zx999 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how zx999 ("the Platform", "we", "us", "our") collects, uses, stores, discloses, and protects the personal data of individuals ("you", "your", "the Player") who register for an account, access, or otherwise interact with the zx999 online betting and casino platform available at zx999.io.

zx999 is committed to handling your personal data lawfully, fairly, and transparently. This Policy is designed to comply with internationally recognised data protection principles, including those set out in the General Data Protection Regulation (GDPR) and equivalent frameworks, applied as best-practice standards for the protection of our players globally, including those based in Bangladesh.

By registering an account on zx999 or by continuing to use the Platform after this Policy has been updated, you acknowledge that you have read and understood its contents. If you do not agree with any aspect of this Policy, you should not register an account or use the Platform.

2 Data We Collect

zx999 collects personal data through several channels, including directly from you during the registration and verification process, automatically through your use of the Platform, and from third parties where permitted by law.

2.1 Data Provided Directly by You

When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or participate in a promotion, you provide us with data directly. This includes your full name, date of birth, contact details, residential address, identity document details, and payment account references.

2.2 Data Collected Automatically

When you access the Platform, our systems automatically collect certain technical data, including your IP address, device identifiers, browser type, operating system, session start and end times, pages viewed, and the sequence of navigation events within the Platform. This data is collected using server logs and first-party analytics tools.

2.3 Data Received from Third Parties

zx999 may receive data about you from the following third-party sources:

• KYC / Identity Verification Providers: Verification outcomes, document authenticity scores, and watchlist screening results from accredited identity verification services.
• Payment Processors: Transaction status confirmations, payment method ownership verification data, and fraud screening flags from bKash, Nagad, Rocket, Upay, Visa, Mastercard, and banking partners.
• Fraud and AML Screening Services: Risk scoring and sanctions screening results from financial crime compliance tools.
• Game Providers: Session metadata and game outcome data from licensed providers such as Evolution Gaming, Pragmatic Play, and Spribe, where this data is required for dispute resolution or responsible gaming monitoring.

3 How We Use Your Data

zx999 uses the personal data we collect for the following specific purposes:

• Account Management: To create, maintain, and administer your player account, including processing deposits, withdrawals, and bonus credits.
• Identity and Age Verification: To confirm that you meet the minimum age requirement of 21 years and to verify your identity in accordance with our KYC obligations.
• Payment Processing: To facilitate deposit and withdrawal transactions via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and Dutch-Bangla Bank, and to reconcile your account balance accurately.
• Anti-Money Laundering (AML) Compliance: To monitor transactions for indicators of money laundering, terrorist financing, or other financial crime, and to fulfil mandatory reporting obligations where applicable.
• Fraud Prevention and Platform Security: To detect and investigate suspicious activity, multiple account registrations, bonus abuse, and unauthorised access attempts.
• Responsible Gaming: To identify patterns of play that may indicate problem gambling behaviour, to apply player-requested deposit and session limits, and to action self-exclusion requests.
• Customer Support: To respond to your queries, process complaints, and maintain records of support interactions for quality assurance purposes.
• Platform Improvement: To analyse aggregated, anonymised usage patterns to improve the design, performance, and content of the Platform.
• Legal Compliance: To comply with applicable laws, regulatory requirements, court orders, or other legal processes in any jurisdiction where zx999 operates.
• Marketing Communications: To send you promotional offers, tournament announcements, and seasonal promotions (such as BPL and IPL cricket betting offers) by email or in-platform notification, where you have provided your consent or where we have a legitimate interest in contacting existing customers. You may opt out of marketing communications at any time by contacting [email protected].

4 Legal Bases for Processing

Every processing activity carried out by zx999 is grounded in at least one of the following recognised legal bases:

• Contractual Necessity: Processing required to fulfil our obligations under the agreement formed when you register an account — including payment processing, account management, and customer support.
• Legal Obligation: Processing required to comply with applicable law — including AML regulations, KYC requirements, and financial record-keeping obligations.
• Legitimate Interest: Processing carried out to pursue zx999's legitimate business interests, where those interests are not overridden by your data protection rights — including fraud detection, platform security, anonymised analytics, and responsible gaming monitoring.
• Consent: Processing carried out on the basis of your freely given, specific, and informed consent — including the sending of direct marketing communications. You may withdraw consent at any time by contacting [email protected], without affecting the lawfulness of processing carried out before withdrawal.

5 Sharing Your Personal Data

zx999 does not sell, rent, or trade your personal data to any third party. Your data is shared only in the following circumstances, and only to the extent necessary for each purpose:

5.1 Service Providers and Data Processors

zx999 engages third-party service providers who process personal data on our behalf under contractual data processing agreements. These include identity verification providers, payment gateway operators, fraud screening services, cloud hosting providers, and customer support software vendors. All processors are required to implement technical and organisational security measures equivalent to those applied by zx999.

5.2 Game Providers

When you play a game provided by a third-party studio (such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, or Ezugi), limited technical session data is transmitted to that provider to deliver the game session. Game providers are contractually prohibited from using this data for any purpose other than delivering the gaming service.

5.3 Regulatory and Law Enforcement Authorities

zx999 will disclose personal data to regulatory bodies, law enforcement agencies, or other competent authorities where required to do so by law, court order, or regulatory instruction. Such disclosures are made only to the extent required and are logged in accordance with our internal data governance procedures.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of the zx999 business, personal data held on registered players may be transferred to the acquiring entity. Where such a transfer occurs, players will be notified by email before their data is transferred and will be given the opportunity to request account closure and data deletion if they do not consent to the transfer.

6 International Data Transfers

zx999 operates internationally and may transfer your personal data to, or process it in, countries outside Bangladesh. These transfers may include transfers to the jurisdiction where the Platform's servers are hosted, where our KYC provider operates its processing infrastructure, or where our game studio partners are domiciled.

Where personal data is transferred to a country that does not provide a level of data protection equivalent to internationally recognised standards, zx999 ensures that appropriate safeguards are in place before the transfer takes place. These safeguards may include:

• Standard Contractual Clauses (SCCs) or equivalent contractual data protection obligations agreed with the recipient organisation.
• Binding corporate rules where the recipient is a member of the same corporate group as zx999.
• Transfers to jurisdictions recognised as providing an adequate level of data protection by the applicable regulatory framework.

By registering an account on zx999, you acknowledge that your personal data may be transferred internationally as described in this section. If you would like further information about the specific safeguards applicable to any international transfer affecting your data, please contact [email protected].

7 Data Retention

zx999 retains personal data only for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following retention periods apply as a general framework:

• Active Account Data: Retained for the duration of your active account relationship with zx999, plus a minimum of five (5) years following account closure to satisfy AML and financial compliance obligations.
• Transaction and Betting Records: Retained for seven (7) years from the date of the transaction, in line with standard financial record-keeping requirements applicable in the jurisdictions where zx999 operates.
• KYC Documentation: Retained for a minimum of five (5) years from the date of submission, or longer where required by specific regulatory instructions applicable to the Platform.
• Customer Support Records: Retained for three (3) years from the date of the most recent interaction, to support dispute resolution and quality assurance review.
• Technical and Usage Logs: Retained for up to twelve (12) months from the date of generation, after which logs are either deleted or irreversibly anonymised.
• Marketing Consent Records: Retained for the duration of your account relationship and for three (3) years following account closure, to demonstrate the basis on which marketing communications were sent.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with zx999's internal data disposal procedures. Anonymised data may be retained indefinitely for aggregate statistical analysis without limitation, as it no longer constitutes personal data.

8 Cookies and Tracking Technologies

zx999 uses cookies and similar tracking technologies on the Platform for the following limited and defined purposes:

8.1 Essential Cookies

These cookies are strictly necessary for the Platform to function. They manage your login session, maintain your authenticated state across page transitions, and store your in-session preferences (such as selected language). Essential cookies cannot be disabled without impairing Platform functionality.

8.2 Security Cookies

Security cookies are used to detect and prevent fraudulent access attempts, identify unusual login patterns, and protect against cross-site request forgery (CSRF) attacks. These cookies do not track your activity outside the zx999 Platform.

8.3 Analytics Cookies

zx999 uses first-party analytics cookies to collect anonymised, aggregated data about how players navigate the Platform — including which pages are most visited, average session duration, and device type distribution. This data is used solely to improve Platform design and performance. No personally identifiable information is included in analytics data sets.

