otsobet Privacy Policy

The following terms carry specific meanings throughout this Privacy Policy:

The Data Controller responsible for the processing of your personal data in connection with your use of the otsobet Platform is otsobet, operating the website at otsobet.lat. otsobet holds a valid PAGCOR (Philippine Amusement and Gaming Corporation) license authorising it to operate online gaming services within the Philippines.

otsobet has designated a Data Privacy Officer (DPO) as required under RA 10173. All data privacy inquiries, access requests, correction requests, and complaints should be addressed to the DPO at the contact details provided in Section 15 of this Policy.

otsobet is registered with the National Privacy Commission as required for personal information controllers processing sensitive personal information of more than 1,000 individuals.

otsobet collects the following categories of personal data in connection with account registration, identity verification, platform use, and payment processing:

otsobet collects personal data through the following methods:

• Direct provision by you — when you complete the registration form, submit KYC documents, contact customer support, or update your account settings;
• Automated collection during Platform use — through server logs, session cookies, and analytics tools that record technical and gaming activity data as you interact with the Platform;
• Payment processing — when you initiate a GCash, Maya, or bank transfer, the payment service provider transmits transaction reference data to otsobet for reconciliation purposes;
• Identity verification services — otsobet uses a third-party KYC verification partner to cross-reference the government ID information you provide against authoritative Philippine databases. This partner processes your data solely on otsobet's instructions and under a data processing agreement;
• Fraud prevention systems — automated systems analyse patterns across login attempts, device fingerprints, and transaction behaviour to detect suspicious activity. These systems do not make automated legal decisions about your account without human review.

otsobet processes your personal data for the following purposes, each of which is directly connected to operating a lawful, PAGCOR-compliant online gaming platform for Filipino players:

1. Account registration and management — creating and maintaining your otsobet account, verifying your identity, and authenticating your logins;
2. Age verification and PAGCOR compliance — confirming that you are at least 21 years of age as mandated by PAGCOR licensing conditions and Philippine law;
3. Anti-Money Laundering (AMLA) compliance — fulfilling otsobet's obligations under Republic Act 9160 (Anti-Money Laundering Act) as amended, including transaction monitoring, suspicious transaction reporting, and Customer Due Diligence;
4. Payment processing — processing your deposits and withdrawals via GCash, Maya, Philippine bank transfers, and other accepted payment methods;
5. Platform operation and improvement — providing gaming services, resolving technical issues, and improving the Platform based on aggregated usage analytics;
6. Responsible gaming — monitoring gaming behaviour to identify potential problem gambling patterns and administer responsible gaming tools such as deposit limits and self-exclusion at your request or at otsobet's initiative under PAGCOR's responsible gaming framework;
7. Customer support — responding to your queries, resolving disputes, and communicating about your account;
8. Security and fraud prevention — detecting, investigating, and preventing fraudulent transactions, multi-accounting, money laundering, and other prohibited activities;
9. Marketing communications — sending you promotional offers, new game announcements, and otsobet news, but only where you have provided explicit opt-in consent and only until you withdraw that consent;
10. Legal compliance — complying with orders of courts, PAGCOR, the NPC, the AMLC, and other Philippine regulatory authorities with jurisdiction over otsobet.

Under RA 10173, otsobet processes your personal data on the following legal grounds:

• Contractual necessity — processing is necessary to perform the Terms & Conditions contract between you and otsobet (account management, payment processing, game operation);
• Compliance with a legal obligation — processing is required by PAGCOR licensing conditions, the Anti-Money Laundering Act, tax regulations, and other applicable Philippine law (KYC, AMLA transaction monitoring, regulatory reporting);
• Legitimate interests — processing is necessary for otsobet's legitimate interests in securing the Platform, preventing fraud, and improving services, provided those interests are not overridden by your rights;
• Consent — for marketing communications and optional data uses, where otsobet relies on your freely given, specific, informed, and unambiguous consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

otsobet does not sell your personal data to third parties. We share personal data only with the following categories of recipients, each under strict data processing agreements and only to the extent necessary:

• KYC and identity verification providers — to perform age verification and document authentication required by PAGCOR;
• Payment service providers — GCash, Maya, BPI, BDO, Metrobank, UnionBank, and other payment partners, for the sole purpose of processing your financial transactions;
• Game software providers — licensed game studios whose software is integrated into the Platform process technical session data to operate the games you play;
• Fraud prevention and security vendors — services that analyse device and behavioural data to detect fraud, account takeover attempts, and prohibited activities;
• Cloud infrastructure providers — data centre and hosting providers on whose servers the Platform operates, under contractual obligations to maintain security and confidentiality;
• Regulatory authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, the Bureau of Internal Revenue (BIR), and law enforcement authorities, where disclosure is required by law or regulatory order.

