anti-money laundering obligations under Republic Act 9160, and other applicable Philippine law.
To detect, investigate, and prevent fraud, multi-accounting, match-fixing, and other prohibited activities as described in the okllay Terms & Conditions.
To operate and improve the okllay platform, including personalizing the game lobby, sportsbook, and promotional offers based on your preferences.
To provide customer support, respond to inquiries, and resolve disputes submitted through okllay's live chat, email, or Messenger channels.
To send you account-related communications, including deposit confirmations, withdrawal notifications, and responsible gaming alerts.
To send you promotional communications about okllay bonuses, new games, and special offers — but only where you have provided consent or where a legitimate interest applies, and always with an option to opt out.
To monitor gambling patterns for responsible gaming purposes and to enforce deposit limits, loss limits, self-exclusion requests, and other player protection tools.
To conduct internal analytics, platform performance testing, and service quality audits.

okllay will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or having a separate lawful basis for doing so under the Data Privacy Act of 2012.

6. Legal Bases for Processing

Every instance of personal data processing at okllay rests on one or more of the following lawful bases recognized under the Philippine Data Privacy Act of 2012:

Consent: Where you have given okllay your clear and informed consent for a specific processing purpose, such as receiving marketing communications or enabling optional analytics features. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
Contractual Necessity: Processing that is necessary to perform the contract between you and okllay — namely, providing you with a functioning player account, processing your transactions, and delivering the games and services you have requested.
Legal Obligation: Processing required to comply with Philippine laws and regulations applicable to okllay, including PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160 as amended), the Data Privacy Act (RA 10173), and tax reporting obligations.
Legitimate Interests: Processing necessary for the legitimate interests of okllay or a third party, provided those interests are not overridden by your fundamental rights and freedoms. This basis applies to fraud prevention, platform security, responsible gaming monitoring, and internal analytics.
Vital Interests: In exceptional circumstances, okllay may process data to protect the vital interests of a player or another person, for example in the context of a self-exclusion request made on welfare grounds.

7. Sharing Your Personal Data

okllay does not sell, rent, or trade your personal data to any third party. okllay may share your data only in the following circumstances and only to the extent strictly necessary:

Payment Processors: GCash (G-Xchange Inc.), BPI, BDO, Metrobank, PayMaya, and other payment service providers receive the financial data necessary to process your deposits and withdrawals. Each provider operates under its own privacy policy and applicable Philippine financial regulation.
Identity Verification Providers: Third-party KYC and age verification service providers may receive copies of your identity documents and biometric data solely for the purpose of verifying your account.
Game Software Providers: okllay's third-party game studios and live casino operators receive anonymized or pseudonymized session data necessary to deliver game functionality. These providers are contractually prohibited from using such data for their own marketing purposes.
Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Bureau of Internal Revenue (BIR), and other competent Philippine authorities may receive your data where okllay is legally required or compelled to disclose it.
Law Enforcement: okllay may disclose personal data to Philippine law enforcement agencies in response to a valid court order, subpoena, or other lawful process.
Professional Advisers: okllay's legal counsel, auditors, and compliance consultants may access personal data on a strictly need-to-know basis and are bound by confidentiality obligations.
Business Transfers: In the event of a merger, acquisition, or sale of okllay assets, personal data held by okllay may be transferred to the acquiring entity subject to equivalent data protection obligations. Affected players will be notified in advance.

Important: okllay requires all third-party data processors to implement appropriate technical and organizational security measures and to process personal data only on okllay's documented instructions. okllay remains accountable as Personal Information Controller for all such processing.

8. Cookies & Tracking Technologies

okllay uses cookies and similar tracking technologies on the okllay platform to provide essential functionality, improve the player experience, and support security and analytics operations. A cookie is a small text file stored on your device when you visit a website.

okllay uses the following categories of cookies:

Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing identifiers. These cookies cannot be disabled without impairing core platform functionality.
Functional Cookies: Remember your preferences such as language, preferred game categories, and responsible gaming settings to provide a more personalized experience during subsequent visits.
Analytical Cookies: Collect aggregated, anonymized data about how players navigate the okllay platform, which pages are visited most frequently, and where technical issues occur. This data is used to improve platform performance and game content.
Security Cookies: Support fraud detection, multi-account identification, and session integrity monitoring to keep your okllay account safe.

You may manage your cookie preferences through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, or receive a warning before a cookie is stored. Please note that disabling certain cookies may affect the functionality of parts of the okllay platform, including login persistence and responsible gaming preference retention.

okllay does not use cookies to serve third-party advertising or to track your activity across unrelated websites. All tracking on the okllay platform is for internal operational purposes only.

9. Data Retention

okllay retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable Philippine law. The following retention periods apply as a general guide:

Active Account Data: Retained for the duration of your account's active status plus a minimum of five (5) years after account closure, in accordance with PAGCOR record-keeping requirements and AML obligations.
Transaction Records: Financial transaction data (deposits, withdrawals, wager history) is retained for a minimum of five (5) years from the date of each transaction, consistent with BIR and AMLC requirements.
KYC / Identity Documents: Copies of government-issued IDs and verification documents are retained for five (5) years following account closure or the last regulated transaction, whichever is later.
Support Communications: Live chat transcripts, support ticket records, and email correspondence are retained for three (3) years from the date of the interaction.
Marketing Consent Records: Records of your marketing consent or opt-out status are retained for the lifetime of your account and for three (3) years thereafter, to evidence compliance with applicable law.
Technical / Log Data: Server logs, IP address records, and session data are retained for a rolling twelve (12) month period, after which they are anonymized or deleted.

