oxplay Privacy Policy

1 Who We Are

oxplay is a Philippines-focused online gaming platform accessible at oxplay.bet. The platform is operated by the oxplay company entity duly licensed and regulated under the Philippine Amusement and Gaming Corporation (PAGCOR) framework. For the purposes of applicable Philippine data privacy law, oxplay acts as the Personal Information Controller (PIC) with respect to the personal data collected from players, visitors, and users of the oxplay Platform.

Our Data Protection Officer (DPO) can be reached through our support email at [email protected]. We are registered with the National Privacy Commission (NPC) of the Philippines as required under the Data Privacy Act of 2012 (Republic Act No. 10173).

This Privacy Policy applies to all personal data processed in connection with your use of the oxplay website, mobile experience, customer support channels, and any related services offered under the oxplay brand. By accessing or using the oxplay Platform, you acknowledge that you have read and understood this Privacy Policy.

2 Information We Collect

oxplay collects personal data through several channels — directly from you during registration and account use, automatically through your interaction with the platform, and from third parties such as payment processors and identity verification services. The categories of personal data we collect are described below.

2.1 Information You Provide Directly

• Registration Data: Full legal name, date of birth, nationality, residential address (including barangay, city, and province for Philippine residents), email address, and mobile number.
• Identity Verification (KYC) Documents: Government-issued photo ID (e.g., Philippine passport, driver's license, SSS/GSIS ID, UMID, PhilSys National ID), proof of address, and proof of payment method ownership.
• Financial Information: Payment method details used to fund your oxplay Account, including GCash account details, PayMaya account information, and bank account details for BPI, BDO, and Metrobank transactions. Note: oxplay does not store full payment card numbers on its own servers.
• Communications Data: Messages sent to our support team via live chat or email, including the content of your queries and our responses.
• Preference Data: Game preferences, notification settings, and responsible gaming limits you configure in your Account.

2.2 Information Collected Automatically

• Device and Technical Data: IP address, browser type and version, operating system, device identifier, screen resolution, and time zone.
• Usage Data: Pages visited, games played, bet amounts and outcomes, session duration, clicks, and navigation patterns within the platform.
• Log Data: Server-side logs recording access times, error events, and security-related activity.
• Cookie Data: Data stored in cookies and similar tracking technologies as described in Section 5 below.

2.3 Information from Third Parties

• Payment Processors: Transaction confirmation data, payment status, and fraud screening flags from GCash, PayMaya, and banking partners.
• KYC/AML Providers: Identity verification results, watchlist screening outcomes, and politically exposed person (PEP) status from our third-party verification partners.
• Regulatory Bodies: Information shared by PAGCOR or other Philippine government agencies in connection with our compliance obligations.

3 How We Use Your Information

oxplay uses your personal data for the following specific purposes. Each purpose is tied to a defined legal basis as set out in Section 4.

oxplay does not use your personal data for automated decision-making processes that produce legal or similarly significant effects on you without human review. Where profiling is used for responsible gaming or fraud prevention purposes, a member of our compliance team reviews flagged cases before any account-level action is taken.

4 Legal Basis for Processing

Under the Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations, oxplay processes your personal data on the following legal grounds:

• Contract Performance: Processing is necessary to fulfill the contractual obligations between oxplay and you as a registered player — including account creation, game access, payment processing, and withdrawal handling.
• Legal Obligation: Processing is required to comply with Philippine laws and regulations, including PAGCOR licensing conditions, Anti-Money Laundering Act (AMLA) obligations, and age verification requirements under applicable gaming regulations.
• Legitimate Interests: Processing is necessary for the legitimate interests of oxplay or third parties, provided those interests are not overridden by your fundamental rights. This covers fraud prevention, platform security, internal analytics, and network integrity monitoring.
• Consent: For optional processing activities — such as sending you marketing emails, promotional SMS messages, or personalized offers — we rely on your freely given, specific, and informed consent obtained during registration or through your Account settings. You may withdraw consent at any time.

5 Cookies and Tracking Technologies

The oxplay Platform uses cookies and similar technologies to deliver and improve our services. Cookies are small text files stored on your device when you visit a website. They help us remember your preferences, maintain session security, analyze platform usage, and deliver relevant content.

5.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the platform to function correctly — including login session management, security token validation, and remembering your cookie preferences. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language settings, game lobby layout, and responsible gaming limit configurations. Disabling these may affect your user experience.
• Analytics Cookies: Collect anonymized data about how players interact with the platform — pages visited, game session lengths, and feature usage. This data helps us improve the oxplay experience over time.
• Security Cookies: Used for fraud detection and account protection purposes, including device fingerprinting to identify suspicious login attempts.

5.2 Managing Cookies

You can control non-essential cookies through the cookie preference panel available on the oxplay Platform. You may also configure your browser to block or delete cookies; however, doing so may impact the functionality of certain platform features. Note that strictly necessary cookies cannot be disabled as they are integral to platform security and operation.

