z98 Privacy Policy

1 Introduction

z98 is an internationally licensed online gaming and sports betting platform operated at z98.bio. The z98 platform serves players across Pakistan and other permitted jurisdictions, offering cricket betting, live casino games, slot titles, and other gaming products.

This Privacy Policy ("Policy") explains how z98 collects, uses, stores, and protects personal data obtained from individuals who visit z98.bio, register an account, make a deposit, place a wager, or otherwise interact with the z98 platform or its customer support channels.

This Policy should be read alongside the z98 Terms & Conditions, which govern the overall relationship between z98 and its players. In the event of any conflict between this Policy and the Terms & Conditions on matters of data privacy, this Policy shall take precedence.

z98 is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection legislation. If you have any questions about how your data is handled, please contact our team at [email protected].

2 Personal Data We Collect

z98 collects the following categories of personal data, depending on how you interact with the platform:

z98 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health data, except where health-related information is voluntarily provided in the context of a responsible gaming or self-exclusion request — in which case it is processed solely for the purpose of player protection.

3 How We Collect Personal Data

z98 collects personal data through the following means:

• Direct Collection: When you complete the z98 registration form, submit identity verification documents, make a deposit, contact customer support, or update your account profile, you provide personal data directly to z98.
• Automated Technical Collection: When you visit z98.bio, our servers automatically record technical data including your IP address, browser type, device identifiers, referring URL, and session duration. This data is collected using server logs and first-party cookies.
• Transaction Processing: When you make a deposit or withdrawal via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, or USDT TRC20, z98 receives transaction confirmation data from the relevant payment processor to verify and record the transaction.
• Identity Verification Providers: Where z98 uses a licensed third-party identity verification service to confirm your age and identity, that provider may return verification status data and document metadata to z98 for account compliance purposes.
• Customer Support Interactions: Communications you initiate with the z98 support team — whether via live chat, email, or any other channel — are recorded and retained for quality assurance, dispute resolution, and regulatory compliance purposes.

z98 does not purchase personal data from data brokers or any other third-party commercial sources.

4 Purposes of Processing

z98 processes personal data for the following specific and documented purposes:

• Account Management: Creating, maintaining, and managing your z98 player account, including processing account updates and communicating account-related notifications.
• Age & Identity Verification: Verifying that all z98 account holders meet the minimum age requirement of 21 years and that account information corresponds to a real, verifiable individual — a legal obligation under our gaming licence.
• Payment Processing: Processing deposits and withdrawals via your chosen payment method, reconciling transactions, and maintaining accurate financial records.
• Fraud & Money Laundering Prevention: Monitoring account and transaction activity for patterns consistent with fraud, money laundering, or match manipulation in compliance with applicable anti-money laundering (AML) legislation.
• Regulatory Compliance: Meeting ongoing obligations to our gaming regulator, including record-keeping, player verification, and reporting requirements.
• Responsible Gaming: Monitoring play patterns to identify players who may be exhibiting signs of problem gambling and offering or enforcing appropriate responsible gaming interventions including deposit limits and self-exclusion.
• Customer Support: Responding to player queries, complaints, and disputes in a timely and informed manner.
• Platform Security: Detecting and preventing unauthorised access, account takeovers, and technical exploitation of the z98 platform.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. Players may opt out at any time.
• Analytics & Improvement: Analysing anonymised and aggregated usage data to improve the z98 platform, optimise user experience, and inform product development decisions.

5 Legal Basis for Processing

z98 processes personal data only where a valid legal basis exists. The following legal bases apply to z98's processing activities:

• Contractual Necessity: Processing required to perform the contract between z98 and the player — including account creation, payment processing, and the provision of gaming services.
• Legal Obligation: Processing required to comply with applicable laws — including age verification, AML screening, record-keeping, and regulatory reporting obligations arising from z98's gaming licence.
• Legitimate Interests: Processing carried out in pursuit of z98's legitimate business interests — including fraud prevention, platform security, and responsible gaming monitoring — where those interests are not overridden by the player's fundamental rights and freedoms.
• Consent: Processing for direct marketing communications, where z98 relies on the player's freely given, specific, and informed consent. Players may withdraw consent at any time by updating their communication preferences in account settings or by contacting [email protected].

6 Data Sharing & Third Parties

z98 does not sell, rent, or otherwise transfer personal data to third parties for commercial purposes. Personal data may be shared with the following categories of recipients only where strictly necessary and subject to appropriate data protection safeguards:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20 infrastructure providers receive only the transaction data necessary to process your deposit or withdrawal request.
• Identity Verification Providers: Licensed KYC / AML service providers receive identity document data solely for the purpose of age and identity verification. These providers are contractually prohibited from using your data for any other purpose.
• Gaming Software Providers: Third-party game studios and live casino providers that supply content to the z98 platform may receive anonymised session identifiers necessary for game delivery. These providers do not receive personally identifiable information.
• Regulatory Authorities: z98 may be required to disclose player data to its gaming regulator, financial intelligence units, or law enforcement agencies where compelled to do so by law or valid legal process.
• Professional Advisors: z98's legal counsel, auditors, and compliance advisors may access limited personal data on a strictly need-to-know basis and are bound by professional confidentiality obligations.
• IT Infrastructure Providers: Cloud hosting and data centre providers that support the z98 platform operate under binding data processing agreements and are not permitted to access or use player data independently.

