Privacy Policy

Basant ("we", "us", "our" or "the Platform"), accessible at https://basant.cam, is committed to protecting and respecting the privacy of every user who accesses our website. This Privacy Policy sets out the basis on which any personal data we collect from you — or that you provide to us — will be processed by Basant.

This Privacy Policy applies to all users of the Platform, including visitors who browse without registering an account and registered users with active accounts. It covers all processing activities undertaken by Basant in connection with the operation of the Platform, including data collected through account registration, payment processes, support communications and automated technical means such as cookies and server logs.

By using the Basant Platform, you confirm that you have read and understood this Privacy Policy and that you consent to the collection and use of your data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform immediately and contact us to request account closure and data deletion where applicable.

For the purposes of this Privacy Policy, the following terms have the meanings set out below unless the context expressly requires otherwise:

Basant collects and processes the following categories of Personal Data, each for defined and lawful purposes as set out in this Policy:

Identity Data:

Full legal name, date of birth, nationality and government-issued identification numbers (such as Pakistani CNIC or passport number) collected during the KYC verification process. This data is used to confirm your age, identity and eligibility to use the Platform.

Contact Data:

Email address, mobile telephone number and, where provided, a billing or correspondence address. This data is used to communicate with you regarding your account, support requests, policy updates and, where applicable, promotional communications.

Account Credentials:

Username and hashed (non-plaintext) password used to secure access to your registered account. Basant does not store passwords in plaintext at any stage.

Financial Reference Data:

Where applicable, transaction reference identifiers, deposit and withdrawal records and payment method identifiers (e.g., partial wallet references for Easypaisa, JazzCash or bank transfer accounts). Basant does not store full payment instrument numbers or full bank account details on its own systems.

Technical & Usage Data:

IP address, browser type and version, operating system, device type, screen resolution, referring URL, pages visited, time spent on pages and click-path data. This data is collected automatically via server logs, cookies and analytics tools.

Communications Data:

Content of support messages, live chat transcripts, email correspondence and feedback submissions made to Basant through any communication channel.

Basant collects Personal Data through the following means:

• Direct submission: Data you voluntarily provide when registering an account, completing KYC verification, submitting a support request, completing a contact form or communicating with us by any channel.
• Automated technical collection: Data collected automatically when you interact with the Platform, including server access logs, cookie-based tracking, session analytics and device fingerprinting for fraud-prevention purposes.
• Third-party identity verification services: Where KYC verification is conducted through a third-party identity verification provider, that provider may share verification outcomes and related data with Basant in accordance with their own privacy terms and applicable regulatory requirements.
• Payment processors: Transaction reference data and payment confirmation signals from third-party payment processors, including those facilitating transactions via local Pakistani payment routes. Full payment instrument data is processed and held by the payment provider, not by Basant.
• Publicly available sources: In limited fraud-prevention circumstances, Basant may reference publicly available information to verify identity claims or assess risk.

Basant uses your Personal Data strictly for the following defined purposes:

Basant processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform the contract between you and Basant, including account registration, KYC verification and account management operations.
• Legal obligation: Processing required for Basant to comply with applicable legal and regulatory requirements, including AML checks, KYC obligations and responses to lawful regulatory requests or court orders.
• Legitimate interests: Processing for fraud prevention, platform security, internal analytics and service improvement, where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given and explicit consent, including the placing of non-essential cookies and the sending of marketing communications. Consent may be withdrawn at any time.

Basant does not sell, rent or trade your Personal Data to third parties for their own commercial purposes. We share your data only in the following limited and defined circumstances:

• Identity verification providers: Third-party KYC and age verification services engaged by Basant to confirm the identity and eligibility of registered users. These providers act as Data Processors under contractual data-processing agreements.
• Payment processors: Payment service providers and financial institutions involved in processing deposits and withdrawals, including those facilitating transactions through local Pakistani financial routes. Data is shared only to the extent necessary to process the relevant transaction.
• IT and infrastructure providers: Cloud hosting providers, content delivery networks, database service providers and cybersecurity vendors engaged to support Platform operations. All such providers are bound by appropriate data processing terms.
• Analytics providers: Where analytics tools are used to understand Platform performance and usage, aggregated and anonymised data may be shared with analytics service providers.
• Regulatory and legal authorities: Where required by applicable law, regulation, court order or legitimate regulatory request, Basant may disclose Personal Data to competent authorities. Basant will, where legally permitted, notify you of any such disclosure.
• Business transfers: In the event of a merger, acquisition, restructuring or sale of Basant's business or assets, Personal Data may be transferred to the successor entity, subject to equivalent privacy protections.

