Privacy Policy – zh888 Pakistan Data Protection & Security

1About This Privacy Policy

This Privacy Policy explains how zh888 ("zh888", "we", "us", "our") collects, stores, uses and protects the personal information of players who register and use the zh888 platform at zh888.run. It applies to all products and services offered by zh888 including sports betting, live casino, poker, virtual sports, slots and the VIP Club.

zh888 takes the privacy of its Pakistani players seriously. We understand that your personal information — including your mobile number, payment details and gaming history — is sensitive, and we treat it accordingly. This policy is written in plain English so you can actually understand what we do with your data, rather than needing a lawyer to translate it.

This policy should be read alongside zh888's Terms and Conditions, which form the broader agreement between you and zh888. In the event of any conflict between this policy and the Terms on a privacy matter, this Privacy Policy shall prevail.

2Personal Data We Collect

zh888 collects personal data from you in three main ways: information you provide directly, information generated automatically when you use the platform, and information received from third parties such as payment processors and identity verification services.

zh888 does not collect sensitive personal data such as religious beliefs, political opinions, biometric data beyond liveness verification, or medical information. If zh888 ever needs to collect a category of data not listed above, we will update this policy and notify you in advance.

3How zh888 Uses Your Personal Data

zh888 uses your personal data only for purposes that are necessary to operate the platform, maintain your account, comply with legal obligations, and improve the service we provide to Pakistani players. We do not use your data for purposes that go beyond what is described here.

• Account management: Your identity and contact data allows zh888 to create and maintain your account, authenticate your logins, send account notifications and respond to support requests. Without this data, we cannot operate your account.
• Identity verification (KYC): zh888 is required to verify the identity of all players before processing withdrawals above certain thresholds. This involves checking your CNIC details against third-party verification databases. This is a mandatory anti-money laundering obligation and cannot be waived.
• Payment processing: Your payment details are used exclusively to process deposits and withdrawals in PKR. zh888 stores the minimum payment information required to facilitate transactions and prevent fraud — not your full payment credentials.
• Fraud prevention and security: zh888 uses technical data (IP addresses, device fingerprints, betting patterns) to detect suspicious account activity, prevent multiple account creation, identify bonus abuse and protect the integrity of the platform for all players.
• Responsible gaming: Gaming activity data — deposit amounts, session frequency, bet sizes — is monitored by zh888's responsible gaming systems to identify patterns that may indicate problem gambling. This is used to trigger responsible gaming interventions such as account limits or support outreach.
• Platform improvement: Anonymised and aggregated technical and gameplay data helps zh888 identify performance issues, optimise the mobile experience for Pakistani users, and prioritise new features. Individual players are never identifiable in this analysis.
• Marketing communications: If you have opted in to marketing communications, zh888 may contact you about new promotions, bonus offers and product launches. You can opt out of marketing at any time through your account settings without affecting your ability to use zh888.

zh888 does not use your data for automated decision-making that produces legal or similarly significant effects on you — other than fraud-detection systems that flag accounts for human review before any action is taken.

4Legal Basis for Processing

zh888 processes your personal data on one or more of the following legal grounds, depending on the specific purpose:

• Contractual necessity: Processing your identity data, payment information and gaming activity records is necessary to fulfil zh888's contractual obligations to you as a registered player — including maintaining your account, settling bets and processing withdrawals.
• Legal obligation: Identity verification, transaction record-keeping and fraud reporting are required by anti-money laundering obligations applicable to online gaming operators. zh888 cannot offer services without meeting these obligations.
• Legitimate interests: Fraud prevention, platform security monitoring, and aggregated analytics are pursued on the basis of zh888's legitimate interest in maintaining a secure, fair platform — balanced against your interests and rights, which zh888 has assessed as not being overridden by these processing activities.
• Consent: Marketing communications and the placement of non-essential cookies on your device are processed on the basis of your explicit consent. You may withdraw this consent at any time.

5Third-Party Data Sharing

zh888 shares your personal data with third parties only to the extent necessary to operate the platform and meet legal obligations. We do not sell your data. The following categories of third party may receive your data:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, and partner banks receive your payment details strictly to process transactions. Each of these processors operates under its own privacy policy and security standards. zh888 selects only processors with strong security records.
• Identity verification providers: zh888 works with licensed KYC (Know Your Customer) and AML (Anti-Money Laundering) service providers who verify CNIC details and liveness photos against official databases. Your identity data is shared with these providers solely for verification purposes and is not retained by them beyond the verification period.
• Game providers: When you play a live casino game, slot or virtual sports simulation on zh888, the game provider's systems record game-specific session data. Providers such as Pragmatic Play, Evolution Gaming, Hacksaw Gaming and others process this data under their own privacy frameworks, which comply with gaming industry standards.
• Fraud prevention services: zh888 uses third-party fraud detection systems that process IP addresses, device fingerprints and behavioural signals to identify suspicious activity. These systems do not receive your full identity data — only technical signals necessary for pattern detection.
• Customer support platforms: Support chat transcripts and communication records are processed through zh888's customer service platform. Support staff have access to the account information necessary to resolve your query and no more.
• Legal and regulatory authorities: zh888 will share data with law enforcement or regulatory bodies when required to do so by applicable law or a lawful order. zh888 will not volunteer your data to authorities beyond what is legally required.

