HeyBaji Privacy Policy — How We Handle Your Personal Data

This Privacy Policy applies to HeyBaji, the online casino and sports betting platform accessible at heybaji.cash. When this policy refers to "HeyBaji", "we", "us" or "our", it means the company operating the HeyBaji platform. When it refers to "you" or "your", it means any individual who visits the HeyBaji website, creates an account or uses any of our services.

HeyBaji acts as the data controller for personal information collected through our platform. This means HeyBaji determines the purposes for which personal data is processed and is responsible for ensuring that processing is carried out lawfully and transparently.

If you have any questions about this policy or how HeyBaji handles your personal data, you can contact us at any time at support@heybaji.cash. Our team responds to all privacy-related queries within two business days.

HeyBaji collects different categories of personal data depending on how you interact with our platform. Here is a clear breakdown of what we collect and when:

HeyBaji does not collect sensitive personal data such as biometric data, political opinions, religious beliefs or health information, except where age or identity verification specifically requires it under applicable law. We do not store full payment card numbers on our own infrastructure — card transactions are processed by PCI-DSS compliant third-party payment processors.

HeyBaji uses your personal data only for legitimate, defined purposes. We do not use your data for anything we haven't told you about. Below is a complete list of how HeyBaji uses the data it collects:

• Account Management: To create, maintain and secure your HeyBaji account, including password resets, two-factor authentication and account recovery.
• Payment Processing: To facilitate deposits to your HeyBaji balance and withdrawals to your Easypaisa, JazzCash, NayaPay, SadaPay or bank account, and to maintain accurate transaction records.
• Identity Verification (KYC): To verify your age and identity as required by our licensing obligations. This protects both you and HeyBaji from fraud and ensures we are not processing payments for underage individuals.
• Service Delivery: To provide you with access to all games, betting markets, bonuses and promotional offers available on HeyBaji's platform.
• Customer Support: To respond to your queries, complaints and requests efficiently and accurately, and to maintain records of those interactions.
• Fraud Prevention & Security: To detect, investigate and prevent fraudulent transactions, account takeovers, money laundering and other illegal activity on the HeyBaji platform.
• Responsible Gaming: To monitor gameplay patterns and, where HeyBaji's responsible gaming systems identify a concern, to reach out to you proactively with appropriate support tools and resources.
• Legal Compliance: To comply with our obligations under applicable anti-money laundering laws, gaming regulations and financial crime prevention requirements, including reporting to authorities where legally required.
• Platform Improvement: To analyse how players use HeyBaji in aggregate, identify technical issues and improve the overall experience — without profiling you as an individual for this purpose.
• Marketing Communications: To send you information about HeyBaji promotions, bonuses and new features that may interest you. You can opt out of marketing communications at any time from your account settings or by emailing support@heybaji.cash.

HeyBaji processes your personal data under one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing that is essential to fulfil our obligations to you under HeyBaji's Terms and Conditions — for example, operating your account, processing deposits and withdrawals, and providing access to games and markets.
• Legal Obligation: Processing required by applicable law — for example, identity verification under anti-money laundering regulations, age verification under gaming licensing requirements, and financial reporting obligations.
• Legitimate Interests: Processing that serves HeyBaji's legitimate business interests and does not override your rights — for example, fraud detection, security monitoring and platform analytics.
• Consent: Processing based on your explicit, freely given and withdrawable consent — for example, sending you marketing communications about HeyBaji promotions and bonuses.

Where HeyBaji relies on consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing that occurred before the withdrawal.

HeyBaji does not sell, rent or share your personal data with any third party for their own commercial purposes. We share your data only in the following limited and necessary circumstances:

• Payment Service Providers: Your financial data is shared with our payment processing partners — including Easypaisa, JazzCash, NayaPay, SadaPay and card payment processors — solely for the purpose of completing your deposit or withdrawal transactions. These providers are bound by their own privacy obligations and PCI-DSS compliance requirements.
• Identity Verification Providers: Where KYC verification is required, HeyBaji shares the relevant identity documents and data with regulated identity verification service providers. These providers act under strict data processing agreements with HeyBaji.
• Fraud Prevention & Security Services: HeyBaji uses third-party fraud detection and security monitoring tools. These services may process your device data, IP address and transaction patterns to identify suspicious activity. No unnecessary personal data is shared beyond what is required for this purpose.
• Regulatory and Legal Authorities: HeyBaji is legally obligated to disclose certain information to financial intelligence units, gaming regulators and law enforcement authorities where required by applicable law. HeyBaji will not disclose more than is legally required.
• Business Transfers: In the event of a merger, acquisition or sale of HeyBaji's business, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and the new entity's privacy policy before the transfer takes effect.

