Privacy Policy —
How okbag Protects Your Personal Data

1. Introduction

Clause 1.1 — Who We Are

okbag ("we", "us", "our", "the Platform") operates an online sports betting and live casino platform accessible at okbag.io, targeting players in Bangladesh. We are committed to protecting the privacy and personal data of every individual who interacts with our platform, whether as a registered user, a visitor to our site, or a participant in any promotional activity we conduct.

Clause 1.2 — Scope of This Policy

This Privacy Policy applies to all personal data collected, processed, stored, and transferred by okbag in connection with the operation of our platform and services. It covers data collected via the okbag website, any mobile-optimised version of the site, communications you send to us via email, live chat, or WhatsApp, and data obtained from trusted third-party sources in connection with identity verification and payment processing.

Clause 1.3 — Your Consent

Where okbag relies on consent as the lawful basis for processing your personal data — for example, for sending you promotional communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent may affect your ability to receive personalised offers and bonus notifications from okbag, but it will not affect your ability to use the core betting and gaming features of the platform.

2. Data We Collect

Clause 2.1 — Registration Data

When you create an okbag account, we collect the following personal data: your full legal name, date of birth, mobile phone number, and a self-selected password (stored in encrypted form — we never store passwords in plain text). This information is required to create your account and verify that you meet the minimum age requirement of 21 years.

Clause 2.2 — Identity Verification (KYC) Data

To comply with applicable anti-money laundering standards and responsible gaming obligations, okbag may request government-issued identity documents at various points during your use of the platform. KYC documents may include a copy of your National Identity Card (NID), passport, or other photographic identification. We may also request a selfie or short video for liveness verification purposes. These documents are processed securely and retained only for as long as required by applicable law.

Clause 2.3 — Financial Data

When you make a deposit or request a withdrawal, okbag collects the payment method details necessary to process the transaction. For mobile financial services (bKash, Nagad, Rocket, Upay), this includes your registered mobile wallet number. okbag does not store full payment credentials beyond what is necessary for transaction processing and fraud prevention. Full card or wallet authentication is handled by the respective payment provider, not by okbag directly.

Clause 2.4 — Transaction & Betting Data

okbag maintains records of all financial transactions made on your account (deposits, withdrawals, bonus credits, adjustments) and all betting and gaming activity (bets placed, markets selected, games played, outcomes, winnings and losses). This data is essential to the operation of the platform, to the calculation of bonus wagering requirements, and to responsible gaming monitoring obligations.

Clause 2.5 — Technical & Device Data

When you access the okbag platform, our servers automatically collect certain technical information, including your IP address, browser type and version, device type and operating system, pages visited, time and duration of visits, and referring URL. This data is used to maintain platform security, detect suspicious access patterns, and optimise the performance of the platform for users accessing it from Bangladesh.

Clause 2.6 — Communications Data

If you contact okbag via live chat, email ([email protected]), or WhatsApp, we collect and retain records of those communications, including the content of messages, timestamps, and the resolution reached. This data is used to resolve your query, train support staff, and maintain a record of any disputes raised.

3. How We Collect Your Data

Clause 3.1 — Directly From You

The majority of personal data okbag holds about you is provided directly by you — when you register your account, complete the KYC verification process, make deposits or withdrawal requests, contact our support team, or participate in promotions and competitions. You are in control of the information you choose to provide, though some data is mandatory for the operation of your account.

Clause 3.2 — Automatically During Platform Use

Technical and device data is collected automatically by okbag's servers and analytics systems when you access and use the platform. This collection is passive and does not require any active input from you. Cookies and similar tracking technologies also play a role in automated data collection — these are covered in detail in Section 7 of this policy.

Clause 3.3 — From Trusted Third Parties

In certain circumstances, okbag may receive personal data about you from trusted third-party sources. This includes identity verification providers used to validate KYC documents, payment processors that confirm the status of your transactions, and fraud prevention services that flag suspicious activity patterns. Data received from third parties is treated with the same level of care and protection as data collected directly from you.

