- 1. Who We Are
- 2. Data We Collect
- 3. How We Use Your Data
- 4. Legal Basis
- 5. Who We Share Data With
- 6. International Transfers
- 7. Data Retention
- 8. Cookies & Tracking
- 9. Your Rights
- 10. Children's Privacy
- 11. Security Measures
- 12. Third-Party Links
- 13. Marketing
- 14. Policy Changes
- 15. Contact & Complaints
1 Who We Are
Baji99 ("we", "us", "the Platform") operates the online casino and sports betting platform accessible at baji99.me. We are the data controller for all personal information collected through the platform, meaning we are responsible for determining how and why your personal data is processed.
This Privacy Policy applies to all visitors, registered players and users of any Baji99 product including live casino games, sports betting, crash games, card games and any promotional services. It covers data collected through the website, any mobile applications and through your direct communications with Baji99 customer support.
If you have questions about how Baji99 handles your data, the most direct route is to contact our support team at support@baji99.me. We try to respond to all privacy-related queries within 48 hours.
2 Data We Collect
Baji99 collects personal data in three ways: information you give us directly when registering or using the platform, information generated automatically through your use of the platform, and information obtained from third parties as part of identity verification and fraud prevention.
| Category | Examples | How Collected |
|---|---|---|
| Identity Data | Full name, date of birth, CNIC number, selfie/ID photo | You provide |
| Contact Data | Mobile number, email address | You provide |
| Financial Data | Payment method details, transaction history, wallet balance | You provide Auto |
| Technical Data | IP address, device type, browser, OS version, session timestamps | Auto |
| Usage Data | Games played, bets placed, cash out history, pages visited | Auto |
| Communications Data | Support chat logs, emails, complaint records | You provide |
| Verification Data | KYC document scans, liveness check results | You provide Third party |
We do not collect sensitive personal data such as biometric data beyond what is strictly necessary for KYC verification, and we do not collect information about religious beliefs, political opinions or health records.
Payment card numbers are not stored on Baji99's own servers. Card transactions are processed by PCI-DSS compliant payment processors and we receive only a tokenised reference that is sufficient to process future transactions without holding the raw card number.
3 How We Use Your Data
Baji99 uses personal data for the following purposes. Where multiple purposes are listed, the legal basis for each is addressed in Section 4.
- Account management: Creating, maintaining and securing your Baji99 account. Verifying your identity when you register and when you request withdrawals.
- Service delivery: Processing bets, settling games, handling deposits and withdrawals, delivering customer support and managing bonus credits.
- Fraud prevention and security: Detecting and preventing fraudulent transactions, bonus abuse, account takeover attempts and money laundering. Monitoring for patterns consistent with prohibited conduct as defined in our Terms and Conditions.
- Legal and regulatory compliance: Fulfilling Know Your Customer (KYC) requirements, retaining financial records as required by applicable law, and cooperating with law enforcement investigations.
- Platform improvement: Analysing usage patterns (in anonymised or pseudonymised form) to identify bugs, improve game performance and develop new features based on how players actually use the platform.
- Responsible gaming: Monitoring for indicators of problem gambling so that we can proactively offer support tools or restrict account activity where necessary to protect player welfare.
- Marketing communications: Sending promotional emails, SMS messages or in-platform notifications about bonuses and new features – but only to players who have not opted out. See Section 13 for more on this.
4 Legal Basis for Processing
Every time Baji99 processes your personal data, we do so on one of the following legal bases:
- Contract performance: Processing your data is necessary to provide the services you signed up for – without it we cannot operate your account, process your bets or pay your winnings.
- Legal obligation: We are required by law to collect and retain certain data, including identity documents and transaction records, for anti-money laundering compliance and regulatory reporting.
- Legitimate interests: Fraud detection, platform security, responsible gaming monitoring and platform analytics serve our legitimate business interests and the broader interest of all players. We balance these interests against your right to privacy and do not use this basis where your interests override ours.
