oktka Privacy
Policy

1. Information We Collect

When you interact with the oktka platform, we collect personal information in order to operate our services, verify your identity, process payments, and comply with applicable anti-money laundering (AML) and know-your-customer (KYC) obligations. The categories of information we collect are described below.

Information You Provide Directly

This is information you submit when you register an account, complete identity verification, contact customer support, or participate in promotions:

• Registration data: full legal name, date of birth, email address, and mobile number linked to your Bangladesh-based mobile financial service account (bKash, Nagad, Rocket, or Upay).
• Identity documents: scanned or photographed copies of your National Identity Card (NID), passport, or other government-issued photo identification submitted for KYC verification.
• Payment information: mobile wallet numbers, bank account details, or card details used to make deposits or receive withdrawals. Full card numbers are never stored on our servers — payment processing is handled by PCI-DSS compliant third-party providers.
• Communications: the content of messages you send to our support team via email or live chat, including any attachments or screenshots you choose to share.
• Promotional participation data: responses to surveys, competition entries, and bonus claim activity.

Information Collected Automatically

When you access the oktka platform, certain technical data is collected automatically by our systems:

• Device and browser data: IP address, device type, operating system version, browser type and version, screen resolution, and language settings.
• Usage data: pages visited, games played, bets placed, session duration, click patterns, and navigation paths within the platform.
• Transaction logs: timestamps, amounts, and method identifiers for every deposit, withdrawal, bet, and bonus transaction processed on your account.
• Geolocation data: approximate location derived from your IP address. We do not collect precise GPS coordinates unless you explicitly grant browser location permission.
• Cookie and tracking data: data collected via cookies, pixel tags, and similar technologies as described in the Cookies section of this policy.

Information from Third Parties

In limited circumstances we may receive information about you from third parties, including identity verification service providers used to cross-check the documents you submit during KYC, payment processors who confirm the status and outcome of transactions, and fraud prevention services that flag unusual activity patterns. We use this information solely for the purposes of account security, payment verification, and regulatory compliance.

2. How We Use Your Information

oktka processes your personal data for clearly defined purposes. We do not use your data for any purpose that is incompatible with the reason it was originally collected. The primary purposes are:

Marketing Communications

If you opt in to marketing communications during registration or at any later point via your account settings, oktka may contact you by email or SMS with information about promotions, new game releases, seasonal offers tied to events such as Eid, Pohela Boishakh, BPL season, or other relevant occasions. You may withdraw your marketing consent at any time by updating your communication preferences in the account settings panel, or by contacting support at [email protected]. Withdrawing marketing consent does not affect our ability to send you essential transactional communications related to your account.

Automated Decision-Making

oktka uses automated systems to flag potentially fraudulent or suspicious account activity, to enforce responsible gaming deposit limits, and to personalise the game lobby display. Where an automated decision results in a material outcome for you — such as an account restriction — you have the right to request a human review of that decision by contacting our support team.

3. Sharing and Disclosure of Data

oktka does not share your personal data with third parties except in the specific circumstances described below. In all cases where data is shared, we require the recipient to maintain appropriate confidentiality and security standards consistent with this policy.

Service Providers and Processors

We share limited personal data with carefully selected third-party service providers who perform functions on our behalf. These include:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, Visa, and Mastercard — to execute deposit and withdrawal transactions. Each provider receives only the data necessary to complete the specific transaction.
• Identity verification providers: third-party KYC services that cross-check the identity documents you submit against available public records and databases.
• Game studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other certified providers receive a pseudonymous player identifier and session token to deliver game content. They do not receive your full name, NID, or payment details.
• Cloud infrastructure and hosting providers: servers on which oktka's platform and data are hosted. These providers are bound by strict data processing agreements.
• Customer support platform providers: tools used to manage and respond to support tickets and live chat conversations.

Legal and Regulatory Disclosure

oktka may disclose your personal data to government authorities, law enforcement agencies, financial intelligence units, or regulatory bodies where we are required to do so by applicable law, court order, or regulatory directive. We will only disclose the minimum data necessary to comply with the specific legal requirement.

Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of the oktka business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the privacy terms applicable to your data going forward.

4. Cookies and Tracking Technologies

oktka uses cookies and similar tracking technologies to enable the platform to function correctly, to remember your preferences, to keep you logged in during a session, and to gather aggregated analytics data that helps us improve the platform experience for all players.

What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device on subsequent visits and to store certain preferences or session data. Cookies set by the website you are visiting are called first-party cookies; those set by third-party services integrated into the site are called third-party cookies.

