This Privacy Policy applies to all individuals who access or use HeyBaji — including visitors who browse heybaji.link without a registered account, individuals who register an account but have not yet made a deposit, active players, and former account holders whose data HeyBaji retains under applicable legal obligations.
HeyBaji is operated for users located in Pakistan and is designed for Pakistani residents. If you are accessing HeyBaji from outside Pakistan, the terms of this policy apply to your use of the platform regardless of your physical location at the time of access.
By using HeyBaji, you acknowledge that you have read this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not consent to these terms, you should not use HeyBaji and should contact support to arrange deletion of any data we may hold about you.
A Note on Minors
HeyBaji is strictly for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that data from a minor has been submitted, that data will be deleted immediately and the associated account will be closed. Parents and guardians should use appropriate parental control tools to prevent minors from accessing the platform.
HeyBaji collects personal data in the categories described below. We collect data directly from you during registration and through your ongoing use of the platform, and in some cases automatically through technical means.
| Data Category |
Specific Data Points Collected |
Collection Method |
| Registration Data |
Full name, Pakistani mobile number, date of birth, password (stored encrypted) |
Provided by you during sign-up |
| Identity Verification |
CNIC number, CNIC photograph (front and back), selfie photograph for liveness verification |
Submitted by you for KYC |
| Payment Data |
Easypaisa/JazzCash mobile number, bank account IBAN (for IBFT), card last four digits (card data is not stored on HeyBaji servers) |
Provided by you during deposit/withdrawal |
| Transactional Data |
Deposit history, withdrawal history, bet placement records, game play records, bonus claims, win/loss records |
Generated automatically by platform activity |
| Device & Technical Data |
IP address, device type, operating system, browser type, session duration, pages visited, referring URL |
Collected automatically via cookies and server logs |
| Communication Data |
Support chat transcripts, email correspondence, SMS interaction records |
Recorded during support interactions |
We do not collect sensitive personal data beyond what is required for identity verification — no biometric data beyond the CNIC selfie used for KYC, no medical information, no data about religious or political beliefs.
HeyBaji uses your personal data only for the purposes described below. Each use has a documented legal basis, explained in the following section.
- Account creation and management: Your registration data is used to create and maintain your HeyBaji account, verify your identity at login, and communicate with you about account activity.
- Payment processing: Your payment details are used to process deposits, verify that withdrawal destinations belong to you, and maintain accurate financial records.
- KYC and regulatory compliance: Your CNIC and selfie data are used to verify your identity before processing your first withdrawal, and to comply with anti-money laundering (AML) and know-your-customer (KYC) obligations.
- Platform operation: Transactional and device data is used to operate the betting and gaming features of HeyBaji, settle bets correctly, and maintain the integrity of the platform.
- Customer support: Communication data is used to respond to queries, resolve payment disputes, and investigate account-related issues.
- Fraud prevention and security: Device and session data is used to identify suspicious login attempts, detect multi-accounting, and protect all players from fraud and abuse.
- Responsible gaming: Betting and transaction history may be used to identify patterns consistent with problem gambling and to apply responsible gaming interventions where appropriate.
- Service improvement: Aggregated, anonymised usage data is used to improve the design and performance of the HeyBaji platform. Individual player data is not shared for this purpose.
We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human oversight, except in the case of automated fraud detection systems which are subject to human review whenever they trigger account-level actions.
HeyBaji processes personal data on the following legal bases. Depending on the specific processing activity, one or more bases may apply simultaneously.
- Contractual necessity: Processing your registration data, payment information, and transaction records is necessary to perform the contract between HeyBaji and you as a registered player. Without this processing, HeyBaji cannot operate your account or process your bets and payments.
- Legal obligation: Processing identity data for KYC verification, maintaining transaction records, and conducting AML checks are required by applicable regulations. HeyBaji cannot waive these requirements regardless of your preferences.
- Legitimate interests: Processing device and session data for fraud prevention, platform security, and responsible gaming monitoring serves HeyBaji's legitimate interests and those of all players on the platform. We have assessed that these interests are proportionate and do not override your data rights.
- Consent: Where HeyBaji uses personal data for optional purposes — such as sending promotional communications — we rely on your explicit consent and provide a clear mechanism to withdraw that consent at any time through your account settings.
HeyBaji shares personal data with third parties only where it is necessary and proportionate to the stated purposes. We do not sell personal data to any third party under any circumstances. The following categories of third parties may receive limited personal data from HeyBaji:
- Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, IBFT banking networks, and Visa/Mastercard payment networks receive the payment data necessary to process your transactions. Each processor operates under its own regulatory framework and privacy policy. HeyBaji does not store full card details.
- Identity verification providers: Third-party KYC service providers may process your CNIC image and selfie photograph for verification purposes. These providers are data processors acting on HeyBaji's instructions and are contractually prohibited from using verification data for their own purposes.
- Technology infrastructure partners: Cloud hosting providers, content delivery networks, and platform software vendors may process technical and usage data as part of providing infrastructure services to HeyBaji. These are data processing arrangements, not data sharing relationships.
- Regulatory and law enforcement authorities: HeyBaji will disclose personal data to regulators, law enforcement agencies, or courts where required by law, pursuant to a valid legal order, or to prevent serious harm.
