okji Privacy Policy

The data controller responsible for your personal information is okji Asia Ltd. ("okji"), the operator of the online gaming platform available at okji.asia. okji is the entity that determines the purposes and means of processing personal data collected through the Platform, in its capacity as data controller under the Philippine Data Privacy Act of 2012.

okji has appointed a Data Protection Officer ("DPO") responsible for overseeing the company's data protection obligations and serving as the primary contact point for data subject rights requests. Contact details for the DPO are provided in Section 14 of this Policy.

This Policy applies to all personal data collected, processed, and stored by okji in connection with:

• Your registration and maintenance of an okji player account;
• Your use of any game, feature, or service offered on the okji Platform;
• Deposits, withdrawals, and financial transactions conducted through your okji account;
• Your communications with okji's customer support team;
• Your participation in any okji promotional offer, bonus, tournament, or VIP program;
• Your visits to the okji website, including browsing behaviour and technical interaction data captured through cookies and similar technologies.

This Policy does not apply to third-party websites, applications, or services that may be linked to or from the okji Platform. okji is not responsible for the privacy practices of any third-party operators. Players are encouraged to review the privacy policies of any third parties whose services they access.

By registering an account, accessing the Platform, or otherwise providing personal data to okji, you acknowledge that you have read this Policy and consent to the collection and processing of your personal data as described herein.

okji collects personal data in the following categories:

3.1 Identity and Registration Data

When you create an okji account, we collect your full legal name, date of birth, nationality, residential address in the Philippines, email address, and Philippine mobile phone number. This information is required to establish your identity, verify your eligibility to use the Platform, and comply with PAGCOR KYC requirements.

3.2 Government Identity Documents

As required by PAGCOR regulations and anti-money-laundering obligations, okji collects copies of government-issued photo identification documents — such as a Philippine passport, driver's licence, SSS card, PhilHealth ID, or Unified Multi-Purpose ID (UMID) — for identity verification purposes. We may also collect proof of address documentation and, in certain circumstances, documentation regarding the source of deposited funds.

3.3 Financial and Transaction Data

okji collects information about deposits, withdrawals, and wagering activity on your account, including transaction amounts, dates, payment methods used (such as GCash, PayMaya, BDO, BPI, or Metrobank account identifiers), and transaction reference numbers. We do not store full payment card numbers or GCash PIN codes on our servers.

3.4 Gaming Activity Data

We record data about your gaming activity on the Platform, including games played, bet amounts, win and loss history, session duration, and feature usage. This data is used for account management, bonus administration, responsible gaming monitoring, and regulatory reporting purposes.

3.5 Technical and Device Data

When you access the okji Platform, we automatically collect certain technical data including your IP address, device type and operating system, browser type and version, device identifiers, and connection information. This data is used for security, fraud prevention, and Platform performance optimisation purposes.

okji processes your personal data for the following purposes:

• Account Registration and Management: To create, maintain, and administer your okji player account, verify your identity, and manage your login credentials.
• Service Delivery: To provide access to games, process wagers, calculate and pay winnings, and deliver the full range of okji Platform features to you.
• Payment Processing: To process deposits and withdrawals through your linked GCash, PayMaya, or bank account, and to maintain accurate records of all financial transactions on your account.
• KYC and Regulatory Compliance: To verify your identity and age (21+) as required by PAGCOR, and to fulfil okji's obligations under the Anti-Money Laundering Act of 2001 (Republic Act No. 9160, as amended) and related AMLC regulations.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, account compromise, collusion, money laundering, and other prohibited conduct as defined in okji's Terms & Conditions.
• Responsible Gaming: To monitor gaming activity for indicators of problem gambling behaviour, to administer self-exclusion and deposit limit requests, and to comply with PAGCOR's responsible gaming requirements.
• Customer Support: To respond to your support queries, resolve complaints, and communicate important account-related information.
• Promotions and Bonuses: To administer bonus offers, VIP rewards, tournaments, and promotional campaigns for which you have opted in or are eligible based on your account activity.
• Platform Improvement: To analyse aggregated usage patterns and player behaviour (in anonymised form) to improve the Platform's performance, user experience, and game offering.
• Legal Obligations: To comply with applicable Philippine laws, court orders, regulatory directions from PAGCOR or the National Privacy Commission ("NPC"), and requests from law enforcement authorities.

okji processes personal data on the following lawful bases under the Philippine Data Privacy Act of 2012:

• Contractual Necessity: Processing your identity, contact, financial, and gaming data is necessary for okji to perform its obligations under the account agreement with you — including providing access to games, processing payments, and administering your account.
• Legal Obligation: Processing identity verification data, transaction records, and regulatory reports is required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act, the Data Privacy Act, and other applicable Philippine laws.
• Legitimate Interest: Processing technical, device, and usage data for fraud prevention, security monitoring, and Platform improvement is justified by okji's legitimate interest in maintaining a secure and reliable gaming environment for all players.
• Consent: Where okji seeks to send you promotional communications or use your data for purposes beyond those described above, we will obtain your explicit consent and provide a clear mechanism for you to withdraw that consent at any time.

The okji Platform uses cookies and similar tracking technologies to enhance your experience, maintain your login session, remember your preferences, and collect anonymous usage analytics data. Cookies are small text files stored on your device by your browser when you visit okji.asia.

6.1 Essential Cookies

Essential cookies are required for the okji Platform to function correctly. They maintain your login session, enable secure authentication, and support core Platform features. Essential cookies cannot be disabled without affecting the functionality of your okji account.

6.2 Analytics Cookies

okji uses analytics cookies to collect aggregated, anonymised data about how players navigate and interact with the Platform. This data helps okji improve the user experience and game offering. Analytics data is not linked to individual player identities in the reports we review.

6.3 Preference Cookies

Preference cookies remember your language settings, display preferences, and game lobby configurations so that your personalised settings are retained between sessions.

6.4 Managing Cookies

You may configure your browser to block or delete cookies at any time. Please note that disabling essential cookies will impair your ability to access the okji Platform and may prevent you from logging in to your account. Browser-level cookie management instructions are available in the help documentation of your specific browser.

okji does not sell your personal data. We share personal data only in the following circumstances:

• Regulatory Authorities: We share data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies as required by law or regulatory direction.
• Payment Processors: We share necessary financial data with GCash (Mynt), PayMaya (Voyager Innovations), BDO Unibank, Bank of the Philippine Islands, Metrobank, and other payment service providers to process your deposit and withdrawal transactions. These providers operate under their own privacy policies and regulatory obligations.
• Game Providers: Technical session identifiers may be shared with okji's licensed game providers (such as Pragmatic Play, Evolution, and NetEnt) to enable game delivery. Game providers do not receive your full identity information.
• Identity Verification Services: We engage third-party KYC and identity verification service providers to assist with verifying the authenticity of identity documents you submit. These providers are contractually bound to process your data only for verification purposes and to maintain appropriate security standards.
• IT and Security Service Providers: We work with cloud infrastructure and cybersecurity providers who process technical data on our behalf under data processing agreements that restrict their use of your data to the services they provide to okji.
• Legal Proceedings: We may disclose personal data to law enforcement authorities, courts, or legal advisors where required by a valid court order, subpoena, or other lawful legal process.

All third-party service providers engaged by okji are required to implement appropriate technical and organisational security measures and are prohibited from using your personal data for their own commercial purposes.

Some of okji's service providers — including game providers and cloud infrastructure partners — may be located outside the Philippines and may process your personal data in data centres located in other countries. Where such transfers occur, okji ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required by the Philippine Data Privacy Act.

Safeguards used for international data transfers include contractual clauses in data processing agreements with service providers, requiring them to maintain security standards and data subject rights protections consistent with Philippine law.

okji retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to applicable legal and regulatory minimum retention requirements:

• Account Data: Retained for the duration of your account's active status plus a minimum of five (5) years following account closure, as required by PAGCOR licensing conditions and applicable anti-money-laundering regulations.
• KYC / Identity Documents: Retained for a minimum of five (5) years from the date of account closure or the last transaction, in compliance with the Anti-Money Laundering Act requirements.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, as required by applicable Philippine financial regulations.
• Gaming Activity Logs: Retained for a period of three (3) years following the relevant gaming session, for dispute resolution, regulatory reporting, and responsible gaming monitoring purposes.
• Support Communications: Retained for three (3) years from the date of the last communication, for quality assurance and dispute resolution purposes.
• Technical and Analytics Data: Anonymised analytics data may be retained indefinitely. Identifiable technical logs are retained for a rolling period of twelve (12) months.