All third-party data processors engaged by z98 are vetted for data security compliance and are required to maintain data protection standards consistent with this Policy.

7 Data Retention

z98 retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, subject to mandatory retention periods imposed by applicable law or regulation. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes, as it can no longer be linked to any identifiable individual.

8 Data Security

z98 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and z98.bio is encrypted using industry-standard SSL/TLS protocols.
• Encryption at Rest: Sensitive personal data including identity documents and financial information is encrypted at rest in z98's data storage infrastructure.
• Access Controls: Access to personal data within the z98 organisation is restricted on a strict need-to-know basis. All internal access is logged and subject to periodic review.
• Two-Factor Authentication: z98 offers and encourages two-factor authentication for all player accounts to reduce the risk of unauthorised account access.
• Penetration Testing: z98's platform infrastructure undergoes regular security testing and vulnerability assessments conducted by independent security specialists.
• Incident Response: z98 maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to affected individuals, z98 will notify the relevant regulatory authority and affected players as required by applicable law.

While z98 takes all reasonable precautions to protect your data, no online platform can guarantee absolute security. Players are responsible for maintaining the confidentiality of their own account credentials and should contact [email protected] immediately if they suspect any unauthorised access to their account.

9 Cookies & Tracking Technologies

z98.bio uses first-party cookies and similar tracking technologies to operate and improve the platform. We do not use third-party advertising cookies or cross-site tracking technologies.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from accessing certain features of the z98 platform. For full details, refer to the cookie preference panel available in your z98 account settings.

10 Your Data Rights

As a z98 account holder, you have the following rights in relation to your personal data. To exercise any of these rights, please submit a written request to [email protected]. z98 will acknowledge your request within 48 hours and respond substantively within 30 days.

• Right of Access: You have the right to request a copy of all personal data z98 holds about you, along with information about how it is being used.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data z98 holds about you.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to z98's legal retention obligations.
• Right to Restrict Processing: You may request that z98 restricts processing of your data in certain circumstances, for example while a rectification request is being reviewed.
• Right to Data Portability: Where z98 processes your data on the basis of consent or contract and by automated means, you have the right to receive that data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to z98 processing your personal data for direct marketing purposes at any time. You may also object to processing based on z98's legitimate interests, subject to z98 demonstrating overriding grounds.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Please note that exercising certain rights — such as the right to erasure — may result in the closure of your z98 account where the data in question is necessary for the continued provision of the service.

11 Minors & Age Protection

The z98 platform is strictly intended for adults aged 21 years and above. z98 does not knowingly collect or process personal data from individuals under the age of 21.

All z98 registrations are subject to age verification as a mandatory step in the account onboarding process. Where z98 has reasonable grounds to suspect that an account has been registered by or on behalf of a person under the age of 21, that account will be immediately suspended pending full age verification. Any funds deposited by an underage player will be returned to the originating payment method — no winnings will be payable — and the matter may be reported to relevant authorities.

Parents and guardians who believe that a minor has accessed the z98 platform using their details or payment methods are encouraged to contact [email protected] immediately. z98 will investigate and take all appropriate action to secure the account and protect the minor's data in compliance with applicable child data protection law.

12 International Data Transfers

z98 operates on an internationally licensed basis and may store and process personal data on servers located outside Pakistan. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection to the country in which it was collected, z98 implements appropriate safeguards to ensure that the data remains protected to the same standard, including:

• Standard contractual clauses approved by relevant data protection authorities, incorporated into agreements with all data processors operating in third countries.
• Binding corporate rules where data is transferred within the z98 corporate group to affiliated entities.
• Adequacy assessments conducted prior to engaging any new third-country data processor, with ongoing review.

By registering a z98 account, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Pakistan in accordance with this Policy and subject to the safeguards described above.

13 Policy Amendments

z98 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, business operations, or data processing practices. The version of this Policy currently published at z98.bio/privacy-policy is the version in force.

Where changes to this Policy are material — meaning they affect the way z98 processes your personal data in a manner that may impact your rights — z98 will provide advance notice to active account holders via their registered email address and/or a prominent notice on the z98 platform prior to the changes taking effect.

Continued use of the z98 platform following the effective date of an updated Policy constitutes acceptance of the revised terms. If you do not accept the amended Policy, you must cease using the z98 platform and contact [email protected] to request account closure.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way z98 handles your personal data, please contact our Data Protection team using the details below:

• Platform: z98 — z98.bio
• Data Protection Contact: [email protected]
• Subject Line for Data Requests: "Data Privacy Request – [Your Registered Email]"
• Response Time: Acknowledgement within 48 hours; full response within 30 days
• Availability: 24 hours a day, 7 days a week, 365 days a year

All data privacy requests must be submitted in writing to the email address above. z98 may need to verify your identity before processing a data access, rectification, or erasure request to ensure that personal data is not disclosed to or altered at the request of an unauthorised party.

If you are not satisfied with z98's response to a data privacy request or complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction.