hybaji Privacy Policy

hybaji is committed to protecting the privacy and personal data of all individuals who interact with our platform. This Privacy Policy sets out how hybaji collects, uses, stores, shares, and protects your personal information, and explains the rights available to you in relation to that data.

This Policy applies to all personal data collected through hybaji's website at hybaji.asia, the hybaji mobile platform, hybaji's customer support channels, and any other hybaji-operated service. It applies to registered Players, applicants who begin but do not complete registration, and unregistered visitors to the hybaji website.

For the purposes of applicable data protection law, hybaji acts as the Data Controller in respect of personal data collected from Players and visitors through the hybaji platform and website. As Data Controller, hybaji determines the purposes and means of processing your personal data.

hybaji operates as an international online gaming platform. Where hybaji engages third-party service providers (such as payment processors or KYC verification services) to process personal data on hybaji's behalf, those providers act as Data Processors under written data processing agreements that bind them to hybaji's data protection standards.

hybaji collects the following categories of personal data in connection with account registration, platform use, payment processing, and legal compliance:

hybaji collects personal data through the following channels and methods:

• Direct submission — Data you enter during account registration, KYC document upload, deposit and withdrawal requests, support communications, and preference settings.
• Automated technical collection — Data collected automatically when you access hybaji, including IP address, device identifiers, browser metadata, and session logs via cookies and similar technologies.
• Third-party verification providers — Identity and document verification results obtained from licensed KYC service providers when you submit documents for account verification.
• Payment processors — Transaction confirmation and reference data received from JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank when you initiate or complete a financial transaction.
• Fraud detection systems — Risk signals and device fingerprinting data collected through hybaji's fraud prevention technology to detect suspicious activity and protect the integrity of the platform.

hybaji processes your personal data on the following legal bases, depending on the specific purpose of the processing activity:

• Contractual necessity — Processing required to perform our contractual obligations to you as a registered hybaji Player, including operating your account, processing deposits and withdrawals, and providing access to betting and casino services.
• Legal obligation — Processing required to comply with hybaji's anti-money laundering (AML), counter-terrorism financing (CTF), KYC, and gaming regulatory obligations, including mandatory record-keeping requirements.
• Legitimate interests — Processing carried out for hybaji's legitimate business interests, including fraud detection and prevention, platform security, service improvement, and responsible gaming monitoring, provided such interests are not overridden by your rights and interests.
• Consent — Processing of your data for marketing communications, non-essential cookies, and optional personalisation features, where you have provided explicit prior consent. You may withdraw this consent at any time.

hybaji uses collected personal data for the following specific purposes:

• Creating, verifying, and maintaining your hybaji account and associated records.
• Processing PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank.
• Verifying your identity and age (21+) in compliance with KYC and responsible gaming requirements.
• Monitoring gaming activity for responsible gaming purposes, including identifying patterns that may indicate problem gambling behaviour.
• Detecting, investigating, and preventing fraud, money laundering, and other prohibited conduct on the hybaji platform.
• Responding to customer support enquiries, complaints, and dispute resolution requests.
• Sending transactional communications, such as deposit confirmations, withdrawal notices, and security alerts.
• Sending promotional communications, bonus offers, and platform updates, where you have consented to receive such messages.
• Analysing aggregated, anonymised platform usage data to improve hybaji's services, user experience, and game offering.
• Complying with applicable legal and regulatory obligations, including responding to lawful requests from regulatory authorities and law enforcement.

hybaji does not sell, rent, or trade your personal data to third-party advertisers or data brokers under any circumstances. Your personal data may be shared in the following limited, controlled circumstances only:

• Payment processors — JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank, to the extent necessary to process your financial transactions. Each provider is subject to their own privacy policies and applicable financial regulations.
• KYC verification providers — Licensed third-party identity verification services engaged to perform document and identity checks on hybaji's behalf, bound by contractual data processing agreements.
• Game software providers — hybaji's certified game studio partners may receive anonymised session and RNG data to support technical operation and game integrity; they do not receive identifiable personal data.
• Regulatory and law enforcement authorities — Where hybaji is legally required or ordered to disclose personal data to a regulatory body, court, or law enforcement agency, hybaji will comply with such lawful requests.
• Fraud prevention networks — Anonymised or pseudonymised risk indicators may be shared with industry fraud prevention systems where hybaji identifies patterns of prohibited conduct affecting multiple platforms.
• Business transfers — In the event of a merger, acquisition, or sale of all or part of hybaji's business, personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

hybaji accepts PKR deposits and processes PKR withdrawals via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank. When you initiate a financial transaction on hybaji, you will be directed to your chosen payment provider's secure interface.

hybaji does not store full mobile wallet credentials, bank account passwords, or full card numbers on its servers. hybaji retains only transaction reference numbers, masked account identifiers, transaction amounts, timestamps, and transaction status — the minimum data required for payment reconciliation, AML compliance, and withdrawal processing.

hybaji uses cookies, pixel tags, and similar tracking technologies to operate the platform, remember your preferences, analyse usage patterns, and enhance your experience. The following cookie categories are used:

• Essential cookies — Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. They cannot be disabled without preventing you from using hybaji.
• Functional cookies — Store your preferences such as language settings, preferred deposit method, and display preferences to improve your experience on return visits.
• Analytical cookies — Used to collect anonymised data about how Players navigate and use hybaji, allowing us to identify and fix usability issues and improve platform performance.
• Marketing cookies — Used only with your explicit consent to track engagement with hybaji promotional content and to deliver relevant offers. You may withdraw consent at any time via your browser cookie settings or your hybaji account preferences.

You can manage or delete cookies through your browser settings at any time. Note that disabling essential cookies will affect your ability to log in and use core hybaji features. hybaji's website does not respond to "Do Not Track" signals, but you retain full rights to manage cookie preferences as described above.

hybaji implements a layered approach to data security, combining technical, organisational, and procedural controls to protect your personal information against unauthorised access, disclosure, alteration, and destruction.

• 256-bit SSL/TLS encryption for all data in transit between your device and hybaji servers.
• Encryption at rest for sensitive personal data categories including identity documents and financial identifiers.
• Role-based access controls ensuring hybaji staff can only access personal data necessary for their specific job function.
• Regular internal and independent third-party security audits and penetration testing.
• Two-factor authentication (2FA) options for Player accounts to reduce unauthorised login risk.
• Automated anomaly detection systems that flag and investigate unusual account or transaction activity in real time.
• Incident response procedures to contain, investigate, and notify in the event of a confirmed personal data breach.

Despite these measures, no system can guarantee absolute security. hybaji encourages all Players to use strong, unique passwords for their hybaji account and to enable two-factor authentication where available.

hybaji retains personal data for the following periods, after which it is securely deleted or anonymised:

• Active account data — Retained for the duration of your active hybaji account relationship plus the applicable post-closure retention period.
• KYC and identity documents — Retained for a minimum of 5 years following account closure, in compliance with anti-money laundering regulatory requirements.
• Financial transaction records — Retained for a minimum of 5 years following the date of each transaction, as required by AML and financial record-keeping obligations.
• Gaming activity records — Retained for a minimum of 3 years following account closure for responsible gaming monitoring, dispute resolution, and regulatory compliance purposes.
• Support and communications data — Retained for 2 years following the close of the relevant support case or correspondence.
• Marketing consent records — Retained for the duration of your account plus 2 years to evidence consent and opt-out history.
• Website technical logs — Retained for up to 12 months for security monitoring and fraud investigation purposes, then deleted or anonymised.

Where hybaji is subject to a legal hold, regulatory investigation, or active dispute at the time a standard retention period would otherwise expire, the relevant data will be preserved until the matter is resolved, after which standard retention and deletion procedures resume.