No Marketing Data Sales
HeyBaji does not share your personal data — including your mobile number — with SMS marketing companies, advertising networks, or any commercial third party for marketing purposes. If you receive unsolicited marketing communications claiming to be from HeyBaji through a channel you did not register, this is not from us and should be reported as spam.
HeyBaji retains personal data only for as long as necessary for the purposes described in this policy or as required by law. The following retention periods apply to the main categories of data we hold:
- Account and registration data: Retained for the duration of your active account plus a minimum of five years after account closure, to comply with regulatory record-keeping obligations.
- Identity verification data (CNIC): Retained for the period required by applicable KYC and AML regulations from the date of verification or account closure, whichever is later.
- Transaction and betting records: Retained for a minimum of five years after each transaction, in line with standard financial record-keeping requirements. These records may be required to resolve disputes arising after account closure.
- Device and session data: Retained for up to 12 months for security and fraud prevention purposes, after which it is aggregated and anonymised.
- Support communications: Retained for a minimum of two years after the conversation closes, to allow reference in the event of a related follow-up query.
When retention periods expire, data is securely deleted or anonymised. If you request deletion of your account data before the applicable retention period has elapsed, HeyBaji will delete what it is legally permitted to delete and will retain only what it is legally required to keep, informing you of what is retained and why.
HeyBaji uses cookies and similar technologies on heybaji.link to operate the platform, maintain session security, and understand how users interact with the site. The categories of cookies used are:
- Essential cookies: Required for the platform to function. These include session authentication cookies that keep you logged in and security cookies that protect against cross-site request forgery. Essential cookies cannot be disabled without breaking the platform.
- Functional cookies: Remember your preferences — such as language settings or saved payment methods — to improve your experience on return visits.
- Analytics cookies: Collect anonymised data about page views, navigation paths, and feature usage to help HeyBaji understand how the platform is used and identify areas for improvement. This data is processed in aggregate and is not linked to your individual account.
- Security cookies: Track login attempts, unusual access patterns, and device fingerprints to identify and prevent fraudulent access attempts.
You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using HeyBaji, but may limit the functionality of certain features. HeyBaji does not use third-party advertising or tracking cookies.
HeyBaji implements technical and organisational security measures designed to protect your personal data against unauthorised access, loss, alteration, or disclosure. Key measures include:
- 256-bit SSL/TLS encryption for all data in transit between your device and HeyBaji's servers.
- Encryption at rest for all stored personal and financial data.
- Two-factor authentication (2FA) available for account login and withdrawal requests.
- Access controls limiting employee access to personal data on a need-to-know basis.
- Regular security audits and penetration testing of the HeyBaji platform.
- Automated monitoring systems that flag unusual login patterns or transaction anomalies for review.
- Segregated storage of player funds separate from operational accounts.
No security system is completely infallible. In the event of a data breach that poses a significant risk to your rights, HeyBaji will notify affected players promptly and take all reasonable steps to contain and remediate the breach. You can assist in protecting your account by using a strong unique password and enabling 2FA in your account settings.
As a HeyBaji user, you have the following rights regarding your personal data. To exercise any of these rights, contact HeyBaji support at support@heybaji.link with the relevant request. HeyBaji will respond within 30 days.
Right of Access
You have the right to request a copy of the personal data HeyBaji holds about you, including what categories of data we hold, the purposes for which it is processed, and who it has been shared with.
Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. This includes updating your registered name, mobile number, or address details.
Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent (for consent-based processing), or where no other legal basis applies. Note that legal retention obligations may prevent full deletion.
Right to Object
You have the right to object to processing based on legitimate interests where you believe your rights override those interests. You may also object to receiving promotional communications at any time through your account settings.
Right to Data Portability
You may request a machine-readable copy of the personal data you provided to HeyBaji, in a format that allows you to transfer it to another service provider where technically feasible.
Right to Restriction
You may request that HeyBaji restricts processing of your data — for example, while a rectification request is being assessed, or where you have objected to processing and we are considering whether our interests override yours.
If you have any questions about this Privacy Policy, want to exercise your data rights, or have concerns about how HeyBaji handles your personal data, please contact us:
Email: support@heybaji.link
Platform: heybaji.link — live chat available 24/7 via the support widget
Response time: Privacy-related requests are responded to within 30 days of receipt
HeyBaji may update this Privacy Policy from time to time. When updates are made, the "Last Updated" date at the top of this page will be revised. Where changes are material — meaning they significantly affect how we process your data or your rights — HeyBaji will notify registered users via SMS or email to their registered contact details before the changes take effect.
Minor or clarificatory changes that do not affect the substance of the policy may be made without individual notification. The current version of this policy is always available at heybaji.link/privacy-policy. Your continued use of HeyBaji after the effective date of any updated policy constitutes acceptance of the revised terms.
Our Commitment Stands
Privacy is not a feature we bolt on when required — it is a foundational part of how HeyBaji was built and how it operates. Every design decision, every third-party partnership, and every data process at HeyBaji is evaluated against the question: does this respect our players' data and their right to privacy? That will not change.
