TojayBet Privacy Policy – How We Protect Your Data in Pakistan

01 Introduction

TojayBet takes its responsibilities around personal data seriously. We are an online gaming and sports betting platform serving Pakistani players, and the people who choose to register with us trust us with sensitive information — mobile numbers, CNIC details, payment method data, and transaction histories. That trust is something we do not take lightly.

This Privacy Policy describes in detail how TojayBet collects, processes, stores, and protects the personal data of its members. It also explains the rights you have over your own data and how to exercise them. We have tried to write this in plain, straightforward English so that members from all backgrounds can understand exactly what they are agreeing to when they join TojayBet.

If anything in this policy is unclear to you, please reach out to our support team at support@tojaybet.bio before registering. We are happy to answer questions about how your data is handled before you make any decision about creating an account.

02 Who We Are

TojayBet operates the online gaming platform accessible at tojaybet.bio. For the purposes of this Privacy Policy, TojayBet is the data controller — meaning we are the organisation responsible for deciding how and why your personal data is used. Our primary point of contact for data-related matters is support@tojaybet.bio.

TojayBet serves members located in Pakistan. Our platform, its databases, and our customer support operations are all oriented towards providing services to Pakistani users in Pakistani Rupees. References to "members", "you", or "users" in this policy refer to individuals who have registered a TojayBet account or who are in the process of doing so.

03 Personal Data We Collect

TojayBet collects personal data across several categories. Below is a clear breakdown of what we collect and why each category is necessary.

04 How We Collect Your Data

TojayBet collects personal data through three main channels:

Information You Provide Directly

When you register for a TojayBet account, you provide your name, mobile number, date of birth, and email address. When you submit KYC documents, you provide identity documents. When you contact our support team, the content of those communications is recorded. When you set betting preferences or deposit limits, those settings are stored.

Information Collected Automatically

When you access tojaybet.bio, our servers automatically record your IP address, the type of device you are using, the browser version, and the pages you visit within the platform. This data is collected through server logs and through cookies and similar tracking technologies as described in Section 9 of this policy.

Information from Payment Providers

When you deposit or withdraw via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, or Visa/Mastercard, our payment processing partners share limited transaction confirmation data with TojayBet so that your account balance can be updated. Full payment credentials — such as PIN numbers or full card numbers — are never shared with TojayBet by our payment partners.

05 How TojayBet Uses Your Data

TojayBet uses personal data for the following specific purposes:

• Account management: Creating, maintaining, and securing your TojayBet account, including password resets and two-factor authentication.
• Transaction processing: Verifying and processing deposits and withdrawals in PKR via your chosen payment method.
• Identity verification (KYC): Confirming your identity before processing withdrawals and detecting any attempts to create multiple accounts.
• Platform personalisation: Displaying your preferred games, remembering your deposit limits, and presenting content relevant to your location and activity on TojayBet.
• Customer support: Using your account history and contact records to resolve queries efficiently.
• Fraud prevention and security: Monitoring login patterns, transaction behaviour, and device fingerprints to detect and prevent unauthorised access, fraud, and money laundering.
• Responsible gaming: Tracking session activity to apply deposit limits, session reminders, and self-exclusion restrictions that you have set on your account.
• Platform improvement: Analysing aggregate, anonymised usage data to understand how members interact with TojayBet and to improve the product.
• Marketing communications: Sending promotional offers, bonus alerts, and news about new games — but only where you have opted in to receive such communications.
• Legal compliance: Maintaining records required for audit, dispute resolution, and compliance with applicable platform regulations.

TojayBet does not use your personal data for any purpose not listed above without first seeking your explicit consent or updating this Privacy Policy.

06 Legal Basis for Processing

TojayBet processes personal data under the following legal bases:

• Contractual necessity: Processing required to fulfil the agreement between you and TojayBet — including running your account, processing transactions, and resolving disputes.
• Legitimate interests: Processing that serves TojayBet's legitimate business interests where those interests are not overridden by your privacy rights — including fraud prevention, platform security, and product improvement using anonymised data.
• Legal obligation: Processing required by applicable law, including record-keeping for financial transactions and identity verification for KYC compliance.
• Consent: Processing based on your specific, informed opt-in — primarily marketing communications. Consent can be withdrawn at any time without penalty.

07 Sharing Your Data with Third Parties

TojayBet does not sell your personal data. We share data with third parties only in the following limited and controlled circumstances:

• Payment processors: We share the minimum necessary data with Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, and Visa/Mastercard to process your PKR transactions. These providers are bound by their own security certifications and confidentiality obligations.
• Identity verification services: Where third-party KYC verification tools are used to validate CNIC documents, those providers receive only the information needed for the verification check and are contractually required to delete it after the check is complete.
• Game software providers: Live casino and sports data providers may receive anonymised session identifiers to maintain the integrity of games. No personally identifiable information is shared with game providers.
• Fraud prevention services: Anonymised technical data (device fingerprint, IP, behaviour patterns) may be shared with fraud detection services that help TojayBet protect member accounts.
• Legal requirements: TojayBet will disclose personal data if required to do so by a valid legal order or where disclosure is necessary to protect the rights, property, or safety of TojayBet, its members, or the public.