8.4 What We Do Not Use

zx999 does not deploy third-party advertising cookies, social media tracking pixels, behavioural profiling cookies, or any tracking technology designed to follow your activity across websites or applications outside the zx999 Platform. We do not integrate Facebook Pixel, Google Ads remarketing tags, or equivalent third-party advertising tracking scripts.

9 Your Data Rights

Subject to applicable law and any overriding legal obligations that require zx999 to retain certain data, you hold the following rights in respect of your personal data:

• Right of Access: You may request a copy of all personal data held by zx999 about you. We will provide this in a structured, commonly used, machine-readable format within thirty (30) days of receiving your verified request.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held about you. Where the correction relates to data that has been shared with third-party processors, we will inform those processors of the correction.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing was unlawful. Erasure requests are subject to any legal retention obligations that require zx999 to retain certain records.
• Right to Restriction of Processing: You may request that zx999 restrict the processing of your data in certain circumstances — for example, while the accuracy of data is disputed, or while an objection to processing is assessed.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you may request that your data be provided to you in a portable format, or transferred directly to another data controller where technically feasible.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing and profiling for marketing purposes. Where an objection is made to direct marketing, processing for that purpose will cease immediately.
• Rights Related to Automated Decision-Making: Where zx999 makes decisions about you that are based solely on automated processing and that produce legal or similarly significant effects, you have the right to request human review of that decision. Automated decisions at zx999 are primarily limited to fraud risk scoring; all material account actions (such as permanent suspension) are reviewed by a human team member.

To exercise any of the above rights, please contact the zx999 Data Protection team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within five (5) business days and provide a substantive response within thirty (30) calendar days. Where a request is complex or where a large volume of data is involved, we may extend this period by a further thirty (30) days with prior notification.

10 Security Measures

zx999 implements a multi-layered security architecture to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Our technical and organisational security measures include:

• Transport Encryption: All data in transit between your device and zx999 servers is encrypted using TLS 1.3 protocol. HTTP connections are automatically redirected to HTTPS.
• Data Encryption at Rest: Sensitive stored data, including identity documents, payment records, and account credentials, is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within zx999's internal systems is restricted on a strict need-to-know basis. All internal access is authenticated via multi-factor authentication and is logged for audit purposes.
• Penetration Testing: zx999 engages independent security specialists to conduct regular penetration testing of the Platform infrastructure. Identified vulnerabilities are remediated according to a risk-prioritised schedule.
• Incident Response: zx999 maintains a documented data breach incident response procedure. In the event of a personal data breach that poses a risk to affected individuals, zx999 will notify the relevant supervisory authority and affected players within the timeframe required by applicable data protection law.
• Employee Training: All zx999 staff with access to personal data receive mandatory data protection and information security training on joining the organisation and annually thereafter.
• Vendor Due Diligence: All third-party processors engaged by zx999 are subject to a security assessment prior to engagement and are contractually required to maintain security standards consistent with those applied by zx999.

While zx999 takes all reasonable technical and organisational precautions to protect your data, no internet transmission or electronic storage system is entirely immune to risk. You are responsible for maintaining the security of your own device and for keeping your zx999 account credentials confidential. If you suspect that your account has been compromised, please contact [email protected] immediately.

11 Changes to This Policy and Contact Information

11.1 Policy Updates

zx999 may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or Platform features. When material changes are made, we will notify registered players by email to the address on file, or by a prominent notice displayed upon next login. The "Effective Date" at the top of this Policy will be updated to reflect the date on which the revised version comes into effect.

Continued use of the Platform after the effective date of any revision constitutes acceptance of the updated Policy. If you do not agree with any changes, you may request account closure and data deletion by contacting the support team before the effective date.

11.2 Minor Players

zx999 strictly prohibits registration by individuals under the age of 21. If zx999 becomes aware that personal data has been collected from a person under the minimum age, that data will be deleted immediately and the associated account will be permanently closed. If you have reason to believe that a minor has registered on zx999, please report this to [email protected] immediately.

11.3 Contact the Data Protection Team

For any query, concern, or request relating to this Privacy Policy or to the handling of your personal data by zx999, please contact us using the details below. All correspondence is handled by a dedicated data protection team member and is treated with the highest level of confidentiality.

Support and Data Protection Contact:
Email: [email protected] (plain text — not a link)
Subject line for data requests: "Data Rights Request"
Response target: within 5 business days of receipt