Tojay Privacy Policy

This Privacy Policy explains how Tojay — the online gaming and sports betting platform operated at tojay.biz — collects, uses, stores, protects and shares personal data belonging to players and visitors based in Pakistan. It applies to every interaction you have with Tojay, including account registration, deposits, gameplay, withdrawals, customer support and any promotional activities.

Tojay is committed to handling personal data responsibly and transparently. We want every player who joins Tojay to understand exactly what information we hold about them and what we do with it. If there is anything in this policy you don't understand or want to discuss, our support team is available 24/7 at support@tojay.biz.

Tojay collects personal data in two ways: information you provide directly, and information collected automatically through your use of the platform.

Information you provide directly:

• Registration data: Full legal name, date of birth, email address, Pakistani mobile number and in some cases your CNIC number for identity verification.
• Identity verification documents: Copy of your CNIC, passport or other government-issued ID when requested for account verification or large withdrawal processing.
• Payment information: Mobile wallet details (Easypaisa, JazzCash, NayaPay, SadaPay), bank account details (for IBFT transfers) or card information (Visa/Mastercard) as needed to process deposits and withdrawals in PKR.
• Communication records: Messages sent to Tojay's support team via live chat or email, including the content of those conversations, for quality assurance and dispute resolution purposes.
• Responsible gaming preferences: Any deposit limits, session reminders or self-exclusion settings you configure in your Tojay account.

Information collected automatically:

Tojay processes your personal data for the following specific purposes. We do not use your data for purposes beyond those listed here without notifying you and, where required, obtaining your consent.

• Account operation: Creating and managing your Tojay account, processing your login sessions and maintaining accurate account records including balance, bet history and bonus status.
• Payment processing: Facilitating deposits and withdrawals in PKR via your chosen payment method — Easypaisa, JazzCash, NayaPay, SadaPay, IBFT or card. Payment data is shared only with the relevant payment processor and only to the extent required to complete the transaction.
• Identity verification: Confirming your identity, age and eligibility to use Tojay in compliance with responsible gambling requirements and to prevent fraud and money laundering.
• Customer support: Responding to your queries, resolving disputes and managing complaints. Support conversations are retained for a reasonable period to enable effective case follow-up.
• Platform security: Detecting and preventing fraud, collusion, bonus abuse, unauthorised access and other activities that violate Tojay's Terms and Conditions or applicable laws.
• Responsible gaming: Applying the deposit limits, session controls and self-exclusion settings you configure in your account, and identifying patterns of behaviour that may indicate a player needs additional support.
• Regulatory compliance: Maintaining records required by applicable laws and responding to lawful requests from regulatory or law enforcement authorities.
• Platform improvement: Analysing aggregate, anonymised usage data to improve the performance, design and content of the Tojay platform — for example, identifying pages that load slowly on 4G connections in Pakistan or games that are difficult to navigate on small screens.
• Marketing communications (opt-in only): Sending promotional offers, bonus notifications and news about Tojay to players who have explicitly opted in to receive such communications.

Tojay processes personal data under the following legal bases depending on the specific processing activity:

• Contractual necessity: Processing your name, contact details, payment information and account activity is necessary to perform the contract between you and Tojay — i.e., to operate your gaming account and process your transactions. Without this data, Tojay cannot provide its services.
• Legal obligation: Identity verification, record-keeping for financial transactions and cooperation with legitimate regulatory or law enforcement requests are required by law. Tojay is obligated to process this data regardless of individual preferences.
• Legitimate interests: Platform security monitoring, fraud detection and the aggregate analysis of anonymised usage data are processed under Tojay's legitimate interest in operating a secure and well-functioning platform. These interests are carefully balanced against player privacy rights.
• Consent: Marketing communications and the use of non-essential cookies are processed only with your explicit consent, which you can withdraw at any time without affecting your account.

Tojay does not sell your personal data. We share your information only in the specific, limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

• Payment processors: When you deposit or withdraw, your payment details are shared with the relevant payment provider — Easypaisa, JazzCash, NayaPay, SadaPay, your bank (for IBFT) or your card network (Visa/Mastercard). These providers are contractually bound to data protection standards and are only given the data they need to complete your transaction.
• Identity verification services: Where Tojay requests ID verification, documents may be processed by a trusted third-party KYC (Know Your Customer) service provider. These providers operate under strict data processing agreements with Tojay.
• Fraud and security providers: Anonymised or pseudonymised technical data (such as IP addresses and device fingerprints) may be shared with fraud detection services to protect the integrity of the Tojay platform.
• Regulatory and legal authorities: Tojay may be required by law to disclose certain information to regulatory bodies, law enforcement or courts. Such disclosures are made only in response to lawful requests and to the minimum extent required.
• Professional advisors: Legal, accounting and auditing firms may have access to certain data as necessary for Tojay to operate as a lawful business. These parties are bound by confidentiality obligations.

Under no circumstances does Tojay share your personal data with other gaming companies, advertisers or data aggregators for commercial purposes. Your contact details, betting history and financial data remain entirely within Tojay's controlled environment except in the cases explicitly listed above.

Tojay uses cookies and similar technologies on its platform. A cookie is a small text file stored on your device by your browser. Here is how Tojay uses them:

• Essential cookies: These are necessary for the platform to function. They include your session authentication token (the thing that keeps you logged in), security tokens and preferences you've set during your session. These cannot be disabled without breaking core platform functionality.
• Functional cookies: These remember your preferences between visits — for example, your preferred display settings or the last game section you visited. They improve your experience but are not strictly necessary.
• Analytics cookies: These help Tojay understand how players use the platform — which pages are visited most, where players drop off, how long sessions last. The data is aggregated and anonymised. Tojay uses this information to improve the platform experience.
• Marketing cookies (opt-in only): If you have consented to marketing, these cookies help Tojay measure the effectiveness of promotional communications. These are only active if you have explicitly opted in.

