Tojay Privacy Policy – Your Data Is Yours, and We Take That Seriously

Tojay is an online betting and gaming platform operated under the brand name "Tojay" and accessible at tojay.ws. For the purposes of this Privacy Policy, Tojay is the data controller — meaning we decide how your personal information is collected, stored, and used.

Tojay is built for Pakistani players. Everything on the platform — from the PKR-denominated wallet to the Easypaisa withdrawal process — is designed with the Pakistani user in mind. That same Pakistani-first approach extends to how we handle your data. We collect what we need to run the platform properly, we protect it to the best of our ability, and we do not misuse it.

If you have questions about how Tojay handles your personal data at any point, the right contact is our support team at support@tojay.ws. A human being will respond — not an automated form letter.

Tojay collects only the personal information that is reasonably necessary to deliver a safe, functional, and compliant betting and gaming service. The categories of data we collect are as follows:

Tojay does not collect or process any special category data (such as health data, biometric data, or political opinions) other than what is strictly required by anti-money laundering regulations in the context of identity verification.

Tojay collects personal data through the following channels:

• Direct from you: When you register an account on Tojay, complete KYC verification, make a deposit or withdrawal, contact our support team, or participate in any promotion.
• Automatically via your device: When you access Tojay via browser or mobile, our servers automatically log technical data including IP address, device identifiers, and session information. This happens on every visit regardless of whether you are logged in.
• Through cookies and tracking technologies: Tojay uses cookies and similar technologies to maintain your login session, remember your preferences, and gather aggregate usage data. See Section 8 for full details on cookies.
• From third-party service providers: Payment processors such as Easypaisa and JazzCash may share transaction confirmation data with Tojay to verify your deposit or withdrawal. Identity verification partners may provide verification status during KYC. Tojay does not purchase data lists from third-party marketers.

Tojay uses your personal data only for legitimate purposes that are either necessary to provide the service you have signed up for or required by law. The specific purposes are:

• Account creation and management: Setting up your Tojay account, verifying your identity and age, maintaining your account, and allowing you to log in securely.
• Processing transactions: Handling your deposits and withdrawals via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT bank transfer, or card — all in PKR.
• Delivering the service: Operating the betting and gaming features of Tojay, settling bets and game results, managing your PKR wallet balance, and crediting any promotional rewards.
• Regulatory and legal compliance: Meeting anti-money laundering (AML) and Know Your Customer (KYC) obligations, maintaining records required by applicable law, and cooperating with regulatory authorities when legally required.
• Fraud prevention and security: Detecting and investigating suspicious account activity, preventing unauthorised access, and protecting both Tojay players and the platform from fraud.
• Responsible gaming: Monitoring usage patterns to identify players who may be exhibiting signs of problem gambling, and administering any self-exclusion or deposit limit requests made through Tojay's responsible gaming tools.
• Customer support: Responding to your queries, resolving disputes, and maintaining records of support interactions for quality and compliance purposes.
• Platform improvement: Using aggregate, anonymised usage data to understand how Pakistani players use Tojay, identify areas for improvement, and develop new features.
• Marketing communications (with your consent): Sending you information about Tojay promotions, bonuses, and new features where you have opted in to receive such communications. You can opt out at any time — see Section 11.

Tojay does not sell, rent, or trade your personal data to any third party for commercial purposes. Full stop. We share your data only in the following limited circumstances, and only to the extent necessary:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, and our banking partners receive only the data necessary to process your specific deposit or withdrawal transaction. These providers have their own privacy policies and are responsible for protecting data within their own systems.
• KYC and identity verification providers: When you submit identity documents for KYC verification, these are processed by a specialist identity verification service. The outcome (verified / not verified) is shared with Tojay. Document data is handled according to the verification partner's own data protection standards.
• Technology service providers: Tojay uses third-party providers for services such as cloud hosting, platform infrastructure, and customer support tooling. These providers process data only on Tojay's instructions and are bound by data processing agreements.
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or regulatory instruction, Tojay may disclose personal data to authorities. Tojay will notify you of any such disclosure where legally permitted to do so.
• Business transfers: In the event that Tojay or its parent entity undergoes a merger, acquisition, or asset sale, player data may form part of the transferred assets. Tojay will notify affected players via their registered contact details if this occurs.

