otsobet Privacy Policy

Introduction

otsobet ("we," "us," or "the Platform") is committed to protecting the personal information of all players who access and use our online gaming services at otsobet.biz. This Privacy Policy describes our practices regarding the collection, use, storage, disclosure, and protection of personal data provided by players in the Philippines and other eligible jurisdictions.

This policy is issued in compliance with Republic Act No. 10173 (the Philippine Data Privacy Act of 2012), its implementing rules and regulations, and the applicable issuances of the National Privacy Commission (NPC). It reflects our obligations under the regulatory framework administered by PAGCOR (Philippine Amusement and Gaming Corporation), which requires licensed online gaming operators to implement robust data protection measures.

We recognize that Filipino players entrust us with sensitive personal and financial information when they create an otsobet account, complete KYC verification, deposit via GCash or Maya, or interact with our platform. This trust is something we do not take lightly. Our data practices are designed to be transparent, proportionate, and consistent with your reasonable expectations as a user.

Data Controller

For the purposes of the Philippine Data Privacy Act and this Privacy Policy, otsobet acts as the Personal Information Controller (PIC) in respect of the personal data collected from players through the otsobet platform.

As Personal Information Controller, otsobet determines the purposes and means of processing your personal data and bears primary responsibility for compliance with applicable data protection laws. Where otsobet engages third-party service providers who process personal data on our behalf (such as payment processors and identity verification providers), those parties act as Personal Information Processors (PIPs) under written agreements that contractually bind them to handle your data only as instructed by otsobet and in compliance with applicable law.

If you wish to exercise any of your data subject rights, submit a complaint, or make an inquiry regarding otsobet's data practices, please contact our designated Data Protection Officer (DPO) using the contact details provided in Section 16 of this policy.

Personal Data We Collect

otsobet collects the following categories of personal data from players, as set out in the table below:

otsobet does not knowingly collect sensitive personal information beyond what is required for KYC compliance (such as government ID numbers), and such information is handled with heightened security measures. We do not collect health information, religious beliefs, political opinions, or biometric data beyond the selfie photograph required for identity verification purposes.

How We Collect Your Data

otsobet collects personal data through the following means:

• Direct Provision: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, submitting a support request, or updating your account profile.
• Automated Collection: Technical and behavioral data collected automatically through cookies, server logs, and similar tracking technologies when you access and use the otsobet platform. See Section 8 for details on our cookie practices.
• Third-Party Sources: Identity verification and fraud screening data received from our KYC and AML service providers, where applicable, in the process of verifying your identity or investigating suspected fraudulent activity.
• Payment Processors: Transaction confirmation data received from GCash, Maya, BPI, BDO, and other payment partners upon the successful processing of deposits or withdrawals.
• Regulatory Sources: Where required, data received from PAGCOR or other competent Philippine regulatory authorities in connection with compliance obligations.

Legal Basis for Processing

otsobet processes your personal data on the following legal bases under the Philippine Data Privacy Act and its implementing rules:

1. Contractual Necessity: Processing required to perform our contractual obligations to you under the otsobet Terms and Conditions — including account creation, game play, processing deposits and withdrawals, and providing customer support.
2. Legal Obligation: Processing required to comply with applicable Philippine laws, including PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), and the requirements of the National Privacy Commission under RA 10173.
3. Legitimate Interests: Processing carried out for legitimate business interests, including fraud prevention, platform security, abuse detection, and improvement of our services — provided those interests are not overridden by your rights and interests.
4. Consent: Processing based on your freely given, specific, and informed consent — particularly for marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

How We Use Your Personal Data

otsobet uses the personal data we collect for the following purposes:

• Account Management: Creating and administering your otsobet account, verifying your identity and age, and managing your account preferences and settings.
• Service Delivery: Enabling access to games, processing bets, settling winnings, and delivering the full range of otsobet's gaming and casino services.
• Financial Transactions: Processing GCash, Maya, and bank transfer deposits and withdrawals, maintaining accurate financial records, and resolving transaction disputes.
• KYC and AML Compliance: Verifying your identity in compliance with PAGCOR licensing conditions, conducting anti-money laundering checks, and fulfilling Suspicious Transaction Reporting (STR) obligations under Philippine law where applicable.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, account compromise, and other prohibited conduct on the platform.
• Responsible Gaming: Monitoring player activity to identify potential problem gaming patterns and proactively offer responsible gaming tools and support resources.
• Customer Support: Responding to your support inquiries, resolving complaints, and maintaining records of our communications.
• Platform Improvement: Analyzing aggregated, anonymized usage data to improve platform performance, fix bugs, and enhance the player experience.
• Legal and Regulatory: Complying with legal obligations, court orders, regulatory directives, and responding to lawful requests from PAGCOR and other competent Philippine authorities.
• Marketing (with consent): Sending you information about otsobet promotions, bonuses, and new game launches — only where you have provided your express consent to receive such communications. You may opt out at any time.

