okbt Privacy Policy — How We Protect and Handle Your Personal Data

1.1 okbt ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of every individual who uses the okbt platform at okbt.io ("you", "the Player", "the User"). This Privacy Policy describes how we collect, use, store, share, and protect personal information in the course of providing our online betting and casino services to players across Bangladesh, including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar.

1.2 okbt operates as a data controller with respect to the personal data of its registered players. As data controller, we determine the purposes and means by which personal data is processed and accept responsibility for its lawful handling.

1.3 This policy is written in plain English and applies to all services offered through the okbt platform, including sports betting, live casino, slots, card games, crash games, and any promotional or loyalty programmes. It covers data collected through the website, mobile browsers, and any communications you initiate with our support team.

1.4 If you have any questions about how okbt handles your personal data that are not addressed by this policy, please contact us at [email protected]. We are committed to responding to privacy enquiries in a timely and transparent manner.

2.1 okbt collects personal data in the following categories. The table below summarises the types of data collected, the context in which they are gathered, and whether provision is mandatory or optional.

2.2 okbt does not collect or store payment card numbers (Visa/Mastercard) directly. Card transactions are processed by PCI-DSS-compliant third-party payment gateways. We retain only a transaction reference and masked card details (last four digits) for reconciliation purposes.

2.3 We do not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data unless specifically required by law enforcement or regulatory authorities.

3.1 okbt uses the personal data we collect for the following purposes:

• Account management: To create, maintain, and administer your okbt player account, including processing your registration, verifying your identity, and managing your account settings.
• Service delivery: To enable you to place bets, play casino games, process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and other supported payment methods, and to credit winnings to your account.
• Identity verification (KYC): To verify that you meet the 21+ age requirement and to confirm your identity as required for financial crime prevention compliance.
• Fraud prevention and security: To detect and investigate suspicious activity, prevent duplicate accounts, identify potential collusion or bonus abuse, and protect the integrity of the platform.
• Responsible gaming: To monitor player behaviour for indicators of problem gambling, to enforce deposit limits and self-exclusion requests, and to flag accounts for welfare checks where appropriate.
• Customer support: To respond to your enquiries, complaints, and feedback, and to maintain a record of communications for quality assurance and dispute resolution.
• Legal compliance: To meet our obligations under applicable laws, including anti-money laundering (AML) requirements, and to respond to lawful requests from law enforcement authorities.
• Platform improvement: To analyse aggregated usage data for the purpose of improving the platform's features, performance, and user experience. This analysis does not individually identify players.
• Marketing communications: Where you have provided consent, to send you promotional offers, bonus notifications, and event updates relevant to your interests. You may withdraw this consent at any time.

3.2 okbt does not use your personal data for automated decision-making that produces significant legal effects without human review. Any account suspension or winnings void decision based on automated fraud detection is subject to manual review upon request.

4.1 okbt processes your personal data on the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing that is necessary to perform the contract between you and okbt — that is, to provide the betting and casino services you have registered for. This covers identity verification, payment processing, account management, and service delivery.
• Legal obligation: Processing required for okbt to comply with applicable legal requirements, including AML obligations, age verification requirements, and responses to lawful regulatory or law enforcement requests.
• Legitimate interests: Processing carried out in pursuit of okbt's legitimate business interests, where those interests are not overridden by your privacy rights. This covers fraud prevention, platform security, responsible gaming monitoring, and aggregated analytics for service improvement.
• Consent: Where processing is based on your explicit consent — specifically, the sending of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

4.2 Where okbt relies on legitimate interests as a legal basis, we have conducted an assessment to confirm that our interests do not override the fundamental privacy rights of the individuals concerned. Copies of such assessments are available upon written request.

5.1 okbt does not sell, rent, lease, or otherwise commercially transfer your personal data to any third party. Data is shared with external parties only to the extent described in this section and only under appropriate contractual protections.

5.2 Categories of third parties with whom okbt may share your personal data include:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and card processing gateways require transaction data to process your deposits and withdrawals. These providers operate under their own privacy policies and regulatory frameworks.
• Game studio providers: Providers including Evolution Gaming, Pragmatic Play, Ezugi, Spribe, NetEnt, and Microgaming receive limited technical data (such as player session tokens) necessary to deliver game content within your account session. They do not receive your full identity or payment data.
• Identity verification services: Third-party KYC providers may receive identity documents and personal details to assist in age and identity verification checks. These providers are bound by strict confidentiality and data security obligations.
• IT infrastructure and security providers: Hosting, cloud storage, and cybersecurity service providers process data on our behalf under data processing agreements that require them to handle your data only as directed by okbt.
• Law enforcement and regulatory authorities: okbt will disclose personal data to competent authorities in Bangladesh or other jurisdictions when required by law, court order, or other legal process. Where permitted by law, okbt will attempt to notify the affected account holder before complying with such a request.

5.3 All third-party processors engaged by okbt are subject to due diligence assessment and are required to maintain security standards no less stringent than those applied by okbt itself.

6.1 okbt uses cookies and similar tracking technologies on the okbt.io website to support platform functionality, security, and performance analysis. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the platform to function. These include session authentication cookies that keep you logged in during a betting session and security tokens that protect against cross-site request forgery. These cannot be disabled without impairing the platform's core functions.
• Functional cookies: These remember your preferences such as language settings, display options, and previously used payment methods to improve your experience on return visits.
• Analytics cookies: Used to collect aggregated data about how players navigate the platform — which pages are most visited, how long sessions last, and where users encounter difficulties. This data is used exclusively for platform improvement and does not identify individual players.
• Fraud prevention and security cookies: These help okbt identify unusual login patterns, detect device spoofing, and flag potential duplicate account activity by maintaining a fingerprint of your device configuration.

