oh365 Privacy
Policy

Introduction

oh365 ("oh365," "we," "us," or "our") operates the online casino and sports betting platform accessible at oh365.vip. As an operator serving Filipino players, oh365 is subject to the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations ("IRR"), and the guidelines issued by the National Privacy Commission ("NPC") of the Philippines.

This Privacy Policy ("Policy") describes how oh365 collects, uses, discloses, and safeguards the personal data of individuals who register accounts on the oh365 platform ("Players") and individuals who visit the oh365 website without registering ("Visitors"). It also describes the rights that Players and Visitors have over their personal data under Philippine law.

oh365 additionally operates under PAGCOR regulatory guidelines, which impose specific data collection and retention obligations on licensed online gaming operators — including mandatory Know Your Customer ("KYC") identity verification. This Policy reflects those obligations and how oh365 meets them while protecting Player privacy.

Data Controller

For the purposes of the Philippine Data Privacy Act, oh365 is the personal information controller responsible for the personal data collected through the oh365 platform. oh365 determines the purposes and means of processing your personal data in connection with platform operations.

Where oh365 engages third-party service providers to process personal data on its behalf — such as payment processors, KYC verification providers, and analytics services — those providers act as personal information processors under the DPA and are bound by data processing agreements that prohibit them from using your data for any purpose other than the specific services they provide to oh365.

Data We Collect

oh365 collects the following categories of personal data from Players and Visitors:

oh365 does not collect sensitive personal information beyond what is strictly necessary for identity verification and PAGCOR compliance. Biometric data (where collected for liveness verification during KYC) is processed solely for identity verification and is not retained beyond the verification event.

How We Collect Data

oh365 collects personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal request, contact customer support, or update your Account Settings on the oh365 platform.
• Automatically: When you access the oh365 website or platform, technical data (IP address, device identifiers, session data, browser information) is collected automatically through standard web server logs and session management technologies.
• Through cookies and similar technologies: oh365 uses session cookies and persistent cookies to maintain your logged-in state, remember preferences, and analyse platform usage patterns. See Section 8 for full cookie details.
• From third-party service providers: oh365 may receive verification results and fraud risk signals from KYC verification providers, and transaction reference data from payment processors such as GCash, Maya, BPI, BDO, Metrobank, and other connected payment channels.
• From PAGCOR: In certain compliance circumstances, PAGCOR may provide oh365 with information relating to self-exclusion registers or regulatory alerts affecting a Player.

How We Use Your Data

oh365 uses the personal data it collects for the following purposes:

1. Account Management: To create, maintain, and secure your oh365 account, including authentication, password reset, and account recovery services.
2. Age and Identity Verification: To verify that you meet the 21+ age requirement mandated by PAGCOR and to confirm your identity in accordance with Philippine anti-money laundering legislation.
3. Payment Processing: To process your deposits and withdrawal requests through GCash, Maya, and other connected payment channels; to verify that payments originate from accounts held in your name; and to comply with applicable financial regulations.
4. Platform Operation: To deliver the gaming services, account features, promotions, and customer support services that form the oh365 platform.
5. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeovers, and other security threats affecting the platform and its Players.
6. Regulatory Compliance: To meet reporting obligations to PAGCOR and other applicable Philippine regulatory authorities, including anti-money laundering (AML) reporting under the Anti-Money Laundering Act (AMLA) and its amendments.
7. Responsible Gaming: To monitor gaming activity for patterns that may indicate problem gambling and to facilitate the operation of deposit limits, session reminders, and self-exclusion tools as required by PAGCOR responsible gaming standards.
8. Customer Support: To respond to support enquiries, investigate complaints, and resolve disputes relating to your oh365 account.
9. Platform Improvement: To analyse aggregated, anonymised usage data to improve platform performance, user experience, and game offering.
10. Communications: To send you account-related notifications via SMS — including OTP codes, withdrawal confirmations, security alerts, and responsible gaming reminders — to your registered Philippine mobile number. oh365 does not send unsolicited marketing SMS without your explicit opt-in.

