Baj Baji Privacy Policy — Your Data, Your Rights, Our Responsibility

1 Who We Are

Baj Baji (accessible at bajbaji.click) is an online gaming platform serving players in Pakistan. When this Privacy Policy refers to "Baj Baji," "we," "us" or "our," it means the operating entity responsible for this platform and the data associated with player accounts on it.

This Privacy Policy applies to all personal data collected through the Baj Baji website, any associated mobile-optimised interfaces and any communications you have with Baj Baji via email, live chat or other support channels. It applies to all registered players and prospective players in Pakistan.

If you have questions about this policy, about how Baj Baji handles your data, or about exercising any of your rights described in this document, please contact our support team at support@bajbaji.click. Our team is available 24 hours a day, seven days a week, in both Urdu and English.

2 What Personal Data We Collect

The data Baj Baji collects falls into three broad categories: information you provide directly, information generated by your use of the platform, and information received from third parties in connection with payment processing and identity verification.

Data You Provide Directly

• Registration data: Your full name, Pakistani mobile phone number, email address, date of birth and any password or PIN you create.
• Identity verification data: A copy of your CNIC (Computerised National Identity Card), a utility bill, a bank statement or other documentation we may request as part of Know Your Customer (KYC) checks.
• Communication data: The content of any messages you send to Baj Baji via live chat, email or any other support channel — including the nature of your query and the resolution provided.
• Responsible gaming data: Any deposit limits, self-exclusion periods or other responsible gaming preferences you set through your account settings.

Data Generated by Platform Use

• Transaction data: Deposit amounts, withdrawal requests, payment method used, timestamps and transaction reference numbers.
• Gaming activity data: Games played, bet amounts, winnings and losses, session durations, timestamps and game outcomes — generated for each round you participate in.
• Technical data: IP address, device type, operating system, browser type and version, screen resolution, and mobile network operator — collected automatically when you access the platform.
• Behavioural data: Navigation patterns within the platform, pages visited, features used and time spent — collected via session cookies and analytics tools.

Data from Third Parties

• Payment processor data: Confirmation of deposit and withdrawal transactions from JazzCash, Easypaisa, NayaPay, SadaPay, bank IBFT systems and card networks (Visa/Mastercard). We receive transaction confirmation data — not your full mobile wallet credentials or banking passwords.
• Identity verification services: Where we use a third-party service to assist with document verification during KYC checks, that service may provide us with a confirmation status and summary — not the full document contents, which are handled securely on their end.

3 Why We Collect Your Data — Legal Basis

Every piece of data Baj Baji collects is collected for a specific, defined purpose. We do not collect data speculatively or "just in case." The table below sets out the main purposes, the data used and the legal basis for each:

4 How We Store and Protect Your Data

Data security is not a compliance exercise at Baj Baji — it is a core operational priority. Pakistani players entrust us with sensitive personal and financial information, and we take that responsibility seriously. Here is how we protect it:

• 256-bit SSL Encryption in Transit: All data transmitted between your device and the Baj Baji platform is encrypted using Transport Layer Security (TLS 1.3). This means that even if someone were to intercept network traffic between you and our servers, the data would be unreadable to them.
• Encrypted Storage at Rest: Personal data and payment records stored in Baj Baji's systems are encrypted at rest. Database-level encryption ensures that raw data cannot be extracted in readable form even in the event of an infrastructure breach.
• Access Controls: Only authorised Baj Baji staff with a demonstrable business need can access personal player data, and only to the extent required for their role. Access is logged, audited and regularly reviewed. Staff with access to player data are bound by confidentiality obligations.
• No Storage of Sensitive Payment Credentials: Baj Baji does not store your JazzCash PIN, Easypaisa password, full card number, CVV or banking login credentials. Payment transactions are processed via the respective payment provider's secure infrastructure — we receive only a transaction reference and confirmation.
• Secure Data Centres: Baj Baji's data is hosted in secure, access-controlled data centre environments with physical security, redundant power systems and regular penetration testing.
• Incident Response: In the event of a data security incident that affects your personal data, Baj Baji has a documented incident response procedure. Affected players will be notified promptly if an incident is likely to result in risk to their personal data.

5 Who We Share Your Data With

Baj Baji does not sell your personal data to any third party, ever. We do not share your data for advertising purposes, and we do not provide your data to data brokers or marketing companies. The only circumstances under which Baj Baji shares player data with any external party are as follows:

Payment Processors

To process deposits and withdrawals, Baj Baji shares the minimum necessary data with payment providers — JazzCash, Easypaisa, NayaPay, SadaPay, and banking networks. This data is limited to transaction amounts, your registered account identifier, and the reference information needed to route and confirm the payment. Payment processors are contractually bound to handle this data only for the purpose of processing the specific transaction.

Identity Verification Services

Where Baj Baji uses a third-party service to assist with KYC document verification, copies of the relevant documents may be submitted to that service for verification. These providers are bound by strict data processing agreements and do not retain or use your documents for any purpose other than the verification check requested.

Legal and Regulatory Obligations

Baj Baji may be required to disclose certain player data to law enforcement authorities, regulatory bodies or courts in response to a lawfully issued order, warrant or legal process. In such cases, we will disclose only the data specifically required by the order and, where legally permitted to do so, we will notify the affected player.

Platform Security and Fraud Prevention

In cases of suspected fraud, money laundering or multi-account abuse, Baj Baji may share relevant account and transaction data with specialist fraud prevention services or, where criminal conduct is suspected, with the appropriate authorities.

