zk999 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

This Privacy Policy ("Policy") is issued by zk999 ("we", "us", "our") and applies to all personal data processed in connection with your use of the zk999 online casino and sports betting platform, accessible at zk999.vu and all associated subdomains and mobile interfaces (collectively, the "Platform").

This Policy is intended to inform you — as a current player, prospective registrant, or visitor to the Platform — about the nature of the personal data we collect, the purposes for which it is processed, the legal grounds on which that processing is based, and the rights available to you in connection with your personal data.

This Policy should be read in conjunction with the zk999 Terms and Conditions. Capitalised terms used but not defined in this Policy carry the meanings given to them in the Terms and Conditions.

By registering for an account on zk999, completing any part of the onboarding or KYC process, or continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood this Policy in its entirety.

For the purposes of applicable data protection law, the data controller in respect of the personal data processed under this Policy is zk999, the operator of the Platform at zk999.vu.

As data controller, zk999 determines the purposes and means by which your personal data is processed. Where zk999 engages third-party service providers to process personal data on its behalf, those providers act as data processors and are contractually bound to process data only on zk999's documented instructions, in accordance with applicable data protection obligations.

All data protection enquiries, subject access requests, and complaints in connection with this Policy should be directed to the zk999 data protection contact detailed in Section 15 of this Policy.

zk999 collects the following categories of personal data from players and platform visitors:

3.1 Identity Data

• Full legal name as it appears on your CNIC or other government-issued identity document;
• Date of birth (used for 21+ age verification);
• CNIC number or passport number;
• Photographs or scanned images of identity documents submitted for KYC.

3.2 Contact Data

• Pakistani mobile number (used as your primary account identifier);
• Email address, where provided;
• City and province of residence (e.g., Karachi, Lahore, Islamabad, Faisalabad), where provided during registration or KYC.

3.3 Financial Data

• JazzCash account reference number associated with your deposits and withdrawals;
• EasyPaisa mobile wallet number used for transactions;
• Bank account name, account number, and bank name (HBL, UBL, Meezan Bank, or other) where bank transfer is used;
• Transaction history including deposit amounts, withdrawal amounts, timestamps, and payment method references;
• Account balance at any given point in time.

3.4 Gameplay Data

• Game session logs including game title, bet amounts, game outcomes, and timestamps;
• Sports betting history including markets wagered, stake amounts, and settlement outcomes;
• Bonus usage history including bonuses claimed, wagering progress, and forfeiture events.

3.5 Technical Data

• IP address at the time of login and gameplay;
• Device type, operating system version, and browser type;
• Session duration and page interaction data collected through cookies and similar technologies (see Section 8).

3.6 Communications Data

• Records of live chat conversations with zk999 support agents;
• Email correspondence sent to or received from zk999;
• Records of formal complaints or disputes submitted through any channel.

zk999 collects personal data through the following channels:

• Directly from you — when you complete the account registration form, submit KYC documents, use the Cashier for deposits or withdrawals, contact our support team, or update your account profile;
• Automatically through your use of the Platform — including IP address logging, device fingerprinting for fraud prevention, cookies, session tracking, and game engine logs;
• From third-party KYC and identity verification providers — to whom your CNIC details are transmitted for cross-referencing against official identity databases where required;
• From payment processors — including JazzCash, EasyPaisa, and banking partners, who confirm transaction status and payment reference numbers;
• From fraud prevention and AML screening services — which may provide risk scores or flagging information associated with submitted identity or payment data.

zk999 processes your personal data on one or more of the following legal bases, as applicable to the specific processing activity:

• Performance of a contract — processing that is necessary to create and maintain your zk999 account, process your deposits and withdrawals, and deliver the gaming and betting services you have registered to use;
• Compliance with a legal obligation — processing required by applicable anti-money laundering regulations, age verification requirements, and regulatory reporting obligations to which zk999 is subject as a licensed gaming operator;
• Legitimate interests — processing necessary for the prevention of fraud, abuse, and money laundering; for platform security monitoring; for responsible gaming enforcement; and for improving the quality and functionality of the Platform, where these interests are not overridden by your data protection rights;
• Consent — where we ask for your explicit consent for a specific processing activity, such as sending you promotional communications, and you have provided that consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

zk999 uses the personal data collected from players for the following specific purposes:

• To register and maintain your zk999 player account, including linking your account to your registered Pakistani mobile number;
• To conduct identity verification (KYC) and confirm that you satisfy the 21+ age eligibility requirement before granting real-money access;
• To process your JazzCash, EasyPaisa, and bank transfer deposits and withdrawals securely and in the correct PKR amounts;
• To detect, prevent, and investigate fraudulent activity, bonus abuse, collusion, money laundering, and other prohibited conduct on the Platform;
• To deliver customer support through our 24/7 Urdu and English live chat and email channels;
• To enforce the zk999 Terms and Conditions, including taking action in respect of account breaches;
• To apply and administer responsible gaming tools including deposit limits, cooling-off periods, and self-exclusion at your request;
• To send you transactional notifications via SMS, such as deposit confirmations, withdrawal approvals, and OTP codes for account security;
• To send promotional communications where you have provided consent, which you may withdraw at any time;
• To generate anonymised and aggregated analytics that inform platform development and game curation decisions, where this data cannot identify you individually.

zk999 does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. Personal data may be shared in the following limited and controlled circumstances:

• Payment processors — JazzCash, EasyPaisa, Raast, and banking partners receive transaction-specific data necessary to process your deposits and withdrawals. These providers are contractually bound by their own privacy and security obligations;
• KYC and identity verification providers — third-party providers engaged to cross-reference CNIC details and confirm identity and age for purposes of regulatory compliance;
• Fraud prevention and AML services — specialist providers that assess transaction risk and screen for financial crime indicators;
• Game software providers — where a game provider's platform processes bet and outcome data directly, only the minimum data necessary for game session management is transmitted;
• Regulatory authorities — where required by the zk999 operating licence or by applicable law, data may be disclosed to gaming regulators, financial intelligence units, or law enforcement agencies upon valid legal request;
• Professional advisors — including legal counsel, auditors, and insurers, where access is necessary and subject to professional confidentiality obligations;
• Business transfers — in the event of a merger, acquisition, or sale of the zk999 business, player data may be transferred to the acquiring entity, subject to equivalent privacy protections.

