otsobet Privacy Policy

1. Introduction

otsobet respects your privacy and is committed to protecting your personal data in accordance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). As a PAGCOR-licensed online gaming platform serving Filipino players, otsobet is also subject to PAGCOR's data governance requirements and anti-money laundering (AML) regulations under Republic Act No. 9160, as amended.

This Privacy Policy applies to all personal data collected through the otsobet website, mobile platform, live chat support system, email correspondence, and any other channel through which you interact with the Company. It does not apply to third-party websites or services that may be linked from our platform.

2. Data Controller

otsobet is the personal information controller (PIC) responsible for your data as defined under the Data Privacy Act of 2012. The Company has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data privacy laws.

Contact details for data privacy matters are provided in Section 13 of this Policy. The registered Data Protection Officer can be reached via the support email address at [email protected] with the subject line "Data Privacy — DPO."

3. Personal Data We Collect

Depending on the nature of your interaction with otsobet, we may collect the following categories of personal data:

We do not collect sensitive personal information as defined under the DPA (such as health data, political affiliations, or religious beliefs) unless specifically required by law and with your explicit consent.

4. How We Collect Your Data

otsobet collects personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or participate in a promotion.
• Automatically: Through cookies, web beacons, server logs, and similar tracking technologies when you visit and interact with the otsobet platform. See Section 7 for details on cookies.
• From third parties: From identity verification service providers, payment processors (GCash, PayMaya, BPI, BDO, Metrobank), and fraud prevention services in connection with regulatory compliance obligations. We only receive data from third parties that are themselves authorised to share it with us.

5. Purpose and Legal Basis for Processing

otsobet processes your personal data for specific, legitimate purposes. The following table summarises our processing activities and their corresponding legal basis under the Data Privacy Act of 2012:

5.1 Contract Performance

Processing your registration information, managing your account, processing deposits and withdrawals, and operating games are necessary for the performance of our contract with you as a player.

5.2 Legal Obligation

KYC identity verification, AML transaction monitoring, age verification (21+ compliance), and record-keeping are required by PAGCOR regulations, the Anti-Money Laundering Act (AMLA), and the Data Privacy Act.

5.3 Legitimate Interests

Fraud detection, account security monitoring, platform improvement, and responsible gaming analytics are processed on the basis of our legitimate interest in maintaining a safe and compliant platform.

5.4 Consent

Marketing communications (SMS, email promotions, bonus notifications) are sent only with your explicit opt-in consent at registration or via your account communication preferences. You may withdraw this consent at any time from your account settings.

6. Sharing Your Personal Data

otsobet does not sell, rent, or trade your personal data. We may share your data only in the following limited circumstances:

• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, and card networks — solely to process your transactions.
• Identity verification providers: Third-party KYC service providers engaged to verify your identity documents in compliance with PAGCOR requirements.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies where disclosure is required by law or court order.
• Fraud and security services: Third-party providers that help us detect, prevent, and investigate fraud, cheating, and security incidents.
• Professional advisors: Legal, accounting, and compliance advisors bound by professional confidentiality obligations.

All third parties with whom otsobet shares personal data are required to maintain appropriate security standards and are prohibited from using your data for any purpose beyond the specific function they perform for us.

7. Cookies and Tracking Technologies

The otsobet platform uses cookies and similar technologies to operate correctly and improve the player experience. The following types of cookies are used:

• Strictly necessary cookies: Required for core platform functions such as login session management, security tokens, and preference storage. These cannot be disabled without affecting platform functionality.
• Analytical cookies: Used to understand how players interact with the platform — which games are most popular, how long sessions last, and where players encounter issues. This data is aggregated and anonymised wherever possible.
• Functional cookies: Remember your preferences such as language settings, last-viewed game categories, and display options.
• Security cookies: Used to detect and prevent fraudulent login attempts, identify unusual account activity, and enforce session timeout policies.

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will affect your ability to use the otsobet platform. We do not use third-party advertising cookies.

8. Data Retention

otsobet retains personal data for as long as necessary to fulfil the purposes described in this Policy and to comply with applicable legal and regulatory retention requirements:

• Active accounts: Personal data is retained for the full duration of your account's existence plus a post-closure retention period.
• Post-closure retention: Following account closure, we retain your identity, financial, and transaction records for a minimum of five (5) years in compliance with PAGCOR regulations and the Anti-Money Laundering Act.
• Support communications: Chat transcripts and email correspondence are retained for up to three (3) years to support dispute resolution.
• Anonymised analytics data: Aggregated usage data stripped of personal identifiers may be retained indefinitely for platform improvement purposes.

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised.

9. Security Measures

otsobet implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers;
• Encryption at rest for all sensitive data fields including passwords (bcrypt hashing) and payment data;
• Access controls — only authorised personnel with a documented business need may access personal data, under strict role-based permissions;
• Regular security audits, penetration testing, and vulnerability assessments by qualified third-party security professionals;
• Incident response procedures — in the event of a personal data breach that poses a risk to your rights and freedoms, otsobet will notify the National Privacy Commission and affected players within 72 hours of becoming aware of the breach, in accordance with NPC Circular 16-03.

While otsobet takes all reasonable precautions, no internet transmission or data storage system is completely secure. You are also responsible for maintaining the security of your own account credentials.

10. Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by otsobet:

To exercise any of these rights, contact the otsobet Data Protection Officer at [email protected] with subject line "Data Privacy Request." We will respond within 15 business days in accordance with NPC guidelines. Some requests may be subject to identity verification before processing.

11. Children's Privacy and Age Restriction

The otsobet platform is strictly intended for individuals 21 years of age or older, as required by PAGCOR regulations and Philippine law. We do not knowingly collect personal data from individuals under the age of 21.

If we discover or are notified that an account has been registered by a person under 21 years of age, we will immediately suspend the account, void any transactions associated with it, and permanently delete all personal data collected in connection with that account. If you believe an underage person has registered on our platform, please contact us immediately at [email protected].

12. Changes to This Privacy Policy

otsobet reserves the right to update this Privacy Policy to reflect changes in applicable law, PAGCOR regulations, our data processing activities, or platform functionality. Material changes will be communicated to registered players via the email address on file at least 14 days before the changes take effect.

The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. We encourage you to review this Policy periodically. Your continued use of the otsobet platform after the effective date of any changes constitutes your acceptance of the updated Policy.

13. Contact Us & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by otsobet, please contact our Data Protection Officer:

• Email: [email protected] (subject line: "Data Privacy — DPO")
• Response time: Within 15 business days for formal data subject requests; within 3 business days for general privacy enquiries
• Support hours: Philippine Standard Time (PST), extended weekday and weekend coverage

If you are not satisfied with our response, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. NPC contact information is publicly available through official Philippine government channels.