Bija Baji Privacy Policy – How We Handle Your Personal Data

The data controller for all personal information collected through the bija baji platform — the entity that decides why and how your data is processed — is the operator of bijabaji.com. When this Privacy Policy refers to "bija baji," "we," "us" or "our," it means that operating entity and any authorised service provider acting on its direct instruction.

As data controller, bija baji is responsible for ensuring that all personal data collected from Pakistani players is handled in accordance with applicable data protection principles: collected lawfully, used only for the stated purposes, stored securely and not retained longer than necessary.

For any privacy-related enquiry, request or complaint, the designated contact point is: support@bijabaji.com with the subject line "Privacy Request". Please include your registered mobile number so we can verify your identity before processing your request.

Bija baji collects personal data in two broad categories: information you provide directly, and information generated automatically through your use of the platform. The table below sets out both categories in detail.

Bija baji collects personal data through several distinct channels. Understanding each one helps you see exactly where your information enters our systems:

• Direct submission: When you fill in the registration form, submit identity documents for KYC verification, contact the support team or update your account settings, you are providing data directly to bija baji.
• Automated technical collection: When you visit bijabaji.com, our servers automatically log your IP address, device identifiers, browser type and session timestamps. This happens for every visitor, including those who have not registered an account.
• Gaming system records: Every bet placed, every game launched and every session started on bija baji generates a system record tied to your account. This is necessary to calculate balances, settle bets, apply bonuses and detect irregularities.
• Payment provider data: When you make a deposit or withdrawal, bija baji receives confirmation data from the payment provider — including the transaction reference, amount and masked payment account identifier. This is provided by the payment provider, not manually entered by you on our side.
• Cookies and similar tracking: Bija baji uses cookies and local storage on your browser. See Section 9 for a full explanation of what cookies are used and why.

Bija baji uses personal data only for specific, legitimate purposes. We do not use your data for anything that isn't directly connected to operating the platform, fulfilling legal obligations or communicating with you about your account. The purposes are:

• Account creation and management: Registering your account, verifying your identity, maintaining your balance and enabling you to log in securely.
• Transaction processing: Processing your PKR deposits and withdrawals accurately and without delay, applying bonuses and recording gaming activity against your account.
• Legal compliance: Meeting anti-money laundering (AML), know your customer (KYC) and age verification obligations. Bija baji is required to collect and retain certain data to satisfy these regulatory requirements — this is not optional for us or for you.
• Fraud and security: Detecting and preventing duplicate accounts, collusion, automated betting software, money laundering and other forms of platform abuse. Device and IP data is a core tool in this process.
• Customer support: Resolving your support requests, investigating disputes and maintaining records of support interactions for quality assurance.
• Responsible gaming: Monitoring gaming patterns to identify potentially problematic behaviour and, where appropriate, proactively offering tools or information to help players manage their activity.
• Platform improvement: Analysing aggregated, anonymised usage data to understand how players interact with bija baji and to make product improvements. This analysis uses anonymised data — it cannot be traced back to you personally.
• Marketing communications: Sending promotional offers and bonus notifications to players who have opted in. See Section 11 for details and opt-out instructions.

Bija baji processes your personal data on the following legal bases, depending on the specific purpose:

• Contractual necessity: Most processing — account management, transaction processing, gaming records, support — is necessary to perform the contract between you and bija baji (i.e., to operate your account and provide the services you signed up for). Without this processing, bija baji cannot operate your account.
• Legal obligation: KYC, AML verification, age checks and certain record-keeping requirements are imposed by applicable law. Bija baji has no discretion to avoid this processing — it is required regardless of player consent.
• Legitimate interests: Fraud detection, platform security monitoring and aggregated analytics are carried out on the basis of bija baji's legitimate business interest in operating a secure, fair platform. This processing is balanced against your privacy rights and does not override them.
• Consent: Marketing communications are sent only to players who have explicitly opted in. You can withdraw this consent at any time. Withdrawal of marketing consent does not affect your ability to use bija baji.

Bija baji does not sell your personal data to any third party — ever. We share data only in the specific circumstances below, and only to the minimum extent necessary:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT networks and card processing providers receive the transaction data necessary to process your deposits and withdrawals. These providers have their own privacy policies and are contractually bound to protect your data.
• Identity verification providers: Third-party KYC verification services may receive your identity documents and CNIC data to complete the verification process. These providers are contractually bound to use data only for verification and to delete documents once verification is complete.
• Fraud prevention services: Device fingerprinting and IP intelligence providers help bija baji identify duplicate accounts and automated betting tools. These services receive technical data (device and IP), not personal identity information.
• Legal and regulatory authorities: Where bija baji is required by applicable law, court order or regulatory requirement to disclose data, it will do so. Bija baji will inform you of such disclosure where legally permitted to do so.
• Professional advisors: Legal counsel, accountants and auditors may access data as part of their professional engagement with bija baji, subject to professional confidentiality obligations.

