zh8 Privacy Policy - How We Protect Your Personal Data

Introduction

zh8 ("we", "us", "our", or "the Platform") operates the online casino and sports betting platform accessible at zh8.bio. This Privacy Policy governs the collection, processing, storage, and sharing of personal data provided by users ("you", "your", or "Player") when accessing or using any part of the zh8 platform, including its website, customer support channels, payment systems, and related services.

zh8 processes personal data in accordance with applicable international data protection standards and the requirements of our gaming licence. We are committed to maintaining the privacy, confidentiality, and security of all personal information entrusted to us by Pakistani players and players from other eligible jurisdictions.

By registering an account with zh8, completing the identity verification process, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not consent to this Privacy Policy, you must not create an account or continue using zh8.

This Policy should be read alongside zh8's Terms & Conditions and Responsible Gaming Policy, both of which form part of the overall agreement governing your use of the Platform.

1 Categories of Personal Data We Collect

1.1 zh8 collects personal data in the following categories, depending on your level of engagement with the Platform:

1.2 Special Category Data. zh8 does not intentionally collect data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric data (beyond the selfie photographs used solely for identity verification), or health data. If such data is inadvertently disclosed during a support communication, it will not be stored beyond the minimum period necessary to resolve the relevant matter.

2 How We Collect Your Personal Data

2.1 Directly from You. The majority of personal data zh8 holds about you is information you provide voluntarily, including data submitted during registration, the KYC verification process, payment transactions, and communications with our support team.

2.2 Automatically via the Platform. When you access zh8, certain technical data is automatically collected by our servers, including your IP address, session identifiers, browser fingerprint data, and gameplay telemetry. This data is collected using standard web server logging technologies and, where applicable, cookies and similar tracking technologies as described in Section 6.

2.3 From Payment Processors. When you make a deposit or request a withdrawal, zh8 receives confirmation data from the relevant payment processor (such as JazzCash, EasyPaisa, or the banking system) sufficient to confirm that the transaction has been completed. zh8 does not receive or store full payment credentials such as complete bank card numbers.

2.4 From Identity Verification Services. Where zh8 uses a third-party identity verification service to assist with KYC checks, that service may provide a verification outcome (confirmed / not confirmed) and associated risk score. The personal data submitted to such a service is governed by both this Privacy Policy and the third party's own privacy documentation.

3 Legal Basis for Processing Your Data

zh8 processes your personal data under one or more of the following lawful bases:

• Contractual Necessity: Processing your identity data, financial data, and account activity data is necessary to perform the contract between you and zh8 — namely, providing you with access to the gaming platform, processing your deposits and withdrawals, and administering your account.
• Legal Obligation: zh8 is required by its international gaming licence and applicable anti-money laundering (AML) regulations to conduct Know Your Customer (KYC) verification, maintain detailed transaction records, and report certain activity to licensing authorities. This processing is not optional and cannot be refused without consequential account restriction.
• Legitimate Interests: zh8 processes technical and account activity data under legitimate interests to detect fraud, prevent money laundering, maintain platform security, improve the gaming experience, and identify problem gambling patterns for responsible gaming intervention purposes.
• Consent: Where zh8 sends you optional marketing communications about promotions, new games, PSL special odds, or VIP tier offers, this is done on the basis of your explicit consent, which you may withdraw at any time by updating your communication preferences in your account settings or by contacting [email protected].