Legal Basis for Processing

oh365 processes your personal data on the following legal bases under the Philippine Data Privacy Act:

• Contractual Necessity: Processing of registration data, payment data, gaming activity data, and account management data is necessary for the performance of the contract between you and oh365 (i.e., the oh365 Terms & Conditions) and to provide the services you have requested.
• Legal Obligation: Processing of KYC identity data, AML-related financial records, and PAGCOR compliance reporting is necessary to comply with mandatory requirements under Philippine law, including RA 10173, the AMLA, and PAGCOR regulatory guidelines.
• Legitimate Interests: Processing of technical data, fraud prevention signals, and aggregated analytics is conducted on the basis of oh365's legitimate interests in maintaining platform security, preventing fraud, and improving service quality — where those interests are not overridden by your data protection rights.
• Consent: Where oh365 processes data for optional purposes (such as personalised marketing communications, where offered), such processing is conducted on the basis of your explicit, informed consent. You may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

Data Sharing & Disclosure

oh365 does not sell your personal data. oh365 shares personal data only in the following circumstances and only to the extent necessary for the stated purpose:

• Payment Processors: Transaction reference data is shared with GCash, Maya, GrabPay, BPI, BDO, Metrobank, UnionBank, 7-Eleven CLiQQ, Coins.ph, and USDT TRC20 processing providers solely to facilitate deposit and withdrawal transactions on your Account.
• KYC Verification Providers: Identity documents and biometric liveness data are shared with third-party KYC verification providers contracted by oh365 to perform identity verification. These providers process data solely for verification purposes under binding data processing agreements.
• Regulatory Authorities: oh365 is required to disclose certain personal data to PAGCOR and, where applicable, to the Anti-Money Laundering Council (AMLC) in compliance with Philippine law. oh365 will comply with such legally mandated disclosures.
• Law Enforcement: oh365 may disclose personal data to Philippine law enforcement agencies where required by a valid court order, warrant, or other legally binding instrument of compulsion.
• Security and Fraud Prevention: Anonymised or pseudonymised fraud risk signals may be shared with industry fraud prevention networks for the purpose of protecting the integrity of online gaming operations in the Philippines.
• Business Transfers: In the event of a merger, acquisition, or transfer of substantially all assets of oh365, personal data may be transferred as part of the transaction, subject to the same privacy protections provided in this Policy.

Cookies & Tracking Technologies

oh365 uses the following categories of cookies and similar technologies on the platform:

• Essential Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in to your oh365 Account during a visit, CSRF protection tokens, and load balancer routing cookies. Essential cookies cannot be disabled without disrupting platform functionality.
• Functional Cookies: Used to remember your preferences — such as language settings and responsible gaming tool configurations — across sessions. These are set only for registered Players.
• Analytics Cookies: oh365 uses first-party analytics to measure platform performance and user experience in aggregate. Analytics data is pseudonymised and does not identify individual Players. Third-party analytics scripts are not loaded without a lawful basis.
• Security Cookies: Short-lived cookies used to detect and prevent fraudulent login attempts, bot activity, and account takeover risks.

oh365 does not use advertising trackers, third-party retargeting pixels, or cross-site tracking cookies. Your browsing activity on oh365 is not shared with advertising networks.

You may manage cookie preferences through your browser settings. Disabling essential cookies will prevent you from logging in to your oh365 Account.

Data Retention

oh365 retains personal data for the following periods, after which data is securely deleted or irreversibly anonymised:

Where retention is required solely to satisfy a legal obligation, data is restricted from operational access during the retention period and is accessible only for compliance purposes.

