zf999 Privacy Policy – How We Collect, Use, and Protect Your Personal Data

This Privacy Policy ("Policy") describes how zf999 ("we", "us", "our") collects, processes, stores, shares, and protects personal data in connection with the operation of the zf999 platform at zf999.biz (the "Platform"), including the online casino, sportsbook, live dealer section, and all account management services offered therein.

This Policy applies to all individuals who access or use the zf999 Platform, including registered Account holders and visitors who browse the site without registering. It should be read in conjunction with the zf999 Terms & Conditions, which form the primary contractual agreement governing your use of the Platform.

By accessing the zf999 Platform, registering an Account, or otherwise engaging with any of our services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should discontinue use of the Platform immediately.

For the purposes of applicable data protection law, zf999 — the operator of zf999.biz, holding an international gaming licence — is the data controller in respect of the personal data it processes in connection with the Platform. zf999 determines the purposes and means of processing your personal data and bears primary responsibility for ensuring that processing activities comply with applicable data protection obligations.

If you have any questions, concerns, or requests relating to how zf999 handles your personal data, you may contact our data protection point of contact at: [email protected]

zf999 collects personal data through several channels in the ordinary course of operating the Platform. The categories of personal data we collect, and the typical circumstances in which each category arises, are set out below.

3.1 — Information You Provide Directly

• Registration data: Full legal name, date of birth, Pakistani mobile number (in +92 format), email address, and account username provided at the time of registration.
• KYC documentation: National Identity Card (CNIC) number and image, photograph, and any supplementary identity or address documentation requested during the Know Your Customer verification process.
• Payment method data: JazzCash and EasyPaisa account identifiers, HBL / UBL / Meezan Bank account details, and any other payment information provided when making deposits or requesting withdrawals. Note: zf999 does not store full card numbers or banking credentials — payment processing is handled by certified payment processors.
• Communications data: The content of messages, queries, complaints, and feedback you send to zf999 through live chat, email, or any other support channel.
• Responsible gaming inputs: Deposit limits, loss limits, session time settings, cooling-off requests, and self-exclusion requests you submit through the Platform.

3.2 — Information Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device model, screen resolution, and language settings.
• Usage and behavioural data: Pages visited, games played, betting patterns, session duration, navigation paths through the Platform, and clickstream data.
• Transaction data: A complete record of all deposits, withdrawals, bets, wagers, game results, bonus activations, and associated timestamps.
• Geolocation data: Approximate geographic location derived from IP address, used to enforce geographic access controls and detect VPN usage.
• Cookie and tracking data: Information collected via cookies, pixels, and similar technologies as described in Section 6 of this Policy.

3.3 — Information from Third Parties

• KYC verification partners: Identity verification status, fraud risk scores, and document authenticity assessments from third-party identity verification services.
• Payment processors: Transaction status, confirmation references, and fraud flags from JazzCash, EasyPaisa, and other payment gateway providers.
• Fraud prevention services: Risk assessments, blacklist status, and suspicious activity flags from industry fraud prevention databases.

zf999 uses the personal data it collects for the following purposes:

zf999 processes personal data in accordance with the legal bases recognised under applicable data protection law. The primary legal bases on which zf999 relies are as follows:

• Contractual necessity: Processing that is necessary to perform the contract between you and zf999 — including operating your Account, processing deposits and withdrawals, and delivering gaming services — is carried out on the basis of contractual necessity.
• Legal obligation: Processing required for compliance with our gaming licence obligations, anti-money laundering regulations, age verification requirements, and responses to lawful regulatory or law enforcement requests is carried out on the basis of legal obligation.
• Legitimate interests: Processing for the purposes of fraud detection, platform security, internal analytics, and responsible gaming monitoring is carried out on the basis of the legitimate interests of zf999 and its players, where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where zf999 sends you optional marketing communications by electronic means, it relies on your prior consent. You may withdraw consent at any time (see Section 13).

The zf999 Platform uses cookies and similar tracking technologies to provide core functionality, improve the user experience, and support security and analytics activities. Cookies are small text files stored on your device by your browser when you visit the Platform.