- Consent: For optional marketing communications – promotional emails, SMS offers and personalised in-platform messages – we rely on your consent. You can withdraw consent at any time by following the unsubscribe link in any marketing email or by contacting support.
5 Who We Share Your Data With
Baji99 does not sell your personal data to third parties. Period. We share data only in the following circumstances and only to the extent necessary for the stated purpose.
- Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, IBFT banks and card processors receive the payment data necessary to process your deposit or withdrawal transaction. Each processor operates under its own privacy policy and data security standards.
- Identity verification providers: Third-party KYC providers receive identity document scans and may perform liveness checks to confirm that submitted documents match the account holder. These providers are contractually bound to use this data only for verification purposes.
- Game providers: Providers such as Spribe, Pragmatic Play and SmartSoft receive your username and session token to launch games. They do not receive your financial data or full identity details.
- Fraud prevention services: Specialist fraud detection platforms may receive device fingerprints, IP data and transaction patterns to identify suspicious activity. These services do not receive your name, national ID or financial account details.
- Legal authorities: Where required by law, court order or a valid regulatory request, Baji99 will disclose personal data to law enforcement or regulatory bodies. We will notify you of such a disclosure unless legally prohibited from doing so.
- Business transfers: In the event that Baji99's business or assets are acquired by a third party, your personal data may be transferred as part of that transaction. You will be notified of any such transfer and your rights in relation to your data will be preserved.
6 International Data Transfers
Some of Baji99's service providers – particularly game providers and fraud detection platforms – operate servers outside Pakistan. Where personal data is transferred internationally, Baji99 ensures that appropriate safeguards are in place.
These safeguards include contractual clauses that require the receiving party to protect your data to a standard equivalent to or higher than what applies in Pakistan, and restrictions on the recipient's ability to further transfer or use your data for purposes beyond what Baji99 has authorised.
Financial data and identity documents are processed on servers located in jurisdictions with robust data protection frameworks. We do not transfer CNIC scan data or payment account details to providers in jurisdictions with inadequate data protection standards.
7 How Long We Keep Your Data
Baji99 keeps personal data for as long as it is needed for the purpose it was collected, or as required by law. The retention periods below are the standard Baji99 policy:
- Account data (active accounts): Retained for the lifetime of the account plus 5 years after closure to meet financial record-keeping obligations.
- Transaction records: Retained for a minimum of 5 years from the date of the transaction, in line with standard financial compliance requirements.
- KYC documents: Retained for 5 years from account closure or from the date of the last transaction, whichever is later.
- Support communications: Retained for 3 years from the date of the interaction.
- Technical and usage logs: Retained for 12 months in detailed form; anonymised aggregate data may be retained indefinitely for analytics purposes.
- Marketing consent records: Retained until consent is withdrawn and for 2 years thereafter as evidence of the consent.
When data is no longer required and there is no legal obligation to retain it, Baji99 deletes or anonymises it securely. We do not archive data indefinitely "just in case".
8 Cookies and Tracking Technologies
Baji99 uses cookies and similar technologies to make the platform work properly, to remember your preferences and to understand how the platform is being used. Here is a summary of the cookie categories we use.
Your browser also allows you to block all cookies, though doing so will affect how Baji99 functions. Most browsers allow you to manage cookie settings through the browser settings menu.
9 Your Data Rights
As a Baji99 player you have specific rights over your personal data. Here is what each right means in practice and how to exercise it.
Right of Access
You can request a copy of all personal data Baji99 holds about you. We will provide this in a readable format within 30 days of receiving your request. There is no charge for a first request in any 12-month period.
Right to Rectification
If any personal data we hold is inaccurate or incomplete, you can ask us to correct it. For minor details like a phone number, you can update these directly in your account settings. For identity documents, contact support.
Right to Erasure ("Right to be Forgotten")
You can ask Baji99 to delete your personal data. This right is not absolute – we may need to retain certain data to meet legal obligations (for example, transaction records for financial compliance). We will tell you exactly what can be deleted and what must be retained.
Right to Restriction
You can ask us to limit processing of your data – for example, while a dispute about accuracy is being resolved. Restricted data is retained but not actively processed.