Categories of Cookies We Use

Managing Cookies

You can control and delete cookies through your browser's settings at any time. Disabling strictly necessary cookies will impair the platform's ability to function — in particular, you will not be able to remain logged in or have responsible gaming controls enforced correctly. For analytics and functional cookies, opt-out via your browser settings will not affect your ability to use the core features of the platform.

5. Data Retention and Storage

oktka retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active account data: retained for the full duration of your account's active status plus a minimum of five years following account closure, in accordance with AML and financial record-keeping obligations.
• KYC documents: retained for a minimum of five years from the date of submission or from the date of account closure, whichever is later, in line with standard financial compliance requirements.
• Transaction logs: retained for a minimum of five years from the date of each transaction.
• Customer support records: retained for three years from the date of the final interaction in a given support case, unless the case relates to an ongoing dispute or investigation.
• Marketing consent records: retained for the duration of the consent plus two years to document compliance, or until a formal objection or withdrawal of consent is received.
• Analytical and aggregated data: may be retained indefinitely in anonymised or aggregated form, as it can no longer be attributed to any individual.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data. Where deletion is not technically feasible in the short term (for example, in backup systems), the data is isolated and protected from further processing until deletion is completed.

6. Security Measures

oktka takes the security of your personal information seriously and implements a range of technical and organisational measures designed to protect your data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS): all data transmitted between your device and the oktka platform is encrypted using TLS 1.2 or higher. The padlock icon visible in your browser address bar confirms this encryption is active.
• Encryption at rest: sensitive personal data stored in our databases is encrypted at rest using AES-256 or equivalent encryption standards.
• Access controls: personal data is accessible only to oktka staff and approved service providers who have a genuine operational need to access it. All staff with data access undergo security awareness training and are bound by confidentiality obligations.
• Audit logging: all access to sensitive personal data is logged and monitored. Unusual access patterns trigger automated alerts for review by our security team.
• Password security: account passwords are stored as salted cryptographic hashes, never in plain text. oktka staff cannot view your password and will never ask you to share it.
• Fraud detection systems: automated systems monitor account activity in real time to detect and respond to signs of unauthorised access, including login from new devices, unusual betting patterns, and suspicious withdrawal requests.

Despite these measures, no system can guarantee absolute security. If you have reason to believe your account has been compromised, you must contact the oktka support team at [email protected] immediately so that we can investigate and take appropriate action.

In the event of a data security incident that materially affects your personal information, oktka will notify affected users within a reasonable timeframe via the registered email address on the account, and will take all reasonable steps to contain and remediate the incident.

7. Your Rights Over Your Data

As a user of the oktka platform, you hold the following rights with respect to your personal data. To exercise any of these rights, submit a written request to [email protected] from the email address registered to your account. We will respond within a reasonable timeframe and in any event no later than 30 days from receipt of a valid request.

Right of Access

You have the right to request confirmation of whether oktka holds personal data about you, and if so, to receive a copy of that data together with information about how it is being used. Where the data held is extensive, we may provide it in a structured, commonly used format.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For account registration details such as your email address, you may update these directly in the account settings panel. For identity document details, contact the support team.

Right to Erasure

You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw your consent (and no other legal basis for processing exists), or where you object to processing on grounds of legitimate interests. This right is subject to overriding obligations such as legal data retention requirements — oktka cannot delete transaction records it is legally required to retain.

Right to Restrict Processing

In certain circumstances — for example, while a dispute about the accuracy of your data is being resolved — you may request that we restrict the processing of your personal data to storage only, without using it for any other purpose.

Right to Object to Marketing

You may withdraw your consent to receive marketing communications at any time without penalty. This can be done via the communication preferences panel in your account settings or by contacting support. Withdrawal of marketing consent does not affect the processing of your data for transactional or legal compliance purposes.

Right to Lodge a Complaint

If you believe that oktka has not handled your personal data in accordance with this Privacy Policy, you have the right to raise a complaint by contacting our support team in the first instance. If you are not satisfied with the outcome of that process, you may escalate your complaint to the relevant data protection authority in your jurisdiction.

8. Changes to This Policy

oktka reviews this Privacy Policy on a regular basis and updates it as necessary to reflect changes in our data processing practices, applicable law, or platform functionality. The date at the top of this page indicates when the policy was last revised.

Where changes are material — meaning they significantly affect how we process your personal data or the rights available to you — we will notify you in advance by email to the address registered on your account, or via a prominent notice on the platform. For minor clarifications that do not affect the substance of the policy, we may update the document without specific notification beyond updating the revision date.

Your continued use of the oktka platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the updated policy, you should cease using the platform and contact our support team to request account closure in accordance with the voluntary closure process described in the Terms and Conditions.

All previous versions of this Privacy Policy are available upon request by contacting [email protected]. Requests for prior versions will be fulfilled within 14 business days.