Basant requires all third parties who receive Personal Data to process it only for specified, agreed purposes and in compliance with applicable data protection standards. We do not permit Data Processors to use your data for their own independent purposes.

Basant uses cookies and similar tracking technologies to operate the Platform, remember your preferences, understand how users interact with our content and improve overall service quality. By continuing to use the Platform, you consent to our use of cookies as described in this section.

We use the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function correctly. These include session authentication cookies, load-balancing cookies and security tokens. They cannot be disabled without materially affecting Platform functionality.
• Functional cookies: Used to remember your preferences, such as language settings, display options and account configuration. These improve your experience but are not essential for the Platform to operate.
• Analytics cookies: Used to collect anonymised data about how users navigate and use the Platform, including page views, session duration and click paths. This data is used to improve Platform performance and content quality.
• Security and fraud-prevention cookies: Used to identify suspicious activity, detect automated bots and protect user accounts from unauthorised access.

You may control cookie settings through your browser's privacy controls. However, disabling strictly necessary cookies may impair your ability to use core Platform features. A cookie consent banner is displayed on your first visit to the Platform, allowing you to accept or decline non-essential cookie categories.

Basant retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. Our retention principles are as follows:

• Active account data: Retained for the duration of your account and for a defined period following account closure, consistent with our legal and regulatory compliance obligations.
• KYC and identity records: Retained for the minimum period required under applicable anti-money-laundering and identity verification regulations, typically five (5) years from the date of account closure or the last regulated transaction.
• Transaction and financial reference records: Retained for the period required by applicable financial record-keeping obligations, which may extend beyond account closure.
• Support and communication records: Retained for a period sufficient to resolve any related dispute, complaint or regulatory enquiry, typically up to three (3) years from the date of the communication.
• Technical and log data: Typically retained for up to twelve (12) months, subject to security and fraud-investigation requirements.

When Personal Data is no longer required, Basant will securely delete or anonymise it. Anonymised data may be retained indefinitely for statistical and analytical purposes, as it can no longer identify individual users.

Basant implements appropriate technical and organisational measures to protect your Personal Data against accidental loss, unauthorised access, disclosure, alteration or destruction. Our security measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your browser and our servers;
• Encrypted storage of sensitive account data, including hashed (not plaintext) passwords;
• Role-based access controls limiting staff access to Personal Data on a need-to-know basis;
• Regular security assessments, penetration testing and vulnerability scanning;
• Multi-factor authentication options for user accounts;
• Monitoring systems designed to detect and respond to unusual account activity or potential breaches.

While Basant takes data security seriously and applies robust controls, no system can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, Basant will notify affected users and, where required, relevant regulatory authorities, in accordance with applicable breach notification obligations.

Subject to applicable data protection law, you may hold the following rights in relation to your Personal Data processed by Basant. To exercise any of these rights, please contact us using the details in Section 14.

Basant will not charge a fee for exercising any of the above rights in normal circumstances. We may, however, charge a reasonable administrative fee or decline a request where it is manifestly unfounded or excessive. We will inform you if either situation applies before taking any action.

The Basant Platform is strictly intended for adults aged 18 years or older — or the higher minimum age required by the applicable operator or license jurisdiction. Basant does not knowingly collect Personal Data from any person under the applicable minimum age.

If Basant becomes aware that it has inadvertently collected Personal Data from a minor, we will take immediate steps to delete that information from our systems and close the associated account. If you are a parent or guardian and have reason to believe that a minor has provided Personal Data to Basant, please contact us immediately using the details in Section 14 so that we can investigate and take appropriate action.

Robust age verification measures, including KYC documentation checks, are in place to minimise the risk of minors accessing the Platform. These controls are applied at account registration and may be triggered at any subsequent point where age eligibility is in question.

Basant reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, Platform features or applicable regulatory requirements. When material changes are made, we will update the "Last updated" date at the top of this Policy and, where appropriate, notify registered users by email or through an in-Platform notice.

Your continued use of the Platform following publication of an updated Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically to stay informed about how Basant protects your Personal Data. If any amendment materially affects your rights or the basis on which we process your data, we will provide you with an opportunity to review the changes before they take effect.

If you have any questions, concerns or requests relating to this Privacy Policy or Basant's processing of your Personal Data, please contact our support team using the details below. We are committed to responding to all privacy-related enquiries promptly and in good faith.

When submitting a data rights request, please include sufficient information to allow us to verify your identity — typically your registered email address and account username. Basant will not process data rights requests from unverified individuals in order to protect account security.