okpl Privacy Policy — Your Data, Protected

This Privacy Policy describes how okpl (referred to as "okpl", "we", "us", or "our") collects, processes, stores, shares, and protects personal data relating to individuals ("you", "the Player", "the Data Subject") who register for or use the okpl online betting and casino platform, accessible at okpl.io and all associated subdomains and mobile interfaces.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that directly or indirectly identifies a natural person, including but not limited to name, date of birth, national identification number, mobile number, email address, payment method details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, retrieval, use, disclosure, deletion, and destruction.
• "Data Controller" refers to okpl in its capacity as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" refers to any third-party entity that processes Personal Data on behalf of okpl pursuant to a written data processing agreement.
• "KYC" refers to the Know Your Customer identity and age verification procedures that okpl is required to conduct in order to comply with applicable anti-money laundering and age verification obligations.

This Privacy Policy applies to all users of the Platform regardless of their location, but is specifically tailored for players accessing the Platform from Bangladesh. This Policy should be read in conjunction with the okpl Terms & Conditions. In the event of any conflict between this Policy and the Terms & Conditions regarding data matters, this Privacy Policy shall prevail.

okpl collects Personal Data through several channels: directly from you when you register an account or interact with the Platform, automatically through your use of the Platform, and from verified third-party sources where required for KYC and fraud prevention purposes. The categories of Personal Data we collect include the following:

2.1 Registration and Identity Data

• Full legal name as it appears on your government-issued identity document.
• Date of birth (used to verify the 21+ age requirement).
• Residential address including district, division, and postal code.
• National ID number or passport number (collected during KYC verification).
• Mobile phone number linked to your bKash, Nagad, or Rocket wallet.
• Email address used for account communications and notifications.
• Username and hashed password chosen at registration.

2.2 Financial and Transaction Data

• Mobile financial service wallet identifiers (bKash, Nagad, Rocket, Upay) used for deposits and withdrawals.
• Transaction reference numbers, amounts in BDT (৳), timestamps, and statuses for all deposit and withdrawal activity.
• Bonus and promotional credit history including rollover progress.

2.3 Gameplay and Betting Activity Data

• Sports betting history including markets, selection, stake amounts, odds, and settlement outcomes.
• Casino game session logs including game title, provider, session start/end times, wager amounts, and results.
• Responsible gaming tool settings including deposit limits, cooling-off periods, and self-exclusion status.

2.4 Technical and Device Data

• IP address at the time of account registration and each subsequent login.
• Device type, operating system version, and browser type.
• Session identifiers, cookies, and authentication tokens.
• Geolocation data at a country/region level derived from your IP address.

2.5 Communications Data

• Records of live chat conversations with our customer support team.
• Email correspondence sent to or received from [email protected].
• Responses to surveys, promotions, or feedback requests where you choose to participate.

okpl processes your Personal Data for specific, clearly defined purposes. We do not use your data for any purpose incompatible with those stated below without first obtaining your explicit consent or being otherwise required or permitted to do so by law.

Where okpl sends you promotional communications — such as bonus offers tied to BPL cricket fixtures, Eid seasonal promotions, or reload bonus notifications — we will only do so where you have provided consent during registration or have subsequently opted in via your account settings. You may withdraw consent for marketing communications at any time by updating your notification preferences in the account dashboard or by contacting [email protected].

okpl processes Personal Data only where a valid legal basis exists for doing so. The four primary legal bases on which okpl relies are as follows:

• Contract Performance: Processing is necessary to fulfil our contractual obligations to you under the okpl Terms & Conditions — for example, to operate your account, process your deposits and withdrawals, and settle your bets.
• Legal Obligation: Processing is required to comply with applicable legal and regulatory requirements, including KYC identity verification, anti-money laundering record-keeping, and age verification obligations.
• Legitimate Interests: Processing is necessary for the purposes of okpl's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and analytics aimed at improving the player experience — provided those interests are not overridden by your data protection rights.
• Consent: For processing activities that are not strictly necessary for contract performance or legal compliance — in particular, sending marketing and promotional communications — okpl relies on your freely given, specific, and informed consent. You may withdraw this consent at any time.

okpl does not sell, rent, or trade your Personal Data to any third party under any circumstances. We share your data only where it is strictly necessary to provide the Platform's services or to comply with legal obligations, and only with verified partners bound by appropriate data protection agreements.