6.2 okbt does not use third-party advertising or behavioural targeting cookies. No data collected by okbt cookies is shared with advertising networks or used to build profiles for the purpose of targeting you with third-party advertisements.

6.3 You may control cookie settings through your browser preferences. Disabling strictly necessary cookies will impair platform functionality. For other cookie types, you can opt out without material impact on your ability to use the core betting and casino features of okbt.

7.1 okbt takes the security of your personal data seriously and employs a layered approach to data protection:

• Encryption in transit: All data transmitted between your device and the okbt platform is encrypted using TLS 1.2 or higher with 256-bit SSL certificates. This applies to account login, registration, payment flows, and all API communications.
• Encryption at rest: Sensitive personal and financial data stored in okbt's databases is encrypted at rest using AES-256 encryption. Database access is restricted to authorised personnel through role-based access controls.
• Access controls: Internal access to player data is granted on a strict need-to-know basis. All staff with data access undergo background checks and are bound by confidentiality obligations. Access logs are maintained and reviewed regularly.
• Two-factor authentication: Account logins from unrecognised devices trigger an OTP (one-time password) verification step sent to your registered mobile number, providing an additional layer of account security.
• Penetration testing: okbt conducts regular security assessments including vulnerability scanning and penetration testing to identify and remediate potential weaknesses in the platform's infrastructure.
• Incident response: okbt maintains a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify affected players and relevant authorities within the timeframes required by applicable law.

7.2 While okbt employs industry-standard security measures, no online platform can guarantee absolute security. You are encouraged to use a strong, unique password for your okbt account and to keep your login credentials confidential. If you suspect unauthorised access to your account, contact [email protected] immediately.

8.1 okbt retains personal data for no longer than is necessary to fulfil the purposes described in this policy or to comply with our legal obligations. The following retention periods apply:

• Active accounts: Personal and account data is retained for the duration of the active account relationship and updated as necessary to remain accurate.
• Closed accounts: Following account closure, identity, financial transaction, and account history records are retained for a minimum of five (5) years in compliance with anti-money laundering recordkeeping requirements applicable in the jurisdictions in which okbt operates.
• KYC documents: Identity verification documents (NID copies, passport scans) are retained for the duration of the account plus five (5) years following closure, after which they are securely destroyed.
• Support communications: Customer support records are retained for three (3) years following the resolution of the relevant enquiry or complaint.
• Marketing consent records: Records of your consent to receive marketing communications are retained for the duration of the consent and for two (2) years following its withdrawal, to evidence that we acted lawfully prior to withdrawal.
• Technical and usage data: Session logs and usage analytics are retained in aggregated, anonymised form. Individually identifiable technical data is deleted within twelve (12) months of collection.

8.2 At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual. Secure deletion applies to both digital records and any physical documents held.

9.1 As an okbt player, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Rights Request" and include your registered account username.

9.2 okbt will respond to all rights requests within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by a further 60 days, in which case we will inform you of the extension and the reason for it within the initial 30-day period.

9.3 We may ask you to verify your identity before processing a rights request to ensure that personal data is not disclosed to or deleted at the request of an unauthorised third party.

9.4 If you are not satisfied with how okbt has handled your personal data or responded to a rights request, you have the right to raise a complaint with the relevant data protection authority in your jurisdiction.

10.1 The okbt platform is strictly for adults aged 21 years and above. okbt does not knowingly collect personal data from individuals under the age of 21. If you are under 21, you must not register an account or use any okbt service.

10.2 If okbt becomes aware that personal data has been collected from a person under 21 years of age, that account will be immediately closed, all associated personal data will be deleted (subject only to any mandatory legal recordkeeping obligations), and any deposited funds will be returned via the original payment method where possible.

10.3 Parents or guardians who believe their minor child has created an okbt account should contact [email protected] immediately. okbt will investigate and act promptly upon receipt of such notification.

11.1 In order to deliver the okbt platform, some personal data may be processed by service providers and game studio partners whose infrastructure is located outside of Bangladesh. This includes cloud hosting providers and certain game content delivery networks operated by international studio providers such as Evolution Gaming, Pragmatic Play, and Ezugi.

11.2 Where personal data is transferred outside Bangladesh, okbt ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this policy. These safeguards include contractual clauses in data processing agreements that impose security and confidentiality obligations on recipient parties.

11.3 okbt does not transfer personal data to jurisdictions that are known to present materially elevated data protection risks without applying additional protective measures appropriate to the circumstances of the transfer.

12.1 okbt reserves the right to update this Privacy Policy at any time. The "Last Updated" date at the top of this page will be revised to reflect the date of any amendment. We encourage you to review this policy periodically to stay informed about how we handle your personal data.

12.2 Where changes to this policy are material — meaning they substantively affect your privacy rights or how your data is used — okbt will notify registered account holders by email to the address associated with their account at least 14 days before the changes take effect.

12.3 Your continued use of the okbt platform following the effective date of an updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with the changes, you may request account closure in accordance with the Terms & Conditions.

13.1 For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by okbt, please contact our privacy team using the details below:

13.2 If you wish to submit a formal complaint about how okbt has handled your personal data, please write to [email protected] with the subject line "Privacy Complaint". We will acknowledge your complaint within 5 business days and aim to provide a full written response within 30 days. Complex complaints may require up to 60 days, in which case we will keep you informed of progress.

13.3 If your complaint is not resolved to your satisfaction through okbt's internal process, you retain the right to escalate your complaint to the relevant data protection authority or competent regulatory body in your jurisdiction. okbt will cooperate fully with any such authority in the investigation of a complaint.

13.4 This Privacy Policy was last reviewed and updated on 1 January 2026. By using the okbt platform on or after this date, you confirm that you have read and understood this policy in its current form.