opeso Privacy Policy

1. Introduction

SECTION 1.0 — WHO WE ARE

opeso is an online casino and sports betting platform operated for Filipino players across the Philippines, including Metro Manila, Cebu, Davao, Quezon City, Makati, and all other regions nationwide. opeso acts as the Personal Information Controller (PIC) in respect of the personal data you provide when using the platform, as defined under RA 10173.

SECTION 1.1 — SCOPE

This Privacy Policy applies to all personal data collected through the opeso website at opeso.net, the opeso mobile web experience, any customer support interactions conducted by email or chat, and any other means by which you provide personal information to opeso. It does not apply to third-party websites or services that may be linked from our platform — those third parties maintain their own privacy policies.

2. Personal Data We Collect

SECTION 2.0 — REGISTRATION DATA

When you create an opeso account, we collect the following information that you provide directly:

• Full legal name as it appears on your government-issued Philippine ID.
• Date of birth (to verify you are at least 21 years of age).
• Email address and mobile number registered in the Philippines.
• Residential address within the Philippines.
• Username and encrypted password.
• Preferred currency (PHP — Philippine Peso).

SECTION 2.1 — IDENTITY VERIFICATION (KYC) DATA

To comply with PAGCOR licensing requirements and Philippine anti-money laundering regulations, opeso conducts Know Your Customer (KYC) verification. During this process we may collect:

• Scanned or photographed copies of a valid Philippine government-issued ID — such as a PhilSys National ID, passport, driver's licence, SSS ID, UMID, PRC ID, or Voter's ID.
• A selfie or live photo taken at the time of verification.
• Proof of address documents such as a recent utility bill, bank statement, or barangay certificate.
• Source-of-funds declarations where required for enhanced due diligence.

SECTION 2.2 — FINANCIAL AND TRANSACTION DATA

When you make deposits or withdrawal requests through opeso, we collect and retain transaction records including:

• GCash or Maya (formerly PayMaya) account references.
• BPI, BDO, Metrobank, UnionBank, or other bank account details provided for withdrawal processing.
• Transaction amounts, timestamps, and reference numbers.
• Deposit and withdrawal history associated with your account.

opeso does not store full debit or credit card numbers on its own servers. Card payment data, where accepted, is processed directly by our PCI-DSS compliant payment processor and is not retained by opeso beyond the transaction reference required for dispute resolution.

SECTION 2.3 — GAMEPLAY AND ACTIVITY DATA

opeso automatically records data generated by your use of the platform, including:

• Game session logs — titles played, bet amounts, win/loss outcomes, session start and end times.
• Sports betting selections, odds accepted, stake amounts, and settlement outcomes.
• Bonus activations, wagering progress, and promotion redemption history.
• Responsible gaming settings you have applied to your account, including deposit limits and self-exclusion status.

SECTION 2.4 — TECHNICAL AND DEVICE DATA

When you access opeso, our servers automatically receive and log technical information including:

• IP address and approximate geolocation derived from it.
• Device type, operating system, and browser version.
• Session duration, pages visited, and referral source.
• Device identifiers used for fraud detection and duplicate account identification purposes.

3. How We Use Your Personal Data

SECTION 3.0

opeso uses the personal data described in Section 2 for the following purposes, summarised in the table below:

Purpose	Data Used	Legal Basis
Account registration and management	Registration data, contact details	Contractual necessity
Age and identity verification (KYC)	KYC documents, selfie, date of birth	Legal obligation (PAGCOR, AMLC)
Payment processing and fraud prevention	Financial data, transaction history	Contractual necessity; legal obligation
Gameplay delivery and game history	Gameplay and activity data	Contractual necessity
Responsible gaming monitoring	Gameplay data, account settings	Legitimate interest; legal obligation
Customer support and dispute resolution	All relevant account data	Contractual necessity; legitimate interest
Security, anti-fraud, and AML monitoring	Technical data, financial data, KYC data	Legal obligation; legitimate interest
Platform improvement and analytics	Anonymised or aggregated usage data	Legitimate interest
Marketing communications (where consented)	Email, mobile number	Consent

4. Legal Basis for Processing

SECTION 4.0

opeso processes your personal data on one or more of the following legal bases as recognised under the Philippine Data Privacy Act of 2012:

• Consent: Where you have given us clear, specific, informed, and freely given consent for a particular processing activity — most commonly for marketing communications.
• Contractual Necessity: Where processing is required to perform our obligations under the account agreement with you — including account creation, game delivery, and payment processing.
• Legal Obligation: Where processing is required to comply with Philippine law, including PAGCOR regulations, the Anti-Money Laundering Act (AMLA), and NPC issuances.
• Legitimate Interest: Where processing is necessary for the legitimate interests of opeso — such as fraud detection, platform security, responsible gaming monitoring, and service analytics — and those interests are not overridden by your privacy rights.

