za888 Privacy Policy

1. Overview & Scope

1.1 This Privacy Policy is published by za888 ("we", "us", "our"), the operator of the online gaming and sports betting platform accessible at za888.one. It sets out how za888 collects, uses, discloses, stores, and protects the personal information of all individuals ("you", "the Player", "the User") who register an account, access the platform, or otherwise interact with za888 in any capacity.

1.2 This policy applies to all personal data processed in connection with the za888 platform, regardless of the device or method used to access it — including desktop browsers, mobile browsers, and any za888 mobile application. It covers data collected in Pakistan and internationally where za888 operates.

1.3 za888 is the data controller in respect of all personal data collected through the za888 platform. Where za888 engages third-party data processors (such as KYC verification providers or payment processors), those processors act on za888's instructions and under appropriate contractual data protection obligations.

1.4 This Privacy Policy should be read alongside za888's Terms & Conditions and Responsible Gaming Policy, all of which form part of the overall legal framework governing your relationship with za888. In the event of any conflict between this Privacy Policy and the Terms & Conditions on a privacy matter, this Privacy Policy shall prevail.

2. Personal Data We Collect

za888 collects personal data that is necessary and proportionate to the purposes described in this policy. The categories of personal data we collect are set out in the table below:

2.1 za888 does not collect sensitive personal data beyond what is strictly required for identity verification and regulatory compliance (e.g., CNIC data is collected for KYC age and identity verification purposes only). za888 does not collect biometric data, political opinions, religious beliefs, or health information.

3. How We Collect Your Data

3.1 Data You Provide Directly

The majority of personal data za888 holds about you is information you provide to us directly — at the point of registration, during the KYC verification process, when making deposits or withdrawal requests, or when contacting za888 support. You are not legally obligated to provide this data, but failure to provide mandatory data (such as identity verification documents) will prevent za888 from opening or maintaining your account in compliance with its regulatory obligations.

3.2 Data Collected Automatically

When you access and use the za888 platform, technical and usage data is collected automatically through server logs, session cookies, and analytics systems. This includes your IP address, device identifiers, browser characteristics, and a detailed record of your interactions with the platform (games accessed, bets placed, pages visited). This data is collected regardless of whether you are logged in to a za888 account.

3.3 Data from Third Parties

za888 may receive personal data about you from trusted third-party sources in limited circumstances, including:

• KYC verification providers who perform identity and document checks on za888's behalf;
• Payment processors (JazzCash, EasyPaisa, bank transfer intermediaries) who confirm transaction details;
• Fraud prevention and AML screening databases used to verify that your details do not appear on sanctions lists or politically exposed person (PEP) registers;
• Game providers (such as Evolution Gaming, Pragmatic Play, Spribe) who report game session data for dispute resolution purposes.

4. Purpose of Processing Your Data

za888 processes your personal data only for specific, legitimate, and documented purposes. We do not process personal data in ways that are incompatible with the purpose for which it was originally collected. The primary purposes for which za888 processes personal data are:

• Account Registration and Management: To create, maintain, and administer your za888 account, verify your identity, and ensure the security of your login credentials.
• Age Verification and KYC Compliance: To confirm that you are at least 21 years of age and to fulfil the Know Your Customer obligations required by za888's gaming licence and international AML standards.
• Payment Processing: To process PKR deposits via JazzCash, EasyPaisa, and bank transfers, and to execute withdrawal requests to your registered payment method in a timely and accurate manner.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, bonus abuse, and other prohibited conduct on the platform.
• Customer Support: To respond to your queries, resolve disputes, investigate complaints, and improve our support services using interaction history.
• Responsible Gaming: To monitor gaming behaviour for signs of problem gambling, to apply self-exclusion and deposit limit settings, and to send responsible gaming communications where appropriate.
• Platform Improvement: To analyse usage patterns, identify performance issues, test new features, and improve the overall quality and reliability of the za888 platform for Pakistani users.
• Legal and Regulatory Compliance: To meet za888's obligations under applicable gaming regulations, AML laws, and any lawful request from a competent regulatory authority.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have given your explicit consent to receive such communications. You may withdraw consent at any time via your account settings or by contacting support.