Data Sharing & Disclosure

otsobet does not sell your personal data. We do not share it with third parties for their own independent marketing purposes. We may, however, disclose your personal data in the following limited circumstances:

• Payment Processors: GCash, Maya, BPI, BDO, Metrobank, GrabPay, and other payment partners receive the transaction data necessary to process your deposits and withdrawals. These parties are independent data controllers for their own services and their privacy practices are governed by their own policies.
• KYC and Identity Verification Providers: Third-party identity verification services engaged by otsobet to perform document verification and biometric checks as part of the KYC process. These providers act as Personal Information Processors under written agreements.
• AML and Fraud Screening Services: Service providers that assist otsobet in screening transactions and accounts for money laundering indicators and fraudulent patterns, as required by the Philippine AMLA and PAGCOR conditions.
• Cloud and Infrastructure Providers: Technology service providers hosting otsobet's platform infrastructure, databases, and support systems, bound by data processing agreements.
• Regulatory and Law Enforcement Authorities: PAGCOR, the AMLC (Anti-Money Laundering Council), the National Privacy Commission, courts of competent jurisdiction, and other Philippine government authorities — where required by law, regulatory direction, or valid legal process.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of assets involving otsobet, player data may be transferred to the successor entity, subject to equivalent privacy protections. Players will be notified of any such material change.

All third-party processors engaged by otsobet are subject to written data processing agreements that require them to handle your data securely, use it only for the purposes specified, and comply with applicable Philippine data protection law.

Cookies & Tracking Technologies

otsobet uses cookies and similar tracking technologies to enable platform functionality, maintain your logged-in session, and analyze platform usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function correctly. These include session authentication cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without affecting your ability to use otsobet.
• Functional Cookies: Enable enhanced functionality and personalization, such as remembering your preferred game lobby view, language settings, and responsible gaming limit preferences between sessions.
• Analytics Cookies: Used to collect anonymized, aggregated information about how players use the otsobet platform — which pages are visited most frequently, how long sessions last, and where users encounter errors. This data is used solely to improve platform performance and user experience.
• Security and Fraud Prevention Cookies: Used to identify and prevent suspicious activity, including detecting automated bot access, unusual login patterns, and account takeover attempts.

otsobet does not use third-party advertising cookies or retargeting pixels that track your behavior across unrelated websites. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will impair your ability to use the platform.

Data Retention

otsobet retains your personal data for as long as necessary to fulfill the purposes described in this Privacy Policy, and for such additional periods as required by applicable Philippine law. The following general retention guidelines apply:

• Account Data: Retained for the duration of your account's active status plus a minimum of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and applicable AML retention obligations.
• KYC Documents: Retained for a minimum of five (5) years following the date of verification, consistent with AMLA record-keeping requirements.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, in compliance with BIR, AMLA, and PAGCOR requirements.
• Customer Support Records: Retained for three (3) years from the date of the final communication in a given support interaction.
• Technical and Device Logs: Retained for twelve (12) months from the date of collection, or longer where required for the investigation of a specific security incident or regulatory matter.
• Marketing Consent Records: Retained for the duration of the consent and for three (3) years thereafter to evidence the consent given.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents re-identification. Where anonymization is not technically feasible within a reasonable time, data is placed in restricted-access archival storage pending secure deletion.

Data Security Measures

otsobet implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction. These measures include, but are not limited to:

• Transport Encryption: All data transmitted between your device and the otsobet platform is encrypted using 128-bit SSL (TLS 1.2 or higher), ensuring that data in transit cannot be intercepted by unauthorized parties.
• Data Encryption at Rest: Sensitive personal data stored in our systems — including identity document files and financial account references — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data is restricted to otsobet personnel whose role specifically requires it. Role-based access controls, multi-factor authentication for administrative systems, and access audit logging are in place across all data-holding systems.
• Penetration Testing: otsobet conducts regular security assessments and penetration testing of the platform to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: otsobet maintains a documented data breach response procedure. In the event of a personal data breach affecting your rights and freedoms, we will notify you and the National Privacy Commission in accordance with RA 10173 requirements within 72 hours of becoming aware of the breach.
• Staff Training: All otsobet staff who handle personal data receive regular training on data protection obligations and security best practices.

