Privacy Policy
How Okrabook collects, uses and protects personal data
This policy explains how Okrabook handles personal data. It is a notice, not a contract. Okrabook's contractual commitments to academies are set out in its Terms of Service and the Data Processing Addendum attached to them.
1Who this policy covers
Academies and their staff. Owners, administrators, coaches and other staff of organisations that subscribe to Okrabook (Customers), and people who enquire about, trial or buy Okrabook. For this data Okrabook decides why and how it is processed and is the controller.
End Users. Players, students, parents, guardians and others who register, book, pay or communicate through a Customer's Okrabook-powered booking portal, app or messaging (End Users). The Customer decides why and how this data is processed and is the controller; Okrabook is the processor acting on the Customer's instructions under our Terms of Service. If you are an End User, the academy's own privacy notice applies to you as well as this policy, and requests about your data should be directed to the academy in the first instance. Section 9 explains how we help.
Website visitors. Anyone who visits okrabook.com or a Customer's booking portal hosted by us. Section 6 covers cookies and analytics.
2What we collect
2.1 From Customers and their staff (Okrabook as controller)
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, job title, business email, phone, WhatsApp number | You, when you enquire, sign up or are added as a user |
| Organisation | Academy name, trade licence details, address, venues, number of players and staff | You; public registers |
| Account and login | Username, hashed password, role and permissions, login timestamps, IP address, device and browser | Generated when you use the Platform |
| Commercial and billing | Package, Order Form, invoices, payment status, billing contact, last four digits and expiry of a card on file (full card details are held by our payment processor, not by us) | You; our payment processor |
| Communications | Helpdesk tickets, emails, WhatsApp messages with our support and account teams, call notes, training attendance | You; our support tools |
| Usage | Features used, pages viewed, actions taken in the administrator application, error logs | Generated when you use the Platform |
| Marketing preferences | Whether you have opted in or out of product news | You |
2.2 About End Users (Okrabook as processor for the Customer)
The academy decides which fields it collects. Typically this includes: name, date of birth and age group, gender, contact details of the player and of a parent or guardian, emergency contact, membership or class enrolment, attendance, skill level or performance notes, medical or allergy notes where the academy chooses to record them, photos where the academy enables them, booking and payment history (payment card details go directly to the academy's payment gateway and are not stored by Okrabook), messages sent through the Platform, and portal login and device information. Okrabook does not use End User data for any purpose of its own except as described in section 3.1.
2.3 Automatically, from any visitor
IP address, approximate location derived from it, browser and device type, referring page, pages visited and time spent, and cookie identifiers. See section 6.
2.4 Children
Many End Users are under 18. Okrabook processes children's data only on behalf of the academy and never for its own purposes. Players aged 13 to 17 may use the booking portal or app under a parent's or guardian's account, so we process their login and device data for the academy. Players under 13 are not given their own logins. Where an academy registers a child under 13, the booking flow asks a parent or guardian for explicit consent before the child's data is processed, and we keep a record of that consent. We do not use children's data for profiling or targeted advertising, and we do not allow third-party advertising on booking portals or apps. Academies that use the Platform are responsible for obtaining parental or guardian consent where the law requires it and for limiting the data they collect about minors to what they need. Parents and guardians can ask the academy to review or delete their child's data at any time; Okrabook will act on the academy's instructions.
3Why we use personal data and on what basis
Where a legal basis is required, we rely on the ones shown. Under the GDPR these are Article 6(1)(a) consent, (b) performance of a contract, (c) legal obligation and (f) legitimate interests. Under the UAE Personal Data Protection Law we rely on the corresponding grounds in that law. Terminology follows the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where applicable, the GDPR and similar laws.
| Purpose | Data | Basis |
|---|---|---|
| Provide the Platform, create and administer Accounts, deliver onboarding and support | Identity, account, organisation, communications, usage | Performance of our contract with the Customer |
| Invoice, take payment, send renewal reminders and receipts, collect overdue amounts | Commercial and billing, identity | Performance of contract; legal obligation (tax and accounting records) |
| Send service messages: outage notices, maintenance windows, security alerts, changes to terms | Identity, account | Performance of contract; legitimate interest in keeping you informed about the service |
| Keep the Platform secure, detect fraud and abuse, maintain logs and backups | Account, usage, automatically collected data | Legitimate interest in security and integrity; legal obligation |
| Improve the Platform, fix defects, understand how features are used | Usage, aggregated and de-identified data | Legitimate interest in improving our service |
| Send product news and offers to Customer contacts | Identity, marketing preferences | Consent. For email to existing Customers, legitimate interest with an easy opt-out. WhatsApp and SMS marketing is sent only with consent. |
| Comply with law, respond to lawful requests, establish or defend legal claims | Any relevant data | Legal obligation; legitimate interest |
End User data. We process End User data only to provide the Platform to the academy — hosting it, displaying it to the academy's authorised staff, sending the messages the academy configures, processing bookings and passing payment instructions to the academy's gateway — and to keep it secure and backed up. We may use End User data in aggregated, de-identified form (for example, total bookings per month across all academies) to operate and improve the Platform. We never use End User data for our own marketing or share it with advertisers.
Automated decisions. We do not make decisions with legal or similarly significant effects on individuals by automated means. Academies may configure automated rules (for example, waitlist promotion or reminder messages); those are the academy's decisions.