4. Legal Basis for Processing

Clause 4.1 — Contractual Necessity

The primary legal basis for processing your personal data is contractual necessity. okbag cannot deliver its betting and gaming services to you without processing your registration data, financial data, and transaction history. Without this processing, your account cannot function and okbag cannot fulfil its obligations to you as a user of the platform.

Clause 4.2 — Legal Obligation

Some processing activities are required by law, including anti-money laundering (AML) obligations that require us to verify your identity, retain transaction records, and report suspicious activity to the relevant authorities. Compliance with these legal obligations may require us to retain certain data for defined minimum periods regardless of your preferences.

Clause 4.3 — Legitimate Interests

okbag processes certain categories of data — particularly technical and device data — on the basis of its legitimate interest in maintaining the security and integrity of the platform, detecting and preventing fraud, and ensuring that the betting environment is fair for all users. We balance these interests carefully against your privacy rights and do not rely on this basis where your interests override ours.

Clause 4.4 — Consent

Where okbag sends you promotional communications, personalised offers, or non-essential notifications, we do so on the basis of your consent. You may withdraw this consent at any time by updating your communication preferences in your account settings or by contacting our support team. Withdrawal of consent for marketing communications does not affect the processing of data required to operate your account.

5. How We Use Your Data

Clause 5.1 — Core Service Delivery

The primary use of your personal data is to deliver the okbag betting and casino service to you. This includes creating and managing your account, processing your deposits and withdrawals via bKash, Nagad, Rocket, and Upay, settling your bets on cricket (BPL, IPL, T20), sports, and casino games, and providing customer support when you need it.

Clause 5.2 — Identity and Age Verification

okbag uses the personal data you provide and KYC documents you submit to verify that you are who you say you are and that you meet the minimum age requirement of 21 years. This is a mandatory process for withdrawals and may be triggered at other points during your account lifecycle. Age and identity verification protect the platform's integrity and the wellbeing of all users.

Clause 5.3 — Responsible Gaming Monitoring

okbag uses your betting and transaction data to monitor for indicators of potentially problematic gambling behaviour, such as rapidly escalating deposit volumes, patterns of chasing losses, or unusual session lengths. Where such indicators are detected, okbag may proactively reach out to offer responsible gaming tools, including deposit limits, cool-off periods, and self-exclusion. This monitoring is carried out in the interest of player welfare.

Clause 5.4 — Fraud Prevention and Security

Technical data, device fingerprints, IP addresses, and behavioural patterns on the platform are used by okbag's security systems to detect and prevent fraud, money laundering, bonus abuse, multi-accounting, and unauthorised account access. This processing is essential to maintaining a fair and safe betting environment for all legitimate users of the platform.

Clause 5.5 — Promotional Communications

With your consent, okbag may use your contact details and platform activity data to send you personalised promotional communications, including bonus offers, free bet promotions, BPL seasonal campaigns, and platform updates. These communications may be delivered via SMS to your registered mobile number. You can opt out of promotional communications at any time.

6. Sharing Your Personal Data

Clause 6.1 — We Do Not Sell Your Data

okbag does not sell, rent, or lease your personal data to any third party for their own independent commercial purposes. Your data is not a commodity — it is information entrusted to us in the course of your use of our services, and we treat it accordingly.

Clause 6.2 — Service Providers

okbag shares personal data with a limited number of trusted third-party service providers who assist us in delivering the platform's services. These include: identity verification and KYC providers; payment processing partners (bKash, Nagad, Rocket, Upay); game content providers (Pragmatic Play, Evolution Gaming, Spribe, Ezugi, Microgaming, NetEnt); fraud detection and cybersecurity services; and customer support platform providers. All service providers are contractually bound to process your data only for the purposes specified by okbag and to maintain appropriate security standards.

Clause 6.3 — Legal and Regulatory Disclosures

okbag may be required by law, court order, or regulatory authority to disclose personal data relating to your account or activity on the platform. In such cases, okbag will comply with its legal obligations and will disclose only the minimum data necessary to satisfy the requirement. Where legally permissible, okbag will make reasonable efforts to inform you of such a disclosure before it occurs.

