zp999 Privacy Policy — How We Handle Your Personal Data

1. Introduction

This Privacy Policy ("Policy") is issued by zp999 ("zp999", "we", "us", "our") and applies to all personal data collected, processed, and stored in connection with your use of the zp999 Platform, including the website at zp999.biz, its associated interfaces, and all related services provided under the zp999 brand (collectively, "the Platform"). This Policy applies to all registered players, account applicants, and visitors to the Platform.

We are committed to protecting the personal data of our users — particularly Pakistani players who trust us with sensitive information including CNIC details, mobile numbers, and financial transaction data. This Policy explains in clear, honest terms what data we collect, why we collect it, what we do with it, who we share it with under what circumstances, how long we keep it, and what rights you hold at all times as an individual data subject.

By registering an account on zp999, accessing the Platform, or otherwise providing us with personal information, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not accept the terms of this Policy, you must not use the zp999 Platform.

2. Data Controller Identity

The data controller responsible for your personal information is the zp999 operating entity, which holds the international gaming licence under which the Platform operates. As data controller, zp999 determines the purposes and means by which your personal data is collected and processed.

For all privacy-related enquiries, requests to exercise your data rights, or formal complaints relating to data processing, you may contact the zp999 Data Protection team via live chat or by email at [email protected] with the subject line "Privacy / Data Request". We aim to acknowledge all data-related enquiries within 48 hours and to resolve substantive requests within 30 calendar days.

3. Categories of Personal Data We Collect

zp999 collects personal data across several categories, depending on the nature of your interaction with the Platform. The principal categories are as follows:

3.1 Registration & Identity Data

• Pakistani mobile number — your primary account identifier and communication channel
• Date of birth — collected to verify compliance with the 21+ minimum age requirement
• Account password — stored in one-way cryptographic hash format; never retained in plain text
• Username or display name — where applicable and chosen by you

3.2 Identity Verification (KYC) Data

• CNIC number — Pakistani Computerised National Identity Card number
• CNIC document images — front and reverse photographs submitted for identity verification
• Full legal name — as it appears on your CNIC
• Residential address — where provided for enhanced KYC verification

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method identifiers
• JazzCash account identifier, EasyPaisa account identifier, or bank account details used for transactions
• Account balance history and bonus claim records
• USDT wallet address where cryptocurrency deposits or withdrawals are made

3.4 Gaming Activity Data

• Game session records — games played, bets placed, outcomes, session duration
• Sports betting selections, odds accepted, and settlement outcomes
• Bonus usage and wagering progress data
• Responsible gaming tool activations (deposit limits, self-exclusion requests, etc.)

3.5 Technical & Device Data

• IP address — used for geolocation, fraud detection, and security purposes
• Device type, operating system, and browser type
• Session tokens and authentication data
• Platform interaction logs — pages visited, buttons clicked, time spent in lobby

3.6 Communications Data

• Live chat transcripts and email correspondence between you and zp999 support
• Complaint and dispute records
• Marketing preference settings and consent records

4. How We Collect Your Personal Data

zp999 collects personal data through the following primary channels:

• Directly from you: During account registration, KYC submission, deposit and withdrawal processing, live chat interactions, email correspondence, and completion of responsible gaming tool settings.
• Automatically during Platform use: Technical and device data, session logs, and gameplay records are collected automatically as you use the zp999 Platform through cookies, server logs, and similar tracking technologies.
• From payment processors: When you make deposits or withdrawals via JazzCash, EasyPaisa, or bank transfer, our payment processing partners provide us with transaction confirmation data necessary to credit or debit your zp999 wallet.
• From fraud prevention services: zp999 may use third-party fraud detection services that provide signals based on device fingerprinting, IP reputation, and behavioural patterns to protect the platform and its players from fraudulent activity.
• From identity verification services: In certain circumstances, zp999 may use third-party identity verification partners to cross-reference CNIC data against available databases to confirm authenticity, in compliance with our AML obligations.