4Who we share data with
We share personal data only as needed to run the service, and never sell it. Our current categories of recipients are:
| Recipient | What and why | Location |
|---|---|---|
| Cloud hosting provider — Contabo GmbH | All Platform data, to host and back up the Platform | Germany |
| Payment processor for Okrabook's own invoices — Stripe | Customer billing details, to take subscription payments | United States |
| Payment gateways chosen by each academy — for example Stripe or CCAvenue | End User payment instructions, so the academy can accept payment. The gateway is the academy's provider and has its own privacy policy | Depends on gateway |
| Messaging providers — WhatsApp Business API provider, SMS gateway, email delivery service | Recipient number or address and message content, to deliver the messages academies and Okrabook send | Depends on service |
| Helpdesk, CRM and support tooling | Customer contact and ticket data, to run support and account management | Depends on service |
| Analytics — Google Tag Manager / Google Analytics on okrabook.com | Website usage data (see section 6) | Global, including the United States |
| Integrations the academy connects — e.g. Zoho CRM, Zoho Books | Data the academy chooses to sync; the academy is responsible for its account with the integrated service | Depends on service |
| Professional advisers, auditors, insurers | Limited data where needed for advice, audit or claims | Depends on service |
| Authorities and courts | Where required by law or to protect rights and safety | As required |
| A buyer or successor | If Okrabook is sold or merges; you will be notified and this policy will continue to apply | — |
An up-to-date list of sub-processors used for End User data is available on request from [email protected] and is set out in the Data Processing Addendum to our Terms of Service. We give Customers at least 30 days' notice of any new sub-processor.
5International transfers
Personal data is hosted in Germany. Some of the recipients in section 4 are located in, or access data from, other countries. Where data leaves the country in which it was collected we rely on safeguards recognised by applicable law, such as transfer to a country recognised as providing adequate protection, contractual clauses approved by the relevant regulator, or the recipient's binding corporate rules. Details are available on request. Transfers from the EEA or UK rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum or, for US recipients such as Stripe and Google, on the recipient's certification under the EU-US Data Privacy Framework where available.
6Cookies and analytics
Our website and the Platform use cookies and similar technologies. Strictly necessary cookies keep you logged in, remember your settings and protect against fraud; they cannot be switched off. Analytics cookies (Google Analytics via Google Tag Manager) help us understand how the website is used; we set them only with your consent where the law requires it, and you can withdraw consent through the cookie banner or your browser settings. We do not use advertising or cross-site tracking cookies on the Platform.
Academies' booking portals hosted by Okrabook use strictly necessary cookies only, unless the academy enables additional tools. In that case the portal shows a consent banner, those tools load only after the visitor consents, and the academy's own notice also applies.
7How long we keep data
| Data | Retention |
|---|---|
| Customer Account and Platform data (including End User data) | For the life of the subscription and 30 days after it ends, during which the Customer may export it; then deleted, except that backups are overwritten within ninety (90) days |
| Billing and tax records | Five (5) years after the end of the financial year to which they relate, as required by law |
| Contracts, Order Forms and acceptance records | Six (6) years after the Agreement ends, to establish or defend legal claims |
| Support tickets and correspondence | Three (3) years after closure |
| Marketing preferences and consent records | Until you withdraw consent, plus a suppression record so we do not contact you again |
| Security and access logs | Twelve (12) months |
| Website analytics | Fourteen (14) months (Google Analytics default) |
Where a Customer instructs us to delete End User data sooner, or an End User's request is passed to us by the academy, we delete it within thirty (30) days unless a legal obligation requires retention.
8How we protect data
We use technical and organisational measures appropriate to the risk, including: encryption of data in transit (TLS) and at rest; role-based access controls and least-privilege access for our staff; multi-factor authentication for administrative access; logging and monitoring; regular backups; secure development practices and vulnerability management; and confidentiality obligations for all personnel and sub-processors.
Card payments are handled by PCI-DSS-compliant payment providers; Okrabook does not store full card numbers.
No system is perfectly secure. If a personal-data breach affects Customer Data, we will notify the affected Customer without undue delay and in any event within 48 hours of becoming aware of it and, where the law requires, the relevant regulator and affected individuals. Customers are responsible for keeping their own credentials secure and removing access for staff who leave.
9Your rights
Depending on where you are, you may have the right to: access the personal data we hold about you; have it corrected; have it deleted; restrict or object to certain processing; receive a copy in a portable format; withdraw consent where processing is based on consent; and complain to a data-protection authority. In the UAE the relevant regulator is the UAE Data Office; elsewhere, your local authority.
Customer staff and contacts. Contact [email protected]. We will respond within thirty (30) days (or the shorter period required by law) and may ask for information to verify your identity.
End Users. Please contact the academy you booked with; it controls your data and can update or delete it directly in the Platform. If you contact us instead, we will pass your request to the academy and help it respond. Where the academy has stopped trading or does not respond, we will act on your request ourselves where we lawfully can. Our Terms of Service authorise us to do this.
Marketing. You can opt out of product news at any time using the unsubscribe link in any marketing email or by contacting us. Service messages about your subscription, security and changes to terms are not marketing and will continue while you have an Account.
10Other sites and services
The Platform links to and integrates with third-party sites and services (payment gateways, messaging apps, Zoho and others). Their privacy practices are governed by their own policies, which we encourage you to read.
11Changes to this policy
We may update this policy from time to time. Each version carries a version number and effective date. We will tell Customers about material changes by email or through the Platform at least thirty (30) days before they take effect, and we keep an archive of previous versions available on request. Continued use of the Platform after the effective date means the updated policy applies. If we want to use personal data for a new purpose that requires consent, we will ask for that consent separately.
12Contact us
Privacy enquiries and rights requests: [email protected]
Postal: OKRA TECH FZCO, Dtec, Dubai Silicon Oasis, Dubai, UAE
For End Users: please contact the academy you booked with first; their contact details are on their booking portal.