08 Payment Data Handling

Payment security is one of TojayBet's highest priorities given that all transactions involve real PKR. The following principles govern how payment data is handled:

• TojayBet does not store full card numbers, CVV codes, mobile wallet PINs, or banking passwords on its servers at any point.
• Card and wallet tokenisation is used where available — meaning your payment provider stores your full credentials and issues TojayBet a one-time token for each transaction.
• Transaction records stored by TojayBet include only: the payment method type, a masked identifier (e.g., last 4 digits of a card), the PKR amount, and the timestamp. This information is required for dispute resolution and audit purposes.
• If you suspect that your payment credentials have been compromised, you should contact your bank or mobile wallet provider immediately and inform TojayBet's support team so your account can be reviewed.

09 Cookies & Tracking Technologies

TojayBet uses cookies and similar browser-based technologies to operate the platform efficiently. Below is a breakdown of the cookie types used:

Essential Cookies

These are required for the platform to function. They maintain your login session, remember your language preference, and ensure your bet slip persists across pages. You cannot opt out of essential cookies without disabling the platform entirely.

Analytics Cookies

TojayBet uses anonymised analytics data to understand how members navigate the platform — which pages are visited most, where users drop off, and how long sessions last. This data is aggregated and does not identify individual users. Analytics cookies can be disabled through your browser settings.

Preference Cookies

These cookies remember your settings — such as your preferred game category, your deposit limit reminders, and your notification preferences — so you do not have to reset them each time you log in to TojayBet.

Managing Cookies

You can control cookie behaviour through your browser's settings. Blocking all cookies will prevent TojayBet from functioning correctly. Blocking analytics and preference cookies specifically will not affect your ability to log in, bet, or withdraw.

10 Data Retention

TojayBet retains personal data for the period necessary to fulfil the purpose for which it was collected, subject to the following guidelines:

• Active account data: Retained for the lifetime of your TojayBet account plus a period of five years after account closure, to meet audit and dispute resolution obligations.
• Transaction records: Financial transaction records in PKR are retained for a minimum of seven years in line with standard financial record-keeping practices.
• KYC documents: Identity documents submitted for KYC verification are retained for the duration of your TojayBet membership and for five years after account closure.
• Support communications: Chat transcripts and email correspondence are retained for three years after the conversation is closed.
• Marketing data: If you have opted out of all marketing communications and your account is closed, marketing preference data is deleted within 90 days.
• Technical logs: Server and access logs are retained for a maximum of 12 months and are then deleted.

When data is no longer required, it is securely deleted or anonymised so that it cannot be linked back to an individual.

11 Security Measures

TojayBet employs a layered security approach to protect personal data:

• Encryption at rest: All databases containing personal information are encrypted using AES-256.
• Encryption in transit: All communications between your device and TojayBet's servers use TLS 1.3, ensuring your data cannot be intercepted in transit.
• Access controls: Personal data is accessible only to authorised TojayBet staff who require it for their specific role. All internal access is logged and audited.
• Two-factor authentication: 2FA is available for all member accounts and is strongly recommended. TojayBet internal systems require 2FA for all staff with access to personal data.
• Penetration testing: TojayBet's platform undergoes regular security assessments to identify and address vulnerabilities before they can be exploited.
• Incident response: A documented incident response plan is in place for data security events. Affected members are notified promptly in the event of any breach that involves their personal data.

Despite these measures, no online platform can guarantee absolute security. Members are encouraged to use strong, unique passwords and to enable 2FA on their TojayBet accounts as a first line of personal defence.

12 Your Data Rights

As a TojayBet member, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at support@tojaybet.bio with your request.

We will respond to all data rights requests within 30 days of receipt. In exceptional circumstances where a request is complex or there are a high number of requests, this period may be extended by a further two months — we will notify you if this applies to your request.

13 Minors & Under-18 Protection

TojayBet is strictly an adult platform. We do not knowingly collect personal data from individuals under 18 years of age. The registration process includes an age declaration, and TojayBet performs age verification checks during the KYC process.

If TojayBet discovers that an account belongs to a person under 18, the account will be closed immediately. Any personal data associated with the account will be deleted or anonymised, and any remaining balance will be returned to the payment method used for deposits after identity of the account holder has been confirmed through a parent or guardian.

If you are a parent or guardian and believe your child has registered an account at TojayBet without your knowledge, please contact our support team at support@tojaybet.bio immediately.

14 Changes to This Privacy Policy

TojayBet may update this Privacy Policy from time to time to reflect changes in how we operate, changes in applicable requirements, or improvements in our data handling practices. The version number and last-updated date at the top of this page are updated with every revision.

When significant changes are made — for example, if we add a new category of data collection, change how we share data with third parties, or introduce new processing purposes — TojayBet will notify registered members via email or an in-platform notification before the changes take effect. For minor editorial updates that do not affect member rights, changes may be applied without advance notice.

Continued use of TojayBet after an updated Privacy Policy takes effect constitutes your acceptance of the revised terms. If you do not agree to the updated policy, you have the right to request account closure as described in Section 12.

15 Contact TojayBet About Privacy

If you have any questions about this Privacy Policy, want to exercise your data rights, or wish to raise a concern about how TojayBet handles your personal information, please get in touch:

• Email: support@tojaybet.bio
• Live Chat: Available 24/7 via the chat widget on tojaybet.bio
• Language: Support available in English and Urdu
• Response time: We aim to acknowledge privacy queries within 24 hours and resolve them within 30 days

For questions about our Terms and Conditions, Responsible Gaming tools, or how to use our FAQ, please visit the relevant pages on TojayBet.