okspin Privacy Policy — How We Handle Your Personal Data

This Privacy Policy ("Policy") describes how okspin ("okspin", "we", "us", "our") collects, uses, stores, discloses, and protects the personal information of individuals ("Player", "User", "you") who access or use the okspin online gaming platform at okspin.cam and any associated browser-based or mobile interfaces (the "Platform").

okspin is committed to protecting the privacy of every Filipino player who registers and plays on the Platform. This Policy is prepared in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations ("IRR"), and the issuances of the National Privacy Commission ("NPC") of the Philippines.

By creating an okspin account or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform and contact okspin support to request account closure.

Under the Philippine Data Privacy Act, okspin acts as the Personal Information Controller ("PIC") with respect to the personal data of players on the Platform. As PIC, okspin determines the purposes and means by which your personal information is processed.

Third-party service providers engaged by okspin — including payment processors, identity verification services, and game software providers — may act as Personal Information Processors ("PIP") when processing your data on okspin's behalf and pursuant to okspin's instructions. okspin ensures that all PIPs are contractually bound to process your data only as directed by okspin and in compliance with applicable Philippine data protection law.

For all data privacy enquiries, you may contact okspin's Data Protection Officer ("DPO") at the contact details provided in Section 15 of this Policy.

okspin collects the following categories of personal data from players:

okspin does not collect sensitive personal information as defined under the Philippine DPA (such as race, religion, health data, or political opinion) unless specifically required by law (e.g., for responsible gaming interventions) and with your explicit consent.

okspin collects personal data through the following channels:

• Direct collection: Information you provide when registering an okspin account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotional activities.
• Automated collection: Technical and usage data collected automatically through cookies, web beacons, server logs, and similar technologies when you access the okspin Platform from any device or browser.
• Payment processors: Transaction confirmation data received from GCash, Maya, GrabPay, QR Ph, BPI, BDO, Metrobank, and 7-Eleven CLiQQ when you make a deposit or withdrawal.
• Identity verification providers: Results of identity and age verification checks conducted by okspin's third-party KYC partners when you submit your government-issued ID.
• Game providers: Aggregated or session-level gaming activity data from JILI, Pragmatic Play, PG Soft, and other software providers whose games are offered on the okspin Platform.

okspin processes your personal data for the following purposes and under the indicated legal bases under the Philippine DPA:

• Account registration and management — To create and maintain your okspin player account. Legal basis: Performance of contract.
• Identity and age verification (KYC) — To confirm that you are who you say you are and that you are at least 21 years of age as required for okspin platform access. Legal basis: Legal obligation; performance of contract.
• Processing deposits and withdrawals — To facilitate GCash, Maya, and other Philippine payment transactions. Legal basis: Performance of contract.
• Fraud prevention and anti-money laundering (AML) — To detect, investigate, and prevent fraudulent transactions, money laundering, and other financial crimes in compliance with Philippine AML regulations. Legal basis: Legal obligation; legitimate interest.
• Customer support — To respond to your enquiries, resolve disputes, and provide technical assistance via live chat or email. Legal basis: Performance of contract; legitimate interest.
• Responsible gaming — To identify signs of problem gambling, enforce voluntary limits, and apply self-exclusion requests in accordance with the okspin Responsible Gaming Policy. Legal basis: Legal obligation; legitimate interest.
• Marketing and promotional communications — To send you information about okspin promotions, bonuses, and new games where you have provided consent. Legal basis: Consent. You may withdraw consent at any time by contacting okspin support.
• Platform security and improvement — To monitor and improve the technical performance, security, and functionality of the okspin Platform. Legal basis: Legitimate interest.
• Regulatory compliance — To comply with applicable Philippine laws, regulations, and the lawful requests of regulatory authorities. Legal basis: Legal obligation.

okspin does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Your data is shared only with the following categories of recipients and only to the extent necessary for the purposes described in Section 5:

• Payment processors: GCash (Mynt / Globe Fintech Innovations), Maya (PayMaya Philippines), GrabPay, Bancnet/Instapay operators, BPI, BDO, Metrobank, and 7-Eleven CLiQQ — for processing your deposits and withdrawals.
• Identity verification providers: Third-party KYC service providers engaged to verify your identity and age using your submitted government-issued ID.
• Game software providers: JILI, Pragmatic Play, PG Soft, Evolution Gaming, and other licensed game providers — to enable game session delivery and resolve game-related disputes.
• Fraud prevention and AML services: Specialist third-party services engaged to detect suspicious activity, prevent fraud, and fulfil Philippine AML compliance obligations.
• IT and cloud service providers: Infrastructure, hosting, and security service providers who process data on okspin's behalf under strict data processing agreements.
• Regulatory authorities: The National Privacy Commission, law enforcement agencies, and other Philippine regulatory bodies, where disclosure is required by law, court order, or valid regulatory demand.
• Professional advisors: Lawyers, auditors, and insurers engaged by okspin, subject to professional confidentiality obligations.

okspin retains your personal data for as long as is necessary to fulfil the purposes described in this Policy, including compliance with legal, accounting, and regulatory obligations. Specific retention periods applicable to okspin are as follows:

• Active account data: Retained for the duration of your account's existence on the okspin Platform.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with Philippine AML regulations and financial record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years following account closure or the last transaction date, whichever is later.
• Support communication records: Retained for three (3) years from the date of the last communication.
• Marketing consent records: Retained until you withdraw consent, or for three (3) years from the date of last marketing interaction, whichever is earlier.
• Self-exclusion records: Retained indefinitely to prevent re-registration by excluded players, or for the minimum period required by applicable regulations.