As a hybaji account holder, you have the following rights in relation to your personal data. To exercise any of these rights, contact hybaji support via your account dashboard or at the email address provided in Section 18:

• Right of Access — You may request a copy of all personal data hybaji holds about you. hybaji will respond within 30 days of a verified request.
• Right to Rectification — You may request correction of inaccurate or incomplete personal data held in your hybaji account.
• Right to Erasure — You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to hybaji's legal retention obligations.
• Right to Restrict Processing — You may request that hybaji limits processing of your data in certain circumstances, such as while the accuracy of data is contested.
• Right to Data Portability — You may request your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contractual necessity.
• Right to Object — You may object to processing of your personal data based on hybaji's legitimate interests, including profiling for direct marketing purposes.
• Right to Withdraw Consent — Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

hybaji may send you marketing emails, SMS notifications, and in-platform messages about promotions, bonuses, new game launches, PSL cricket betting markets, and other hybaji platform updates — but only where you have explicitly consented to receive such communications during registration or through your account notification settings.

You may withdraw your marketing consent at any time by:

• Clicking the "Unsubscribe" link in any hybaji marketing email.
• Updating your notification preferences in your hybaji account settings.
• Contacting hybaji support via your account dashboard and requesting removal from marketing lists.

Withdrawal of marketing consent does not affect your ability to use the hybaji platform or your entitlement to receive essential transactional communications such as deposit confirmations, withdrawal notices, and account security alerts, which are sent regardless of marketing preferences as they are necessary for account operation.

hybaji's responsible gaming obligations require us to monitor Player gaming activity to identify patterns that may indicate problem gambling behaviour. This monitoring involves processing gaming activity data — including bet frequency, session duration, deposit patterns, and loss patterns — on an ongoing basis.

This processing is carried out on the basis of hybaji's legitimate interests and legal obligations as a licensed gaming operator, and is a non-negotiable aspect of platform operation. It cannot be opted out of.

Where a Player activates responsible gaming tools such as deposit limits, cooling-off periods, or self-exclusion through their hybaji account, records of those elections are retained for the full duration of the restriction plus the applicable post-closure retention period to prevent circumvention of exclusion commitments. For more information on hybaji's responsible gaming tools and commitments, visit the Responsible Gaming page. Strictly 21+ only.

hybaji's services are strictly restricted to individuals aged 21 and above. hybaji does not knowingly collect personal data from any person under the age of 21. If hybaji discovers or has reasonable grounds to believe that a registered account belongs to a person under 21, that account will be immediately suspended, all associated data will be reviewed, and the matter will be referred to the relevant authorities where appropriate.

hybaji operates as an international gaming platform. In the course of providing its services, personal data may be transferred to and processed in countries outside Pakistan, including the location of hybaji's licensed servers, KYC verification providers, and game software partners.

Where personal data is transferred internationally, hybaji ensures that appropriate safeguards are in place to protect the transferred data, including contractual data transfer agreements with receiving entities that impose equivalent data protection obligations to those described in this Policy.

By using hybaji and consenting to this Privacy Policy, you acknowledge and agree to the international transfer of your personal data as described in this section.

hybaji reserves the right to update or amend this Privacy Policy at any time. Material changes — such as new categories of data collection, new third-party sharing arrangements, or significant changes to retention periods — will be communicated to registered Players via email and/or a prominent notice on the hybaji website, with reasonable advance notice where practicable.

The "Last Updated" date at the top of this Policy reflects when the most recent changes took effect. Your continued use of hybaji following a Policy update constitutes your acceptance of the revised terms. If you disagree with any update, you may close your account by contacting hybaji support.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a data protection concern, you may contact hybaji through the following channels:

• Live Chat Support: Available 24/7 via your hybaji account dashboard — the fastest way to raise a data query.
• Support Email: [email protected] — plaintext address, not a clickable link. Please include "Privacy Request" in your subject line.
• FAQ Page: Visit the hybaji FAQ for answers to common account and privacy questions.

hybaji aims to respond to all data subject requests and privacy complaints within 30 calendar days of receipt. Where a request is complex or involves a large volume of data, hybaji may extend this period by a further 60 days, in which case you will be notified of the extension and the reasons for it.