HeyBaji retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected and to comply with our legal obligations. The following retention periods apply:

• Active Account Data: Retained for the duration of your active HeyBaji account.
• Transaction Records: Financial transaction records are retained for a minimum of five years after the date of the transaction, as required by anti-money laundering regulations.
• Identity Verification Documents: Retained for a minimum of five years after account closure, in compliance with KYC regulatory requirements.
• Customer Support Records: Retained for three years after the resolution of the relevant support interaction.
• Marketing Preferences: Retained until you withdraw consent for marketing communications, after which your preference to opt out is stored indefinitely to prevent accidental re-subscription.
• Closed Account Data: Upon account closure, most personal data is anonymised or deleted within 90 days. Data subject to legal retention periods (see above) is held for those periods and then securely deleted.

When HeyBaji no longer has a legal or legitimate basis to retain your personal data, it is permanently deleted using secure erasure methods that prevent recovery.

HeyBaji takes the security of your personal data seriously. We implement a layered set of technical and organisational measures to protect against unauthorised access, disclosure, alteration or destruction of your information. Our key security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and HeyBaji's servers is encrypted using industry-standard SSL/TLS protocols.
• Encrypted Storage: Sensitive data fields — including identity documents and financial details — are encrypted at rest using strong encryption standards.
• Access Controls: HeyBaji staff access to player data is restricted on a strict need-to-know basis, with role-based access controls, audit logging and multi-factor authentication for internal systems.
• Regular Security Audits: HeyBaji's platform and infrastructure are subject to regular independent security assessments and penetration testing.
• Incident Response: HeyBaji maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected players within 72 hours of becoming aware of the breach.

HeyBaji uses cookies and similar technologies to operate our platform, remember your preferences, detect fraud and understand how players use our services. A cookie is a small text file placed on your device by a website. Here is a breakdown of the types of cookies HeyBaji uses:

You can manage your cookie preferences through your browser settings at any time. Disabling essential or security cookies may prevent certain features of HeyBaji from functioning correctly. For analytics and functional cookies, the toggles above represent your current preference which is saved locally on your device.

As a HeyBaji player, you have a set of rights over the personal data we hold about you. These rights are explained below. To exercise any of them, contact us at support@heybaji.cash with the subject line "Data Rights Request". HeyBaji will respond within 30 days.

HeyBaji's services are strictly intended for adults aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18. If you are a parent or guardian and believe that a minor has created a HeyBaji account using false information, please contact us immediately at support@heybaji.cash.

Upon receiving a verified report that an account belongs to a minor, HeyBaji will immediately suspend the account, refund any deposits made (less any withdrawals already processed), delete the minor's personal data and report the incident to our compliance team. We take underage gambling prevention extremely seriously and support all regulatory efforts to prevent minors from accessing gambling services.

HeyBaji may update this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements or improvements to our services. The date at the top of this page reflects when the policy was last updated.

When HeyBaji makes material changes to this policy — changes that meaningfully affect how we collect, use or share your personal data — we will notify you by email to the address registered with your HeyBaji account, and by displaying a prominent notice on the platform for at least 30 days before the changes take effect.

For minor changes (such as corrections to wording that do not affect the substance of the policy), the updated date will be changed but no separate notification will be issued. We encourage you to check this page periodically to stay informed about how HeyBaji protects your privacy.

If you have any questions about this Privacy Policy, want to exercise any of your data rights, or have a concern about how HeyBaji is handling your personal information, please get in touch with us through one of the following channels:

• Email: support@heybaji.cash — please use the subject line "Privacy Query" or "Data Rights Request" for the fastest routing.
• Live Chat: Available 24/7 on the HeyBaji website. Our support agents can handle most privacy queries directly or escalate to our data team where needed.
• Response Time: HeyBaji aims to acknowledge all privacy-related queries within 24 hours and to resolve them within 30 days. Complex data access or erasure requests may take up to 30 days from receipt of all necessary information.
• Languages: You can contact HeyBaji's support team in English or Urdu.

We are committed to working transparently and fairly with every HeyBaji player regarding their personal data. If you feel your privacy concern has not been adequately addressed after contacting us, you have the right to escalate your complaint to the relevant regulatory authority.