4 How zh8 Uses Your Personal Data

The personal data zh8 collects is used for the following specific purposes:

• Account Creation and Management: To create and maintain your zh8 account, authenticate your identity at login, process password resets, and communicate account-related notifications such as security alerts and transaction confirmations.
• Identity and Age Verification: To verify that you are 21 years of age or older as required by zh8's responsible gaming policy and licensing obligations, and to confirm your identity in compliance with AML regulations.
• Payment Processing: To process deposits made via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, or USDT TRC20, and to execute withdrawal requests to your verified payment accounts denominated in Pakistani Rupees (PKR).
• Regulatory Compliance: To comply with zh8's obligations under its international gaming licence, including maintaining required transaction records, conducting AML checks, and responding to lawful requests from regulatory and law enforcement authorities.
• Fraud Prevention and Security: To detect and prevent fraudulent account activity, identify multi-accounting, monitor for unusual betting patterns, and protect the integrity of the Platform for all players.
• Responsible Gaming: To monitor gameplay patterns for signs of problem gambling, administer self-exclusion and deposit limit requests, and contact players where behavioural data indicates potential harm.
• Customer Support: To respond to your support queries, investigate complaints, and maintain records of communications for quality assurance purposes.
• Platform Improvement: To analyse aggregate usage data for the purpose of improving the zh8 user experience, game library curation, payment system performance, and overall platform reliability.
• Marketing Communications (Consent-Based): To send you information about promotions, bonuses, PSL betting specials, and new game releases where you have provided explicit consent to receive such communications.

5 Data Sharing and Disclosure

5.1 Service Providers. zh8 shares personal data with a limited number of third-party service providers who assist in operating the Platform. These providers are contractually bound to process your data only for the purposes specified by zh8 and in accordance with applicable data protection standards. Categories of such providers include:

• Payment processing partners (JazzCash, EasyPaisa, banking system operators);
• Identity verification and KYC service providers;
• Anti-fraud and AML compliance technology providers;
• Live chat and customer support platform providers;
• Cloud hosting and data storage infrastructure providers;
• Game software providers (who receive anonymised session identifiers, not full personal data).

5.2 Regulatory and Law Enforcement Disclosure. zh8 may disclose personal data to regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, a court order, or the conditions of our gaming licence. zh8 will inform you of such disclosures where legally permitted to do so.

5.3 Business Transfers. In the event of a merger, acquisition, or sale of all or part of zh8's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified via the email address registered to your account in the event that such a transfer results in a material change to how your data is processed.

5.4 No Sale of Data. zh8 does not and will never sell personal data to any third party for commercial purposes. This prohibition is absolute and not subject to exception regardless of the commercial value of the data concerned.

6 Cookies & Tracking Technologies

6.1 What Cookies We Use. zh8 uses the following categories of cookies and similar technologies when you access the Platform:

• Strictly Necessary Cookies: These are essential for the Platform to function and cannot be disabled. They maintain your login session, remember your language preference, and enable secure authentication. No consent is required for these cookies.
• Functional Cookies: These remember your preferences within the Platform, such as your preferred currency display (PKR), game categories you visit most frequently, and interface settings. They do not track activity outside zh8.
• Analytics Cookies: zh8 uses internal analytics tools to understand how Players use the Platform in aggregate — which game categories are most visited, where in the registration flow users drop off, and what pages generate the most support queries. This data is anonymised before analysis.
• Security Cookies: These assist zh8's fraud detection systems in identifying unusual login patterns, device changes, and potentially compromised sessions. They are part of our account security infrastructure.

6.2 Cookie Management. You may adjust your browser settings to block or delete cookies. Please note that blocking strictly necessary cookies will impair your ability to use the zh8 Platform, including maintaining a login session. zh8 does not use cookies for cross-site advertising tracking or real-time behavioural profiling for advertising purposes.

6.3 Local Storage. zh8 may also use browser local storage to retain session preferences across visits. This data remains on your device and is not transmitted to zh8's servers except as part of normal authenticated session activity.

7 Data Retention

7.1 Retention Principles. zh8 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and licensing obligations. The following general retention periods apply:

• Account Data: Retained for the duration of the account relationship and for a minimum of 5 years following account closure, as required by standard AML regulatory requirements applicable to licensed gaming operators.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction, in accordance with anti-money laundering record-keeping obligations.
• KYC Verification Documents: Retained for a minimum of 5 years following the completion of the verification process or account closure, whichever is later.
• Customer Support Communications: Retained for a minimum of 3 years following the resolution of the relevant support matter.
• Marketing Consent Records: Retained for as long as your account is active and for a further period of 3 years following account closure to demonstrate compliance with consent-based marketing practices.

