ze99 Privacy Policy

1 Data Controller

ze99 is the data controller responsible for the personal information collected through the ze99 platform at ze99.bio. ze99 is operated under an international gaming licence, and all data processing activities are conducted in accordance with the data protection obligations imposed by that licence and applicable international standards.

As data controller, ze99 determines the purposes and means of processing your personal data. Where ze99 engages third-party service providers to process data on its behalf, those providers act as data processors and are contractually bound to handle your data only in accordance with ze99's documented instructions and this Privacy Policy.

2 Information We Collect

ze99 collects personal data from you at various points during your use of the platform. The categories of personal data we collect are described in the table below.

ze99 collects only the minimum personal data necessary for the purposes described in this Policy. We do not collect sensitive categories of personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is required for CNIC-based identity verification.

3 How We Use Your Data

ze99 uses the personal data we collect for the following specific purposes:

• Account Management: To create, maintain, and administer your ze99 account, including processing your registration, verifying your identity via KYC, and managing your login credentials.
• Service Delivery: To provide access to casino games, sports betting markets including cricket, PSL, and snooker, virtual games, live dealer tables, and all other ze99 platform features.
• Payment Processing: To process deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, and Mastercard, and to maintain accurate financial records in PKR.
• Regulatory Compliance: To fulfil our obligations under our international gaming licence, including AML (Anti-Money Laundering) checks, Know Your Customer (KYC) verification, and responsible gaming monitoring.
• Responsible Gaming: To monitor betting patterns and identify players who may be showing signs of problem gambling, and to enforce deposit limits, cooling-off periods, and self-exclusion requests.
• Customer Support: To respond to your enquiries, process complaints, and provide assistance via email and live chat in English.
• Security & Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, duplicate accounts, money laundering, and other prohibited conduct listed in our Terms & Conditions.
• Platform Improvement: To analyse aggregated usage data to improve platform performance, game selection, and user experience for Pakistani players.
• Marketing Communications: To send you promotional offers and bonus notifications where you have given your explicit consent. You may withdraw this consent at any time through your account settings or by contacting support.

ze99 does not use automated decision-making or profiling in any manner that produces legal or similarly significant effects on individual players, beyond the responsible gaming monitoring described above, which operates in the player's direct interest.

4 Legal Basis for Processing

ze99 processes your personal data on the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to enter into and perform our contract with you — including account registration, service delivery, and payment processing — is conducted on the basis that such processing is necessary to fulfil the ze99 Terms & Conditions you have accepted.
• Legal Obligation: Processing required to comply with our regulatory obligations under our international gaming licence — including KYC verification, AML monitoring, and responsible gaming requirements — is conducted on the basis of legal obligation.
• Legitimate Interests: Processing for fraud prevention, security monitoring, platform improvement, and internal analytics is conducted on the basis of ze99's legitimate interests, provided those interests are not overridden by your rights and freedoms.
• Consent: Processing for direct marketing communications, non-essential cookies, and optional preference analytics is conducted on the basis of your freely given, specific, and informed consent, which you may withdraw at any time.

5 Data Sharing & Third Parties

ze99 does not sell, rent, or trade your personal data to any third party. We share your data only in the limited circumstances described below, and only to the extent strictly necessary for the relevant purpose:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, and Mastercard receive transaction data necessary to process your deposits and withdrawals. Each processor operates under its own privacy policy and applicable financial regulations.
• KYC & AML Verification Partners: Regulated identity verification and AML screening services may receive your identity data solely for the purpose of completing mandatory compliance checks required under our gaming licence.
• Game Software Providers: Third-party game developers and live casino providers may receive technical session data to deliver their games on the ze99 platform. No financial or identity data is shared with game providers beyond what is technically necessary.
• Regulatory Authorities: ze99 may disclose personal data to its licensing authority, law enforcement agencies, or financial intelligence units where required by law, court order, or regulatory directive.
• IT Infrastructure Providers: Hosting, cloud storage, and cybersecurity partners may process data on ze99's behalf under strict data processing agreements. These providers act as data processors and are not permitted to use your data for any purpose other than providing services to ze99.

6 Cookies & Tracking Technologies

ze99 uses cookies and similar tracking technologies on the ze99.bio platform to provide essential functionality, improve performance, and personalise your experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session cookies that maintain your logged-in state, security tokens, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• Performance Cookies: Collect anonymised data about how players use the ze99 platform — such as which pages are visited most frequently and where error messages occur — to help ze99 improve platform performance. No personally identifiable information is collected through performance cookies.
• Functionality Cookies: Remember your preferences such as language settings, display options, and responsible gaming configuration so that your experience is consistent across sessions.
• Analytics Cookies: Used by ze99's internal analytics tools to understand aggregate player behaviour patterns. These are activated only where you have provided consent.

You may control non-essential cookie preferences through the cookie settings panel available within your ze99 account. You may also manage cookies through your browser settings at any time. Note that disabling strictly necessary cookies will impair your ability to use the ze99 platform.

7 Data Retention

ze99 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by our legal and regulatory obligations. The following retention periods apply as a general guide:

• Account & Identity Data: Retained for the lifetime of your active ze99 account, plus a minimum of five (5) years following account closure, as required by our licensing and AML obligations.
• Financial & Transaction Records: Retained for a minimum of seven (7) years following each transaction, in line with standard financial regulatory requirements applicable under our gaming licence.
• Gaming Activity Logs: Retained for five (5) years from the date of each recorded session, for regulatory audit and dispute resolution purposes.
• Communications Data: Support correspondence and complaint records are retained for three (3) years from the date of the most recent interaction.
• Marketing Consent Records: Retained for the duration of your account plus two (2) years following account closure, to evidence compliance with consent obligations.

