Privacy Policy – okta Player Data & Protection

This Privacy Policy ("Policy") is issued by okta ("okta", "we", "us", "our"), the operator of the online betting and gaming platform accessible at https://okta.pro ("Platform"). okta serves players primarily located in Bangladesh and is committed to handling all personal data with integrity, transparency, and rigorous security.

This Policy applies to all personal data collected from individuals who visit the okta Platform, register a player account, use any okta service, or otherwise interact with okta through any channel, including our customer support email at [email protected].

The categories of personal data that okta collects and processes are described in the table below. Collection is limited to what is necessary for the stated purposes.

okta does not intentionally collect sensitive personal data such as racial or ethnic origin, religious beliefs, political opinions, health data, or biometric identifiers, except where a regulatory obligation specifically requires it (for example, medical documentation submitted in connection with a self-exclusion request).

okta collects personal data through the following channels:

• Direct submission: Data you provide when registering your account, completing identity verification, making a deposit or withdrawal request, or contacting our support team.
• Automated collection: Technical and usage data collected automatically as you browse and interact with the okta Platform, using server logs, session tracking, and analytics tools.
• Payment providers: Confirmation data received from bKash, Nagad, Rocket, Upay, City Bank, BRAC Bank, and other payment partners to verify transaction status.
• Identity verification partners: Results of identity and age verification checks carried out by our KYC compliance partners when you submit documents for account verification.
• Fraud detection services: Risk signals and device fingerprinting data from third-party fraud-detection providers used to protect the integrity of the Platform and the safety of player accounts.

okta processes personal data only where a lawful basis for doing so exists. The primary legal bases on which okta relies are as follows:

• Contractual necessity: Processing is required to fulfil the contract between okta and the Player — including account creation, service delivery, payment processing, and withdrawal execution.
• Legal obligation: Processing is required to comply with applicable legal and regulatory obligations, including anti-money-laundering checks, age verification, and financial record-keeping.
• Legitimate interests: Processing is necessary for okta's legitimate interests in operating a secure, fair, and commercially viable Platform — including fraud prevention, security monitoring, and responsible gaming analysis — where those interests are not overridden by the Player's data rights.
• Consent: Where processing is not covered by the bases above — for example, sending optional promotional communications — okta will seek your explicit consent. You may withdraw consent at any time by contacting [email protected].

okta uses the personal data it collects for the following purposes:

• Creating and managing your player account, including identity verification and age confirmation in compliance with the 21+ age policy.
• Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported Bangladeshi banks, and maintaining accurate financial records.
• Delivering and improving the betting, casino, and gaming services available on the Platform, including personalising content recommendations based on your activity history.
• Administering VIP loyalty program tiers, calculating reward points, and notifying you of tier upgrades and VIP-exclusive promotions (where you have opted in to marketing communications).
• Detecting, investigating, and preventing fraudulent activity, multi-accounting, bonus abuse, money laundering, and any other conduct that breaches okta's Terms and Conditions.
• Monitoring gameplay patterns to identify signs of problem gambling and, where warranted, proactively engaging with players about responsible gaming tools available on okta.
• Responding to player support enquiries, resolving complaints, and maintaining records of player interactions for quality assurance and dispute resolution.
• Sending account-related communications such as deposit confirmations, withdrawal notifications, and security alerts.
• Complying with applicable legal obligations, cooperating with law enforcement or regulatory bodies where required by law.

okta does not sell your personal data. We share personal data with third parties only where it is necessary to provide our services, comply with legal obligations, or protect the integrity and security of the Platform. The categories of third parties with whom we may share data are set out below:

• Payment processors: bKash, Nagad, Rocket, Upay, City Bank, BRAC Bank, Dutch-Bangla Bank, Islami Bank, Sonali Bank, Visa, and Mastercard, for the purpose of processing deposits and withdrawals. These providers handle payment data under their own privacy policies and security standards.
• Identity verification providers: KYC and AML compliance partners who perform identity checks, document verification, and age confirmation on okta's behalf.
• Fraud detection services: Third-party risk and fraud intelligence providers who assist okta in identifying suspicious activity and protecting player accounts.
• Game providers: Where gameplay data is technically transmitted to third-party game studios (e.g., Pragmatic Play, Evolution Gaming, Spribe, Ezugi, Microgaming, NetEnt) to render games on the Platform, data is shared on a minimum-necessary basis under data processing agreements.
• Legal and regulatory authorities: okta may disclose personal data to law enforcement agencies, financial intelligence units, or regulatory bodies where required by law or where we have a good-faith belief that disclosure is necessary to investigate fraud, money laundering, or other unlawful activity.
• Professional advisors: Legal counsel, auditors, and compliance consultants, under strict confidentiality obligations, where necessary for okta's legal and business operations.