5. Legal Basis for Processing

5.1 Contractual Necessity. The majority of personal data za888 processes is necessary for the performance of your account contract — without this processing, za888 cannot operate your account, accept deposits, pay out winnings, or provide customer support.

5.2 Legal Obligation. Certain processing activities — including KYC identity verification, AML screening, and record-keeping — are required by the gaming regulatory framework under which za888 operates. za888 has no discretion to waive these obligations.

5.3 Legitimate Interests. za888 processes technical and usage data on the basis of its legitimate interests in: maintaining platform security; detecting and preventing fraud; improving platform performance; and conducting internal analytics. These interests have been assessed against player privacy rights and are considered proportionate.

5.4 Consent. Marketing communications and non-essential cookies are processed on the basis of your explicit, freely given consent. Consent can be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. How We Share Your Data

za888 does not sell, rent, or trade your personal data. We share personal data with third parties only to the extent necessary and only in the following circumstances:

6.1 Service Providers and Data Processors

za888 engages carefully selected third-party service providers who process personal data on our behalf and under our documented instructions. These include KYC verification platforms, payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay), cloud hosting providers, fraud detection services, and customer support tooling. All processors are contractually bound to process data only as instructed by za888 and to maintain appropriate security standards.

6.2 Game Providers

To facilitate real-money gaming, limited account data (such as a player identifier and session token) is shared with za888's licensed game providers including Evolution Gaming, Pragmatic Play, Spribe, and similar studios. These providers receive only the minimum data required to initialise and record a game session. They are prohibited from using this data for any purpose outside of game provision.

6.3 Regulatory and Law Enforcement Authorities

za888 may disclose personal data to gaming regulatory authorities, financial intelligence units, law enforcement agencies, or courts where required to do so by law, court order, or regulatory directive. za888 will notify affected players of such disclosures where legally permitted to do so.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of za888's business assets, player personal data may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer and of any material changes to this Privacy Policy that result from it.

7. Data Retention

7.1 za888 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, and to comply with applicable legal and regulatory retention obligations. The general retention periods applicable to each data category are as follows:

7.2 Upon expiry of the applicable retention period, personal data is securely deleted from all za888 systems or, where deletion is technically impractical in the short term, anonymised such that it can no longer be attributed to an identifiable individual.

8. Security Measures

8.1 za888 implements technical and organisational security measures appropriate to the sensitivity of the personal data processed and the risks presented by unauthorised access, loss, or disclosure. These measures include:

• Transport Encryption: All data transmitted between your device and za888 servers is encrypted using TLS 1.3 with 256-bit AES cipher suites. Older, insecure protocols (SSL 3.0, TLS 1.0, TLS 1.1) are disabled.
• Data at Rest: Sensitive personal data stored in za888 databases (including KYC documents, financial data, and password hashes) is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. za888 staff who handle player data are subject to access logging, role-based permissions, and confidentiality obligations.
• Password Security: Player account passwords are stored as salted cryptographic hashes. za888 never stores plaintext passwords and can never retrieve your password — only reset it.
• Two-Factor Authentication: za888 supports and encourages the use of two-factor authentication (2FA) for all player accounts as an additional layer of login security.
• Penetration Testing: The za888 platform undergoes periodic penetration testing and security audits conducted by qualified third-party security specialists.
• Incident Response: za888 maintains a documented data breach response plan. In the event of a data breach affecting player personal data, za888 will notify affected players and relevant regulatory authorities within the timeframes required by applicable law.

8.2 While za888 takes all reasonable steps to protect your personal data, no internet transmission or electronic storage system is 100% secure. Players are responsible for maintaining the security of their own login credentials and for notifying za888 immediately upon suspecting any unauthorised account access.

9. Cookies & Tracking Technologies

9.1 za888 uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your session, and collect analytics data. The categories of cookies used by za888 are as follows:

9.2 You may manage your cookie preferences at any time through your browser settings or via the za888 cookie preference centre accessible from the platform footer. Please note that disabling strictly necessary cookies will impair the functioning of the za888 platform and may prevent you from logging in or completing transactions.