Upon expiry of the applicable retention period, okllay will securely delete or anonymize your personal data. Where data cannot be immediately deleted due to backup or archival constraints, it will be isolated from active processing systems until deletion is possible.

10. Data Security

okllay implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Key security measures in place include:

End-to-end 256-bit SSL/TLS encryption for all data transmitted between your device and the okllay platform.
Encrypted storage of sensitive data, including payment details and identity documents, using industry-standard encryption algorithms.
Role-based access controls limiting employee access to personal data strictly to those with a verified operational need.
Regular independent security audits and penetration testing of the okllay platform infrastructure.
Multi-factor authentication requirements for all internal okllay staff accounts with access to personal data systems.
Incident response procedures in place for prompt detection, containment, and reporting of any data security incident to the National Privacy Commission (NPC) within the timeframe required by law.

While okllay takes every reasonable precaution to protect your data, no online platform can guarantee absolute security. You are also responsible for maintaining the confidentiality of your okllay account credentials and for notifying support immediately if you suspect unauthorized access to your account.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, okllay will notify affected players and the NPC in accordance with the breach notification requirements of the Data Privacy Act and its Implementing Rules.

11. Your Data Rights

As a data subject under the Philippine Data Privacy Act of 2012, you hold the following rights in respect of your personal data held by okllay. These rights may be exercised at any time by contacting okllay through the channels described in Section 15:

Right to Access

Request a copy of the personal data okllay holds about you and information about how it is being processed.

Right to Rectification

Request correction of inaccurate or incomplete personal data held by okllay without undue delay.

Right to Erasure

Request deletion of your personal data where it is no longer necessary for the purpose collected, subject to okllay's legal retention obligations.

Right to Object

Object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.

Right to Portability

Receive a structured, machine-readable copy of personal data you have provided to okllay, where technically feasible.

Right to Withdraw Consent

Withdraw any consent previously given to okllay at any time without affecting the lawfulness of processing carried out before withdrawal.

Right to Damages

Claim compensation for any damages sustained as a result of inaccurate, incomplete, outdated, or unlawfully obtained personal data held by okllay.

Right to Complain

Lodge a complaint with the Philippine National Privacy Commission (NPC) if you believe okllay has violated your data privacy rights.

okllay will respond to all verifiable data rights requests within thirty (30) calendar days of receipt. In complex cases, this period may be extended by a further thirty (30) days, and you will be notified of such extension. okllay may require proof of identity before processing any data rights request to protect against unauthorized access.

12. Children & Minors

The okllay platform is strictly intended for adults aged 21 years and above, consistent with Philippine gaming law and PAGCOR regulations. 21+

okllay does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the okllay account registration process, and okllay reserves the right to request documentary proof of age from any player at any time.

If okllay becomes aware that it has inadvertently collected personal data from a person under the age of 21, okllay will immediately suspend the associated account, delete all personal data collected in connection with that account, and reverse any financial transactions made on the account to the extent technically possible. okllay may also report the incident to PAGCOR and other relevant Philippine authorities as required.

If you are a parent or guardian and believe that a minor under your care has registered an okllay account, please contact okllay support immediately using the contact details in Section 15.

13. Cross-Border Data Transfers

The okllay platform serves players across the Philippines, from Luzon to Visayas to Mindanao. In certain circumstances, personal data collected by okllay may be transferred to, stored on, or processed by systems or service providers located outside the Philippines — for example, cloud infrastructure providers, international game studio partners, or global fraud detection services.

Any cross-border transfer of personal data by okllay will be conducted only where at least one of the following safeguards applies:

The receiving country or organization has been assessed by the NPC as providing an adequate level of data protection.
The transfer is governed by a Data Sharing Agreement or Data Processing Agreement incorporating the NPC's standard contractual clauses or equivalent enforceable protections.
You have provided your explicit consent to the transfer after being informed of the possible risks.
The transfer is necessary for the performance of your account contract with okllay (e.g., processing a GCash withdrawal that routes through an international payments gateway).

okllay will always ensure that cross-border recipients of your personal data are bound by data protection obligations at least equivalent to those applicable under Philippine law.

14. Changes to This Privacy Policy

okllay may update or revise this Privacy Policy from time to time to reflect changes in applicable Philippine law, NPC guidance, PAGCOR regulatory requirements, or okllay's internal data processing practices. The effective date at the top of this page will be updated whenever a material change is made.

Where changes are material — for example, a new purpose for processing your data or a new category of third-party recipients — okllay will provide advance notice to registered players via email, in-platform notification, or a prominent notice on the okllay website, at least fifteen (15) days before the changes take effect.

Your continued use of the okllay platform after the effective date of any revised Privacy Policy constitutes your acknowledgment of the updated terms. If you disagree with any changes, you may exercise your right to erasure or account closure as described in Sections 11 and 15.

okllay recommends that all players review this Privacy Policy periodically. Archived versions of prior Privacy Policy versions are available upon request by contacting okllay support.

15. Contact Us & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about okllay's data handling practices, please reach out to the okllay Data Protection Officer through the following channels. All contact details are provided as plain text and are not clickable links.

Live Chat: Available 24/7 within the okllay platform — the fastest way to reach us
Email: [email protected]
Subject Line: Please include "Privacy Request" or "Data Rights" in the subject of your email so our DPO team can prioritize your inquiry
Messenger / Viber: Available via the official okllay channels
Response Time: okllay aims to acknowledge all privacy-related inquiries within 72 hours and to provide a substantive response within 30 calendar days

Regulatory Complaints: If you are not satisfied with okllay's response to a privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines. The NPC is the independent government body responsible for enforcing the Data Privacy Act of 2012. Information on how to file a complaint with the NPC is available on the NPC's official website.

Contents