The categories of third parties with whom okpl may share your Personal Data, and the purpose of each sharing relationship, are set out below:

• Payment Processors: bKash, Nagad, Rocket, and Upay receive the minimum data necessary to process your deposit and withdrawal transactions — typically your wallet reference and the transaction amount. These providers operate under their own privacy policies and are independently regulated by Bangladesh Bank.
• Identity Verification Partners: Third-party KYC service providers may receive your identity documents and facial verification data solely for the purpose of confirming your identity and age as required prior to withdrawal processing. All such partners are subject to strict data processing agreements with okpl.
• Game Providers: Certified third-party game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — receive session tokens and anonymised player identifiers sufficient to operate game rounds. They do not receive your full identity or payment data.
• Platform Infrastructure Providers: Cloud hosting, content delivery network (CDN), and database service providers who store and process platform data on okpl's behalf. All infrastructure partners are contractually bound to process data only on okpl's documented instructions.
• Fraud Prevention and Security Services: Anti-fraud and cybersecurity service providers may receive technical and behavioural data — such as IP addresses, device fingerprints, and login patterns — for the purpose of detecting and preventing fraudulent activity.
• Legal and Regulatory Authorities: Where okpl is legally required to disclose Personal Data to law enforcement, regulatory bodies, or courts — for example, in connection with a money laundering investigation — it will comply with such requirements and, where permitted by law, will notify the affected player.

Where Personal Data is transferred to service providers located outside Bangladesh, okpl ensures that appropriate safeguards are in place — including contractual data protection clauses — to protect your data to a standard no less rigorous than that applied within Bangladesh.

The okpl platform uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain session security, and — where you have provided consent — to analyse platform usage and personalise your experience. Cookies are small text files stored on your device by your browser when you visit the Platform.

okpl uses the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function and cannot be disabled. They include session authentication tokens, load-balancing cookies, and security cookies that prevent cross-site request forgery. No consent is required for strictly necessary cookies.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, odds format, and sports category — to provide a personalised experience across sessions. They do not track your activity on external websites.
• Analytics Cookies: Where you have provided consent, okpl uses first-party analytics cookies to understand aggregate platform usage patterns — such as the most popular game categories, peak betting times, and navigation flows. This data is used to improve the Platform and is processed in anonymised or pseudonymised form.
• Fraud Prevention Cookies: Technical identifiers used to detect and flag unusual account access patterns, multiple account creation attempts, and suspected automated activity. These operate under the legitimate interests legal basis.

You can manage your cookie preferences through your browser settings at any time. Disabling cookies other than strictly necessary ones may limit certain Platform features. Please note that clearing all cookies will log you out of your current session and may reset your saved preferences.

okpl retains your Personal Data for as long as is necessary to fulfil the purposes for which it was collected, to provide and operate your account, and to comply with applicable legal and regulatory obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be associated with any individual. Where data cannot be immediately deleted due to active legal proceedings or regulatory investigations, it is placed under restricted access pending resolution.

As a player on the okpl platform, you hold the following rights in relation to your Personal Data. okpl is committed to responding to all valid data subject requests within 30 days of receipt. If additional time is required due to the complexity or volume of a request, okpl will notify you within the initial 30-day window.

• Right of Access: You have the right to request a copy of all Personal Data that okpl holds about you, along with information about how it is processed, the legal basis for processing, and the categories of third parties with whom it has been shared.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data held about you. For account details such as your name, address, or mobile number, minor corrections can also be made directly through the account settings panel.
• Right to Erasure: You have the right to request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you object to processing based on legitimate interests. This right is subject to legal retention obligations — for example, okpl is required to retain KYC and transaction records for regulatory compliance periods and cannot delete these on request during that window.
• Right to Restriction: You have the right to request that okpl restricts the processing of your Personal Data in certain circumstances — for example, where you contest the accuracy of the data, where processing is unlawful but you prefer restriction over deletion, or where okpl no longer needs the data but you require it for a legal claim.
• Right to Data Portability: Where processing is based on your consent or on contract performance, and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to Object: You have the right to object at any time to processing of your Personal Data carried out on the basis of legitimate interests, including profiling based on those interests. Upon receiving an objection, okpl will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on consent — in particular, marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent, update your preferences in the account dashboard or contact [email protected].

