okttt Privacy Policy

1.1   This Privacy Policy ("Policy") describes how okttt ("the Company," "we," "us," or "our") collects, uses, processes, discloses, and safeguards the personal data of individuals ("you," "your," or "the Player") who access or use the okttt gaming platform at okttt.co and any associated services.

1.2   okttt is committed to protecting the privacy and security of the personal information of all users in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the applicable circulars and guidelines issued by the National Privacy Commission ("NPC") of the Philippines.

1.3   By registering an Account on the okttt Platform, you acknowledge that you have read and understood this Policy and consent to the collection, use, and processing of your personal data as described herein. If you do not agree with this Policy, you must not register an account or use the Platform.

1.4   This Policy should be read together with the Terms and Conditions and the Responsible Gaming Policy, all of which form part of the overall agreement between you and okttt.

2.1   For the purposes of the Philippine Data Privacy Act of 2012, okttt acts as the Personal Information Controller ("PIC") in respect of the personal data collected from Players and website visitors through the okttt Platform.

2.2   As the Personal Information Controller, okttt determines the purposes for which personal data is processed and ensures that all processing activities are conducted in accordance with the principles of transparency, legitimate purpose, and proportionality as mandated by RA 10173.

2.3   okttt has designated a Data Privacy Officer ("DPO") responsible for overseeing compliance with this Policy and applicable data protection laws. Contact details for the DPO are provided in Section 16 of this Policy.

3.1   Personal Information Provided by You. When you register, verify, and use your okttt Account, we collect the following categories of personal data directly from you:

3.2   Technical and Usage Data Collected Automatically. When you access the okttt Platform, we automatically collect certain technical data:

• IP address and approximate geographic location derived from IP data;
• Device type, operating system, browser type and version;
• Session timestamps, pages visited, features used, and games played;
• Wagering activity, game outcomes, and betting patterns (for fraud detection and responsible gaming monitoring);
• Referral source (how you arrived at the okttt Platform).

3.3   Communications Data. Records of communications between you and the okttt support team via live chat or email, including transcripts, are retained for quality assurance and dispute resolution purposes.

4.1   okttt collects personal data through the following mechanisms:

• Direct collection: Data you provide when registering, completing KYC verification, making deposits or withdrawal requests, contacting support, or responding to surveys;
• Automated technical collection: Data collected through cookies, web server logs, and analytics tools as you navigate the Platform (see Section 10 for cookie details);
• Payment processors: Transaction confirmation data received from GCash, PayMaya, partner banks (BDO, BPI, Metrobank), and cryptocurrency processing services;
• Identity verification providers: Results and flags from third-party KYC verification services that process your submitted identity documents;
• Fraud prevention systems: Device fingerprinting and behavioural analytics data generated by our anti-fraud infrastructure;
• Public records: In limited circumstances and where permitted by law, publicly available information relevant to fraud prevention or regulatory compliance obligations.

5.1   okttt processes your personal data only for the specific purposes described below. We do not process personal data in ways that are incompatible with these stated purposes without first obtaining your explicit consent.

6.1   Under the Philippine Data Privacy Act of 2012, okttt processes personal data on the following legal grounds:

• Contractual necessity: Processing required to fulfil the contract between you and okttt as described in the Terms and Conditions — including account management, game access, and payment processing;
• Legal obligation: Processing required to comply with PAGCOR regulations, Anti-Money Laundering Act obligations, NPC directives, and other applicable Philippine laws;
• Legitimate interests: Processing necessary for fraud prevention, platform security, abuse detection, and responsible gaming monitoring, where such interests are not overridden by your data protection rights;
• Consent: Processing for optional purposes such as direct marketing communications, where you have provided explicit, freely given, and revocable consent.

7.1   okttt does not sell your personal data. We do not transfer, rent, or sell your personal information to third parties for their own commercial marketing purposes under any circumstances.

7.2   Your personal data may be shared with the following categories of third parties only to the extent necessary for the stated purpose:

• Payment processors and e-wallet providers (GCash, PayMaya, BDO, BPI, Metrobank, InstaPay, and cryptocurrency processing partners) — for the purpose of processing your financial transactions;
• Identity verification service providers — for the purpose of processing KYC document verification and liveness checks in connection with your account;
• Game content providers and live casino operators — limited technical data necessary to deliver real-time game experiences (e.g., session tokens; no identity data is transmitted);
• Fraud prevention and anti-money laundering screening services — for the detection and prevention of financial crime as required under the AMLA;
• Cloud infrastructure and data hosting providers — who process data on our behalf under strict data processing agreements and confidentiality obligations;
• Regulatory and law enforcement authorities — including PAGCOR, the Anti-Money Laundering Council (AMLC), and other competent Philippine authorities, where disclosure is required by law or lawful order;
• Professional advisers — including legal counsel, auditors, and compliance consultants, under obligations of professional confidentiality.

7.3   All third-party service providers who process personal data on behalf of okttt are required to enter into data processing agreements that mandate compliance with RA 10173 and prohibit any use of Player data beyond the specified purpose.

8.1   okttt retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law, whichever is longer.

