Privacy Policy for zaya999

zaya999 collects personal data from you in several ways — directly when you register and interact with the platform, automatically as you use the site, and occasionally from third-party sources where permitted. The categories of personal data we collect are set out below.

1.1 Registration & Account Data

When you create a player account on zaya999, we collect the following mandatory information:

• Full legal name (as it appears on your government-issued identity document)
• Date of birth (to verify that you meet the 18+ age requirement)
• Residential address in Bangladesh (city, district, and full mailing address)
• Email address (used for account notifications and correspondence)
• Bangladeshi mobile phone number (used for account authentication and support contact)
• Username and encrypted password credential
• Account currency (Bangladeshi Taka — BDT, set at registration and non-changeable)

1.2 Identity Verification (KYC) Data

As part of our mandatory Know Your Customer (KYC) process — required before any withdrawal is processed and potentially at other points during your use of the platform — we collect copies of identity documents including:

• National Identity Card (NID) — front and back scan or photograph
• Valid passport (photo page)
• Government-issued birth certificate
• Proof of address document (utility bill, bank statement, or official correspondence dated within 90 days)
• Selfie photograph or video verification, where required

KYC documents are stored securely and are used solely for the purpose of verifying your identity and complying with anti-money laundering (AML) obligations. They are not shared with any party other than our regulated KYC verification partner.

1.3 Financial Transaction Data

Every deposit, withdrawal, and transfer made through your zaya999 account generates a transaction record. We collect and retain:

• Payment method used (e.g., bKash, Nagad, Rocket, Upay, Visa, Mastercard, bank transfer)
• Transaction amount in BDT and the equivalent timestamp in Bangladesh Standard Time (BST, UTC+6)
• Transaction reference number and status (pending, completed, failed, reversed)
• Mobile wallet number or partial card number (last four digits only — we do not store full card numbers)
• Bank account details where bank transfer is used as the payment method

1.4 Gaming Activity Data

We record detailed logs of your activity on the zaya999 platform for operational, security, and responsible gaming purposes, including:

• Game sessions — titles played, bet amounts, outcomes, session duration, and timestamps
• Sportsbook bets — markets selected, odds at time of bet, stake, and settlement outcome
• Bonus claims — bonuses activated, wagering progress, and bonus expiry records
• Login and logout events — date, time, IP address, and device type
• Customer support interactions — messages sent, responses received, and complaint records

1.5 Technical & Device Data

When you access zaya999 via a browser or mobile interface, we automatically collect certain technical data including:

• IP address and approximate geolocation (country and city level)
• Browser type and version, operating system, and device type (desktop/mobile/tablet)
• Pages visited, time spent on each page, and click-path data
• Referral source (the URL from which you arrived at zaya999, if applicable)
• Screen resolution and language settings

This technical data is collected via server logs and analytics tools for the purpose of improving platform performance, detecting security threats, and optimising the user experience for players in Bangladesh.

zaya999 does not sell your personal data. We share personal data with third parties only where strictly necessary to deliver platform services or to comply with legal obligations. The categories of third parties with whom we share data are described below.

3.1 Payment Processing Partners

To process your deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and BRAC Bank, we share the minimum necessary transaction data with the relevant payment provider. Each payment partner operates under its own privacy policy and is independently responsible for the data it processes in connection with your transaction. zaya999 does not transmit your full account data to payment partners — only the transaction-specific information required to complete the payment.

3.2 KYC & Identity Verification Providers

Your identity documents — national ID, passport, or birth certificate — are shared with our regulated third-party KYC verification provider solely for the purpose of confirming your identity. Our KYC partner is contractually obligated to process your documents only for the purpose of identity verification and to delete them from their systems within the timeframes stipulated in our data processing agreement.

3.3 Game Software Providers

Games on zaya999 are powered by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you play a game, a session token and anonymised player identifier are shared with the relevant game provider to facilitate gameplay and calculate results. Game providers receive your player identifier but not your full account details, name, address, or payment information unless their specific integration requires it and you have been informed of this.

3.4 Analytics & Performance Tools

We use analytics tools to understand platform usage patterns. These tools may receive anonymised or pseudonymised technical data such as page views, session duration, and click paths. We configure these tools to mask IP addresses where possible and to refrain from creating individual user profiles linked to your zaya999 account identity.

