Tojay Privacy Policy – How We Protect Your Data in Pakistan

Tojay operates the online betting and gaming platform accessible at tojay.im. Tojay is the data controller responsible for the personal information collected from players who register accounts, make deposits, place bets, and use any part of the platform. When this policy refers to "tojay," "we," "us," or "our," it means the entity that operates tojay.im.

This Privacy Policy applies to all players who use tojay's platform, including those who browse without registering, those who register but have not yet deposited, and fully active account holders. It covers all personal data collected through the website at tojay.im, including any interactions with our support team, notifications sent to your device, and data collected through payment processing.

If you have any questions about how tojay handles your personal data, you can reach us at any time at support@tojay.im. Our support team is available 24 hours a day, seven days a week.

The personal data tojay collects can be grouped into the following categories:

Registration and Identity Data: When you create a tojay account, we collect your full name, date of birth, Pakistani mobile number, and email address if provided. This data is required to create and manage your account and to verify your age and identity.

Identity Verification (KYC) Data: To comply with anti-money laundering obligations and to process withdrawals above defined thresholds, tojay may request a copy of your CNIC (Computerised National Identity Card) or other government-issued identity document, and evidence of your registered payment method. This data is used solely for identity verification and fraud prevention.

Financial and Transaction Data: Every deposit, withdrawal, and bet placed on tojay generates a transaction record. This includes the amount, date, time, payment method used, and the outcome of each bet. This data is retained for account management, payout processing, dispute resolution, and regulatory compliance.

Device and Technical Data: When you access tojay, we automatically collect certain technical information including your IP address, device type, operating system, browser type, and screen resolution. This data helps us optimise the platform for different devices and detect suspicious access patterns.

Behavioural Data: Tojay records which pages you visit, which games you play, how long you spend on each section, and the betting patterns associated with your account. This data is used to improve the platform, personalise your experience, and monitor for responsible gaming indicators.

Communications Data: If you contact tojay support via live chat or email, we retain a record of those communications. This includes the content of your messages, timestamps, and any documents or screenshots you share with us. Communication records are used to resolve your query, train our support team, and as evidence in the event of a dispute.

Tojay collects data through three main channels:

• Directly from you: Information you provide when registering, completing KYC, making a deposit or withdrawal, placing a bet, or contacting support.
• Automatically: Technical and behavioural data collected by tojay's platform systems as you navigate and interact with the website. This includes session data, click patterns, game interaction logs, and device fingerprinting used for fraud prevention.
• From third parties: Payment processors (Easypaisa, JazzCash, NayaPay, SadaPay, banks, and card networks) share transaction confirmation data with tojay. Identity verification providers may share the result of document checks. Anti-fraud services may share risk scores associated with certain IP addresses or device signatures.

Tojay uses the data collected for the following specific purposes:

Tojay will not use your personal data for any purpose beyond those listed above without first informing you and, where required by applicable law, obtaining your consent. If you have opted in to marketing communications from tojay, you can withdraw that consent at any time by contacting support or updating your account notification preferences.

Tojay processes your personal data under the following legal bases:

• Contract performance: Processing necessary to operate your tojay account, process transactions, and settle bets is required to fulfil the contract between you and tojay. Without this processing, tojay cannot provide its services to you.
• Legal obligation: Tojay is required to verify player identities, maintain transaction records, and monitor for money laundering and fraud. This processing is mandated by applicable legal and regulatory requirements.
• Legitimate interests: Fraud prevention, platform security, responsible gaming monitoring, and platform improvement are conducted under tojay's legitimate interest in operating a safe and fair platform. These interests do not override your privacy rights.
• Consent: Marketing communications and the use of non-essential cookies are conducted only with your explicit consent. You can withdraw this consent at any time.

Tojay shares your personal data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, banks, and card networks receive your payment details to process deposits and withdrawals. Each payment provider operates under their own privacy policy and applicable Pakistani financial regulations.
• Identity verification providers: Third-party KYC service providers receive identity documents and facial images where applicable to perform verification checks. These providers are bound by strict data processing agreements.
• Fraud prevention services: Device fingerprint data and behavioural signals may be shared with anti-fraud partners to identify and block suspicious activity. No personally identifiable information beyond technical signals is shared for this purpose.
• Technology providers: Cloud infrastructure, database, and platform technology providers who host and operate tojay's systems may have access to player data in the course of providing their services. All such providers operate under contractual data protection obligations.
• Law enforcement and regulators: Tojay will disclose personal data to government authorities, law enforcement agencies, or regulators when required to do so by law, court order, or a legally valid regulatory request.
• Business transfers: In the event that tojay's business is transferred, acquired, or merged with another entity, player data may be transferred as part of that process. Any successor entity will be required to honour this Privacy Policy.

Tojay uses cookies and similar tracking technologies on the tojay.im website. Cookies are small text files stored on your device that help the platform remember your preferences and session state. Below is a summary of the cookies tojay uses:

• Essential cookies: Required for the platform to function. These include session management cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences such as language, last-visited game, and notification settings. These improve your experience but are not strictly necessary.
• Analytics cookies: Used to understand how players navigate tojay, which pages are most visited, and where users drop off. Analytics data is aggregated and anonymised. Tojay uses this data to improve the platform experience.
• Marketing cookies: Used only with your explicit consent to track the effectiveness of tojay promotional campaigns. If you have not consented, these cookies are not set.