6How Long We Keep Your Data

zh888 retains personal data only for as long as it is necessary for the purposes described in this policy, or as required by applicable legal obligations — whichever is longer. The following retention periods apply:

• Active account data: All personal, payment and gaming activity data associated with an active zh888 account is retained for the duration of the account's active status.
• Closed account data: Following account closure, zh888 retains identity and transaction records for a minimum of five years to comply with anti-money laundering record-keeping requirements. This period may be extended if an account is closed while under investigation.
• Payment transaction records: Individual deposit and withdrawal records are retained for seven years from the date of the transaction for financial compliance purposes.
• Support communications: Customer support transcripts and email records are retained for three years from the date of the interaction, or until the related account is closed and the post-closure retention period expires.
• Marketing preferences: Records of your marketing opt-in or opt-out status are retained for as long as necessary to honour your preference — this may be longer than the account itself in the case of opted-out players, to prevent inadvertent re-contact.

When data reaches the end of its retention period, zh888 either permanently deletes it or anonymises it so it can no longer be associated with any individual player. Anonymised data may be retained indefinitely for aggregate analytics.

7How zh888 Secures Your Data

zh888 implements a layered security architecture to protect your personal data from unauthorised access, disclosure, alteration or destruction. Our security measures include:

• Encryption in transit: All data transmitted between your device and zh888's servers is encrypted using TLS 1.3 with 256-bit AES encryption. No data travels in plain text — not your login credentials, not your CNIC details, not your payment information.
• Encryption at rest: Sensitive data stored on zh888's servers — including identity documents and payment records — is encrypted at rest using AES-256. Database-level encryption is applied to all tables containing personally identifiable information.
• Access controls: zh888 employs role-based access controls that restrict access to personal data to staff who require it for their specific job function. All access to player data is logged and audited. Staff with data access privileges undergo regular security training.
• Two-factor authentication: zh888 strongly recommends that all players enable two-factor authentication (2FA) on their accounts. 2FA significantly reduces the risk of unauthorised account access even if a password is compromised.
• Fraud monitoring: Automated systems monitor all account activity on zh888 in real time for patterns consistent with account takeover, identity fraud or money laundering. Anomalies trigger alerts for immediate human review.
• Penetration testing: zh888's platform undergoes regular penetration testing by independent security professionals to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a data breach that affects your personal data, zh888 will notify affected players and relevant authorities within the timeframes required by applicable law. A dedicated incident response team is on standby at all times.

Despite these measures, no system is completely invulnerable. zh888 cannot guarantee absolute security of your data transmitted over the internet, but we take every practical measure to minimise risk. Securing your account credentials and device is also your responsibility — please use a strong, unique password for your zh888 account.

8Cookies and Tracking Technologies

zh888 uses cookies and similar technologies to make the platform function correctly, to remember your preferences, to keep your session active when you're logged in, and to help us understand how the platform is being used so we can improve it for Pakistani players.

zh888 does not use third-party advertising or tracking cookies. No cookie placed by zh888 sends your data to any advertising network, social media platform or data broker. You can manage cookie preferences for functional and analytics cookies through your browser settings at any time.

9Your Data Rights

As a zh888 player, you have the following rights over your personal data. These rights can be exercised by contacting zh888 support at support@zh888.run. zh888 will respond to all data rights requests within 30 days.

zh888 will not charge you for exercising any of these rights. If a request is clearly unfounded, repetitive or excessive, zh888 may decline it or charge a reasonable administration fee — but we will always explain our reasoning in writing.

10Children's Privacy — Under-18 Policy

zh888 is strictly an adults-only platform. Registration requires users to be at least 18 years of age. zh888 does not knowingly collect personal data from anyone under the age of 18.

If zh888 becomes aware that personal data has been collected from a minor — whether through a misrepresentation of age at registration or any other means — we will immediately close the account, delete all associated personal data (subject to any legal record-keeping obligations related to the account), return any deposits net of withdrawals, and void all winnings.

If you are a parent or guardian and believe that a minor in your care has registered on zh888, please contact us immediately at support@zh888.run. We take these reports extremely seriously and act on them as an emergency priority.

11Updates to This Privacy Policy

zh888 may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or the services we offer. When material changes are made, zh888 will notify registered players via their registered mobile number or email address at least 7 days before the changes take effect.

The current version of this policy is always available on this page, with the "Last Updated" date clearly shown at the top. Minor editorial changes — such as formatting improvements or clarifications that don't affect the substance of the policy — may be made without advance notice.

Continued use of zh888 following a policy update constitutes your acceptance of the revised Privacy Policy. If you disagree with any update, you should stop using zh888 and request account closure before the new policy takes effect.

12How to Contact zh888 About Privacy

If you have any questions about this Privacy Policy, want to exercise your data rights, have a complaint about how zh888 has handled your personal data, or simply want to understand more about our data practices, please get in touch with our team.

• Email: support@zh888.run — mark your subject line "Privacy Request" for fastest routing to the data team.
• Live Chat: Available 24/7 on the zh888 platform in English and Urdu. For complex privacy matters, our chat team will escalate to the data team on your behalf.
• Response time: zh888 aims to acknowledge all privacy-related requests within 48 hours and to fully respond within 30 days. Complex requests involving large volumes of data may take slightly longer — we'll let you know in our acknowledgement if that's the case.

zh888 is committed to resolving privacy concerns directly and promptly. If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. zh888 will co-operate fully with any such authority investigation.