9.3 za888 does not use third-party advertising cookies or cross-site tracking cookies that follow your activity outside of the za888 platform.

10. Your Data Rights

As a za888 player, you hold the following rights in respect of your personal data. To exercise any of these rights, contact za888 support via live chat or by email at [email protected]. za888 will respond to all verified data rights requests within 30 days.

Right of Access

You have the right to request confirmation of whether za888 holds personal data about you, and to receive a copy of that data together with details of how it is being processed.

Right to Rectification

You have the right to request correction of any inaccurate personal data za888 holds about you. For identity data changes, additional verification may be required to maintain account security.

Right to Erasure ("Right to be Forgotten")

You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. This right is subject to za888's legal and regulatory retention obligations — za888 is required by its gaming licence to retain certain records for defined periods even after account closure, and erasure requests cannot override these legal obligations.

Right to Restriction of Processing

You may request that za888 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or while a complaint is under investigation.

Right to Data Portability

You have the right to receive a copy of personal data you have provided to za888 in a structured, commonly used, and machine-readable format, and to request that this data be transferred to another controller where technically feasible.

Right to Object

You have the right to object to za888 processing your personal data on the basis of legitimate interests, and to object to the use of your data for direct marketing at any time.

Right to Withdraw Consent

Where za888's processing is based on your consent (e.g., marketing emails, analytics cookies), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal can be completed via account settings or by contacting support.

11. Minors & 21+ Age Policy

11.1 The za888 platform is strictly intended for individuals aged 21 years and over. za888 does not knowingly collect, process, or retain personal data belonging to individuals under the age of 21.

11.2 Age verification is conducted at the point of registration and may be reinforced through documentary KYC at any stage. Where za888 discovers or has reasonable grounds to believe that a registered account belongs to a person under the age of 21, za888 will immediately:

• Suspend all platform access for the affected account;
• Permanently close the account;
• Return any deposited funds to the original payment method;
• Void all winnings generated during the period of underage use;
• Delete all personal data associated with the underage account beyond what is required for legal reporting purposes.

11.3 If you are a parent or guardian and believe that a minor has created a za888 account without your knowledge or consent, please contact za888 support immediately via live chat. za888 will investigate and take the appropriate actions set out in 11.2 above as a matter of urgency.

12. Third-Party Links & Integrations

12.1 The za888 platform may contain links to the websites or applications of third-party game providers, payment processors, or other service partners. These third-party properties operate under their own privacy policies, which za888 does not control and is not responsible for. za888 strongly recommends that you review the privacy policy of any third-party service before providing them with your personal data.

12.2 The presence of a third-party integration or link on the za888 platform does not constitute an endorsement of that third party's privacy practices by za888.

13. International Data Transfers

13.1 As an internationally licensed gaming platform, za888 may transfer personal data to servers and service providers located outside Pakistan. Where personal data is transferred internationally, za888 ensures that appropriate safeguards are in place to protect the data to a standard equivalent to that required by the data protection provisions of its gaming licence.

13.2 Safeguards used for international data transfers may include: standard contractual clauses incorporated into data processing agreements with third-party processors; transfers to jurisdictions that maintain adequate data protection standards as assessed by relevant authorities; or other lawful transfer mechanisms as applicable.

14. Changes to This Privacy Policy

14.1 za888 reserves the right to update or amend this Privacy Policy at any time. The date of the most recent revision is displayed at the top of this document. Material changes to this Privacy Policy — particularly those affecting how we process your personal data or your data rights — will be communicated to registered players by email and/or by a notice on the za888 platform at least 7 days before the changes take effect.

14.2 Your continued use of the za888 platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the revised policy. If you do not accept the revised Privacy Policy, you must cease using the platform and may request account closure in accordance with the Terms & Conditions.

15. Contact Us

15.1 If you have any questions, concerns, or requests relating to this Privacy Policy or the way za888 processes your personal data, please contact us through any of the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 directly on the za888 platform
• Response Time: za888 aims to respond to all privacy-related enquiries within 5 business days, and to data rights requests within 30 days.

15.2 If you are not satisfied with za888's response to your privacy concern, you have the right to escalate your complaint to the relevant gaming regulatory authority under whose licence za888 operates.