3.5 Legal & Regulatory Authorities

We may be required to disclose personal data to regulatory authorities, law enforcement agencies, or courts where required by applicable law — for example, in connection with an investigation into financial crime, money laundering, or underage gambling. In such cases, zaya999 will disclose only the minimum information required by law and will, where legally permissible, notify the affected player of the disclosure.

3.6 Business Transfers

In the event that zaya999 undergoes a merger, acquisition, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer via the email address registered on your account, and the acquiring entity will be required to honour the terms of this Privacy Policy or provide you with a new policy that offers equivalent or greater protections.

zaya999 applies rigorous technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security programme is reviewed and updated regularly to respond to emerging threats.

5.1 Technical Security Measures

• SSL/TLS Encryption: All data transmitted between your device and zaya999 servers is encrypted using TLS 1.2 or higher. Our SSL certificate is maintained and renewed continuously.
• Data Encryption at Rest: Sensitive data fields including identity document images, mobile wallet numbers, and partial payment card details are stored using AES-256 encryption at rest.
• Password Hashing: Account passwords are never stored in plain text. We use bcrypt with a high cost factor to hash all passwords before storage.
• Two-Factor Authentication: Players are encouraged to enable two-factor authentication (2FA) via their registered Bangladeshi mobile number. 2FA is available from your account security settings.
• Intrusion Detection: Our infrastructure is monitored continuously by automated intrusion detection systems that flag and quarantine unusual access patterns in real time.

5.2 Organisational Security Measures

• Access to personal data is restricted on a strict need-to-know basis. Only authorised staff with a legitimate operational reason may access player account data.
• All staff with access to personal data are subject to confidentiality obligations and receive regular data protection training.
• Third-party service providers are assessed for security compliance before being granted any access to player data.
• Security incidents affecting personal data are logged, investigated, and — where required — reported to affected players promptly.

5.3 Data Retention Periods

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, plus any additional period required by law. The following retention schedule applies:

• Account registration data: Retained for the lifetime of your active account plus 5 years after account closure.
• KYC identity documents: Retained for 5 years from the date of verification or from account closure, whichever is later, in accordance with AML obligations.
• Financial transaction records: Retained for 7 years from the date of the transaction for financial compliance purposes.
• Gaming activity logs: Retained for 3 years from the date of the session or bet for responsible gaming monitoring and dispute resolution purposes.
• Customer support records: Retained for 3 years from the date of the support interaction.
• Marketing consent records: Retained for the duration of your consent and for 3 years after withdrawal of consent as evidence of the consent record.
• Technical/server logs: Retained for 12 months on a rolling basis.

Upon expiry of the applicable retention period, personal data is either securely deleted using industry-standard deletion methods or anonymised such that it can no longer be linked to an individual player.

zaya999 may send promotional and informational communications to players who have opted in to receive them. This section explains how our marketing communications work, what they contain, and how you can manage your preferences.

7.1 Types of Marketing Communications

With your consent, zaya999 may contact you by email or SMS with the following types of content:

• Welcome bonus and deposit match offer notifications
• BPL T20 season promotions and cricket betting special offers
• Free spin and cashback campaign announcements
• New game launch notifications from providers such as Pragmatic Play, Evolution Gaming, and Spribe
• Seasonal promotions tied to events such as Eid, Pohela Boishakh, Victory Day (December 16), and Independence Day (March 26)
• VIP Club tier upgrades and exclusive member offers
• Platform update announcements and new feature releases

7.2 Consent-Based Opt-In

Marketing communications are sent only to players who have given explicit consent at the point of registration or subsequently via their account settings. We do not send marketing messages to players who have not opted in. Consent is recorded with a timestamp and stored as part of your account record for compliance purposes.

7.3 How to Opt Out

You may withdraw your marketing consent and opt out of all promotional communications at any time using any of the following methods:

• Click the unsubscribe link included at the bottom of every marketing email we send
• Log in to your zaya999 account, navigate to Account Settings, and toggle off marketing preferences
• Send an opt-out request by email to support@zaya999 with the subject line "Marketing Opt-Out"

Opt-out requests are processed within 5 business days. During this period you may receive one or two further communications that were already scheduled before your opt-out was processed — these are not a breach of your preferences and will cease once the opt-out is confirmed.

7.4 Transactional Communications

Please note that opting out of marketing communications does not affect transactional or account-related messages. We will continue to send you emails and SMS messages that are necessary for the operation of your account — including deposit and withdrawal confirmations, KYC verification requests, security alerts, responsible gaming notifications, and responses to your support queries. These messages are not marketing and cannot be opted out of while your account remains active.