Tojay Privacy Policy — How We Protect Your Data

1. Introduction

This Privacy Policy applies to all players who access or use the Tojay platform, including the website, the Tojay App and any related services. "Personal data" in this policy refers to any information that can identify you as an individual — your name, mobile number, email address, PKR transaction records and account activity, for example.

By registering a Tojay account, making a deposit or using any part of our service, you acknowledge that you have read this Privacy Policy and consent to the processing of your personal data as described here. If you do not agree with any part of this policy, you should discontinue use of the platform and contact support to close your account.

2. Information We Collect

Tojay collects personal data in two main ways: information you provide directly when using the platform, and data that is generated automatically as part of normal platform operation.

Information you provide directly:

• Registration details — your name, date of birth, mobile number and any other information entered during sign-up.
• Identity verification documents — where required to confirm your age or identity, such as a CNIC or passport copy.
• Payment information — the mobile wallet number or bank account details you use for PKR deposits and withdrawals.
• Support communications — messages, emails or chat logs you send to our support team.
• Responsible gaming preferences — deposit limits, session reminders or self-exclusion requests you set in your account.

Data collected automatically:

• Device and browser information — device type, operating system, browser version and screen resolution.
• IP address and approximate location — used for security checks and to identify unusual account activity.
• Session data — pages visited, time spent on the platform, games played and bets placed.
• Cookie and tracking data — as described in the Cookies section of this policy.

We do not collect sensitive personal data such as racial or ethnic origin, religious beliefs or political opinions. We do not collect data from your social media accounts unless you choose to share it with us directly.

3. How We Use Your Data

The personal data Tojay collects is used for specific, legitimate purposes. We do not use your data for purposes beyond what is described below without first informing you.

We may send you notifications about your account — deposit confirmations, withdrawal updates, security alerts and responsible gaming reminders. These are service communications, not marketing messages, and they cannot be turned off while your account is active as they relate to your account security and financial activity.

4. Payment Data and PKR Transactions

All PKR deposits and withdrawals on Tojay are processed through trusted payment providers including JazzCash, Easypaisa, Raast and supported banks. When you initiate a payment, your transaction details are passed to the relevant payment provider in a secure, encrypted format.

Tojay does not store your full JazzCash PIN, Easypaisa mPIN, bank password or card CVV on our servers. We retain only the information necessary to record the transaction and link it to your account — such as the last few digits of the wallet number or a transaction reference ID.

• Payment data is retained for as long as required for financial record-keeping and to handle any disputes or chargebacks.
• If you request a withdrawal, the payment is sent only to an account registered in your own name — this is required both for your security and to prevent fraud.
• Tojay's payment processors are bound by their own privacy policies in addition to the data sharing agreements they hold with Tojay.

5. Sharing Your Personal Data

Tojay does not sell your personal data. We share it only in the specific, limited circumstances described below.

• Payment providers: JazzCash, Easypaisa, Raast, banks and other payment processors receive the minimum data needed to complete your PKR transaction.
• Game providers: Where required for game integrity or technical operation, game providers may receive a player identifier. They do not receive your full name, payment details or contact information.
• Technology and infrastructure providers: Companies that host, maintain or support the Tojay platform may process your data under strict contractual obligations that prevent them from using it for any other purpose.
• Fraud and security services: Specialist providers that help detect and prevent fraudulent account activity or money laundering may receive limited data such as IP address, device fingerprint and transaction patterns.
• Legal obligations: If Tojay is required by a valid legal process to disclose information, we will comply to the extent required by law. We will notify affected players where we are legally permitted to do so.

All third parties who receive personal data from Tojay are required to keep it confidential, use it only for the agreed purpose and protect it with appropriate security measures. We do not share your data with advertisers, data brokers or any organisation whose purpose is to profile or target you commercially.

