bataa Privacy Policy

§ 1 Introduction

bataa operates Pakistan's premier online casino and sports betting platform, providing players across Karachi, Lahore, Islamabad, Faisalabad, and throughout Pakistan with access to over 1,200 casino games, live PSL and international cricket betting markets, and fast PKR payment services via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank.

In the course of providing these services, bataa necessarily collects and processes certain personal data about its players and website visitors. We recognise that your personal data belongs to you, and we take our responsibility to handle it carefully, securely, and transparently with the utmost seriousness.

This Privacy Policy ("Policy") sets out in full detail what personal data bataa collects, why it is collected, how it is used, how long it is kept, who it may be shared with, and what rights you have in relation to your data. This Policy is incorporated into and forms part of the bataa Terms & Conditions. All terms used in this Policy have the meaning given to them in the bataa Terms & Conditions unless otherwise defined here.

§ 2 Data Controller

For the purposes of applicable data protection law, bataa is the data controller in respect of all personal data processed in connection with the bataa platform and services. The data controller is responsible for deciding how and why personal data is processed, and for ensuring that processing is carried out lawfully and in accordance with this Policy.

Questions, requests, and complaints regarding the processing of your personal data may be directed to bataa's designated privacy contact at the following address:

Privacy Contact: [email protected]

All privacy-related communications should clearly indicate "Privacy Request" in the subject line to ensure they are directed to the appropriate team. We aim to acknowledge all privacy enquiries within 2 business days.

§ 3 Personal Data We Collect

bataa collects the following categories of personal data in connection with the operation of the Platform and provision of services to players:

bataa does not collect special categories of sensitive personal data (such as health data, biometric data, or political opinions) except where strictly necessary for responsible gaming compliance and with your explicit consent, such as when a player discloses a gambling-related health condition when requesting enhanced support.

§ 4 How We Collect Your Data

bataa collects personal data through the following channels and mechanisms:

• Direct collection: Data you provide when registering a bataa account, completing KYC verification, making deposits or withdrawals, contacting customer support, or using responsible gaming tools.
• Automated collection: Technical and usage data collected automatically when you access bataa.org, through server logs, cookies, and similar tracking technologies as described in Section 9 of this Policy.
• Third-party verification services: Identity and age verification data received from third-party KYC service providers engaged by bataa to confirm player eligibility.
• Payment processors: Transaction confirmation data received from payment providers including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and Visa in connection with deposit and withdrawal processing.
• Game providers: Gaming session data received from licensed third-party game suppliers whose games are available on the bataa platform.

§ 5 How We Use Your Personal Data

bataa uses personal data collected from players for the following purposes:

• Account management: Creating, maintaining, and managing your bataa account, including authentication and access control.
• Service delivery: Providing access to casino games, sports betting markets, and all other features available on the bataa platform.
• Payment processing: Processing deposits and withdrawals in PKR through your chosen payment method, and maintaining accurate transaction records.
• Identity and age verification: Conducting mandatory KYC verification to confirm that all players are at least 21 years of age and to comply with anti-money laundering obligations.
• Responsible gaming compliance: Monitoring gaming patterns to identify potentially problematic behaviour, administering self-exclusion and deposit limit features, and fulfilling our duty of care toward all players.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, unauthorised account access, bonus abuse, and other prohibited conduct as defined in the bataa Terms & Conditions.
• Customer support: Responding to player enquiries, resolving disputes, processing complaints, and providing technical assistance.
• Legal and regulatory compliance: Meeting applicable legal obligations, including record-keeping requirements, and responding to lawful requests from competent authorities.
• Platform improvement: Analysing aggregated, anonymised usage data to improve bataa's services, features, and user experience.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications, subject to Section 14 of this Policy.

§ 6 Legal Basis for Processing

bataa processes personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between bataa and the player, including account management, game access, and payment processing.
• Legal obligation: Processing required to comply with applicable legal and regulatory obligations, including KYC verification, anti-money laundering record keeping, and responses to lawful authority requests.
• Legitimate interests: Processing for bataa's legitimate business interests, including fraud prevention, security, platform improvement, and responsible gaming monitoring, where those interests are not overridden by the player's rights and interests.
• Consent: Processing for which bataa has obtained the player's explicit prior consent, including marketing communications and the processing of any special category data as described in Section 3.

Where bataa relies on consent as the legal basis for processing, you have the right to withdraw your consent at any time by contacting [email protected] or by updating your account communication preferences. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

§ 7 Data Sharing & Third Parties

bataa does not sell, rent, or trade your personal data to third parties for their own commercial purposes. bataa may share your personal data with the following categories of third parties solely for the purposes described in this Policy:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and Visa, for the sole purpose of processing your deposit and withdrawal transactions.
• KYC and identity verification providers: Licensed third-party services engaged by bataa to conduct identity, age, and document verification as part of our KYC obligations.
• Game providers: Licensed casino game suppliers whose games are available on the bataa platform, who receive gaming session data necessary to operate their games and maintain RNG certification.
• IT and infrastructure providers: Cloud hosting, data storage, cybersecurity, and platform development providers who process data on bataa's behalf under binding data processing agreements.
• Regulatory and law enforcement authorities: Competent governmental or regulatory bodies where disclosure is required by applicable law, court order, or regulatory direction.
• Professional advisers: Legal, audit, and compliance advisers who are bound by professional confidentiality obligations.

All third-party service providers engaged by bataa to process personal data on our behalf are required to enter into data processing agreements confirming that they will process personal data only on bataa's documented instructions, will implement appropriate technical and organisational security measures, and will not sub-process or transfer personal data without bataa's prior authorisation.

§ 8 International Data Transfers

bataa's primary data processing infrastructure is located in secure data centres. In the course of providing services, certain personal data may be transferred to or processed in countries outside Pakistan, including in connection with the use of third-party service providers such as cloud hosting platforms or game suppliers.

Where such international transfers occur, bataa ensures that appropriate safeguards are in place to protect your personal data, including:

• Transfers only to recipients in countries that provide an adequate level of data protection as assessed by bataa's compliance team.
• Use of contractual data protection clauses in agreements with international service providers that impose equivalent data protection obligations.
• Technical security measures that apply uniformly to personal data regardless of where it is processed.

Players who wish to obtain further information about the safeguards applicable to specific international transfers may submit a request to [email protected] marked "International Transfer Enquiry".

§ 9 Cookies & Tracking Technologies

bataa uses cookies and similar tracking technologies on bataa.org to enable the Platform to function correctly and to improve the user experience. The following types of cookies are used:

bataa does not use third-party advertising cookies, retargeting cookies, or social media tracking pixels. You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may affect the functionality of the bataa platform, including the ability to log in and access games.

§ 10 Data Security

bataa implements a comprehensive set of technical and organisational security measures designed to protect player personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security programme includes:

• Encryption in transit: All data transmitted between player devices and bataa's servers is encrypted using TLS 1.3 protocol. HTTPS is enforced across all pages of bataa.org.
• Encryption at rest: Sensitive personal data, including CNIC numbers, payment account details, and KYC documents, is stored using AES-256 encryption within secured data storage environments.
• Access controls: Access to player personal data within bataa's organisation is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and receive regular data protection training.
• Infrastructure security: bataa's hosting infrastructure is subject to ongoing security monitoring, intrusion detection, and regular independent penetration testing.
• Incident response: bataa maintains a documented data breach response procedure. In the event of a data breach that poses a risk to player rights, affected players will be notified without undue delay.

While bataa takes data security very seriously and maintains robust security measures, no online platform can guarantee absolute security. Players are responsible for maintaining the confidentiality of their account credentials and must notify bataa immediately at [email protected] if they suspect any unauthorised access to their account.