8.2   The following retention schedules apply:

• Active account data: Retained for the duration of the active account relationship plus five (5) years following account closure, to satisfy anti-money laundering record-keeping obligations under Philippine law;
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction as required by PAGCOR and AMLC regulations;
• KYC verification documents: Retained for five (5) years after account closure or the conclusion of any regulatory investigation, whichever is later;
• Customer support communications: Retained for three (3) years from the date of the interaction;
• Marketing consent records: Retained until consent is withdrawn, plus one (1) year for audit trail purposes;
• Technical logs (server and access logs): Retained for twelve (12) months.

8.3   Upon the expiry of applicable retention periods, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.

9.1   okttt implements and maintains appropriate technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and the okttt Platform is encrypted using 256-bit TLS encryption;
• Password hashing: Account passwords are processed using a strong cryptographic hashing algorithm with unique salts; plain-text passwords are never stored;
• Access controls: Internal access to personal data is restricted on a need-to-know basis with role-based access controls, multi-factor authentication for all staff, and comprehensive audit logging;
• Encryption at rest: Sensitive data categories (identity documents, financial data) are stored using encryption at rest on secured servers;
• Penetration testing: The okttt Platform undergoes regular third-party security assessments and penetration testing;
• Employee training: All personnel with access to personal data receive regular training on data privacy obligations and security best practices.

10.1   The okttt Platform uses cookies and similar tracking technologies to provide a functional, personalised, and secure user experience. A cookie is a small text file placed on your device by a web server and retrieved on subsequent visits to identify your browser session.

10.2   Types of Cookies Used:

• Strictly Necessary Cookies: Essential for Platform operation — authentication tokens, session management, load balancing, and security functions. These cannot be disabled without breaking Platform functionality;
• Functional Cookies: Store your preferences such as language settings, game lobby filters, and notification preferences to personalise your experience across sessions;
• Analytics Cookies: Collect anonymised data about how players navigate the Platform to help us identify usability issues and improve features. This data is aggregated and does not identify individuals;
• Fraud Prevention Cookies: Support device fingerprinting and behavioural analysis used to detect account takeover attempts and bonus abuse patterns.

10.3   You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging into the Platform. Analytics and functional cookies can be disabled without affecting core account access.

11.1   Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to the personal data okttt holds about you. These rights are exercisable by contacting our Data Privacy Officer as described in Section 16.

11.2   Requests to exercise data subject rights will be acknowledged within seventy-two (72) hours of receipt and responded to in full within thirty (30) calendar days, in accordance with NPC guidelines. Where a request is complex or involves a high volume of data, this period may be extended by a further thirty (30) days with notice provided to you.

11.3   okttt will not charge a fee for reasonable data subject access requests. Where requests are manifestly unfounded or excessive, we reserve the right to charge a reasonable administrative fee or decline the request, providing written reasons.

12.1   The okttt Platform is strictly prohibited to individuals under the age of twenty-one (21) years. This is a hard legal requirement under PAGCOR regulations and is non-negotiable.

12.2   okttt does not knowingly collect personal data from individuals under the age of 21. If we become aware that a minor has accessed the Platform or provided personal data, we will immediately suspend the relevant account, delete the associated data, and decline to process any pending transactions.

12.3   If you are a parent or guardian and believe that a minor in your care has registered an Account or provided personal data to okttt, please contact our Data Privacy Officer immediately at [email protected] so that the matter can be addressed without delay.

13.1   Some of okttt's third-party service providers (including cloud infrastructure, analytics, and game content providers) may process personal data on servers located outside the Philippines. In such cases, okttt ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under RA 10173.

13.2   Safeguards for cross-border data transfers include: contractual data protection clauses consistent with NPC guidelines; transfer to countries or organisations recognised as providing adequate data protection; and obtaining your explicit consent where required.

13.3   okttt will not transfer your personal data to jurisdictions that do not provide an adequate level of data protection without ensuring that appropriate contractual safeguards are first in place.

14.1   In the event of a personal data breach that poses a real risk of serious harm to affected individuals, okttt will notify the Philippine National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular No. 16-03.

14.2   Where a breach is likely to result in high risk to your rights and freedoms, okttt will also notify affected Players directly via email or in-platform notification without undue delay, providing: a description of the nature of the breach; the categories and approximate number of individuals and records affected; the likely consequences of the breach; and the measures taken or proposed to address the breach.

14.3   okttt maintains a Data Breach Response Plan which includes containment, assessment, notification, and remediation procedures. All breach incidents are logged and reviewed as part of our ongoing security improvement process.

15.1   okttt reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or the services we offer. The most current version of this Policy is always available at okttt.co/privacy-policy.

15.2   Material changes to this Policy will be communicated to registered Players via email notification and/or a prominent notice on the Platform at least seven (7) days before the changes take effect. For changes required by law or NPC directive, the amendment may take immediate effect with simultaneous notice.

15.3   Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must cease using the Platform and request account closure in accordance with the Terms and Conditions.

16.1   If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by okttt, please contact our Data Privacy Officer using the details below:

16.2   If you are not satisfied with the outcome of any privacy concern raised with okttt, you have the right to file a complaint with the National Privacy Commission of the Philippines. The NPC is the independent regulatory authority responsible for administering and implementing the Data Privacy Act of 2012 in the Philippines.

16.3   This Privacy Policy was last reviewed and updated on 1 January 2026 and is effective as of that date.