Upon expiry of applicable retention periods, personal data will be securely deleted or irreversibly anonymised. Data subject to ongoing legal proceedings, regulatory investigations, or unresolved disputes will be retained until the relevant matter is concluded.

okji implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, and destruction. Our security framework includes:

• Transport Encryption: All data transmitted between your device and okji's servers is encrypted using 256-bit SSL/TLS protocols, the same standard used by major Philippine banks.
• Password Security: Passwords are stored using industry-standard cryptographic hashing algorithms. Plain-text passwords are never stored on okji's systems.
• Two-Factor Authentication (2FA): Players may enable 2FA on their accounts for an additional layer of login security beyond the password.
• Access Controls: Internal access to player personal data is restricted to authorised employees who require that access to perform their job functions, governed by role-based access control policies.
• Intrusion Detection: okji's infrastructure is monitored continuously for unusual access patterns, attempted intrusions, and anomalous data access events.
• Vulnerability Management: okji conducts regular security assessments, penetration testing, and software vulnerability scans to identify and address security risks proactively.

10.1 Data Breach Notification

In the event of a personal data breach that is likely to result in significant risk to affected individuals, okji will notify the Philippine National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular 16-03. Affected players will be notified promptly once the breach has been assessed and notifications have been prepared.

Under the Philippine Data Privacy Act of 2012, as a data subject you have the following rights with respect to your personal data held by okji:

To exercise any of the above rights, please contact okji's Data Protection Officer using the contact details in Section 14. okji will respond to data subject rights requests within thirty (30) days of receipt. In cases of complex or high-volume requests, this period may be extended by a further thirty (30) days with prior notification.

The okji Platform is strictly restricted to individuals who are at least twenty-one (21) years of age. okji does not knowingly collect personal data from individuals under 21 years of age. The Platform's age verification process is designed to prevent minors from accessing real-money gaming services.

If okji becomes aware that personal data has been collected from an individual under 21 years of age — whether through a false age declaration at registration or any other means — okji will immediately suspend the relevant account, delete all associated personal data to the extent not required for regulatory reporting, and report the matter to PAGCOR as required.

If you are a parent or guardian and believe that a minor has created an okji account using false age information, please contact okji's customer support team immediately.

okji reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable laws, regulatory requirements, our data processing practices, or the features of the okji Platform. The "Last Updated" date at the top of this Policy reflects the date of the most recent revision.

Where a proposed amendment materially affects the rights of registered Players or the way okji processes their personal data, okji will provide advance notice via email to the registered address associated with affected accounts, at least fourteen (14) days before the changes take effect.

Continued use of the okji Platform following the effective date of any policy amendment constitutes acceptance of the updated Policy. If you do not accept the changes, you should cease using the Platform and may close your account in accordance with the procedure described in the okji Terms & Conditions.

Historical versions of this Privacy Policy are available on request by contacting okji's Data Protection Officer.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data rights under the Philippine Data Privacy Act of 2012, please contact okji's Data Protection Officer through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, accessible from your okji account dashboard. Please select "Privacy / Data Request" as the subject category.
• Email: [email protected] — subject line: "Privacy Policy / Data Subject Request"

Please include your full name and the email address registered to your okji account in all data subject rights requests to allow us to verify your identity and locate your records accurately. okji will not process data subject rights requests from individuals whose identity cannot be verified.

If you are not satisfied with okji's response to a data privacy concern, you have the right to lodge a complaint with the Philippine National Privacy Commission (NPC). The NPC is the independent government authority responsible for administering the Data Privacy Act of 2012 and can be contacted through official Philippine government channels.