HeyBaji Privacy Policy — How We Handle Your Personal Data

HeyBaji (operated at heybaji.plus) is an online gaming and sports betting platform built specifically for Pakistani players. We understand that sharing personal information online requires trust, and we take the responsibility of protecting that information very seriously. This Privacy Policy is written to give you a clear, plain-language understanding of exactly how your data is handled — not to obscure things behind technical or legal jargon.

Pakistan's digital landscape has changed rapidly over the past few years. Millions of people now use mobile wallets like Easypaisa and JazzCash for everyday transactions, and the idea of sharing personal details online is increasingly normal. At the same time, concerns about data privacy and misuse are growing — and rightly so. HeyBaji is committed to being a platform you can trust not just with your money, but with your personal information too.

This policy applies to every type of data we handle — from the mobile number you provide during registration to the games you play and the transactions you make. It covers our website, our customer support channels, our payment processing flows and any marketing communications we send to you. The goal is simple: you should always know what HeyBaji knows about you and what we do with it.

HeyBaji collects personal data in several categories depending on how you interact with the platform. The table below gives an overview of the main data types we hold and why:

We do not collect sensitive personal data beyond what is required for identity verification and legal compliance. Specifically, HeyBaji does not collect biometric data, religious information, health data or political opinions unless directly relevant to a legal obligation or formal complaint process.

HeyBaji collects personal data through a number of different channels and interactions. Understanding these helps you know exactly what you're sharing and when:

• Account Registration: When you create a HeyBaji account, you provide your mobile number, name, date of birth and other registration details directly to us.
• Identity Verification: When HeyBaji requests KYC documentation, you submit documents such as your CNIC or passport image through our secure upload facility.
• Deposits and Withdrawals: Financial transactions via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT or card payments generate transaction records that include your payment account details.
• Platform Activity: Your use of the HeyBaji platform — games played, bets placed, sessions started, pages visited — is automatically recorded to our servers as part of normal platform operation.
• Device and Browser Data: Technical information about your device, browser, operating system, screen resolution and IP address is collected automatically through standard web technologies.
• Customer Support: When you contact HeyBaji via Live Chat, WhatsApp, Telegram or email, the content of those communications is stored for support and quality assurance purposes.
• Cookies and Tracking: HeyBaji uses cookies and similar tracking technologies on its website. Full details are provided in Section 9 of this policy.

HeyBaji uses your personal data for a defined set of operational purposes. We do not process your data for any purpose beyond what is reasonably necessary to provide and improve the platform. The primary purposes are:

• Account Management: To create, maintain and secure your HeyBaji account, including verifying your identity and processing account-related requests.
• Payment Processing: To accept deposits, process withdrawals and maintain accurate financial records of all transactions associated with your account in Pakistani Rupees.
• Fraud Prevention and Security: To detect, investigate and prevent fraudulent activity, money laundering, account takeover attempts and other prohibited behaviour on the platform.
• Legal and Regulatory Compliance: To meet obligations under applicable law, including anti-money laundering requirements, record-keeping obligations and responses to lawful requests from authorities.
• Customer Support: To respond to your queries, resolve disputes and handle complaints in a timely and effective manner.
• Platform Improvement: To analyse usage patterns, identify technical issues and develop new features that better serve Pakistani players.
• Responsible Gaming: To monitor gaming patterns that may indicate problematic behaviour and to apply responsible gaming tools where appropriate — including deposit limits, session reminders and self-exclusion where requested.
• Personalisation: To tailor the HeyBaji experience to your preferences, including relevant game recommendations and appropriate promotional offers based on your activity profile.
• Service Communications: To send you transactional notifications related to your account — such as deposit confirmations, withdrawal processing updates and security alerts.

Marketing communications from HeyBaji — such as promotional offers and bonus notifications — are sent only where you have opted in to receive them or where we have a legitimate interest to do so under applicable rules. You may opt out of marketing communications at any time through your account settings or by contacting our support team.

HeyBaji processes your personal data on the basis of one or more of the following legal grounds:

• Contractual Necessity: Processing that is required to fulfil the services described in our Terms and Conditions — such as operating your account, processing deposits and paying out winnings — is carried out because it is necessary to perform the contract between you and HeyBaji.
• Legal Obligation: Some processing is required to comply with applicable laws, including anti-money laundering obligations, identity verification requirements and record-keeping mandated by regulatory authorities.
• Legitimate Interests: HeyBaji may process certain data where doing so serves legitimate business interests — such as fraud prevention, platform security and platform improvement — provided those interests are not overridden by your privacy rights.
• Consent: Where processing is based on your consent — such as receiving marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

HeyBaji does not sell, rent or disclose your personal data to third parties for commercial purposes. However, in order to operate the platform effectively and meet legal obligations, we do share certain data with a limited set of trusted third parties under strict conditions:

• Payment Processors: When you make a deposit or withdrawal via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT or card, we share the minimum necessary financial information with the relevant payment gateway to process the transaction. These processors are bound by their own privacy obligations and security standards.
• Identity Verification Services: When KYC verification is required, your identity documents may be processed by third-party verification services that confirm authenticity and check against relevant databases. These services are contractually bound to handle your data securely and not to use it for any other purpose.
• Fraud Detection Providers: HeyBaji uses specialist third-party services to detect fraudulent activity, bot behaviour and suspicious transaction patterns. These providers receive anonymised or pseudonymised data where possible.
• Regulatory Authorities: HeyBaji may be required by law to disclose account information or transaction records to regulatory bodies, law enforcement agencies or courts in response to legally valid requests. We will only comply with requests that are properly authorised and legally binding.
• Technology Partners: Hosting, cloud infrastructure and analytics providers that support the operation of the HeyBaji platform may process technical data as part of their service delivery. All such providers are required to maintain appropriate data protection standards.

All third parties that process data on behalf of HeyBaji are subject to data processing agreements that restrict their use of your information to the specified purpose and require them to implement appropriate technical and organisational security measures.

HeyBaji retains personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Identity, contact and financial data is retained for the duration of your account's active status plus a minimum of five years thereafter, in line with standard financial record-keeping requirements.
• Transaction Records: All deposit and withdrawal transaction records are retained for a minimum of five years from the date of the transaction.
• KYC Documentation: Identity documents submitted for verification are retained for five years from the date of submission or from account closure, whichever is later.
• Customer Support Records: Communications with the HeyBaji support team are retained for up to three years from the date of the final interaction.
• Technical and Usage Data: Log files, IP address records and device data are typically retained for 12–24 months and then anonymised or deleted.
• Marketing Preferences: Records of your marketing consent or opt-out status are retained for as long as needed to honour your stated preferences.

When the retention period for a category of data expires, HeyBaji will either delete the data securely, anonymise it so it can no longer be associated with you, or archive it in a restricted environment where it can only be accessed for specific legal or compliance purposes.

HeyBaji implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration or disclosure. These measures include:

• Encryption in Transit: All data transmitted between your device and HeyBaji's servers is encrypted using 256-bit TLS/SSL. Every page of the platform runs over HTTPS.
• Encryption at Rest: Sensitive data stored on HeyBaji's servers — including financial records and identity documents — is encrypted at rest using industry-standard encryption protocols.
• Access Controls: Access to personal data within HeyBaji's systems is restricted on a strict need-to-know basis. Staff access is logged, regularly reviewed and governed by internal data handling policies.
• Two-Factor Authentication: HeyBaji offers optional two-factor authentication for player accounts to provide an additional layer of security against unauthorised login attempts.
• Fraud Monitoring: Real-time fraud and anomaly detection systems monitor account activity for patterns consistent with unauthorised access or financial crime.
• Regular Security Reviews: HeyBaji's technical infrastructure undergoes periodic security assessments to identify and address vulnerabilities.

Despite these measures, no system is perfectly secure. In the event of a data breach that poses a significant risk to your rights, HeyBaji will notify affected users as promptly as practicable and take immediate steps to contain and remediate the breach.

HeyBaji uses cookies and similar technologies on its website. Cookies are small text files placed on your device when you visit a site. They help the site remember your preferences and understand how users interact with the platform.

The types of cookies HeyBaji uses are:

• Essential Cookies: Required for the platform to function correctly. These include session cookies that keep you logged in during your visit and security cookies that protect against cross-site request forgery. These cannot be disabled without breaking core platform functionality.
• Functional Cookies: Used to remember your language preferences, last visited game category and other personalisation settings that improve your experience across sessions.
• Analytics Cookies: Used to understand how players navigate the HeyBaji platform — which pages are most visited, how long sessions last, and where users encounter difficulties. This data is used in aggregate and anonymised form to improve the platform.
• Security and Fraud Detection Cookies: Used to detect bots, automated traffic and fraudulent behaviour by distinguishing genuine human users from malicious scripts.

HeyBaji does not use third-party advertising cookies or allow external advertisers to place tracking technologies on the platform. You can manage cookie preferences through your browser settings, though disabling essential cookies will affect your ability to use the platform. For mobile users, similar tracking occurs through standard mobile web technologies.

As a HeyBaji user, you have a number of rights regarding your personal data. These rights can be exercised at any time by contacting our support team. We aim to respond to all data rights requests within 30 days:

To exercise any of these rights, please contact us at support@heybaji.plus with the subject line "Data Rights Request" and include your registered mobile number or account username so we can locate your records. We will acknowledge your request within 48 hours and complete it within 30 days, or notify you if a longer period is required due to complexity.

HeyBaji is strictly an adults-only platform. We do not knowingly collect, store or process personal data relating to individuals under the age of 18. Account registration on the platform requires confirmation that the user is 18 or older, and we apply age verification measures to enforce this requirement.

If HeyBaji becomes aware that personal data has been collected from a person under the age of 18, the associated account will be immediately closed, all data relating to the minor will be deleted as quickly as our legal obligations allow, and any funds deposited by the minor will be returned to the source payment account.

Parents or guardians who believe a minor in their household has registered at HeyBaji should contact us immediately at support@heybaji.plus. We will handle such reports urgently and with complete confidentiality.

HeyBaji may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations or the services we offer. When we make material changes to the policy, we will:

• Update the "Last Updated" date at the top of this page.
• Notify registered users via email and/or in-platform notification.
• Give you a reasonable opportunity to review the changes before they take effect.

Your continued use of the HeyBaji platform after a policy update has been notified to you constitutes your acceptance of the revised Privacy Policy. If you disagree with any material change, you have the right to close your account and withdraw your remaining balance before the revised policy comes into effect. We recommend bookmarking this page and checking it periodically if privacy matters are important to you.

For any questions, concerns or requests relating to this Privacy Policy or the way HeyBaji handles your personal data, please contact us through any of the following channels. Our support team is available 24 hours a day, seven days a week:

For formal data rights requests, please use the email channel with "Data Rights Request" in the subject line. HeyBaji will acknowledge all privacy-related requests within 48 hours and provide a full response within 30 days. If your request is complex, we will notify you if additional time is required.