Upon expiry of the applicable retention period, ze99 will securely delete or anonymise your personal data so that it can no longer be attributed to you as an individual. Anonymised data may be retained indefinitely for statistical and analytical purposes.

8 Security Measures

ze99 implements a layered approach to data security to protect your personal information against unauthorised access, alteration, disclosure, or destruction. Our security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and ze99 servers is encrypted using industry-standard SSL/TLS protocols.
• Encrypted Data Storage: Sensitive data fields — including CNIC numbers, payment identifiers, and passwords — are stored in encrypted form using strong cryptographic algorithms. Passwords are never stored in plain text.
• Access Controls: Access to personal data is restricted on a strictly need-to-know basis. ze99 staff are granted the minimum level of access necessary to perform their role, and all access is logged and audited.
• Two-Factor Authentication: ze99 supports two-factor authentication (2FA) for player accounts and enforces 2FA for all internal administrative access to systems holding personal data.
• Penetration Testing & Security Audits: ze99's platform undergoes regular independent security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: ze99 maintains a documented data breach response procedure. In the event of a security incident affecting your personal data, ze99 will notify the relevant regulatory authorities and affected players within the timeframes required by our licensing obligations.

While ze99 takes all reasonable technical and organisational measures to protect your data, no internet transmission is entirely risk-free. You are responsible for keeping your ze99 account credentials secure. See Section 4 of the Terms & Conditions for your obligations regarding account security.

9 Your Rights Over Your Data

As a ze99 player, you have the following rights with respect to your personal data. To exercise any of these rights, contact ze99 support at the email address provided in Section 13. ze99 will respond to all valid requests within 30 days of receipt, or within any shorter period required by applicable regulations.

• Right of Access: You may request a copy of all personal data ze99 holds about you, including your account information, transaction records, and gaming history.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held on your ze99 account. Some corrections may require re-submission of KYC documentation.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the original purpose, where you have withdrawn consent, or where processing is unlawful. Note that ze99 may be required to retain certain data for regulatory compliance, as described in Section 7.
• Right to Restrict Processing: You may request that ze99 restricts the processing of your data in certain circumstances, such as while a complaint is under investigation.
• Right to Data Portability: You may request that ze99 provides your personal data in a structured, commonly used, machine-readable format, where technically feasible.
• Right to Object: You may object at any time to processing of your personal data for direct marketing purposes. Upon receipt of such an objection, ze99 will cease all marketing communications to you immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

10 Children & Minors

ze99 enforces a strict 21-years-minimum age policy through mandatory CNIC verification during account registration and prior to processing any withdrawal. If ze99 discovers or has reasonable cause to believe that personal data has been collected from a person under the age of 21, ze99 will:

• Immediately suspend the relevant account pending investigation.
• Void all wagering activity and bonus credits associated with the account.
• Delete all personal data collected from the underage individual as soon as is practicable, subject to any mandatory regulatory retention obligations.
• Report the matter to the relevant regulatory authority where required under ze99's licensing obligations.

If you believe a minor has registered on the ze99 platform, please contact support immediately so that the account can be investigated and appropriate action taken.

11 International Data Transfers

ze99 operates under an international gaming licence and may use service providers located in jurisdictions outside Pakistan. As a result, your personal data may be transferred to and processed in countries other than Pakistan.

Where such transfers occur, ze99 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that required under our licensing jurisdiction. These safeguards may include:

• Contractual data protection clauses binding the recipient to process data only in accordance with ze99's instructions and this Privacy Policy.
• Transfers to jurisdictions recognised as providing an adequate level of data protection.
• Binding corporate rules or equivalent mechanisms where applicable.

By using the ze99 platform, you acknowledge and consent to the transfer of your personal data to ze99's international service providers as described in this Policy. You retain all rights described in Section 9 regardless of where your data is processed.

12 Amendments to This Policy

ze99 reserves the right to update or amend this Privacy Policy at any time. The updated Policy will be published on this page with a revised effective date. Where changes are material — such as changes to the categories of data collected, the purposes for which it is used, or your rights — ze99 will notify registered players by email or via an in-platform notification at least seven (7) days before the revised Policy takes effect.

Your continued use of the ze99 platform following the effective date of any amended Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with the revised Policy, you must cease using the platform and may request account closure in accordance with Section 12 of the ze99 Terms & Conditions.

13 Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a formal data protection complaint, please contact the ze99 data protection team using the details below. All privacy enquiries are handled in English and responded to within the timelines described in Section 9.

When submitting a privacy request or complaint, please include your registered ze99 account email address, a clear description of your request or complaint, and any relevant reference numbers (e.g., transaction IDs or support ticket numbers). Marking your email subject line as "Privacy Request" or "Data Protection Complaint" will ensure it is routed directly to the relevant team.

If you are not satisfied with ze99's response to a privacy complaint, you may refer the matter to the dispute resolution mechanism available under ze99's international gaming licence. ze99 will cooperate fully with any such process and provide all relevant documentation within the required timeframes.