You can manage cookie preferences through your browser settings. Blocking essential cookies will prevent you from logging in and using the platform. Blocking non-essential cookies will not affect your ability to bet, deposit, or withdraw, but may reduce certain personalisation features. Tojay's cookie consent banner allows you to granularly control which categories of cookies you accept when you first visit the platform.

Tojay retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following retention standards:

• Active account data: Retained for the lifetime of your tojay account and for a minimum of five years after account closure to comply with anti-money laundering and financial record-keeping obligations.
• Transaction records: Retained for a minimum of five years from the date of the transaction, consistent with financial regulatory requirements applicable in Pakistan.
• KYC and identity documents: Retained for a minimum of five years from the date of account closure or the completion of the verification process, whichever is later.
• Support communications: Retained for three years from the date of the last communication in that support thread.
• Technical and behavioural data: Typically retained for 12 months in identifiable form before being anonymised or deleted.
• Marketing consent records: Retained for as long as you remain a tojay account holder, or until you withdraw consent.

When data reaches the end of its retention period, tojay securely deletes or anonymises it. Anonymised data – from which no individual can be identified – may be retained indefinitely for statistical and analytical purposes.

Tojay implements a range of technical and organisational security measures to protect your personal data from unauthorised access, alteration, disclosure, or destruction:

• TLS encryption: All data in transit between your device and tojay's servers is protected by Transport Layer Security (TLS) encryption. The padlock in your browser's address bar confirms this connection is active.
• Encrypted data storage: Sensitive data – including identity documents and financial information – is encrypted at rest in tojay's database systems. Plain-text storage of sensitive personal data is not permitted.
• Access controls: Role-based access controls ensure that only authorised tojay personnel can access player data, and only to the extent required by their role. Access logs are maintained and reviewed.
• Two-factor authentication: Tojay uses internal two-factor authentication systems for staff accessing sensitive data systems. We also offer account-level two-factor authentication to registered players for additional login security.
• Security monitoring: Tojay's systems are monitored continuously for unusual access patterns, intrusion attempts, and data exfiltration signals. Security events are logged and reviewed by our security team.
• Third-party security audits: Tojay engages independent security professionals to audit its systems and data handling practices on a regular basis.

Despite these measures, no online platform can guarantee absolute security. In the event of a security incident that compromises personal data, tojay will notify affected players promptly and take immediate steps to contain the breach, investigate the cause, and prevent recurrence.

As a tojay player, you have the following rights over your personal data. To exercise any of these rights, contact tojay support at support@tojay.im. We will respond within 30 days of receiving a valid request.

Tojay is strictly an adults-only platform. We do not knowingly collect personal data from anyone under the age of 18. If you are under 18, you must not register a tojay account or attempt to use the platform in any capacity.

Tojay's registration process includes age verification steps. Where we have reason to believe that an account was registered by a minor, we will suspend the account immediately, conduct a review, and if confirmed, close the account permanently. Any funds in such an account will be handled in accordance with applicable guidance.

If you are a parent or guardian and believe that a minor in your care has registered a tojay account, please contact us immediately at support@tojay.im. We take underage access seriously and will act on valid notifications without delay.

Tojay uses behavioural and financial data to monitor for signs of problem gambling. This includes tracking betting frequency, deposit patterns, session duration, and chasing-loss behaviour. This monitoring is conducted in tojay's legitimate interest and in the interest of player wellbeing.

If our responsible gaming systems identify patterns consistent with problem gambling, tojay may proactively contact the player to offer support tools, apply temporary limits, or suggest a cooling-off period. This monitoring is not used for any commercial purpose – it exists solely to protect players.

Data associated with self-exclusion is handled with particular sensitivity. If you self-exclude from tojay, a record is kept for the duration of the exclusion period to prevent re-registration. This data is not used for any other purpose.

For more information about responsible gaming tools available on tojay, visit our Responsible Gaming page.

Tojay may update this Privacy Policy from time to time to reflect changes in how we operate, changes in applicable law, or improvements in our data practices. When changes are made, the revised policy will be published at tojay.im/privacy-policy with an updated "last updated" date.

For significant changes that materially affect how we use your personal data, tojay will make reasonable efforts to notify registered players via their registered mobile number or email address before the changes take effect. This gives you the opportunity to review the changes and, if you do not agree with them, to request account closure before they come into force.

We encourage you to review this Privacy Policy periodically. Your continued use of tojay after any update constitutes acceptance of the revised policy.

If you have any questions about this Privacy Policy, want to exercise your data rights, or have a concern about how tojay has handled your personal information, please get in touch:

• Email: support@tojay.im – privacy requests are treated as priority and responded to within 2 business days
• Live Chat: Available 24/7 within your tojay account after logging in
• Subject line: Use "Privacy Request" in your email subject line so your message reaches the right team immediately

If you submit a data access, correction, or deletion request, please include your registered mobile number, the email address associated with your account (if applicable), and a brief description of what you are requesting. This helps us identify your account and action your request promptly.

If you believe tojay has not handled your personal data appropriately and you are not satisfied with our response to your complaint, you may have the right to raise the matter with the relevant data protection authority in your jurisdiction.