Tojay retains personal data for as long as it is needed to fulfil the purposes for which it was collected, subject to any legal requirements for longer retention periods. Below are Tojay's standard retention periods by data category:

• Account data (name, contact details, date of birth): Retained for the duration of your account and for a minimum of five years after account closure, in line with applicable financial record-keeping requirements.
• Identity verification documents: Retained for the duration of your account and for five years after closure. May be retained longer if required by a specific regulatory or legal obligation.
• Transaction records (deposits, withdrawals, bets): Retained for a minimum of five years from the date of each transaction. This is a standard financial records requirement.
• Support communications: Retained for three years from the date of the last interaction in a support case, to enable effective case follow-up and dispute resolution.
• Marketing consent records: Retained for as long as you are an active Tojay player or until you withdraw consent, plus one year after withdrawal of consent as evidence of the consent status.
• Session and analytics data: Aggregated and anonymised after 12 months; the anonymised aggregate data may be retained indefinitely for platform improvement purposes.

When your personal data is no longer required under any of the above categories, Tojay will securely delete or anonymise it in accordance with standard data disposal procedures.

As a Tojay player, you have the following rights in relation to your personal data. You can exercise any of these rights by contacting support@tojay.biz with the subject line "Data Rights Request". Tojay will respond within 30 days.

Tojay implements robust technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. These include:

• SSL/TLS encryption: All data transmitted between your device and Tojay's servers is encrypted using industry-standard SSL/TLS protocols. You can verify this by checking the padlock icon in your browser's address bar when visiting tojay.biz.
• Encrypted data storage: Sensitive data — including payment details, identity documents and account credentials — is stored with encryption applied at the database level.
• Access controls: Access to personal data within Tojay's systems is restricted to authorised personnel who need it to perform their specific job functions. Access is logged and audited regularly.
• Security monitoring: Tojay runs continuous security monitoring on its systems to detect and respond to unusual activity, attempted breaches and vulnerabilities.
• Data breach response: In the event of a personal data breach that poses a risk to player rights, Tojay will notify affected players and relevant authorities as required by applicable law, without undue delay.

While Tojay takes all reasonable precautions, no online platform can guarantee absolute security. Players are responsible for keeping their own login credentials secure and should contact Tojay support immediately if they suspect unauthorised access to their account.

Tojay's services are intended exclusively for adults aged 18 years and older. Tojay does not knowingly collect or process personal data belonging to anyone under the age of 18.

If Tojay becomes aware that a person under 18 has registered an account or provided personal information, the account will be immediately closed, all associated data will be deleted (subject to any legal obligations around the specific circumstances) and any deposited funds will be returned to the source payment method. No winnings accumulated on an underage account will be paid out.

If you believe that a minor may have created a Tojay account, please contact support@tojay.biz immediately so that the account can be investigated and closed without delay.

Tojay may send promotional emails, SMS messages or in-platform notifications about bonuses, new game launches, special events and other Tojay news — but only to players who have explicitly opted in to receive such communications.

If you have opted in to Tojay marketing communications, you can unsubscribe at any time by:

• Clicking the unsubscribe link in any promotional email from Tojay.
• Updating your communication preferences in your Tojay account settings.
• Contacting support@tojay.biz with the subject line "Unsubscribe from Marketing".

Unsubscribing from marketing communications has no effect on transactional messages — you will still receive important account notifications such as deposit confirmations, withdrawal updates, security alerts and support responses. These operational messages are not marketing and cannot be opted out of while your account remains active.

Tojay will never share your contact details with third-party marketers. All promotional communications you receive that reference Tojay will originate from Tojay's own systems.

The Tojay platform does not contain links to external third-party websites as part of its standard navigation or game interfaces. However, if any such links appear — for example in support documentation or responsible gaming resources — Tojay is not responsible for the privacy practices of those external websites.

This Privacy Policy applies exclusively to the Tojay platform at tojay.biz. If you follow a link to an external site, the privacy policy of that site will govern how your data is handled there. Tojay recommends reviewing the privacy policy of any external site before providing personal information to it.

Tojay reserves the right to update this Privacy Policy at any time. When we make material changes — changes that affect how we use your data in ways that are meaningfully different from what is described here — we will update the "Last Updated" date at the top of this page.

For significant changes that affect your rights or the way Tojay uses your personal data, we will additionally notify active players by email to the address on file. Where required, we will seek fresh consent before applying new processing practices.

Continued use of Tojay after an updated Privacy Policy has been posted constitutes acceptance of the revised policy. If you disagree with any changes, your right is to close your account and request deletion of your personal data subject to Tojay's legal retention obligations.

If you have any questions, concerns or requests related to this Privacy Policy or to the personal data Tojay holds about you, please get in touch:

• Email: support@tojay.biz — use subject line "Privacy Request" for data-related queries.
• Live Chat: Available 24/7 directly on the Tojay platform after logging in to your account. Our support team is available in both English and Urdu.

Tojay aims to respond to all privacy-related requests within 30 days. For complex requests — such as complete data exports or deletion requests that require cross-system review — Tojay may extend this period by a further 30 days, in which case you will be notified of the extension and the reason.