Data Security

oh365 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and oh365 servers is protected by TLS 1.2 / TLS 1.3 encryption (256-bit).
• Encryption at rest: Sensitive data fields (including passwords, which are stored only as salted cryptographic hashes, and KYC document copies) are encrypted at rest using industry-standard algorithms.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. oh365 staff with legitimate access to personal data are subject to contractual confidentiality obligations and regular security training.
• Infrastructure security: oh365 servers are hosted in data centres with physical security, redundancy, and regular security assessments. Penetration testing and vulnerability scanning are conducted on a scheduled basis.
• Incident response: oh365 maintains a data breach response procedure. In the event of a personal data breach likely to result in risk to Player rights and freedoms, oh365 will notify the National Privacy Commission (NPC) within 72 hours of discovery, and will notify affected Players without undue delay, in accordance with NPC Circular 16-03.

No data transmission over the internet can be guaranteed to be completely secure. While oh365 takes all reasonable precautions, you acknowledge that you provide personal data at your own risk and that oh365 cannot guarantee absolute security.

Your Rights Under Philippine Law

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by oh365:

To exercise any of these rights, submit a written request to the oh365 Data Protection Officer via live chat on the oh365 platform or at [email protected]. oh365 will respond to verifiable requests within 15 business days in accordance with NPC guidelines.

oh365 may decline requests where fulfilling them would conflict with a mandatory legal obligation — for example, where data must be retained under AMLA record-keeping requirements. In such cases, oh365 will explain the reason for the limitation and the portion of the request it is able to fulfil.

Children & Minors

The oh365 platform is strictly restricted to individuals aged 21 years and older, as required by PAGCOR regulations governing online gaming in the Philippines. oh365 does not knowingly collect personal data from any person under the age of 21.

If oh365 discovers that personal data has been collected from a person under 21, whether through the registration process, KYC verification, or any other means, oh365 will immediately suspend the account, forfeit any associated balance in accordance with the oh365 Terms & Conditions, and delete the personal data of the underage individual in a timely manner.

If you are a parent or guardian and believe that your child under the age of 21 has registered on oh365, please contact our support team immediately via live chat on the platform so that the account can be closed and any personal data removed.

International Data Transfers

oh365's primary data processing operations are conducted within the Philippines. Where personal data is transferred to or processed by service providers located outside the Philippines — for example, cloud infrastructure providers, KYC verification platforms, or fraud prevention services operating internationally — oh365 ensures that such transfers are conducted in accordance with Section 21 of the Philippine Data Privacy Act and applicable NPC guidelines.

International data transfers by oh365 are protected by one or more of the following safeguards:

• Standard contractual clauses approved by the NPC or equivalent data protection authority;
• Binding data processing agreements requiring the recipient to apply a level of data protection equivalent to that required under Philippine law;
• Transfer to jurisdictions recognised by the NPC as providing adequate data protection standards.

oh365 does not transfer personal data to jurisdictions with inadequate data protection frameworks without implementing appropriate additional safeguards.

Third-Party Links

The oh365 platform may contain links to third-party websites, including payment gateway interfaces and game provider loading screens. This Privacy Policy applies solely to the oh365 platform and does not govern the data practices of any third-party website or service.

oh365 is not responsible for the privacy practices, content, or security of any third-party website or service. You are encouraged to review the privacy policies of any third-party services you access in connection with your use of oh365.

Changes to This Policy

oh365 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, platform operations, or data processing practices. Where changes are material — meaning they affect the way your personal data is collected, used, or disclosed — oh365 will notify registered Players by SMS to their registered mobile number, or by displaying a prominent notice on the oh365 platform, no less than fourteen (14) days before the changes take effect.

The effective date of the current version of this Policy is displayed at the top of this page. Your continued use of the oh365 platform following the effective date of any revised Policy constitutes your acknowledgement and acceptance of the updated terms. If you do not agree with any revision, you may close your Account and request deletion of your data (subject to mandatory retention obligations) by contacting our support team.

Contact & Complaints

Data Protection Officer Contact:

• Live Chat: Available 24/7 via the live chat widget on the oh365 platform
• Email: [email protected] (plain text — not a clickable link)

If you are not satisfied with oh365's response to a privacy complaint or data rights request, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines. The NPC is the independent government body responsible for enforcing the Data Privacy Act and can be reached through its official website and published complaints procedure.