All third parties with whom okta shares personal data are required to handle that data securely and to use it only for the specific purpose for which it was shared. okta does not permit third parties to use player data for their own marketing, profiling, or secondary purposes.

okta uses cookies and similar tracking technologies on the Platform to ensure proper functionality, maintain session security, analyse usage patterns, and improve the overall player experience. The types of cookies we use are as follows:

• Essential cookies: Strictly necessary for the Platform to function. These include session authentication cookies that keep you logged into your okta account and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without impairing Platform functionality.
• Analytics cookies: Used to collect anonymised data about how players interact with the Platform — such as pages visited, session duration, and navigation paths — to help us identify areas for improvement. No personally identifiable information is transmitted through analytics cookies.
• Preference cookies: Used to remember your Platform settings and preferences (e.g., display settings, notification preferences) so that you do not need to reconfigure them each time you visit.
• Fraud detection cookies: Used to collect device fingerprinting signals that assist okta in detecting multi-accounting, automated access, and other fraudulent behaviour.

You can manage your cookie preferences through your browser settings. Please note that disabling non-essential cookies will not affect your ability to use the core betting and gaming features of the okta Platform.

okta retains personal data for as long as is necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by law. Our standard retention periods are as follows:

• Active account data: Retained for the duration of the account relationship plus five (5) years after account closure, in compliance with standard financial record-keeping obligations.
• Identity verification documents: Retained for five (5) years from the date of verification or account closure, whichever is later, in accordance with anti-money-laundering record-keeping requirements.
• Transaction records: Financial transaction data is retained for a minimum of five (5) years from the date of the transaction.
• Support and communications records: Customer support logs are retained for three (3) years from the date of the last interaction.
• Technical and usage data: Anonymised analytics data is retained for up to twenty-four (24) months. Non-anonymised session logs are deleted after twelve (12) months.
• Self-exclusion records: Records of self-exclusion requests are retained permanently to prevent re-registration during the exclusion period and to comply with responsible gaming obligations.

When personal data is no longer required, okta securely destroys or irreversibly anonymises it so that it can no longer be attributed to an identifiable individual.

As a player on the okta Platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request" and your account username.

• Right of access: You have the right to request a copy of the personal data that okta holds about you, along with information about how it is being used.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to okta's legal retention obligations (see Clause 8).
• Right to restrict processing: You may request that okta restricts the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being verified.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another service provider where technically feasible.
• Right to object: You have the right to object to processing based on legitimate interests, including the use of your data for direct marketing. We will honour valid objections promptly.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

okta will respond to all verified data rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it.

okta employs a comprehensive set of technical and organisational security measures to protect player data against unauthorised access, disclosure, alteration, or destruction. These measures include but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between the player's device and the okta Platform.
• AES-256 encryption for sensitive personal and financial data stored in okta's database systems.
• Multi-factor authentication requirements for all staff with administrative access to player data systems.
• Role-based access controls ensuring that only authorised personnel can access specific categories of player data relevant to their job function.
• Continuous automated monitoring and alerting for anomalous access patterns, login attempts, and potential data breaches.
• Regular independent security audits and penetration testing of the Platform and its underlying infrastructure.
• Secure deletion protocols applied when data reaches the end of its retention period.

In the event of a personal data breach that poses a risk to players, okta will assess the breach promptly and notify affected players via their registered email address without undue delay. Notifications will describe the nature of the breach, the data affected, the likely consequences, and the steps taken by okta to address it.

The okta Platform is strictly intended for adults aged 21 years and over. okta does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration process, and okta reserves the right to request government-issued proof of age at any point.

If okta discovers that personal data has been collected from an individual who is under 21 years of age, we will immediately suspend the relevant account, delete all associated personal data, and refund any deposited funds to the originating payment method after completing the necessary verification steps. If you have reason to believe that a minor has registered on the okta Platform, please notify us immediately at [email protected].

okta reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or the services we offer. When material changes are made, we will notify registered players by email to the address held on their account, or by displaying a prominent notice on the Platform, at least seven (7) days before the changes take effect.

We recommend that all players review this Policy periodically. The date at the top of this page indicates when this Policy was last updated. Continued use of the okta Platform after the effective date of any update constitutes your acceptance of the revised Policy.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how okta handles your personal data, please contact us using the following details:

• Email: [email protected]
• Subject line for data rights requests: "Data Rights Request – [Your Username]"
• Support availability: 24 hours a day, 7 days a week including Bangladeshi public holidays
• Response time: Within 30 calendar days for formal data rights requests; within 1 hour for general support enquiries during Bangladesh Standard Time (BST, UTC+6) peak hours
• Language: English support available at all times