5. Purposes for Which We Use Your Personal Data

The following table summarises the primary purposes for which zp999 processes your personal data, together with the data categories used for each purpose:

6. Legal Bases for Data Processing

zp999 processes your personal data on the following legal bases, as applicable to each processing activity:

• Contractual necessity: Processing required to perform our obligations to you under the Terms and Conditions — including account management, gameplay facilitation, and payment processing.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements — including KYC identity verification, AML transaction monitoring, age verification, and responsible gaming obligations imposed by our gaming licence.
• Legitimate interests: Processing carried out for the legitimate business interests of zp999 — including fraud prevention, platform security, customer support, and anonymised analytics — provided such interests do not override your fundamental privacy rights.
• Consent: Processing activities that are optional and rely on your freely given, specific, and informed consent — primarily marketing communications. You may withdraw consent for any consent-based processing at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Data Sharing & Third-Party Disclosure

zp999 does not sell, rent, or trade your personal data to third parties for their own marketing purposes under any circumstances. We may share your personal data with third parties only in the following defined circumstances:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Bank Alfalah, and USDT processing partners receive the minimum data necessary to process your deposit and withdrawal transactions.
• Identity verification providers: Where third-party KYC verification services are used to support CNIC authentication, the minimum required data fields are shared under strict data processing agreements.
• Game software providers: Licensed game providers whose titles appear in the zp999 lobby receive anonymised session data necessary to deliver their games. Personally identifiable information is not shared with game providers.
• Fraud prevention partners: Aggregated technical signals (device fingerprints, IP reputation data) may be shared with fraud detection services for the purpose of protecting the platform and its players.
• Regulatory authorities and law enforcement: zp999 may disclose personal data to gaming regulators, financial intelligence units, or law enforcement agencies where legally compelled to do so by valid court order, regulatory demand, or applicable law.
• Professional advisers: Legal counsel, auditors, and compliance consultants engaged by zp999 may access limited personal data on a need-to-know basis under confidentiality obligations.

All third parties who process personal data on behalf of zp999 are bound by data processing agreements that require them to maintain appropriate technical and organisational security measures and to process data only for the agreed purposes.

8. Data Retention Periods

zp999 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or for as long as required by applicable legal, regulatory, or contractual obligations. The following retention periods apply as general guidelines:

• Active account data: Retained for the duration of your account's existence on zp999 plus a post-closure period of at least 5 years, as required by gaming licence AML obligations.
• KYC verification documents: Retained for a minimum of 5 years from the date of verification, or for such longer period as may be required by applicable AML legislation or regulatory direction.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction to satisfy AML record-keeping requirements and potential dispute resolution needs.
• Gaming activity logs: Retained for a minimum of 3 years, or longer where required for responsible gaming compliance, fraud investigation, or regulatory audit purposes.
• Customer support communications: Retained for 2 years from the date of the communication, or longer where a dispute or formal complaint is ongoing.
• Marketing consent records: Retained for the duration of your account plus 1 year, to demonstrate consent compliance in the event of regulatory enquiry.
• Technical and device logs: Retained for up to 12 months in aggregated form for security and platform performance purposes.

Upon expiry of the applicable retention period, personal data is either securely deleted from zp999 systems or irreversibly anonymised so that it can no longer be associated with any identifiable individual.

9. Security Measures

zp999 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our principal security controls include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and zp999 servers — including login, payment, and KYC submission flows
• Password hashing using industry-standard one-way cryptographic algorithms — your password is never stored in readable form anywhere in our systems
• Role-based access control — zp999 staff access to personal data is restricted to the minimum necessary for their operational role
• Two-factor authentication (2FA) available for all player accounts and mandatory for administrative access to internal systems
• Regular third-party security audits and penetration testing conducted by independent cybersecurity firms
• Segregated server infrastructure for production, testing, and administrative environments
• Automated anomaly detection on login activity, transaction patterns, and data access logs
• Staff data protection training — all personnel with access to personal data complete mandatory privacy and security training on appointment and annually thereafter

Despite the above measures, no internet-based system can guarantee absolute security. In the unlikely event of a data breach that affects your personal data and poses a risk to your rights and freedoms, zp999 will notify affected players without undue delay and take all reasonable steps to contain and remediate the incident.