Following the applicable retention period, personal data is securely deleted, anonymised, or pseudonymised in accordance with okspin's data disposal procedures.

okspin implements organisational and technical security measures designed to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the okspin Platform, including all login sessions, deposits, and withdrawals.
• Encryption of sensitive data at rest, including stored payment references and identity document copies.
• Access controls: Role-based access controls limiting okspin staff access to player data on a strict need-to-know basis, with all access logged and audited.
• Two-factor authentication (2FA) available to all players for additional account security.
• Regular security audits and penetration testing of the okspin Platform infrastructure.
• Staff training on data privacy obligations under the Philippine DPA conducted upon onboarding and annually thereafter.

While okspin takes reasonable and proportionate security measures, no online system can guarantee absolute security. You are responsible for maintaining the security of your own account credentials. See Section 3 of the okspin Terms & Conditions for your account security obligations.

In the event of a personal data breach that poses a real risk of serious harm to affected players, okspin will notify the National Privacy Commission within 72 hours of becoming aware of the breach and will notify affected players as soon as reasonably practicable, in accordance with the Philippine DPA Breach Notification requirements.

The okspin Platform uses cookies and similar tracking technologies to operate certain platform functions, improve user experience, and gather statistical information about Platform usage. The types of cookies used by okspin are as follows:

• Strictly necessary cookies: Required for the Platform to function correctly — including session management, login authentication, and security features. These cannot be disabled without affecting platform functionality.
• Functional cookies: Store your preferences (e.g., language settings, game history display) to personalise your okspin experience across sessions.
• Analytics cookies: Collect anonymised data on how players navigate the Platform, which pages are visited most frequently, and where technical errors occur. This helps okspin improve Platform performance and content.
• Session restore cookies: Used with the "Remember me" login option to maintain your session across browser closes on your personal device.

okspin does not use cookies to serve third-party advertising or to track your browsing activity on other websites. You may manage or delete cookies via your browser settings. Disabling strictly necessary cookies will affect your ability to use the okspin Platform.

The okspin Platform is strictly intended for individuals who are 21 years of age or older. okspin does not knowingly collect, process, or retain personal data from persons under the age of 21. This age restriction is aligned with Philippine regulatory requirements applicable to casino-style online gaming.

okspin implements age verification as part of the account registration and KYC process. Where okspin discovers or reasonably suspects that an account has been registered by a person under 21 years of age, okspin will:

• Immediately suspend the account and freeze any balance pending investigation.
• Permanently close the account and void all transactions associated with it.
• Delete all personal data collected in relation to the underage account, to the extent permitted or required by applicable law.
• Where required by law, report the matter to the appropriate Philippine authorities.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by okspin. You may exercise any of these rights by contacting okspin's Data Protection Officer using the details in Section 15.

okspin will respond to all data subject rights requests within 15 business days of receipt. Where a request is complex or voluminous, okspin may extend this period by a further 15 business days with written notice and explanation. Exercising these rights will not result in any penalty or adverse treatment of your okspin account.

The okspin Platform is primarily served from servers located in or near the Philippines to minimise latency for Filipino players. However, certain third-party service providers — including game software companies, cloud infrastructure providers, and KYC partners — may be located outside the Philippines.

Where personal data is transferred outside the Philippines, okspin ensures that such transfers comply with the cross-border data transfer provisions of the Philippine DPA. Specifically, okspin ensures that:

• The recipient country provides an adequate level of protection for personal data as recognised by the NPC, or
• Appropriate contractual safeguards (such as standard contractual clauses approved by the NPC) are in place with the recipient entity, or
• The transfer is necessary for the performance of the contract between you and okspin (e.g., processing your game session with an overseas game server), or
• You have provided explicit consent to the transfer after being informed of the risks associated with inadequate protections in the destination jurisdiction.

If you have a concern about how okspin has handled your personal data, we encourage you to contact okspin's Data Protection Officer in the first instance (see Section 15). okspin will investigate all privacy complaints and respond within 15 business days.

If you are not satisfied with okspin's response to your complaint, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Philippines, which is the government body responsible for administering and enforcing the Philippine Data Privacy Act.

okspin reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, okspin's data processing practices, or the services offered on the Platform. The date of the most recent revision is displayed at the top of this Policy.

Material changes to this Policy — i.e., changes that materially affect your rights or the way okspin uses your personal data — will be communicated to you via a notice on the okspin Platform, by email to your registered address, or by SMS to your registered Philippine mobile number, at least seven (7) days before the change takes effect where operationally practicable.

Your continued use of the okspin Platform following the effective date of any amendment constitutes your acknowledgement of the revised Policy. If you do not accept the amended Policy, you must cease using the Platform and request account closure via okspin support.

For all data privacy enquiries, data subject rights requests, or privacy complaints, please contact okspin's Data Protection Officer using the following details:

Please include "Privacy Request" or "Data Subject Rights" in the subject line of your email or at the start of your live chat message so that your enquiry is routed directly to the okspin DPO team. okspin will acknowledge receipt of your request within two (2) business days and respond in full within fifteen (15) business days.