Right to Data Portability
You can request your personal data in a structured, commonly-used and machine-readable format (CSV or JSON) so that you can transfer it to another service provider if you choose.
Right to Object
You can object to processing of your data where Baji99 relies on legitimate interests as the legal basis. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent
Where processing is based on your consent (particularly marketing), you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, contact support@baji99.me with the subject line "Data Rights Request" and your account details. We will verify your identity before processing any data rights request and will respond within 30 days.
10 Children's Privacy
Baji99 is strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. Our registration process includes age verification steps, and we may require submission of identity documents to confirm age before allowing a player to deposit or play.
If you believe a person under 18 has registered an account on Baji99, please contact us immediately at support@baji99.me. We will investigate and close the account, returning any deposited funds where legally appropriate.
11 Security Measures
Baji99 takes data security seriously and has implemented technical and organisational measures appropriate to the risk level of the data we process. These include:
- Encryption in transit: All data transmitted between your device and Baji99 servers is encrypted using TLS 1.2 or higher with 256-bit encryption.
- Encryption at rest: Sensitive data including identity documents and financial records is encrypted in storage using AES-256.
- Access controls: Baji99 staff access to personal data is restricted on a strict need-to-know basis. Access logs are maintained and reviewed regularly.
- Two-factor authentication: We offer optional two-factor authentication (2FA) on all Baji99 accounts. We strongly recommend enabling this from your account security settings.
- Penetration testing: Baji99 commissions independent security audits and penetration tests on a regular schedule.
- Breach response: In the event of a data breach that poses a risk to your rights and freedoms, Baji99 will notify affected players within 72 hours of becoming aware of the breach and will take immediate remediation steps.
Despite these measures, no internet-based platform can guarantee absolute security. You also have a role to play – use a strong unique password for your Baji99 account, enable 2FA, and never share your login credentials with anyone.
12 Third-Party Links and Services
The Baji99 platform may contain references to third-party game providers and payment processors. When you interact with these services – for example, when launching a game from a provider like Spribe or processing a payment through Easypaisa – you are also subject to that third party's own privacy policy.
Baji99 is not responsible for the privacy practices of third-party service providers. We recommend reviewing the privacy policies of any payment processor or game provider you interact with. Our selection of providers considers their data protection standards as part of the due diligence process, but we cannot guarantee their practices on your behalf.
13 Marketing Communications
With your consent, Baji99 may send you promotional communications including information about bonuses, new game launches, special promotions and VIP Club events. We send these communications via email, SMS and in-platform notifications.
You can opt out of marketing communications at any time by:
- Clicking the unsubscribe link at the bottom of any Baji99 marketing email.
- Replying STOP to any SMS marketing message.
- Updating your notification preferences in your Baji99 account settings.
- Contacting support@baji99.me with the subject "Unsubscribe".
Opting out of marketing communications does not affect transactional communications – you will still receive account-related notifications such as deposit confirmations, withdrawal updates and security alerts. These are sent regardless of marketing preferences because they are necessary for account management.
Baji99 does not share your contact details with external marketing companies for their own marketing purposes. Any personalisation in our communications is based only on your activity within the Baji99 platform.
14 Changes to This Privacy Policy
Baji99 reviews this Privacy Policy regularly and updates it when our data practices change, when we add new services, or when legal requirements are updated. The "Last Updated" date at the top of this page always reflects the most recent revision.
Where changes are material – meaning they significantly affect how we collect, use or share your data – we will notify registered players by email at least 14 days before the changes take effect. For minor clarifications or corrections, we may update the Policy without advance notice.
Continued use of the Baji99 platform after any update constitutes your acknowledgement of the updated Policy. If you disagree with changes, you may close your account by contacting support.
15 Contact Us and Complaints
For any questions, concerns or requests related to this Privacy Policy or how Baji99 handles your personal data, contact us through the following channels.
If you are not satisfied with how Baji99 has handled a privacy concern after raising it with us, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction. We will cooperate fully with any such investigation.