Bija baji retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or to satisfy applicable legal and regulatory requirements — whichever is longer. The following retention periods apply:

• Active account data (identity, contact, financial, gaming records): Retained for the duration of your active account plus a minimum of 5 years after account closure, in line with standard AML record-keeping obligations.
• KYC verification documents (CNIC copies, utility bills): Retained for 5 years from the date of verification, then securely deleted.
• Support communications (chat logs, emails): Retained for 2 years from the date of the last communication in a thread, then deleted.
• Technical logs (IP addresses, session logs): Retained for 12 months for fraud prevention and platform security purposes, then deleted.
• Marketing consent records: Retained for as long as your consent remains active, plus 3 years after withdrawal of consent to demonstrate compliance if challenged.

When the applicable retention period expires, bija baji securely deletes or irreversibly anonymises the data. Anonymised data — where individual identification is impossible — may be retained indefinitely for aggregate statistical analysis.

Data security is not a single measure at bija baji — it is a layered set of technical and organisational controls applied continuously:

• Encryption in transit: All data transmitted between your browser or device and bija baji's servers is encrypted using TLS 1.2 or higher (256-bit SSL). This prevents interception by third parties on any network you use to connect.
• Encryption at rest: Sensitive personal data stored in bija baji's databases — including identity and financial data — is encrypted at rest using AES-256.
• Access controls: Bija baji staff access to personal data is restricted on a strict need-to-know basis. Support agents see only what is necessary to resolve your query. Full financial records and identity documents are accessible only to authorised compliance personnel.
• Two-factor authentication: All bija baji internal systems that contain player data require multi-factor authentication for staff access. Player accounts also have 2FA available as an option.
• Penetration testing: Bija baji engages independent security professionals to conduct regular penetration testing of the platform to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a data breach that poses a risk to players, bija baji will notify affected players and relevant authorities within the timeframes required by applicable law, and will take immediate steps to contain the breach.

Bija baji uses cookies — small text files stored on your browser — and similar technologies to make the platform work properly, keep your session active and understand how the site is used. Here is a breakdown of the cookies in use:

Required cookies cannot be disabled — they are necessary for the platform to function. Analytics cookies can be opted out of by contacting support or adjusting your browser's cookie settings. Removing all cookies will log you out and reset your platform preferences.

As a player on bija baji, you have the following rights in relation to your personal data. These rights apply to data held by bija baji as data controller:

Bija baji sends promotional communications — bonus offers, PSL season promotions, new game announcements and personalised betting offers — to players who have opted in to receive them. These communications are sent by SMS to your registered mobile number and, where provided, by email.

How to opt out: You can withdraw your marketing consent at any time by:

• Updating your notification preferences in your bija baji account settings.
• Replying "STOP" to any SMS marketing message from bija baji.
• Emailing support@bijabaji.com with the subject line "Marketing Opt-Out."

Opting out of marketing communications will not affect your ability to use bija baji, will not impact your account status and will not remove you from essential account notifications — such as deposit confirmations, withdrawal processing alerts and security notifications. These essential messages are sent regardless of marketing preference because they relate directly to your account operation.

Bija baji is strictly an 18+ platform. We do not knowingly collect personal data from anyone under 18 years of age. The registration process includes a date-of-birth field and bija baji conducts age verification checks on all accounts.

If bija baji becomes aware that a minor has registered an account and provided personal data, the account will be immediately suspended, all funds returned to the depositing payment method and all personal data associated with the account deleted within 72 hours of discovery.

If you are a parent or guardian and believe your child has registered on bija baji without permission, please contact us immediately at support@bijabaji.com with the subject line "Minor Account Report." We will investigate and act on all such reports as a priority.

Bija baji may update this Privacy Policy from time to time to reflect changes in our data practices, new platform features or updated legal requirements. When material changes are made, we will:

• Post a prominent notice on the bija baji platform at least 7 days before the changes take effect.
• Send an in-account notification to all registered players on their next login.
• For significant changes affecting how sensitive data is handled, send a direct notification to your registered mobile number or email.

The "Last updated" date at the top of this page will always reflect the most recent revision. We encourage you to check this page occasionally — particularly before making a large deposit or sharing additional personal information with bija baji.

Continued use of the bija baji platform after a Privacy Policy update becomes effective constitutes your acceptance of the updated policy. If you do not agree with any changes, you should stop using the platform and contact support to initiate account closure.

If you have any questions, concerns or requests related to this Privacy Policy or how bija baji handles your personal data, please get in touch:

• Email: support@bijabaji.com — use the subject line "Privacy Request" for data rights enquiries or "Privacy Complaint" for concerns about how your data has been handled.
• Live Chat: Available in your bija baji account 24 hours a day, 7 days a week — fastest response for general privacy questions.

Bija baji commits to acknowledging all privacy-related communications within 48 hours and to providing a substantive response within 30 days. If a matter is complex and requires more time, we will let you know within the initial 30-day period and give you an updated timeline.