5. Sharing Your Personal Data

SECTION 5.0 — WHO WE MAY SHARE DATA WITH

opeso does not sell your personal data. We may share your data with the following categories of third parties, strictly on a need-to-know basis and subject to data processing agreements where required:

• Payment Processors: GCash, Maya, BPI, BDO, Metrobank, and other accepted payment providers, for the purpose of processing your deposits and withdrawals in PHP.
• Identity Verification Providers: Third-party KYC technology vendors that assist in document verification and biometric matching as part of the account opening and enhanced due diligence process.
• Game Software Providers: Licensed game content providers whose slot, live dealer, and other game titles are accessible through opeso. These providers may receive session data required to deliver and validate game outcomes.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies, where we are required by law to disclose information.
• Security and Fraud Prevention Services: Providers of device fingerprinting, IP analysis, and fraud scoring tools used to protect the integrity of the opeso platform.
• Professional Advisers: Legal, accounting, and auditing firms retained by opeso, subject to professional confidentiality obligations.

SECTION 5.1

All third parties with whom opeso shares personal data are required to process such data only for the specified purpose, to maintain appropriate technical and organisational security measures, and to comply with applicable Philippine data privacy requirements. opeso remains responsible for ensuring that such third-party arrangements meet the standards required by RA 10173.

6. Cookies and Tracking Technologies

SECTION 6.0

opeso uses cookies and similar tracking technologies on the opeso.net website. A cookie is a small text file placed on your device when you visit a website. We use the following categories of cookies:

• Strictly Necessary Cookies: Required for the platform to function — including session authentication, security tokens, and load balancing. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language settings, preferred game categories, and responsible gaming configurations.
• Analytics Cookies: Collect anonymised or aggregated data about how players use the opeso platform — such as which pages are visited most frequently — to help us improve the service. No individually identifiable data is shared with analytics providers for advertising purposes.
• Security Cookies: Support our fraud detection systems by flagging unusual session patterns or login anomalies.

SECTION 6.1

You may manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the opeso platform, including the ability to maintain a logged-in session or access certain game features. opeso does not use third-party advertising cookies or retargeting pixels.

7. Data Security

SECTION 7.0

opeso implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• HTTPS/TLS encryption for all data in transit between your device and opeso servers.
• AES-256 encryption for sensitive data fields stored at rest, including identity documents and financial records.
• Role-based access controls ensuring that only authorised opeso staff can access personal data, limited to what their role requires.
• Regular penetration testing and vulnerability assessments conducted by qualified security professionals.
• Multi-factor authentication requirements for internal system access.
• Incident response and breach notification procedures aligned with NPC requirements under RA 10173.

SECTION 7.1

In the event of a personal data breach that is likely to result in serious harm to affected players, opeso will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected players without undue delay, as required under NPC Circular 16-03.

8. Data Retention

SECTION 8.0

opeso retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, subject to the following retention schedules:

• Account and KYC data: Retained for the duration of your account and for a minimum of five (5) years after account closure, as required by PAGCOR regulations and the Anti-Money Laundering Act.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLC record- keeping requirements.
• Gameplay logs: Retained for up to two (2) years from the date of each session, for dispute resolution and responsible gaming monitoring purposes.
• Customer support correspondence: Retained for up to three (3) years from the date of last interaction.
• Marketing consent records: Retained until you withdraw consent, plus one (1) year thereafter for compliance documentation.

SECTION 8.1

Upon expiry of the applicable retention period, personal data is securely deleted from opeso's systems or, where deletion is not technically feasible in the short term, anonymised such that it can no longer be linked to any identifiable individual.

9. Your Rights as a Data Subject

SECTION 9.0

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by opeso:

• Right to Be Informed: The right to know that your personal data is being collected and processed, the purpose of processing, and the scope of data being held — which is what this Privacy Policy provides.
• Right of Access: The right to request a copy of the personal data opeso holds about you, and to receive information about how it is being processed.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected. You may update basic account information directly through your opeso account settings; KYC data corrections require contact with our support team.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected and there is no overriding legal basis for continued retention (such as PAGCOR or AMLC record-keeping requirements).
• Right to Object: The right to object to processing based on legitimate interest, including profiling for responsible gaming monitoring. Note that objection to certain processing may prevent opeso from continuing to provide gaming services to you.
• Right to Data Portability: The right to receive a copy of the personal data you have provided to opeso in a structured, commonly used, machine-readable format.
• Right to Damages: The right to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of your personal data.
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated.