Categories of cookies used on zf999.biz:

• Strictly necessary cookies: Required for the Platform to function. These include session management cookies that keep you logged in to your zf999 Account during a play session, CSRF protection tokens, and cookies that remember your responsible gaming settings. These cookies cannot be disabled without impairing Platform functionality.
• Functional cookies: Used to remember your preferences, such as language settings, game lobby filters, and notification preferences. These enhance your experience but are not strictly required for the Platform to operate.
• Analytics cookies: Used to collect aggregated information about how users navigate the Platform — which games are most played, which pages generate the most time-on-site, and where users encounter friction in the deposit or withdrawal flow. This data is used internally to improve the Platform.
• Security cookies: Used to detect and prevent fraudulent login attempts, bot traffic, and other malicious activity. These cookies are part of zf999's fraud detection infrastructure and cannot be disabled.

zf999 does not sell, rent, or trade your personal data to third parties for their own commercial marketing purposes. We share personal data with third parties only to the extent necessary for the following legitimate operational and legal purposes:

• Identity verification providers: We share identification documentation with certified KYC service providers for the purpose of verifying your identity and age in compliance with our licensing obligations.
• Payment processors: We share payment-related data with JazzCash, EasyPaisa, bank payment gateways, and USDT processing services to facilitate deposit and withdrawal transactions on your Account.
• Game content providers: Game studios (including but not limited to Evolution Gaming for live dealer products, and slot providers in the zf999 casino lobby) may receive session identifiers and anonymised game data necessary to deliver certified game content and verify RNG outcomes.
• Fraud prevention and AML services: We share data with industry fraud prevention databases and anti-money laundering screening services to detect, prevent, and report suspicious financial activity.
• Regulatory and law enforcement authorities: We disclose personal data to gaming regulators, financial intelligence units, law enforcement agencies, and courts where we are legally required to do so by applicable law, court order, or regulatory directive.
• Technology infrastructure providers: We utilise third-party hosting, cloud storage, and cybersecurity services whose personnel may have incidental access to personal data in the course of providing those services. All such providers are bound by data processing agreements that restrict use of data to the purposes for which it was shared.

In all cases where personal data is shared with third parties, zf999 applies appropriate contractual safeguards — including data processing agreements — to ensure that shared data is processed only for the specified purpose and with adequate security protections in place.

zf999 operates as an internationally licensed gaming platform, and some of the third-party service providers with whom we work — including KYC providers, game studios, and cloud infrastructure partners — may be located in countries outside Pakistan. Where personal data is transferred outside Pakistan, zf999 implements appropriate safeguards to ensure that your data continues to receive a level of protection that is consistent with the standards applied within Pakistan and under our international gaming licence framework.

Such safeguards may include contractual clauses binding recipient entities to data protection obligations equivalent to those applicable to zf999, or reliance on the recipient jurisdiction's adequacy as a destination for international data transfers under applicable regulatory frameworks.

zf999 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. The following general retention periods apply:

• Active Account data: Retained for the full duration of your Account's active status on the zf999 Platform.
• Closed Account data: Following voluntary or involuntary Account closure, we retain Account registration data, transaction records, and KYC documentation for a minimum period of five (5) years from the date of closure, in compliance with anti-money laundering and gaming licence record-keeping obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the relevant transaction, consistent with financial record-keeping requirements applicable under our licensing framework.
• Support communications: Retained for a period of three (3) years from the date of the last communication, to support dispute resolution and ongoing player welfare obligations.
• Analytics data: Aggregated and anonymised analytics data (from which no individual can be identified) may be retained indefinitely for the purpose of Platform improvement and business analytics.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data is anonymised, it may be retained and used for analytical purposes without further restriction.

zf999 implements a comprehensive set of technical and organisational security measures to protect the personal data we hold against unauthorised access, disclosure, alteration, or destruction. These measures include, but are not limited to, the following:

• 256-bit SSL/TLS encryption applied to all data transmitted between your browser or device and zf999 servers, ensuring that login credentials, payment details, and personal data are never transmitted in plain text.
• Data encryption at rest for sensitive personal data held in zf999's databases, including identity documentation and payment method identifiers.
• Two-factor authentication (2FA) available to all Account holders, providing an additional layer of access control beyond username and password.
• Access control and privilege management limiting employee and contractor access to personal data to those with a demonstrated operational need, governed by role-based access control policies.
• Automated intrusion detection and prevention systems monitoring for unauthorised access attempts, brute-force attacks, and other malicious activity targeting the Platform or its underlying infrastructure.
• Regular security audits and vulnerability assessments conducted by qualified independent security professionals, with findings actioned in accordance with a defined remediation process.
• Data breach response procedures enabling zf999 to identify, contain, and notify affected parties and relevant authorities in the event of a personal data breach within the timeframes required by applicable law.

Subject to applicable law and the limitations of zf999's legal obligations (including gaming licence record-keeping requirements and AML obligations), you hold the following rights in respect of your personal data held by zf999:

To exercise any of the above rights, please contact zf999 at [email protected] with a clear description of your request. zf999 will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. Where requests are complex or numerous, the response period may be extended by up to a further 60 days, in which case zf999 will notify you of the extension and the reasons for it.

Please note that certain rights — particularly the right to erasure — are subject to overriding legal retention obligations under gaming licence regulations and anti-money laundering law. Where zf999 is unable to fulfil an erasure request in full, it will explain the reason and indicate the applicable retention period for any data that must be retained.

The zf999 Platform is strictly restricted to individuals aged 21 years and older. zf999 does not knowingly collect, process, or store personal data belonging to individuals under the age of 21. If you are under 21, you must not register an Account, access the Platform, or provide any personal information to zf999.

If zf999 discovers or has reasonable grounds to believe that an Account holder is under the age of 21, it will immediately suspend the Account, close it permanently, forfeit any associated funds in accordance with its regulatory obligations, and securely delete the personal data collected in connection with that Account to the fullest extent permitted by applicable law.

If you believe that a minor has registered an Account on the zf999 Platform, please report this immediately to [email protected]. zf999 takes underage access extremely seriously and will act on all such reports without delay.

zf999 may send you marketing communications — including promotional offers, bonus notifications, PSL and cricket season promotions, and platform news — via SMS, push notification, or email, where you have provided consent to receive such communications at the time of registration or at any subsequent point.

You may withdraw your consent to receive marketing communications at any time, without affecting the lawfulness of marketing sent prior to your withdrawal of consent. To opt out of marketing communications, you may:

• Update your notification preferences in the Account Settings section of your zf999 Account dashboard; or
• Contact zf999 support directly at [email protected] with a request to opt out of all marketing communications.

Please note that certain transactional and account-related communications — including deposit confirmations, withdrawal notifications, security alerts, and responsible gaming communications — are not optional and will continue to be sent regardless of your marketing preferences, as they form part of the contractual service zf999 provides.

zf999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing activities, applicable law, regulatory requirements, or Platform operations. The date of the most recent version is indicated at the top of this Policy document.

Where material changes are made to this Policy — particularly changes that expand how we use your data or introduce new categories of data sharing — zf999 will notify registered Account holders via email or via a prominent notice on the Platform not less than fourteen (14) calendar days before the revised Policy takes effect. For changes required immediately by law or regulation, no advance notice period may be possible, in which case zf999 will notify Account holders as soon as practicable.

Your continued use of the zf999 Platform following the effective date of any amended Privacy Policy constitutes your acknowledgement and acceptance of the updated terms. If you do not agree with the revised Policy, you must close your Account and cease use of the Platform prior to the effective date of the amendment.

For any questions, concerns, complaints, or requests relating to this Privacy Policy or zf999's handling of your personal data, please contact us through one of the following channels:

• Live Chat: Available 24/7 within your zf999 Account dashboard — the fastest route for urgent privacy queries, with an average response time under 10 minutes.
• Email: [email protected] — for formal data subject access requests, erasure requests, objection notices, and complaints about data handling. Please mark your email subject line with "Privacy Request" for prompt routing.

zf999 acknowledges all privacy-related communications within 5 business days and aims to provide a full response within 30 calendar days. Complex or multi-part requests may take up to 90 calendar days in total, with progress updates communicated at regular intervals.