baaji Privacy Policy

baaji ("we", "us", "our") is Pakistan's premier online sports betting and casino platform, serving registered players from Karachi, Lahore, Faisalabad, Islamabad, and across Pakistan. baaji operates under an internationally recognised gaming licence framework and is fully committed to protecting the privacy and personal data of every player who registers and plays on the baaji platform ("the Platform").

This Privacy Policy ("Policy") describes how baaji collects, processes, stores, shares, and protects your personal data when you visit baaji.one, create a baaji account, use the baaji Login page, place bets, play casino games, make deposits via JazzCash or EasyPaisa, or otherwise interact with any feature of the Platform. It also explains your rights in relation to your personal data and how to exercise them.

This Policy should be read alongside baaji's Terms & Conditions and Responsible Gaming policy, both of which form part of the full legal agreement between you and baaji.

baaji collects personal data from you through several channels — directly when you register and interact with the Platform, and automatically through standard web technologies. The categories of personal data we collect are as follows:

baaji uses your personal data for the following specific purposes. We process data only for purposes that are compatible with the reason it was originally collected.

baaji processes your personal data on one or more of the following legal bases, depending on the specific purpose of processing:

• Contractual necessity: The majority of data processing by baaji is necessary to perform the contract between you and baaji — specifically, to provide you with access to the Platform, process your bets and payments, and manage your baaji account.
• Legal obligation: baaji is required by its gaming licence framework and applicable anti-money laundering regulations to collect and retain certain categories of data, including identity verification (KYC) documents and transaction records. This processing is mandatory and cannot be opted out of.
• Legitimate interests: baaji processes certain data on the basis of its legitimate interests, including fraud detection, security monitoring, platform analytics, and responsible gaming monitoring. We have assessed that these interests are not overridden by your privacy rights.
• Consent: Where baaji sends you marketing communications or uses non-essential cookies, this processing is based on your freely given, specific, and informed consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

baaji does not sell, rent, or trade your personal data to any third party. We share your data only in the following strictly defined circumstances:

• Payment processors: We share necessary transaction data with our licensed payment partners (including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other supported processors) to facilitate deposits and withdrawals. These partners are bound by their own regulatory obligations and by contractual confidentiality requirements with baaji.
• Identity verification providers: baaji uses third-party KYC and identity verification service providers to validate CNIC documents and confirm player age. These providers process data solely for verification purposes and are prohibited from using it for any other purpose.
• Game and technology providers: To deliver casino games, slot titles, and arcade products such as Fishing Yi Lu Fa, baaji shares necessary session and account data with licensed game providers including Pragmatic Play, PG Soft, and similar providers. Game providers receive only the minimum data required to operate the game session.
• Regulatory and licensing authorities: baaji may be required to disclose player data to its gaming licence authority, financial intelligence bodies, or law enforcement agencies in response to a lawful request or as part of our regulatory compliance obligations. baaji will not notify you of such disclosures where prohibited by law.
• Professional advisors: baaji may share data with its legal counsel, auditors, and compliance consultants on a strictly confidential, need-to-know basis.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of baaji's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer in advance.

baaji places particular importance on the security and privacy of financial data. The following specific protections apply to all payment-related information processed through the Platform:

• Full bank account numbers, JazzCash wallet PINs, EasyPaisa account passwords, and similar authentication credentials are never stored by baaji — these credentials are entered directly on your payment provider's secure interface and never pass through baaji's servers.
• Payment method identifiers (such as your JazzCash mobile number or last four digits of a bank account) are stored by baaji solely for the purpose of matching withdrawals to the correct payment method, as required under anti-money laundering regulations.
• All payment transaction records are retained for a minimum of five years from the date of the transaction, as required by baaji's licensing obligations. After this period, records are securely destroyed.
• baaji will never instruct you to share your full payment credentials, passwords, or OTP codes with any member of our support team. If you receive a request of this nature purporting to come from baaji, please report it to our support team immediately as it is likely fraudulent.

baaji uses cookies and similar tracking technologies (including local storage, session tokens, and pixels) on baaji.one. The following categories of cookies are used:

You can manage or withdraw your consent to non-essential cookies at any time through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to use the baaji Platform. For detailed instructions on managing cookies in popular browsers, please consult your browser's help documentation.

baaji retains your personal data for the periods set out below, after which data is securely deleted or anonymised unless a longer retention period is required by law:

• Account and identity data: Retained for the duration of your active baaji account plus five years following account closure, as required by anti-money laundering regulations applicable under baaji's gaming licence framework.
• Transaction and payment records: Retained for a minimum of five years from the date of each transaction, in compliance with applicable financial record-keeping requirements.
• Betting and gaming activity records: Retained for a minimum of three years from the date of each bet or game session, for the purposes of dispute resolution, regulatory audit, and responsible gaming monitoring.
• Customer support communications: Retained for two years from the date of the last communication in the relevant support thread, unless the subject matter requires longer retention (e.g., an unresolved formal complaint).
• KYC verification documents: Retained for five years from the date of verification, as required by licensing obligations. Copies of CNIC and other identity documents are stored in encrypted form.
• Marketing consent records: Retained for the duration of your registration plus three years, to demonstrate that marketing communications were sent only with your valid consent.