Tojay retains personal data for as long as necessary to fulfil the purposes for which it was collected, and to meet our legal, regulatory, and compliance obligations. The following retention guidelines apply:

When the retention period for any data category expires, Tojay securely deletes or anonymises that data so that it can no longer be linked to you as an individual.

Tojay takes the security of Pakistani players' personal and financial data seriously. The following technical and organisational measures are in place to protect your data:

• All data transmitted between your device and Tojay's servers is encrypted using TLS (Transport Layer Security). You will always see HTTPS in your browser when using Tojay.
• Stored data — including your personal details, financial records, and identity documents — is encrypted at rest on Tojay's infrastructure.
• Access to personal data within Tojay's operations is restricted to team members who need it for specific job functions. All internal access is logged and audited.
• Tojay uses OTP-based two-step verification for account logins and for withdrawal requests above certain thresholds.
• Tojay's servers are hosted in data centres with physical access controls, redundant power, and network security monitoring.
• Third-party service providers who process Tojay player data are assessed for their security practices before being engaged and are contractually bound to maintain appropriate security standards.

Tojay uses cookies — small text files stored on your device — and similar tracking technologies to make the platform work properly, keep you logged in, and understand how players use the site. Here is a breakdown of the types of cookies Tojay uses:

You can control cookie settings through your browser preferences. Disabling cookies beyond essential session cookies may affect the functionality of parts of Tojay. Tojay does not use third-party advertising cookies or sell any cookie-derived data to advertisers.

As a Tojay player, you have meaningful rights over your personal data. These are not just words — you can exercise any of these rights by contacting Tojay at support@tojay.ws and Tojay will respond within a reasonable timeframe, typically within 30 days.

Tojay is strictly an 18+ platform. We do not knowingly collect personal data from anyone under the age of 18. Age verification is required at registration and again during KYC withdrawal processing. Any account found to belong to a person under 18 will be suspended immediately, all funds within it forfeited, and all associated personal data deleted as soon as the minor status is confirmed.

Tojay does not market to minors and does not use targeting methods that would be likely to reach individuals under 18 years of age. If you believe your child has accessed or registered on Tojay, please contact us immediately at support@tojay.ws and we will take immediate action.

Tojay may send you promotional communications — about new features, bonuses, seasonal promotions, and special offers for Pakistani players — via SMS, in-app notification, or email, where you have given your consent to receive such communications at the time of registration or subsequently through your account settings.

You can opt out of Tojay marketing communications at any time by:

• Updating your notification preferences in your Tojay account settings.
• Replying STOP to any SMS from Tojay.
• Contacting Tojay support via live chat and asking to be removed from marketing communications.
• Emailing support@tojay.ws with the subject line "Opt out of marketing".

Opting out of marketing communications will not affect transactional communications from Tojay — you will still receive messages related to your deposits, withdrawals, account security, and support queries, as these are operational rather than marketing in nature.

Tojay does not include external links to third-party websites within the platform itself. However, if you arrive at Tojay through a link from another website — a Pakistani sports news site, a social media post, or an affiliate referral — please be aware that Tojay has no control over the privacy practices of those referring sites.

This Privacy Policy applies solely to data collected and processed by Tojay directly. If you visit any other website before or after visiting Tojay, that site's own privacy policy governs how your data is handled there.

Tojay may update this Privacy Policy from time to time to reflect changes in the platform, changes to the services we use, or changes to legal and regulatory requirements that affect how we handle Pakistani players' data. When material changes are made, Tojay will update the "last updated" date at the top of this page and notify registered players via SMS or in-app notification where the changes significantly affect their rights or how their data is used.

Tojay recommends that you review this Privacy Policy periodically. The most current version is always available at tojay.ws/privacy-policy. Your continued use of Tojay following publication of an updated Privacy Policy constitutes your acceptance of the changes.