SECTION 9.1 — HOW TO EXERCISE YOUR RIGHTS

To exercise any of the rights listed above, please contact opeso's Data Protection Officer at [email protected] with the subject line "DATA SUBJECT REQUEST — [Your Account ID]". opeso will acknowledge your request within five (5) business days and will respond to the substance of the request within thirty (30) calendar days, unless the complexity or volume of requests requires a reasonable extension, of which you will be notified.

10. Children and Minors

SECTION 10.0

opeso is strictly an adult platform. Access is limited to individuals who are 21 years of age or older, in compliance with Philippine gaming regulations enforced by PAGCOR. opeso does not knowingly collect personal data from individuals under 21 years of age.

SECTION 10.1

If opeso becomes aware that personal data has been collected from an individual under the age of 21, the associated account will be immediately suspended and all collected data will be deleted or handled in accordance with applicable Philippine law. If you believe that a minor has registered on the opeso platform, please notify us immediately at [email protected].

11. Cross-Border Data Transfers

SECTION 11.0

Where opeso engages third-party service providers — such as game software providers, KYC technology vendors, or cloud infrastructure providers — that process personal data outside the Philippines, we ensure that such transfers comply with the cross-border transfer provisions of RA 10173 and the NPC's guidelines on the matter.

SECTION 11.1

Specifically, opeso requires that any overseas recipient of Philippine player data: (a) is located in a country deemed to provide an adequate level of protection by the NPC, or (b) has entered into a data transfer agreement with opeso containing standard contractual clauses that provide equivalent protection to those afforded under Philippine data privacy law.

12. Marketing Communications

SECTION 12.0

opeso may send you promotional communications about new games, upcoming sports betting markets — including PBA, NBA, and international boxing events — bonus offers, and platform updates. These communications are sent only where you have provided explicit consent during registration or via your account notification preferences.

SECTION 12.1

You may withdraw your consent to marketing communications at any time by updating your notification preferences in your opeso account settings, or by contacting us at [email protected] with the subject line "UNSUBSCRIBE". Withdrawal of marketing consent will not affect the lawfulness of any processing that occurred prior to withdrawal, nor will it affect your ability to continue using the opeso gaming platform.

13. Responsible Gaming and Data Processing

SECTION 13.0

opeso processes gameplay and transaction data as part of its responsible gaming programme. This includes automated analysis of your session patterns, betting behaviour, and account history to identify potential indicators of problem gambling. Where such indicators are detected, opeso may take proactive steps including contacting you with responsible gaming information or applying temporary account restrictions where there is a serious and immediate welfare concern.

SECTION 13.1

Data processed for responsible gaming purposes is held separately from marketing data and is never used to build commercial profiles or to target you with promotional content. You may access your own responsible gaming data, including your self-imposed limits and exclusion history, through your opeso account settings. For more information, visit our Responsible Gaming page.

14. Changes to This Privacy Policy

SECTION 14.0

opeso may update this Privacy Policy from time to time to reflect changes in our data practices, updates to Philippine data privacy law, or new NPC guidance. The effective date at the top of this document will be updated whenever changes are made.

SECTION 14.1

Where changes are material — meaning they significantly affect how your personal data is collected or used — opeso will notify registered players via the email address on file and through an in-platform notification at least fourteen (14) days before the revised policy takes effect. Your continued use of the opeso platform after the effective date of any revised policy constitutes your acceptance of the updated terms.

15. Contact Us and Data Protection Officer

SECTION 15.0

opeso has appointed a Data Protection Officer (DPO) in accordance with the requirements of RA 10173 and NPC Circular 17-01. The DPO is responsible for overseeing opeso's data protection strategy, ensuring compliance with applicable Philippine privacy law, and serving as the primary point of contact for data subject requests and NPC inquiries.

SECTION 15.1

For any privacy-related queries, data subject requests, or concerns about how opeso handles your personal data, you may contact us at:

Email: [email protected]
Subject line format: "PRIVACY — [Your Account ID] — [Request Type]"

opeso will acknowledge all privacy-related correspondence within five (5) business days. If you are not satisfied with our response, you have the right to escalate your complaint to the National Privacy Commission of the Philippines.