otsobet uses cookies and similar tracking technologies on the Platform for the following purposes:

You can manage cookie preferences through your browser settings at any time. Disabling strictly necessary cookies will prevent the Platform from functioning correctly. Instructions for managing cookies are available in your browser's help documentation.

otsobet implements the following technical and organisational security measures to protect your personal data:

• TLS 1.3 / 256-bit SSL encryption on all data in transit between your device and the Platform;
• AES-256 encryption at rest for all stored personal data and payment credentials;
• Segregated database architecture — player identity data, financial data, and gaming activity data are stored in logically separated systems with distinct access controls;
• Role-based access controls — internal staff access to personal data is limited strictly to job-function necessity, with access logged and audited;
• Multi-factor authentication required for all internal administrative system access;
• Regular penetration testing conducted by independent security professionals;
• Incident response plan — in the event of a personal data breach, otsobet will notify the NPC within 72 hours of becoming aware of the breach where the breach is likely to give rise to a real risk of serious harm to affected data subjects, as required by NPC Circular 16-03.

otsobet retains personal data only for as long as necessary for the specific purpose for which it was collected, or as required by applicable law. The following retention periods apply:

At the expiry of applicable retention periods, personal data is securely deleted or anonymised such that re-identification is not possible.

Under RA 10173 and its implementing rules, you have the following rights with respect to your personal data held by otsobet. These rights are exercisable by contacting the DPO as detailed in Section 15:

otsobet will respond to all validated data subject rights requests within fifteen (15) business days. We may request identity verification before fulfilling an access or correction request to ensure that data is not disclosed to an unauthorised party.

The otsobet Platform is strictly for persons aged 21 years and above. otsobet does not knowingly collect, use, or retain personal data from any person under the age of 21. The mandatory KYC process verifies every account against a Philippine government-issued photo ID precisely to enforce this requirement.

If otsobet becomes aware that an individual under the age of 21 has registered an account or provided personal data, the account will be immediately suspended, all data will be deleted (subject to any mandatory regulatory reporting obligations under PAGCOR's minor-access reporting requirements), and the matter may be reported to PAGCOR.

If you are a parent or guardian and believe your child has accessed or registered on the otsobet Platform, please contact the DPO immediately at the details provided in Section 15 so that otsobet can take prompt corrective action.

Some of otsobet's technical infrastructure providers and game software suppliers are located outside the Philippines. Where personal data is transferred to a country or territory outside the Philippines, otsobet ensures that such transfers comply with the requirements of RA 10173, specifically:

• Transfers are made only to countries that have adequate data protection laws, or where the recipient is subject to binding contractual obligations that provide a level of protection substantially equivalent to RA 10173;
• Data Processing Agreements are in place with all sub-processors who receive Philippine personal data, restricting their use of the data to the agreed processing purposes only;
• Where required by NPC regulations, cross-border transfer contracts are subject to NPC notification or approval.

otsobet does not transfer personal data to jurisdictions outside of those directly necessary for operating the Platform and processing payments. KYC documents and financial data are stored on servers located in the Philippines or in compliant jurisdictions with equivalent data protection standards.

otsobet reserves the right to update this Privacy Policy at any time. Material changes — those that significantly affect the rights of data subjects or the way personal data is processed — will be communicated to registered players by email to their registered address at least fourteen (14) calendar days before the change takes effect.

Non-material updates (such as clarifications or corrections of typographical errors that do not change the substantive meaning of the Policy) will be published with an updated "Last Updated" date at the top of this page without individual notice.

The current version of this Policy is always accessible at otsobet.lat/privacy-policy. If you disagree with any amendment, you may exercise your right to request account closure and data deletion as described in this Policy and in otsobet's Terms & Conditions.

For all data privacy inquiries, data subject rights requests, concerns about this Policy, or to report a potential data privacy incident, please contact otsobet's designated Data Privacy Officer:

If you are not satisfied with otsobet's response to your privacy inquiry or believe your rights under RA 10173 have not been respected, you may lodge a complaint with the National Privacy Commission of the Philippines. Information on how to file a complaint with the NPC is available at the NPC's official website.