Business Transfers

In the event that Baj Baji's business or assets are transferred to a new operator, player data may be included in the transferred assets. Any successor operator would be bound by this Privacy Policy in relation to data collected before the transfer. Players would be notified of any such transfer in advance.

6 Cookies and Tracking Technologies

Baj Baji uses cookies and similar tracking technologies to make the platform work correctly, to remember your preferences and to understand how the platform is being used so we can improve it. Here is what the main categories of cookies we use actually do:

• Strictly Necessary Cookies: These are required for the platform to function. They manage your login session, keep you authenticated between pages, and handle security tokens. You cannot opt out of these without ceasing to use the platform, because they are what makes the platform actually work.
• Functional Cookies: These remember your preferences — such as your preferred language, your last bet amount and your display settings — so you do not have to re-enter them every session.
• Analytics Cookies: These collect anonymised data about how players navigate the platform — which pages are visited most, how long sessions last, where players drop off. This data is aggregated and used only for improving the platform. Individual players cannot be identified from analytics data.
• Performance Cookies: These monitor platform loading times and detect errors, helping the technical team identify and fix performance issues quickly.

You can manage cookie preferences through your browser settings. Blocking certain cookies may affect the functionality of the Baj Baji platform. Strictly necessary cookies cannot be disabled while you are using the platform.

7 Payment Data — What We See and What We Don't

Pakistani players at Baj Baji commonly deposit and withdraw via JazzCash and Easypaisa, which are mobile wallet services that many players use as their primary financial tool. It is important to be clear about what Baj Baji sees and what it does not see in relation to these transactions.

What Baj Baji receives: A transaction confirmation, the amount deposited or requested for withdrawal, a reference number, and a timestamp. This is sufficient to credit your account or dispatch your withdrawal.

What Baj Baji does not receive and does not store: Your JazzCash or Easypaisa PIN, your mobile banking password, your full bank account number, your card CVV, or any other authentication credential used to authorise a payment on your mobile wallet or bank's side.

Payment authorisation for all methods at Baj Baji happens within the payment provider's own secure environment — not on Baj Baji's platform. This means your most sensitive financial credentials never touch our systems at all. Baj Baji's payment integration is designed specifically so that we cannot see your wallet password or banking PIN even if we wanted to.

8 Your Rights Over Your Personal Data

As a Baj Baji player, you have specific rights over the personal data we hold about you. These are not theoretical — they are practical rights you can exercise at any time by contacting our support team:

To exercise any of these rights, contact Baj Baji support at support@bajbaji.click. We may need to verify your identity before processing any data rights request to ensure we do not release data about you to someone else.

9 How Long We Keep Your Data

Different categories of data are retained for different periods at Baj Baji, depending on why the data was collected and what legal obligations apply to it:

• Account data (name, email, phone number) is retained for the duration of your active account plus a period of five years following account closure, to comply with financial record-keeping requirements and to handle any late-arising disputes.
• Transaction records (deposits, withdrawals, game outcomes) are retained for a minimum of five years after the transaction date, in line with standard financial record-keeping practice. This is not optional — financial records must be retained to comply with applicable anti-money laundering obligations.
• KYC documents (CNIC copies, supporting documents) are retained for the duration of your account and for five years post-closure, or longer if required by a specific legal obligation.
• Support communications are retained for three years after the query was resolved, to allow review of past interactions in the event of repeat issues or escalated disputes.
• Analytics data (anonymised behavioural and technical data) is retained in aggregated, non-identifiable form for as long as it is useful for platform improvement purposes. Individual-level analytics data is anonymised after 24 months.
• Marketing preferences (consent records) are retained from the date consent was given until you withdraw it, plus sufficient time to demonstrate compliance with consent requirements.

When data reaches the end of its retention period, it is securely deleted or irreversibly anonymised. Baj Baji does not keep data longer than necessary.

10 Children's Privacy

The Baj Baji platform is strictly for adults. You must be 18 years of age or older to register an account, make any deposit, place any bet or access any real-money game on the platform. We do not knowingly collect personal data from anyone under the age of 18.

If Baj Baji becomes aware that an account has been created by or is being used by a person under 18, that account will be immediately suspended. Any funds deposited by a minor will be returned to the payment source used. Any winnings accumulated by a minor during any period of use will be forfeited.

Parents and guardians who are concerned that a minor may be accessing the Baj Baji platform are encouraged to contact support immediately. We also encourage the use of parental control software on shared devices to prevent access to online gaming platforms by minors.

11 Changes to This Privacy Policy

Baj Baji reviews this Privacy Policy regularly and updates it when our data practices change, when the platform evolves, or when applicable legal requirements change. The "Last Updated" date at the top of this page reflects when the current version was finalised.

For material changes — those that significantly affect how we use your data or your rights over it — Baj Baji will notify active players via email or an in-platform notification at least 7 days before the change takes effect. For minor, non-material updates (such as clarifications of existing practices), we will update the page without advance notification.

Continuing to use the Baj Baji platform after the effective date of a policy update constitutes your acceptance of the updated Privacy Policy. If you do not agree with changes to this policy, you should close your account before the changes take effect.

12 How to Contact Us About Privacy

If you have a question, concern or request related to this Privacy Policy, your personal data or your rights as a Baj Baji player, please contact us using the details below. Our support team handles privacy requests in both Urdu and English, 24 hours a day, seven days a week.

When submitting a data rights request, please include your registered name and phone number so we can verify your identity before processing the request. We take these requests seriously and will not dismiss or delay a legitimate rights request.