Clause 6.4 — Business Transfers

In the event that okbag undergoes a merger, acquisition, restructuring, or sale of all or part of its business, your personal data may be transferred to the acquiring entity as part of that transaction. In such circumstances, okbag will take reasonable steps to ensure that the acquiring entity provides equivalent privacy protections to those described in this policy, and will notify you of any material change in how your data is managed as a result of the transaction.

7. Cookies & Tracking Technologies

Clause 7.1 — What Are Cookies

Cookies are small text files placed on your device by a website when you visit it. They are widely used to make websites function correctly, to remember your preferences, and to provide website operators with information about how users interact with their platform. okbag uses cookies and similar technologies (including local storage and session tokens) to deliver a consistent and secure experience on the platform.

Clause 7.2 — Types of Cookies We Use

• Essential Cookies: These are strictly necessary for the platform to function. They maintain your login session, manage your account security token, and ensure that your bets and transactions are processed correctly. These cookies cannot be disabled without breaking core platform functionality.
• Performance & Analytics Cookies: These cookies collect anonymised data about how users navigate the platform — which pages are visited most frequently, where users encounter errors, and how long sessions typically last. This data helps okbag improve the platform experience over time.
• Functional Cookies: These remember your preferences, such as your language settings, preferred payment method, and any responsible gaming limits you have set, so that you do not need to re-enter them on every visit.
• Security Cookies: These support okbag's fraud detection systems by helping to identify unusual device or browser behaviour that may indicate account compromise or unauthorised access attempts.

Clause 7.3 — Managing Cookies

You can manage or delete cookies via your browser settings at any time. Most browsers allow you to block all cookies, accept all cookies, or receive a notification when a cookie is set so you can decide on a case-by-case basis. Please note that disabling essential cookies will impair your ability to log in to your okbag account and use the platform's core features. Disabling performance or functional cookies will not prevent you from using the platform but may result in a less personalised experience.

8. Data Retention

Clause 8.1 — Retention Principles

okbag retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory obligations, and to resolve any disputes that may arise in connection with your account. When data is no longer required, it is securely deleted or anonymised in accordance with okbag's data lifecycle management procedures.

Clause 8.2 — Retention Periods by Category

• Account and Registration Data: Retained for the duration of your active account and for a minimum of five years following account closure, to satisfy applicable record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five years following the completion of the verification process, in accordance with anti-money laundering requirements.
• Transaction and Betting Records: Retained for a minimum of five years from the date of each transaction or bet, to support regulatory compliance and dispute resolution.
• Communications Data: Live chat transcripts and email correspondence are retained for a minimum of two years from the date of the conversation.
• Technical and Device Data: Retained for up to 12 months from the date of collection, unless a longer retention period is required for fraud investigation or security purposes.

9. Security Measures

Clause 9.1 — Technical Safeguards

okbag employs a range of technical security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include industry-standard SSL/TLS encryption for all data transmitted between your device and our servers, encrypted storage of sensitive data at rest, firewalls and intrusion detection systems, and regular security audits of our platform infrastructure.

Clause 9.2 — Access Controls

Access to personal data within okbag's systems is restricted on a strict need-to-know basis. All staff members who handle personal data are subject to background checks, confidentiality agreements, and mandatory data protection training. Access logs are maintained and reviewed regularly to detect any anomalous internal access patterns.

Clause 9.3 — Incident Response

In the event of a personal data breach that poses a risk to your rights and freedoms, okbag will take immediate steps to contain the breach, assess its scope and impact, and notify affected users as quickly as practicable. okbag maintains a formal incident response plan that is reviewed and tested on a regular basis.

Clause 9.4 — Your Role in Security

While okbag takes extensive technical and organisational measures to protect your data, the security of your account also depends on your own actions. You are responsible for keeping your password confidential, for using a strong and unique password for your okbag account, for logging out of the platform when using a shared device, and for notifying okbag immediately if you suspect unauthorised access to your account.