In all cases where data is shared with third-party processors, zk999 maintains contractual data processing agreements that require those processors to handle data in accordance with applicable data protection standards and zk999's documented instructions.

zk999 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies — essential for the Platform to function, including session management, login state maintenance, and security token validation. These cannot be disabled without impairing your ability to use the Platform;
• Functional cookies — remember your preferences such as language settings and lobby view preferences to provide a personalised experience;
• Analytical cookies — collect aggregated, anonymised data about how players navigate and use the Platform, used to improve performance and identify technical issues;
• Security and fraud prevention technologies — device fingerprinting and behavioural analytics tools used to detect and prevent fraudulent access attempts and account takeover.

You may manage cookie preferences through your browser settings. Blocking strictly necessary cookies will affect your ability to log in to and use the zk999 Platform. Blocking functional or analytical cookies will not prevent you from accessing or playing on the Platform.

zk999 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, taking into account applicable regulatory retention requirements.

The following general retention periods apply:

• Account and identity data — retained for the duration of the active account relationship and for a minimum period of five (5) years following account closure, as required for AML compliance and regulatory inspection purposes;
• Financial transaction records — retained for a minimum of five (5) years from the date of the transaction, consistent with applicable financial record-keeping requirements;
• KYC documents — retained for a minimum of five (5) years from the date of the most recent account closure or transaction, whichever is later;
• Support communications — retained for a period of three (3) years from the date of the interaction;
• Gameplay logs — retained for a minimum of three (3) years from the date of the session, for dispute resolution and regulatory audit purposes;
• Technical logs — IP address and session logs are retained for twelve (12) months from collection.

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised such that it can no longer be attributed to any individual player.

zk999 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and zk999 servers;
• Encryption at rest for sensitive stored data including CNIC details, payment references, and authentication credentials;
• Two-factor authentication (SMS OTP) available to all players as an optional additional login security layer;
• Role-based access controls ensuring that only authorised personnel with a documented need can access player data;
• Regular security audits and penetration testing of the Platform infrastructure;
• Automated intrusion detection and anomalous activity monitoring systems;
• Staff confidentiality obligations and periodic data protection training.

Notwithstanding the above, no internet-based transmission or electronic storage system can be guaranteed to be completely secure. zk999 will notify affected players and, where required, applicable regulatory authorities in the event of a personal data breach that poses a risk to player rights and interests, in accordance with applicable notification obligations.

Subject to applicable data protection law and any overriding regulatory obligations (such as mandatory AML data retention), you hold the following rights in respect of your personal data held by zk999:

To exercise any of the above rights, please contact zk999 using the details in Section 15. We will respond to all verified data subject requests within thirty (30) calendar days. In complex cases, this period may be extended by a further two months, of which you will be informed promptly.

Where we are unable to fulfil a data erasure request due to a mandatory legal retention obligation (such as AML record-keeping), we will inform you of the specific retention basis and the earliest date at which deletion can be completed.

The zk999 Platform is strictly for individuals aged 21 years and above. zk999 does not knowingly collect personal data from any individual under the age of 21.

All registrations are subject to mandatory CNIC-based age verification as part of the KYC process. Any account found to have been opened by or on behalf of an individual under 21 years of age will be immediately closed, all funds will be frozen pending investigation, and the matter may be reported to relevant authorities.

If you are aware of or suspect that an individual under the age of 21 has created or is using a zk999 account, please contact our support team immediately at the contact details set out in Section 15.

As an internationally operating platform, zk999 may transfer your personal data to service providers and infrastructure partners located outside Pakistan. Such transfers may include KYC verification services, fraud prevention tools, game engine providers, and cloud hosting infrastructure.

Where personal data is transferred internationally, zk999 ensures that appropriate safeguards are in place to protect that data, including contractual data processing agreements incorporating standard data protection clauses equivalent to internationally recognised data transfer adequacy standards.

zk999 does not transfer personal data to jurisdictions that do not offer an adequate level of data protection without first implementing supplementary safeguards sufficient to compensate for any identified deficiencies in that jurisdiction's data protection framework.

zk999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable data protection law, our processing activities, or our operational practices. The effective date of the most recent version is always displayed at the top of this Policy.

Where changes to this Policy are material — meaning they affect how your data is used in a way that is less favourable to you, or introduce new categories of data collection — zk999 will provide advance notice through your account dashboard notification, SMS to your registered mobile number, or a notice displayed prominently on the Platform.

Your continued use of the zk999 Platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of and agreement to the revised Policy. If you do not accept the revised Policy, you must cease using the Platform and submit any pending withdrawal request before the effective date.

The current version of this Privacy Policy is always accessible via the footer on every page of the zk999 Platform.

For all data protection enquiries, subject access requests, consent withdrawal requests, or privacy-related complaints, please contact zk999 through the following channels:

zk999 will acknowledge all privacy-related correspondence within two (2) business days and will aim to substantively respond within thirty (30) calendar days. For complex subject access requests involving large volumes of data, an extension of up to two further months may apply, and you will be informed of any extension promptly.

If you are dissatisfied with zk999's response to a privacy complaint, you may have the right to escalate the matter to the relevant data protection supervisory authority under applicable law.