Privacy policy

How the OktagonBet partner program (the oktagonbet.partners site and cabinet) processes your personal data. Last updated: 3 October 2026.

Who processes the data

The data controller is ALPHAPEX DOO Beograd — the operator of games of chance under the OktagonBet brand, which runs the OktagonBet Partners program. For any question about your data and to exercise your rights, write to support@oktagonbet.partners. We process data in accordance with the Law on Personal Data Protection of the Republic of Serbia.

What we collect

Access request and account: email, preferred language (the language of the page you send the request from), password (stored only as a cryptographic hash, never as text). The request does not ask for your name — we receive it from Google or Telegram if you sign in with them.
Sign-in and security: IP address and browser details (user agent) for each session, a log of sign-ins and important account actions. To prevent abuse we count sign-in attempts by a hash of the IP address and email, not by the values themselves.
Telegram, if you link it: your numeric Telegram ID and username, and — if you share your contact with our bot yourself — your phone number and the first and last name from Telegram.
Google (and Facebook, once available), if you sign in with them: first and last name, email and whether it is verified, and your account ID with that service. We request only the basic profile and email — we do not access your contacts, files, messages or any other data of those services.
Emails to support: if you write to our address, we keep the email and its attachments in order to reply. A notice of the email — sender, subject, text and attachment names — reaches the program operator through Telegram.

Why we process it

to review your access request, open and maintain your account and sign you in to the cabinet — performance of the agreement on participation in the program;
to protect the account and the site from abuse (attempt limits, the “not a robot” check, sign-in notices in Telegram) — our legitimate interest;
to send you account emails: email confirmation, sign-in links, a notice that an account already exists;
to keep records of commissions and payouts — financial records we are required to keep.

We do not sell data, do not use it for advertising and do not build profiles for targeted advertising.

Data from Google

The data we receive from Google at sign-in (name, email, email verification status, account ID) is used only to sign you in and link you to your program account. We do not transfer it to third parties, except the infrastructure provider that stores it for us (Cloudflare), and we do not use it for advertising. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke the link in your Google account settings or by writing to us — we then delete your Google account ID.

Who receives the data

Cloudflare, Inc. — the site infrastructure: servers, database, email storage, email sending, the “not a robot” check (Turnstile, which receives your IP address when you submit a request) and anonymous visit statistics (Web Analytics, without cookies). Data may be processed outside Serbia, on Cloudflare servers.
Telegram — if you link it, messages from our bot to you (link confirmation, sign-in notice) go through Telegram. Separately, the operator receives notices of emails to support (sender, subject, text) through Telegram.
Google and Facebook — only if you sign in with them: they send us the data listed above.

We currently do not send your personal data to the partner traffic tracking system; if that changes, we will update this policy beforehand.

Cookies and browser storage

We set one cookie — __Host-obp_session, required for sign-in: it lasts 7 days, is sent only over HTTPS and is not available to scripts. In the browser’s local storage we remember your choice of language, theme and the side menu state. We do not use analytics or advertising cookies.

How long we keep data

account data — while the account exists;
a session — 7 days or until you sign out; email confirmation links — 24 hours, sign-in links — 15 minutes, Telegram codes — 10 minutes;
the log of sign-ins and actions — for account security, while the account exists;
commission and payout records — as long as financial record-keeping rules require;
emails to support — until the enquiry is resolved; we delete them on request.

At your request we delete your account and data, except data we are required by law to keep.

Your rights

You have the right to request access to your data, correction, deletion, restriction of processing and data portability, and to object to processing. Send your request to support@oktagonbet.partners from the address linked to your account; we reply within 30 days. You also have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of Serbia.

Minors

The program is intended for adults only. We do not knowingly collect data of persons under 18.

Changes to this policy

When we change the policy, we update the date above; we notify account holders of significant changes by email.