10. Your Data Rights

As an individual whose personal data is processed by zp999, you hold the following rights. You may exercise any of these rights at any time by contacting our support team via live chat or at [email protected]:

Please note that the right to erasure is not absolute and may be limited by our legal obligations to retain certain data for defined periods under gaming licence and AML requirements, as described in Section 8. Where erasure cannot be completed in full, we will explain which data must be retained and why.

11. Cookies & Tracking Technologies

The zp999 Platform uses cookies and similar tracking technologies to support core functionality, enhance your user experience, and analyse aggregated platform usage patterns. The principal categories of cookies used on zp999 are as follows:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They include session authentication tokens that keep you logged in, security cookies that protect against cross-site request forgery (CSRF), and load-balancing cookies. These cannot be disabled without preventing the Platform from working correctly.
• Functional Cookies: These cookies remember your preferences such as language settings and previously selected game categories to provide a more personalised experience on return visits.
• Analytics Cookies: We use aggregated analytics cookies to understand how players interact with the Platform — which pages receive the most visits, how long sessions last, and where players encounter difficulties. This data is used in anonymised, aggregated form only and is not linked back to individual player identities.
• Marketing Cookies: Where you have provided explicit consent, marketing cookies may be used to deliver relevant communications within the zp999 Platform about active promotions and new game releases. These are not used for cross-site advertising.

You may control cookie preferences through your browser settings. Disabling strictly necessary cookies will impair Platform functionality. Disabling analytics or marketing cookies will not affect your ability to play games, deposit, or withdraw. For detailed cookie management, please refer to the help section of your browser or mobile operating system.

12. Minors & Age Verification Policy

The zp999 Platform is strictly intended for individuals aged 21 years and above. zp999 does not knowingly collect personal data from any person under the age of 21. Age verification via CNIC submission is mandatory before any account can access real-money features, including deposits, gameplay, and withdrawals.

If zp999 discovers or has reasonable grounds to believe that personal data has been collected from a person under the age of 21, we will immediately suspend the account, delete the associated personal data to the extent permissible by our legal obligations, and in cases of deliberate misrepresentation, report the incident to relevant authorities.

If you are a parent or guardian and believe that a minor in your care has accessed or registered on zp999 using falsified identity information, please contact us immediately via live chat or at [email protected]. We treat such reports with the utmost urgency.

13. International Data Transfers

As an internationally licensed online gaming platform, certain operational, technical, and compliance functions may involve the transfer of personal data to servers, processors, or service providers located outside Pakistan. Where such transfers occur, zp999 ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to or exceeding that required in Pakistan.

Safeguards applied to international data transfers include contractual data processing agreements with receiving entities, use of standard contractual clauses where applicable, and restriction of transferred data to the minimum necessary for the specified processing purpose. zp999 does not transfer personal data to countries known to have inadequate data protection frameworks without implementing additional protective measures.

14. Changes to This Privacy Policy

zp999 reserves the right to update or revise this Privacy Policy at any time. Where changes are material — meaning they significantly affect how your personal data is collected, used, or shared — we will provide advance notice to registered players via email notification, in-account notification, or prominent notice on the Platform, no less than 14 days before the changes take effect.

The effective date of the current version of this Policy is displayed at the top of this page. We encourage you to review this Policy periodically to stay informed about how zp999 protects your information. Continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms.

Previous versions of this Privacy Policy are archived internally and are available upon written request submitted to [email protected].

15. Contact Us — Privacy & Data Enquiries

For any questions, concerns, or formal requests relating to this Privacy Policy or your personal data held by zp999, please contact us through any of the following channels:

This Privacy Policy was last reviewed and updated on 1 January 2026. All prior versions are superseded by this document.