When data reaches the end of its applicable retention period, baaji applies secure deletion procedures to ensure that the data cannot be recovered or reconstructed. Aggregated, anonymised analytical data that does not identify any individual player may be retained indefinitely for statistical purposes.

baaji implements comprehensive technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Our security framework includes:

• TLS 1.3 encryption: All data transmitted between your device and baaji.one is encrypted in transit using TLS 1.3, the current industry standard for web encryption.
• Password hashing: baaji account passwords are never stored in plain text. They are hashed using bcrypt with a unique per-user salt before storage.
• Two-factor authentication (2FA): baaji strongly recommends enabling 2FA on your baaji Login. 2FA adds a second layer of protection to your account beyond your password alone.
• Access controls: Personal data is accessible only to baaji staff who have a legitimate operational need to access it. All staff access to production data is logged and audited.
• Infrastructure security: baaji's servers operate in ISO-certified, access-controlled data centres with continuous security monitoring, intrusion detection, and redundant backup systems.
• Penetration testing: baaji engages independent third-party security researchers to conduct regular penetration testing of the Platform and underlying infrastructure.

In the event of a data security incident that is likely to result in a risk to your rights and freedoms, baaji will notify affected players without undue delay and in accordance with our notification obligations under applicable data protection law.

As a registered baaji player, you have the following rights in relation to your personal data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Subject Request". We will respond within 30 calendar days.

• Right of access: You have the right to request a copy of the personal data that baaji holds about you. We will provide this in a structured, commonly used, and machine-readable format.
• Right to rectification: If any personal data that baaji holds about you is inaccurate or incomplete, you have the right to request that we correct it without undue delay.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected. Please note that baaji may be required to retain certain data for regulatory purposes even following an erasure request — we will inform you of any such limitations when responding to your request.
• Right to restrict processing: You have the right to request that baaji restrict processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to data portability: You have the right to receive your personal data in a structured, machine-readable format and to transmit that data to another controller where technically feasible.
• Right to object: You have the right to object to processing of your personal data where baaji is relying on legitimate interests as its legal basis. You also have an absolute right to object to the use of your data for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications or non-essential cookies), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

baaji is strictly a 21+ platform. The collection and processing of personal data from individuals under the age of 21 is strictly prohibited. baaji uses age verification technology and manual KYC document checks to prevent underage registration and access.

If baaji discovers that personal data has been collected from a person under the age of 21, we will immediately close the associated account, void all bets and winnings, return any deposits to the payment method used, and permanently delete all associated personal data. Any parent or guardian who believes that their child under 21 has registered on baaji should contact our support team immediately at [email protected].

baaji does not direct any marketing communications or Platform content at persons under the age of 21, and we do not knowingly collect any data from minors for any purpose whatsoever.

In order to deliver the baaji Platform to players across Pakistan, it may be necessary to transfer your personal data to servers or service providers located outside Pakistan. This may include transfers to the jurisdictions where our gaming licence authority, technology infrastructure providers, and game content suppliers are based.

Wherever personal data is transferred outside Pakistan, baaji ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to the protections described in this Policy. These safeguards may include:

• Contractual clauses that bind the receiving party to data protection standards equivalent to those maintained by baaji;
• Transfers to entities located in jurisdictions recognised as providing an adequate level of data protection;
• Transfers covered by baaji's gaming licence framework data handling requirements.

You may request further information about the safeguards applicable to any specific international transfer by contacting our support team.

baaji reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our Platform features. When we make material changes to this Policy, we will:

• Post the updated Policy on baaji.one with a revised "Last updated" date at the top of the page;
• Display a prominent notice on the Platform informing registered players of the update;
• Where the changes are significant, send a notification to your registered email address with a summary of the key changes.

Your continued use of the baaji Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you must discontinue your use of the Platform and may request account closure by contacting our support team.

We encourage you to review this Privacy Policy periodically to stay informed about how baaji is protecting your personal data. Archived versions of previous Privacy Policy documents are available upon request from our support team.

If you have any questions, concerns, or complaints regarding this Privacy Policy or baaji's handling of your personal data, or if you wish to exercise any of your data rights as described in Section 10, please contact our dedicated privacy support team:

If you are not satisfied with baaji's response to your privacy concern, you have the right to escalate your complaint to the relevant data protection authority or to baaji's licensing authority. Details of the applicable supervisory authority will be provided in our response to your initial complaint.

This Privacy Policy was last reviewed and updated on 1 January 2026. This version supersedes all previously published versions of the baaji Privacy Policy. v2026.1