§ 11 Data Retention

bataa retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention periods required by applicable law. The following retention periods apply:

• Account data and KYC records: Retained for a minimum of 5 years from the date of account closure, in accordance with anti-money laundering record-keeping requirements.
• Transaction and payment records: Retained for a minimum of 5 years from the date of each transaction.
• Gaming history: Retained for 3 years from the date of each gaming session, unless a longer period is required for dispute resolution or regulatory compliance.
• Customer support communications: Retained for 2 years from the date of resolution, unless the matter remains the subject of an unresolved dispute or legal proceedings.
• Marketing consent records: Retained for the duration of the player's active account and for 1 year following account closure or withdrawal of consent, as applicable.
• Technical and usage data: Retained in anonymised or aggregated form for up to 13 months for platform improvement purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual player.

§ 12 Your Data Rights

Subject to applicable law, all bataa players hold the following rights in relation to their personal data. You may exercise any of these rights by submitting a request to [email protected] marked "Data Rights Request". bataa will respond to all valid requests within 30 calendar days.

§ 13 Children & Minors

bataa is an age-restricted platform. The bataa Terms & Conditions strictly prohibit registration or use by any individual under 21 years of age. bataa does not knowingly collect personal data from minors.

All bataa accounts are subject to mandatory CNIC-based age verification. Where age verification reveals that an account has been registered by an individual under 21 years of age, bataa will immediately close the account, void all gameplay, and return deposited funds to the deposit source where legally required. No winnings will be paid out from accounts found to belong to underage individuals.

If you have reason to believe that a minor has accessed or registered a bataa account, please report this to [email protected] immediately, marked "Underage Access Report". Such reports are treated as the highest priority and investigated immediately by bataa's compliance team.

§ 14 Marketing Communications

bataa may send marketing communications to players who have opted in to receive such communications, including promotional offers, bonus notifications, VIP programme updates, and platform news. Marketing communications are sent via email and, where consent has been given, via SMS to registered mobile numbers.

You may opt out of marketing communications at any time by:

• Updating your communication preferences in your bataa account settings;
• Clicking the "Unsubscribe" link in any marketing email sent by bataa;
• Replying "STOP" to any marketing SMS from bataa; or
• Contacting [email protected] with the subject line "Marketing Opt-Out".

Marketing opt-out requests are processed within 10 business days. Please note that opting out of marketing communications does not affect transactional communications, including account notifications, payment confirmations, security alerts, responsible gaming notifications, and legal or regulatory updates, which you will continue to receive as they are necessary for the operation of your bataa account.

§ 15 Third-Party Links

The bataa platform may contain links to third-party websites, including game provider websites, payment provider portals, and responsible gaming support organisations. bataa is not responsible for the privacy practices or content of any third-party website.

This Privacy Policy applies only to personal data collected by bataa. When you follow a link to a third-party website, you are subject to that website's own privacy policy. bataa encourages all players to review the privacy policies of any third-party websites they visit.

§ 16 Policy Amendments

bataa reserves the right to amend this Privacy Policy at any time in response to changes in applicable law, changes to bataa's services or business practices, or for any other reason. Where amendments are material, bataa will provide advance notice to players via account notification, email, or prominent on-site messaging.

The "Last Updated" date at the top of this Policy reflects the date of the most recent amendment. Players are encouraged to review this Policy periodically. Continued use of bataa following the publication of any amendment to this Policy constitutes acceptance of the revised Policy.

If you do not agree with any amendment to this Privacy Policy, you may close your bataa account in accordance with the account closure provisions set out in the bataa Terms & Conditions.

§ 17 Contact & Privacy Complaints

Questions, requests, or complaints relating to the processing of your personal data or the content of this Privacy Policy may be directed to bataa's privacy team at the following contact point:

Privacy Contact: [email protected]

Please mark all privacy-related communications with "Privacy Enquiry" or "Privacy Complaint" in the subject line to ensure prompt routing to the appropriate team. bataa aims to acknowledge all privacy enquiries within 2 business days and to provide a substantive response within 30 calendar days.

If you are dissatisfied with bataa's response to a privacy complaint, you may have the right to lodge a complaint with a competent data protection supervisory authority in your jurisdiction.