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Subject Request". Include your registered username and a brief description of the right you wish to exercise. okpl may request additional verification of your identity before processing the request in order to protect against unauthorised disclosure of Personal Data.

okpl takes the security of your Personal Data seriously and maintains a comprehensive set of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures are reviewed and updated regularly in line with industry best practice and evolving threat landscapes.

Our key security controls include the following:

• Transport Layer Security (TLS): All data transmitted between your device and the okpl platform is encrypted using 256-bit TLS. This applies to login sessions, account management, transaction flows, and customer support interactions.
• Password Hashing: Account passwords are stored exclusively as salted cryptographic hashes. okpl never stores or transmits passwords in plaintext. Support staff cannot retrieve your password — only a password reset process is available.
• Role-Based Access Control: Access to player Personal Data within okpl's internal systems is restricted to authorised personnel based on the principle of least privilege. Only staff members with a documented business need can access specific data categories, and all access is logged and auditable.
• Multi-Factor Authentication: Administrative systems containing player data are protected by multi-factor authentication. Players are also encouraged to enable any available second-factor options on their own accounts for additional login security.
• Regular Security Audits: okpl conducts periodic vulnerability assessments and penetration testing of its platform infrastructure to identify and remediate security weaknesses before they can be exploited.
• Data Minimisation: okpl collects only the minimum Personal Data necessary for each processing purpose and avoids retaining data beyond its required retention period.
• Incident Response: In the event of a data security incident that poses a risk to your rights and freedoms, okpl will notify affected players within 72 hours of becoming aware of the breach, where feasible, and will take immediate steps to contain and remediate the incident.

The okpl platform is strictly prohibited to individuals under the age of 21. okpl does not knowingly collect, store, or process the Personal Data of anyone under 21 years of age. The 21+ age restriction applies universally to all players regardless of their country of access.

Age verification is a mandatory step in the okpl registration and withdrawal process. Players are required to submit government-issued identity documentation confirming their date of birth. Accounts where age verification cannot be completed, or where a player is subsequently identified as being under 21, will be immediately suspended. Any funds deposited by a minor will be returned to the source payment method following an investigation, and no betting or gaming activity conducted during the period of underage access will be honoured.

okpl supports the use of parental control tools and third-party internet filtering software to restrict access to gambling websites. If you share a device with anyone under 21, we strongly recommend installing appropriate access controls to prevent underage access to the okpl platform and other gambling services.

okpl reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, business operations, or data processing practices. The "Last Updated" date displayed at the top of this Policy and in the hero section of this page will be revised each time a material change is made.

Where amendments are material — meaning they significantly affect how we process your Personal Data or the rights available to you — okpl will notify registered players via email to their registered address and/or via a prominently displayed notice on the Platform at least 14 days before the amended Policy takes effect. Your continued use of the Platform after the effective date of the amended Policy constitutes your acceptance of the revised terms.

For non-material amendments — such as minor clarifications, corrections of typographical errors, or restructuring of sections without substantive change to their meaning — okpl may update the Policy without prior notice, though the "Last Updated" date will still be revised accordingly.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your Personal Data by okpl, please contact our support team using the details below. All privacy-related enquiries are handled by trained staff and are treated with strict confidentiality.

• Email: [email protected] — use the subject line "Privacy Enquiry" or "Data Subject Request" as appropriate.
• Live Chat: Available 24/7 via the live chat widget on the okpl platform. Average response time is 2–5 minutes.
• Response Time: Written privacy enquiries submitted by email will receive an acknowledgement within 24 hours and a substantive response within 30 days, or sooner where the matter is straightforward.

When submitting a data subject request, please include your registered username, the email address associated with your account, and a clear description of your request. This allows okpl to locate your records promptly and process your request within the required timeframe. If we need to verify your identity before responding, we will request a copy of a government-issued identity document.

This Privacy Policy was last reviewed and updated in January 2026. It supersedes all previous versions of the okpl Privacy Policy. The English-language version of this document is the sole authoritative version for all legal and regulatory purposes.