Your Data Subject Rights

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by otsobet. You may exercise any of these rights by contacting our Data Protection Officer using the details in Section 16.

1. Right to be Informed: You have the right to be informed about how your personal data is being collected and processed. This Privacy Policy fulfills that obligation. Material changes to our processing practices will be communicated to you directly.
2. Right of Access: You have the right to obtain confirmation of whether otsobet processes your personal data and, if so, to receive a copy of that data together with information about how it is used. We will respond to access requests within fifteen (15) business days.
3. Right to Rectification: You have the right to have inaccurate or incomplete personal data corrected. You may update many of your account details directly through your account dashboard; for other corrections, please contact support.
4. Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and there is no other legal basis), or where the data has been unlawfully processed. This right is subject to our legal retention obligations under PAGCOR, AMLA, and other applicable law.
5. Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes at any time, with immediate effect. You may also object to other processing based on legitimate interests, subject to assessment of competing grounds.
6. Right to Block or Restrict Processing: You have the right to request restriction of processing where you contest the accuracy of data, the processing is unlawful but you prefer restriction to deletion, or where we no longer need the data but you require it for legal claims.
7. Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where the processing is based on consent or contract.
8. Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe that your data has been processed in a manner inconsistent with the Data Privacy Act.

Requests to exercise your data subject rights will be processed within fifteen (15) business days of receipt. We may ask you to verify your identity before processing a request to protect against fraudulent submissions.

Children's and Minors' Privacy

otsobet is a gaming platform intended exclusively for individuals who are at least twenty-one (21) years of age, as required by PAGCOR regulations and applicable Philippine law. We do not knowingly collect personal data from persons under the age of 21.

If otsobet discovers or is informed that personal data has been collected from an individual under the age of 21, we will take immediate steps to close the relevant account and delete the associated personal data, subject to any retention obligations under applicable law. Any deposits made by an underage user will be handled in accordance with PAGCOR's applicable procedures.

If you are a parent or guardian and believe that your child or a minor in your care has registered for an otsobet account, please contact our support team immediately so that we can take appropriate action.

International Data Transfers

otsobet primarily processes and stores player data within the Philippines or with service providers operating under Philippine data protection standards. Where data is transferred to, or processed by, service providers located outside the Philippines — for example, cloud infrastructure providers or game content providers — such transfers are carried out only where:

• The receiving jurisdiction has been assessed to provide an adequate level of data protection by the National Privacy Commission; or
• Appropriate safeguards are in place through standard contractual clauses, binding corporate rules, or other mechanisms recognized under Philippine data protection law; or
• The transfer is necessary for the performance of our contract with you (for example, game content delivery by an international provider).

You may request information about the safeguards in place for any international transfers of your personal data by contacting our DPO.

Third-Party Services & Links

The otsobet platform integrates with third-party services including game providers (JILI Games, Pragmatic Play, PG Soft, Evolution Gaming, and others), payment processors (GCash, Maya, BPI, BDO, and others), and identity verification services. While otsobet exercises due diligence in selecting and contracting these providers, their data processing practices when you interact directly with their interfaces (for example, authenticating a GCash payment through the GCash app) are governed by their own privacy policies.

otsobet is not responsible for the privacy practices of these third-party services in respect of their own processing activities. We recommend reviewing the privacy policies of any third-party service you use in connection with your otsobet account.

Policy Amendments

otsobet reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. The effective date at the top of this document indicates when the current version was last updated.

Material changes — such as new categories of data collected, new purposes for processing, or new categories of third parties to whom data is disclosed — will be communicated to registered players via email or in-platform notification no less than fourteen (14) days before they take effect, unless an immediate change is required by law.

Your continued use of the otsobet platform after the effective date of an updated Privacy Policy constitutes your acknowledgment of the changes. If you do not accept the amended policy, you must discontinue use of the platform. You may request account closure at any time by contacting support.

Contact Us & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by otsobet, please contact our Data Protection Officer (DPO) or support team through the following channels:

• Data Protection Officer (DPO): [email protected] (plain text — not a clickable link). Privacy-specific inquiries addressed to the DPO are treated with priority and handled in accordance with RA 10173 timeframes.
• General Support: [email protected] (plain text — not a clickable link) or via the 24/7 live chat available on the otsobet platform. Typical live chat response time: under 2 minutes.

If you are not satisfied with our response to your data privacy inquiry or complaint, you have the right to escalate the matter to the National Privacy Commission (NPC) of the Philippines, which is the competent supervisory authority for data protection matters under RA 10173.