oxoplay
Privacy Policy

oxoplay is an online gaming platform serving the Philippine market. As a platform that processes real-money transactions and operates under a regulatory framework that requires identity verification, we necessarily collect and process personal information about our users. We take this responsibility seriously and are committed to treating your data with the highest standards of care, transparency, and security.

This Policy applies to:

• All registered oxoplay account holders regardless of their location within the Philippines;
• Visitors to oxoplay.co who have not yet registered but are browsing the platform;
• Former account holders whose data we retain for legally required or operationally necessary periods after account closure;
• Any person who contacts oxoplay's customer support team via live chat or email.

This Policy does not apply to third-party websites or services that may be accessible via links from the oxoplay platform. oxoplay is not responsible for the privacy practices of external operators or software providers whose games or tools you may access through oxoplay.

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations, oxoplay is the personal information controller responsible for the processing of personal data collected through the oxoplay platform.

oxoplay has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with applicable data privacy regulations and for responding to data subject requests. Contact details for the DPO are provided in Section 15 of this Policy.

oxoplay collects personal data that falls into the following categories. The specific data collected from you depends on how you interact with our platform — a visitor who does not register will have minimal data collected compared to a verified account holder who has completed KYC.

4.1 Data You Provide Directly

The majority of personal data we hold about you is information you have provided to us directly through:

• The account registration form (email, mobile number, date of birth confirmation);
• KYC document submission via the account verification portal;
• Deposit and withdrawal requests through the cashier;
• Correspondence with our customer support team via live chat or email;
• Participation in promotions, tournaments, or surveys where personal information is required.

4.2 Data Collected Automatically

When you access or use the oxoplay platform, certain technical and usage data is collected automatically through our platform infrastructure and analytics systems, including:

• IP address and approximate geographic location derived from IP;
• Browser and device characteristics for compatibility and security monitoring;
• Session timestamps, page views, and navigation path within the platform;
• Game session initiation, duration, stake sizes, and outcomes for all real-money game rounds.

4.3 Data from Third Parties

In limited circumstances, oxoplay may receive personal data about you from third parties including:

• Payment processors — transaction confirmation data from GCash, Maya, BPI, BDO, and other payment providers used for deposit and withdrawal verification;
• Identity verification services — in cases where document verification is performed through an automated third-party verification system;
• Fraud prevention partners — risk signals from fraud detection providers to protect against money laundering and payment fraud;
• Self-exclusion registries — confirmation of exclusion status where available through PAGCOR-linked channels.

oxoplay processes your personal data only for specific, legitimate purposes. For each purpose, we identify the applicable legal basis under RA 10173 and related regulations:

oxoplay does not sell, rent, or trade your personal data to third parties for commercial purposes. We share your data only in the specific circumstances described below, and only to the extent necessary for the stated purpose.

6.1 Service Providers

We engage carefully selected third-party service providers who process data on our behalf under contractual data processing agreements. These include:

• Payment processors — GCash, Maya, BPI, BDO, Metrobank, Coins.ph, 7-Eleven Cliqq, UnionBank, and cryptocurrency gateway providers for transaction execution;
• KYC verification providers — automated identity and document verification services;
• Customer support platform providers — live chat and ticketing system operators;
• Cloud hosting and infrastructure providers — secure server and data storage services;
• Fraud detection and cybersecurity services — risk scoring and anomaly detection providers;
• Analytics platforms — for anonymized platform performance data.

All service providers engaged by oxoplay are contractually bound to process personal data only on oxoplay's instructions and in accordance with applicable data privacy law.

6.2 Regulatory and Law Enforcement Disclosure

oxoplay may be required by law, court order, or regulatory directive to disclose personal data to:

• PAGCOR, in the exercise of its regulatory oversight functions over licensed gaming operators;
• The Anti-Money Laundering Council (AMLC) of the Philippines, pursuant to the requirements of the Anti-Money Laundering Act (AMLA) and its amendments;
• The National Privacy Commission (NPC), in the event of a data breach or as part of a regulatory inquiry;
• Philippine law enforcement agencies (PNP, NBI) where required by valid legal process.

In all such cases, oxoplay will share only the minimum data required to fulfill the legal obligation and will notify affected users where legally permissible.

6.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of assets involving oxoplay, your personal data may be transferred to the relevant successor entity. You will be notified of any such transfer and of any changes to this Privacy Policy resulting from it.

oxoplay uses cookies and similar tracking technologies when you access the platform. These are small data files stored on your device that allow the platform to remember your preferences, maintain your session, and analyze usage patterns.

7.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled without rendering the platform non-functional.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and last-visited game categories. Improve the continuity of your experience across sessions.
• Analytics Cookies: Collect anonymized data about how users navigate and use the platform — page views, session duration, game category preferences. Used to improve platform design and performance.
• Security Cookies: Used for device fingerprinting and anomaly detection — identifying login attempts from unusual devices or locations as part of oxoplay's fraud prevention and account security systems.