6. Cookies and Tracking Technologies

Tojay uses cookies — small text files stored on your device — and similar technologies to make the platform work properly and to understand how players use it. Here is a breakdown of the types of cookies we use:

• Essential cookies: These are required for the platform to function. They keep you logged in during your session, remember your language preference and maintain your basket or game state. These cannot be disabled without breaking core platform functionality.
• Analytics cookies: These help us understand which pages and games are most popular, how long players stay in a session and where technical errors occur. The data is aggregated and anonymised — it does not identify you personally.
• Security cookies: Used to detect suspicious activity, protect against CSRF attacks and flag unusual login patterns that may indicate account compromise.

Tojay does not use third-party advertising cookies or tracking pixels that follow you across other websites. You can manage cookie preferences in your browser settings. Note that disabling essential cookies may prevent some parts of Tojay from working correctly.

7. Data Security

Tojay uses industry-standard technical and organisational measures to protect your personal data from unauthorised access, alteration, disclosure or destruction. These measures include:

• TLS/SSL encryption for all data transmitted between your device and Tojay's servers.
• Encryption of sensitive data fields stored in our databases, including payment references and identity document details.
• Access controls that restrict internal access to personal data on a strict need-to-know basis.
• Regular security testing and vulnerability assessments of our platform infrastructure.
• Monitoring systems that flag unusual access patterns or potential data breaches in real time.

No online platform can guarantee absolute security, but Tojay makes every reasonable effort to protect your data. If you believe your account has been compromised, please contact our support team immediately so we can take protective action.

8. Data Retention

Tojay retains your personal data for as long as your account is active and for a reasonable period afterwards, as required for legal, financial and security purposes. Specific retention periods vary by data type:

• Account registration data: Retained for the duration of your account and for a period after closure to handle any outstanding disputes or legal obligations.
• Transaction records: PKR deposit and withdrawal records are retained as required for financial record-keeping purposes.
• Identity verification documents: Retained for the period required to meet verification and anti-fraud obligations, after which they are securely deleted.
• Support communications: Retained for a reasonable period to allow us to reference previous interactions when resolving follow-up queries.
• Session and analytics data: Retained in aggregated, anonymised form for platform improvement purposes. Individual session logs are not retained indefinitely.

When personal data is no longer required, Tojay securely deletes or anonymises it so that it can no longer be linked back to you as an individual.

9. Your Data Rights

As a Tojay player, you have the following rights over your personal data. To exercise any of these rights, contact our support team through your account. We will respond within a reasonable timeframe and may need to verify your identity before actioning the request.

10. Children and Minors

Tojay is strictly an adults-only platform. No person under the age of 18 is permitted to register an account or use any part of the Tojay service. We do not knowingly collect personal data from anyone under 18.

If we become aware that a minor has provided us with personal data or has registered an account, we will immediately close that account and delete all associated data. If you believe a minor may be using a Tojay account, please contact our support team right away so we can investigate and act on it promptly.

Parents and guardians are encouraged to use device-level parental controls to prevent minors from accessing online gaming platforms. Tojay also offers self-exclusion and account restriction tools that can be used by adults who wish to manage their own access responsibly.

11. Changes to This Privacy Policy

Tojay may update this Privacy Policy from time to time to reflect changes in our data practices, platform features or applicable requirements. When we make changes, the "Last Updated" date at the top of this page will be revised. For significant changes that materially affect how your data is processed, we will make reasonable efforts to notify you directly — through the platform or via your registered mobile number or email.

Your continued use of Tojay after any update to this Privacy Policy means you accept the revised terms. If you do not agree with the changes, you should stop using the platform and contact support to close your account and withdraw any eligible PKR balance.

12. Contact Us About Privacy

If you have any questions about this Privacy Policy, want to exercise any of your data rights, or have a concern about how Tojay handles your personal information, please get in touch with our support team. We aim to respond to all privacy-related queries promptly and thoroughly.

You can reach us at: [email protected]

For account-specific privacy requests — such as accessing your data or requesting a correction — please log in to your Tojay account before submitting the request. This helps us verify your identity and process your request more efficiently.

If you are not satisfied with our response to a privacy concern, you have the right to escalate the matter through appropriate channels available to you.