10. Your Privacy Rights

Clause 10.1 — Overview of Rights

As a user of the okbag platform, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to legal limitations in certain circumstances, but okbag is committed to facilitating their exercise wherever it is lawfully possible to do so:

• Right of Access: You have the right to request a copy of all personal data that okbag holds about you. This is known as a Subject Access Request (SAR). We will respond to all SARs within 30 days of receipt.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. You can update most account data directly via your account dashboard.
• Right to Erasure: In certain circumstances, you have the right to request that we delete your personal data ("the right to be forgotten"). This right applies where the data is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where the processing was unlawful. It does not apply where retention is required by law.
• Right to Restriction: You have the right to request that okbag restricts the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or where you have objected to processing based on legitimate interests.
• Right to Data Portability: Where processing is based on your consent or on a contract with you, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another data controller.
• Right to Object: You have the right to object to processing of your personal data that is based on okbag's legitimate interests, including profiling for responsible gaming monitoring purposes. You also have an absolute right to object to processing for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Clause 10.2 — How to Exercise Your Rights

To exercise any of the rights listed above, please contact okbag's support team via live chat or by emailing [email protected] with the subject line "Privacy Rights Request". We will acknowledge your request within 48 hours and provide a full response within 30 calendar days. We may need to verify your identity before processing your request to ensure that we are disclosing data to the correct individual.

11. Children & Minors

Clause 11.1 — Strict Age Restriction

The okbag platform is strictly intended for adults aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21. If you are under 21 years of age, you must not register an account, use the platform, or provide any personal data to okbag. If okbag discovers that personal data has been collected from an individual under the minimum age, that account will be immediately closed and all associated data will be deleted, except to the extent that retention is required by law.

Clause 11.2 — Parental Responsibility

If you are a parent or guardian and believe that a minor in your care has registered an okbag account or provided personal data to our platform, please contact our support team immediately at [email protected]. We will investigate the matter promptly and take all necessary steps to close the account and remove the data. We also encourage parents and guardians to make use of parental control software to prevent minors from accessing online gambling platforms.

12. International Data Transfers

Clause 12.1 — Cross-Border Processing

As an online platform serving users in Bangladesh, okbag may process and store certain categories of your personal data on servers or with service providers located outside of Bangladesh. When data is transferred internationally, okbag ensures that appropriate safeguards are in place to protect that data to a standard equivalent to the protections described in this policy. These safeguards may include contractual data processing agreements with third-party providers that impose equivalent data protection obligations.

Clause 12.2 — Game Providers

Certain categories of your data — specifically technical session data and game activity records — may be processed by our third-party game content providers (including Pragmatic Play, Evolution Gaming, Spribe, Ezugi, Microgaming, and NetEnt) whose infrastructure is located outside Bangladesh. These providers are contractually bound to process this data solely for the purpose of delivering their game content and related technical services, and to maintain industry-standard data protection practices.

13. Changes to This Privacy Policy

Clause 13.1 — Right to Update

okbag reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, changes in the services we offer, changes in the technology we use, or changes in our internal data handling practices. The date of the most recent revision is always displayed at the top of this document.

Clause 13.2 — Notification of Material Changes

Where a change to this Privacy Policy is material — meaning it significantly affects how we collect, use, or share your personal data — okbag will notify registered users via SMS or in-platform notification at least seven days before the change takes effect. Your continued use of the platform after the revised policy takes effect constitutes your acceptance of the updated terms. If you do not accept the changes, you may request account closure in accordance with our Terms & Conditions.

14. Contact & Data Protection Officer

Clause 14.1 — How to Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which okbag handles your personal data, please contact us through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the okbag platform.
• Email: [email protected] — please include "Privacy Query" in the subject line.
• WhatsApp: +880 1700 000000 (plain text — not a clickable link).

Clause 14.2 — Response Commitment

okbag is committed to addressing all privacy-related queries and complaints promptly and transparently. We will acknowledge all privacy queries within 48 hours of receipt and will provide a substantive response within 14 calendar days. Where a query relates to a Subject Access Request or the exercise of another data protection right, the 30-day statutory response window applies as described in Section 10.