7.2 Cookie Control

You may manage your cookie preferences through your browser settings to reject non-essential cookies. Please note that disabling strictly necessary cookies will prevent you from logging in to or using the oxoplay platform. Browser-level cookie controls vary by browser; consult your browser's help documentation for instructions specific to your software.

oxoplay retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or to comply with applicable legal, regulatory, or operational obligations. The following retention periods apply as a general guideline:

Upon expiry of applicable retention periods, personal data is securely deleted or anonymized. Where data has been anonymized, it may be retained indefinitely for aggregate analytics purposes without restriction.

oxoplay implements comprehensive technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction. These measures include:

• 256-bit TLS/SSL encryption on all data transmitted between your device and oxoplay servers — the same standard used by major Philippine banks including BPI, BDO, and Metrobank for their online banking services;
• Password hashing using industry-standard cryptographic algorithms — your password is never stored in readable form, even in our own internal systems;
• Access controls and role-based permissions — oxoplay staff can only access user personal data to the minimum extent required by their specific job function;
• Two-factor authentication (2FA) available on all user accounts — we strongly encourage all oxoplay users to enable 2FA in their account security settings;
• Intrusion detection and monitoring systems — continuous surveillance of platform access logs for anomalous activity indicative of unauthorized access attempts;
• Secure KYC document storage — identity documents submitted for KYC are stored in encrypted, access-controlled vaults with strict audit logging of all access;
• Regular security assessments — penetration testing and vulnerability assessments conducted periodically by qualified security professionals.

oxoplay operates primarily in the Philippines and stores the majority of personal data on servers located in the Philippines or in jurisdictions with equivalent data protection standards. In limited circumstances, certain data may be processed by service providers operating in other countries — for example, cloud infrastructure providers or technology suppliers with international operations.

When personal data is transferred outside of the Philippines, oxoplay ensures appropriate safeguards are in place including:

• Contractual data processing agreements incorporating the NPC's standard clauses for international transfers;
• Limiting international transfers to service providers in jurisdictions whose data protection frameworks have been assessed as adequate;
• Ensuring that KYC documents and sensitive financial data are processed only on servers where oxoplay has direct contractual control over data handling standards.

Under the Philippine Data Privacy Act of 2012 and NPC regulations, you have the following rights with respect to your personal data held by oxoplay. These rights may be exercised by contacting our Data Protection Officer using the details in Section 15.

To exercise any of the above rights, submit your request in writing to [email protected] or via the contact details in Section 15. We will respond to verifiable data subject requests within 15 business days. We may require proof of identity before processing certain requests to protect against fraudulent data access attempts.

The oxoplay platform is strictly intended for adults aged 21 years or older. oxoplay does not knowingly collect personal data from persons under the age of 21. If you are under 21, you must not register an account, access any game, or provide any personal information to oxoplay.

oxoplay enforces the 21+ minimum age through KYC document verification. If oxoplay discovers that personal data has been collected from a person under the minimum age, that data will be promptly deleted and the associated account immediately closed. Deposits associated with such accounts will be returned to the originating payment method following completion of any required compliance review.

If you are a parent or guardian and believe your dependent may have registered on oxoplay without meeting the age requirement, please contact our support team immediately at [email protected].

The oxoplay platform integrates with third-party services including game software providers, live dealer streaming services, and payment processors. While oxoplay carefully vets all third-party partners for security and data handling standards, we do not control the privacy practices of these independent companies.

When you use a third-party payment method such as GCash or Maya, your interaction with that payment provider is governed by that provider's own privacy policy in addition to this Policy. oxoplay receives only the transaction confirmation data necessary for payment reconciliation — we do not store full payment account credentials.

Game software providers whose titles are available on oxoplay may process limited technical data (such as session ID and game event data) through their own server infrastructure to determine game outcomes and render game states. This processing is governed by agreements between oxoplay and the software provider.

oxoplay may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or platform features. When a material change is made to this Policy, we will:

• Update the "Last Updated" date at the top of this page;
• Notify active account holders via email to their registered address and/or via an in-platform notification;
• Where required by applicable law, obtain fresh consent for any new category of data processing.

We encourage all oxoplay users to review this Privacy Policy periodically. Your continued use of the oxoplay platform after the effective date of any update constitutes your acceptance of the revised Policy.

For all data privacy inquiries, data subject requests, consent withdrawal, or privacy-related complaints, please contact the oxoplay Data Protection Officer (DPO):

• DPO Email: [email protected] — for formal data subject requests and privacy compliance inquiries
• General Support: [email protected] — for account-related data questions and general inquiries
• Live Chat: Available 24/7 within the oxoplay platform for urgent account and data matters
• Response Time: DPO email responses within 15 business days; support chat under 2 minutes during peak hours

If you are unsatisfied with oxoplay's response to a data privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, the regulatory authority responsible for enforcing RA 10173 and the rights of Philippine data subjects.