Privacy Policy — zy888 Platform

1. About This Policy

This Privacy Policy ("Policy") describes how zy888 ("we", "us", "our") collects, processes, stores, and shares personal data relating to users ("you", "your") of the zy888 online casino and sports betting platform accessible at zy888.pro and any associated mobile applications or sub-domains (collectively, the "Platform").

This Policy forms part of the zy888 Terms and Conditions and should be read in conjunction with them. By registering an account or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not use the Platform.

2. Data Controller

For the purposes of applicable data protection legislation, the data controller responsible for your personal information is the zy888 operating entity registered under its international gaming licence. All data protection enquiries, subject access requests, and complaints should be addressed to the zy888 Data Protection contact set out in Section 15 of this Policy.

Where zy888 engages third-party service providers who process personal data on its behalf — such as KYC verification providers, payment processors, and fraud detection services — those providers act as data processors under written agreements that impose data protection obligations consistent with this Policy.

3. Data We Collect

zy888 collects the following categories of personal data, depending on how you interact with the Platform:

3.1 Identity & Contact Data

• Full legal name as it appears on your CNIC or passport
• Date of birth
• Residential address (city, province, postal code — for example, Karachi, Lahore, Islamabad, Faisalabad)
• Email address
• Mobile phone number
• Government-issued identification number (CNIC number)

3.2 Financial Data

• JazzCash or EasyPaisa account number linked to your deposits and withdrawals
• Bank account details (HBL, UBL, Meezan Bank, or other Pakistani bank) where bank transfer is the chosen payment method
• Visa or Mastercard partial card number, expiry date, and billing address
• Transaction history including deposit amounts, withdrawal amounts, and PKR balances
• Source of funds documentation where required for KYC compliance

3.3 Technical & Usage Data

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser information
• Session duration and login timestamps
• Pages visited, games played, and betting markets accessed
• Referral source and campaign identifier (if applicable)

3.4 Communications Data

• Content of live chat, email, and support ticket exchanges with the zy888 customer service team
• Responses to promotional communications where you have opted in
• Survey or feedback responses voluntarily submitted

Data Category	Examples	Primary Purpose
Identity & Contact	Name, CNIC, address, email	Account creation, KYC verification
Financial	JazzCash no., bank details, PKR transactions	Payment processing, AML compliance
Technical	IP address, device info, session data	Fraud detection, platform security
Communications	Support chat logs, email history	Customer support, dispute resolution

4. How We Collect Data

zy888 collects personal data through the following channels:

• Direct submission: Data you enter during registration, KYC verification, deposit and withdrawal forms, or when contacting support.
• Automated technical collection: Data collected automatically as you use the Platform, including via cookies, server logs, and analytics tools described in Section 8.
• Third-party verification providers: Identity and address verification data returned by our licensed KYC partners following document checks.
• Payment processors: Transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, and Mastercard processing networks.
• Fraud and risk screening services: Risk scores and flagged patterns shared by fraud detection services with whom zy888 has data sharing agreements in place.

5. Legal Basis for Processing

zy888 processes your personal data on one or more of the following legal bases, depending on the processing activity in question:

• Contract performance: Processing is necessary to create and manage your zy888 account, execute deposits and withdrawals in PKR, and deliver the betting and gaming services you have requested.
• Legal obligation: Processing is necessary to comply with anti-money laundering (AML) regulations, Know Your Customer (KYC) requirements imposed by our licensing authority, and applicable financial crime prevention obligations.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and internal analytics, where our interests do not override your fundamental rights.
• Consent: Processing for optional marketing communications, where you have explicitly opted in. You may withdraw this consent at any time without affecting any other processing.

6. How We Use Your Data

zy888 uses collected personal data for the following purposes:

• Creating, verifying, and maintaining your zy888 player account
• Processing PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, and Mastercard
• Conducting KYC and age verification to ensure compliance with the 21+ age restriction and licensing requirements
• Detecting and preventing fraud, collusion, money laundering, and other prohibited activities
• Monitoring responsible gaming indicators and applying player protection tools where appropriate
• Responding to customer support queries, complaints, and dispute submissions
• Sending transactional communications such as deposit confirmations, withdrawal notifications, and account security alerts
• Sending promotional communications — only where you have opted in — regarding zy888 bonuses, cricket betting markets, and new slot releases
• Fulfilling legal and regulatory reporting obligations to our licensing authority
• Improving the zy888 platform through aggregated, anonymised analytics

7. Data Sharing & Disclosure

zy888 does not sell, rent, or trade your personal data. We may share your data with the following categories of third parties, strictly for the operational and compliance purposes described in this Policy:

• KYC and identity verification providers: Licensed third-party services that verify your CNIC, passport, and address documents as part of mandatory onboarding compliance.
• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and card network processors (Visa/Mastercard) require transaction data to execute payments. These providers are bound by their own data protection and financial regulatory obligations.
• Fraud detection and risk management services: Specialist providers who analyse transaction patterns and device data to identify and prevent fraudulent activity on the Platform.
• Regulatory and licensing authorities: Our licensing authority may require us to submit player data, transaction records, or audit information as part of ongoing regulatory oversight. Disclosure in this context is mandatory and legally compelled.
• Law enforcement agencies: Where required by a valid legal order, court order, or regulatory demand, zy888 may disclose personal data to relevant law enforcement or government bodies.
• Platform infrastructure providers: Cloud hosting, database management, and cybersecurity service providers who process data solely on zy888's instructions under binding data processing agreements.