6 Sharing Your Information

oxplay does not sell your personal data. We share personal data with third parties only in the limited circumstances described below, and always subject to appropriate contractual data protection obligations.

6.1 Service Providers and Data Processors

We engage carefully vetted third-party service providers who process personal data on our behalf as Data Processors under our instruction. These include:

• Payment processors: GCash (Mynt/G-Xchange Inc.), PayMaya (Voyager Innovations), BPI, BDO, and Metrobank for transaction processing.
• KYC/AML providers: Identity verification and watchlist screening partners operating under strict data processing agreements.
• Cloud infrastructure providers: Secure server hosting and database management services operating in compliant data centers.
• Analytics providers: Anonymized usage data analytics to improve platform performance.

6.2 Regulatory and Legal Disclosure

oxplay may disclose personal data to PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), or other competent Philippine government authorities when required by law, court order, or regulatory directive. We may also disclose data where necessary to protect the rights, property, or safety of oxplay, our players, or the public.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of oxplay's assets, personal data held by oxplay may be transferred to the successor entity. We will provide reasonable advance notice of any such transfer and the successor entity will be bound by this Privacy Policy or a materially equivalent policy.

7 International Data Transfers

oxplay primarily stores and processes personal data within the Philippines. In certain cases — for example, where a third-party service provider operates infrastructure in another country — your personal data may be transferred outside the Philippines. When such transfers occur, oxplay ensures they are governed by appropriate safeguards, including:

• Data processing agreements incorporating the NPC's standard contractual clauses or equivalent contractual protections.
• Transfers only to jurisdictions that have been assessed as providing an adequate level of personal data protection.
• Binding corporate rules where applicable for intra-group transfers.

By using the oxplay Platform, you acknowledge that your personal data may be transferred to and processed in countries outside the Philippines, subject to the safeguards described above.

8 Data Retention

oxplay retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Our key retention periods are as follows:

After the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where anonymization is applied, the resulting data no longer constitutes personal data and may be retained indefinitely for statistical purposes.

9 Your Data Protection Rights

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by oxplay. You may exercise any of these rights by contacting our Data Protection Officer at [email protected]. We will respond to verified requests within thirty (30) calendar days.

10 Children and Minors

If oxplay discovers or has reasonable grounds to believe that personal data has been collected from a person under the age of 21, we will immediately suspend the associated Account, void any winnings, delete the collected data to the extent permitted by law, and report the matter to PAGCOR as required by our licensing conditions.

If you are a parent or guardian and believe your child has registered on the oxplay Platform, please contact us immediately at [email protected] so we can take prompt action. We also encourage parents and guardians to use available parental control tools to restrict access to online gaming websites.

11 Security Measures

oxplay implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, loss, destruction, alteration, or disclosure. These measures include:

• Transport Security: All data transmitted between your browser or device and oxplay servers is encrypted using TLS 1.2 or higher with 256-bit SSL certificates.
• Data-at-Rest Encryption: Sensitive personal and financial data stored in our databases is encrypted using industry-standard algorithms.
• Access Controls: Strict role-based access control (RBAC) ensures that only authorized oxplay personnel with a legitimate need can access personal data. Access is logged and regularly audited.
• Multi-Factor Authentication: Internal systems handling personal data require multi-factor authentication for all access attempts.
• Regular Security Audits: oxplay conducts periodic penetration testing, vulnerability assessments, and security code reviews to identify and address weaknesses.
• Incident Response: A documented data breach response plan is maintained. In the event of a personal data breach that poses a risk to your rights and freedoms, oxplay will notify the NPC within 72 hours of discovery and inform affected players without undue delay as required by law.
• Staff Training: All oxplay personnel with access to personal data undergo mandatory data privacy and security training upon onboarding and annually thereafter.

12 Changes to This Policy

oxplay reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this page will be revised whenever a change is made.

For material changes that significantly affect your rights or how we process your personal data, oxplay will provide advance notice via email to your registered address or through a prominent notice on the Platform, at least fourteen (14) days before the changes take effect. Minor clarifications or non-material updates may be made without advance notice.

Your continued use of the oxplay Platform after the effective date of any revised Privacy Policy constitutes your acknowledgment of and agreement to the updated terms. If you do not agree to the updated policy, you must cease using the Platform and may request Account closure by contacting our support team.

13 Contact and Complaints

If you have questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by oxplay, please contact our Data Protection Officer through the following channel:

• Email: [email protected]
• Live Chat: Available 24/7 on the oxplay Platform — average response time under 60 seconds
• Subject Line: Please include "Privacy Request" or "Data Subject Rights" in your communication subject for faster routing

We will acknowledge your request within five (5) business days and aim to resolve it within thirty (30) calendar days. For complex requests, we may extend this period by a further thirty (30) days, in which case we will notify you of the extension and the reason.

If you are not satisfied with oxplay's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines through its official government channels. oxplay fully cooperates with NPC investigations and will provide all information required to resolve data privacy complaints lawfully and transparently.