zc22 Privacy Policy — Your Data, Your Rights, Our Commitment

zc22 is an online casino and sports betting platform operating under an internationally recognised gaming licence and serving registered players across Pakistan. The platform is accessible at zc22.app and offers a full suite of gaming products including live dealer casino games, slot titles, cricket betting, and other sports wagering markets.

For the purposes of this Policy, zc22 acts as the data controller in respect of personal data collected from players using the platform. As data controller, zc22 determines the purposes for which, and the means by which, personal data is processed.

If you have any questions regarding the identity of the data controller or wish to exercise any of your data rights described in this Policy, please contact our support team via the live chat facility on the platform or by emailing [email protected] (plain text — not a clickable link).

zc22 collects personal data through several channels: directly from you when you register an account, make a deposit, contact support, or interact with the platform; automatically when you use the platform (technical and behavioural data); and from third-party verification providers during the KYC process. The categories of personal data we collect are detailed in the table below.

zc22 processes your personal data only for specific, clearly defined purposes. We do not use your data for any purpose that is incompatible with the purposes for which it was originally collected. The primary purposes for which we process your personal data are as follows:

• Account Registration and Management: To create and maintain your player account, authenticate your login sessions, and manage your account preferences and settings.
• KYC and Age Verification: To verify that you are at least 21 years of age and that your identity matches the details provided at registration, as required by our international gaming licence and anti-money laundering obligations.
• Payment Processing: To process deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20, and to maintain accurate transaction records as required by law.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeover attempts, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible Gaming Compliance: To monitor player activity against responsible gaming thresholds, enforce deposit and loss limits, apply self-exclusion orders, and identify patterns that may indicate problem gambling behaviour requiring intervention.
• Customer Support: To respond to enquiries, resolve account disputes, process complaints, and provide technical assistance through our live chat and email support channels.
• Platform Improvement: To analyse aggregate, anonymised behavioural data for the purpose of improving game offerings, platform performance, and user experience. This analysis does not involve individual profiling for commercial decisions.
• Promotional Communications: To send you bonus offers, promotional notifications, and account-related updates — but only where you have explicitly opted in to receive such communications. You may opt out at any time via your account settings or by contacting support.
• Legal and Regulatory Compliance: To comply with our obligations under the terms of our gaming licence, applicable anti-money laundering regulations, and any lawful requests from regulatory authorities.

zc22 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing that is necessary to perform the contract between zc22 and you — including account creation, deposit processing, game play, and withdrawal execution. Without this processing, we cannot provide our services to you.
• Legal Obligation: Processing that is required by our gaming licence obligations, anti-money laundering regulations, or other applicable legal requirements — including KYC identity verification, transaction record-keeping, and regulatory reporting.
• Legitimate Interests: Processing that is necessary for the legitimate interests of zc22, including fraud detection, platform security, responsible gaming monitoring, and aggregate analytics — provided that these interests are not overridden by your privacy rights. Where we rely on legitimate interests, we conduct a balancing assessment to ensure your rights are adequately protected.
• Consent: Where we rely on your consent — specifically for sending promotional communications and for the use of non-essential cookies — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

zc22 does not sell, rent, or trade your personal data to any third party. Data is shared with third parties only where strictly necessary to operate the platform, meet our regulatory obligations, or protect the security of our players. The categories of third parties with whom data may be shared are as follows:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and cryptocurrency network processors receive the minimum financial data necessary to process your deposit or withdrawal transactions. These providers operate under their own privacy policies and applicable financial regulations.
• KYC and Identity Verification Providers: Third-party identity verification services receive your CNIC and identity documentation for the purpose of age and identity verification. These providers are contractually bound to process your data solely for verification purposes and in accordance with applicable data protection standards.
• Regulatory Authorities: Where required by our gaming licence or applicable anti-money laundering law, zc22 may be required to disclose player information — including transaction records and identity documentation — to the relevant regulatory authority or law enforcement body. Such disclosures are made only where legally mandated.
• IT Infrastructure and Security Providers: Hosting, cloud infrastructure, and cybersecurity service providers may have access to platform data as part of their contracted services. All such providers are bound by data processing agreements that restrict the use of your data to the purposes for which it was shared.
• Responsible Gaming Service Providers: Where you have requested self-exclusion or where our monitoring systems have identified a responsible gaming concern, your details may be shared with multi-operator self-exclusion registries where participation is required by our licence conditions.

zc22 uses cookies and similar tracking technologies on the platform to enable core functionality, improve user experience, and support security and fraud detection. The categories of cookies used are described below:

• Strictly Necessary Cookies: These cookies are essential for the platform to function correctly. They enable session authentication, maintain your login state, and support core security features such as CSRF protection. These cookies cannot be disabled as they are required for the service to operate.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, game settings, and responsible gaming limit configurations — to personalise your experience on the platform.
• Analytics Cookies: zc22 uses anonymised analytics cookies to understand how players navigate the platform, which games are most popular, and where technical issues may occur. This data is processed in aggregate and is not used to identify individual players.
• Security and Fraud Detection Cookies: These cookies help identify unusual or suspicious activity on your account, such as login attempts from unrecognised devices or IP addresses that differ significantly from your usual location.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from accessing the platform. For non-essential cookies, you may withdraw consent at any time without affecting your ability to use core platform features.

zc22 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by our gaming licence and applicable regulatory obligations. The following retention periods apply:

• Account Data and KYC Documentation: Retained for a minimum of 5 years from the date of account closure, as required by our anti-money laundering compliance obligations under our international gaming licence.
• Transaction Records: Retained for a minimum of 5 years from the date of each transaction, in accordance with standard financial record-keeping requirements applicable to licensed gaming operators.
• Communications and Support Records: Live chat transcripts and email correspondence are retained for a period of 2 years from the date of the last interaction, to support dispute resolution and quality assurance.
• Technical and Behavioural Data: Session logs and behavioural data are retained in identifiable form for a period of 12 months, after which they are either deleted or permanently anonymised for aggregate analytical purposes.
• Responsible Gaming Records: Self-exclusion orders, cooling-off period records, and responsible gaming limit histories are retained for the duration of the account and for a minimum of 5 years following account closure, to prevent re-registration during an active exclusion period.

At the end of the applicable retention period, personal data is securely deleted or anonymised in a manner that ensures it cannot be reconstructed or attributed to any individual. Anonymised aggregate data may be retained indefinitely for platform improvement purposes.

zc22 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• TLS Encryption: All data transmitted between your device and the zc22 platform is encrypted using TLS (Transport Layer Security) to prevent interception by third parties.
• Data Encryption at Rest: Sensitive personal data — including KYC documentation and financial information — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data within zc22 is restricted to authorised personnel on a strict need-to-know basis. All staff with access to player data undergo data protection training and are bound by confidentiality obligations.
• Multi-Factor Authentication: zc22's internal systems require multi-factor authentication for all personnel accessing production data environments.
• Regular Security Audits: The platform undergoes periodic security assessments, penetration testing, and vulnerability scanning to identify and address potential security weaknesses before they can be exploited.
• Incident Response: zc22 maintains a formal data breach response procedure. In the event of a security incident that poses a risk to your personal data, we will notify affected players and relevant regulatory authorities within the timeframe required by our licence conditions.