8. Cookies & Tracking

The zy888 platform uses cookies and similar tracking technologies to deliver a functional, secure, and personalised gaming experience. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function. These include session cookies that keep you logged in during an active gaming session and security cookies that protect your account from cross-site request forgery attacks. These cookies cannot be disabled.
• Performance and analytics cookies: Used to collect aggregated, anonymised data about how players navigate and interact with the Platform. This data helps zy888 improve page load times, identify navigation issues, and optimise the user experience. No personally identifiable information is included in these analytics reports.
• Fraud detection cookies: Used to fingerprint device characteristics and detect suspicious login patterns, multiple account creation attempts, and automated bot activity. These cookies are a mandatory component of zy888's security infrastructure.

zy888 does not use third-party advertising cookies, social media tracking pixels, or any cross-site behavioural profiling technologies. You can manage or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair your ability to use the Platform.

9. Data Retention

zy888 retains personal data for the following periods:

• Active account data: Retained for the full duration of your account's active status.
• Post-closure retention: Following account closure, identity, financial, and transaction data is retained for a minimum of five years to satisfy AML record-keeping obligations imposed by our licensing authority. This period may be extended where an account is subject to an ongoing investigation or legal proceeding.
• Communications data: Support chat logs and email correspondence are retained for three years from the date of the communication, or for the duration of any related dispute, whichever is longer.
• Marketing consent records: Records of your marketing opt-in or opt-out are retained for the lifetime of your account plus three years, to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, personal data is either securely and permanently deleted from all zy888 systems, or irreversibly anonymised such that it can no longer be attributed to any identifiable individual.

10. Data Security

zy888 implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Key security measures in place include:

• TLS 1.3 encryption for all data in transit between your device and zy888 servers
• AES-256 encryption for all sensitive data stored at rest, including identity documents and payment details
• Role-based access controls ensuring that zy888 staff can only access personal data strictly necessary for their role
• Multi-factor authentication required for all zy888 internal systems containing personal data
• Regular third-party penetration testing and vulnerability assessments of the Platform infrastructure
• Automated monitoring systems that detect and alert on suspicious access patterns in real time

In the event of a personal data breach that poses a risk to your rights, zy888 will notify you and the relevant regulatory authority within 72 hours of becoming aware of the breach, in accordance with applicable data protection obligations.

11. Your Rights

Subject to applicable data protection law, you hold the following rights with respect to your personal data held by zy888:

• Right of access: You may request a copy of all personal data zy888 holds about you, along with information about how it is being processed.
• Right to rectification: If any of your personal data is inaccurate or incomplete, you have the right to request that it be corrected or updated.
• Right to erasure: You may request deletion of your personal data where there is no longer a legitimate legal or contractual basis for zy888 to retain it. Note that mandatory AML retention obligations may prevent immediate deletion of certain records.
• Right to restrict processing: You may request that zy888 limit the processing of your data in certain circumstances, for example while a rectification request is under review.
• Right to data portability: Where processing is based on your consent or the performance of a contract, you may request that zy888 provide your personal data in a commonly used, machine-readable format.
• Right to object: You may object to processing of your personal data where it is based on zy888's legitimate interests. zy888 will cease such processing unless compelling legitimate grounds can be demonstrated that override your interests.
• Right to withdraw consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact the zy888 Data Protection team using the details in Section 15. zy888 will respond to all verified requests within 30 calendar days. In cases of complexity or volume, this period may be extended by a further 60 days, with notification provided within the initial 30-day window.

12. Children's Privacy

The zy888 platform is strictly intended for individuals aged 21 and above. zy888 does not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory component of the zy888 registration process, and accounts found to belong to underage individuals will be immediately closed and all associated data deleted in accordance with applicable regulations.

If you believe that a person under the age of 21 has provided personal data to zy888 or has gained access to a zy888 account, please contact support immediately at the email address set out in Section 15 so that the matter can be investigated and resolved promptly.

13. International Transfers

zy888 operates under an international gaming licence and some of its service providers — including cloud infrastructure, fraud detection, and KYC verification partners — may process personal data in jurisdictions outside Pakistan. Where such international transfers occur, zy888 ensures that appropriate safeguards are in place, which may include:

• Contractual clauses that impose data protection obligations on the receiving party equivalent to those described in this Policy
• Processing only with service providers who are themselves certified under recognised international data security frameworks
• Transferring only the minimum data necessary for the specific service being provided

By using the zy888 platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Pakistan where data protection laws may differ from those in your country of residence.

14. Changes to This Policy

zy888 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services offered on the Platform. Where changes are material — affecting the types of data collected, the purposes of processing, or your rights — zy888 will notify you via email to your registered address and/or via a prominent notice on the Platform at least 14 days before the changes take effect. Non-material clarifications may be made without prior notice. The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision. Continued use of the Platform following the effective date of an updated Policy constitutes acceptance of the revised terms.

15. Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data rights, or would like to raise a privacy-related complaint, please contact the zy888 Data Protection team through the following channels:

• Email: [email protected] — please use the subject line "Privacy Request" or "Data Complaint" so your message is routed correctly. Responses are typically provided within 2–4 business hours during Pakistan Standard Time.
• Live Chat: Available 24/7 via the Platform. For formal data requests, we recommend following up in writing via email to create a verifiable record.

zy888 will acknowledge all formal privacy complaints within 5 business days and aims to resolve them within 30 calendar days. If you are not satisfied with the outcome of a complaint, you may escalate the matter to the relevant supervisory authority under our licensing jurisdiction.