7.2 Deletion. Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with zh8's data management procedures. Anonymised data (from which personal identification is no longer possible) may be retained indefinitely for aggregate analytics purposes.

8 Security Measures

8.1 Technical Safeguards. zh8 implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your browser and zh8 servers is encrypted using TLS 1.3 with 256-bit encryption. This applies to login credentials, payment data, and all account communications.
• Encryption at Rest: Personal data stored on zh8 servers, including KYC documents and financial records, is encrypted at rest using AES-256 encryption standards.
• Password Hashing: Account passwords are hashed using the bcrypt algorithm with an appropriate cost factor before storage. zh8 personnel cannot retrieve or view your plain-text password under any circumstances.
• Access Controls: Access to player personal data is restricted on a strict need-to-know basis. zh8 employees with legitimate access rights are subject to confidentiality obligations and regular security training.
• Intrusion Detection: zh8's infrastructure includes real-time intrusion detection systems, anomaly monitoring, and automated alerts for unusual data access patterns.
• Regular Audits: zh8 conducts periodic security audits and penetration testing of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.

8.2 Data Breach Response. In the event of a personal data breach that poses a risk to your rights and freedoms, zh8 will notify affected Players via their registered email address without undue delay and, where required, will notify relevant regulatory authorities within the timeframes prescribed by applicable law. The notification will describe the nature of the breach, the data affected, the likely consequences, and the measures zh8 has taken or proposes to take to address the breach.

9 Your Data Rights

Depending on applicable law, you may have the following rights in respect of personal data that zh8 holds about you. To exercise any of these rights, contact zh8's data privacy team at [email protected] with the subject line "Data Privacy Request". zh8 will respond within 30 calendar days.

• Right of Access (Subject Access Request): You may request a copy of the personal data zh8 holds about you, together with information about how it is used, where it is held, and with whom it has been shared. zh8 will provide this free of charge unless the request is manifestly unfounded or excessive.
• Right to Rectification: If any personal data zh8 holds about you is inaccurate or incomplete, you may request that it be corrected. Some corrections may require supporting documentation before they can be implemented.
• Right to Erasure ("Right to Be Forgotten"): You may request that zh8 delete personal data it holds about you where it is no longer necessary for the purposes for which it was collected, your consent has been withdrawn, or the processing is unlawful. This right is subject to zh8's mandatory regulatory retention obligations described in Section 7.
• Right to Restriction of Processing: In certain circumstances, you may request that zh8 restrict the processing of your data — for example, while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that zh8 provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing carried out under legitimate interests grounds at any time. You may also withdraw consent for marketing communications at any time without affecting the lawfulness of processing carried out before withdrawal.

10 Children & Minors

10.1 Age Restriction. zh8 is strictly an adults-only platform, accessible only to individuals aged 21 years or older. zh8 does not knowingly collect personal data from persons under the age of 21. The collection and processing of personal data from underage individuals is not permitted under any circumstances.

10.2 Underage Registration. Where zh8 discovers or is informed that an individual under 21 years of age has registered an account, zh8 will immediately suspend the account, delete all personal data associated with it to the extent not required to be retained under regulatory obligations, and return any deposits to the payment source from which they originated. Any winnings generated by an underage account will be forfeited.

10.3 Parental Responsibility. Parents and guardians are strongly encouraged to use parental control tools and device-level access controls to prevent minors from accessing online gambling platforms. zh8 recommends that any device used by minors be protected with password controls that prevent access to the zh8 account of any adult member of the household.

11 Third-Party Services & Links

11.1 Game Providers. zh8's game library is populated by licensed third-party software developers including, but not limited to, Evolution Gaming, Pragmatic Play, and PG Soft. When you play a game provided by a third-party developer, game session data (such as bet amounts, game round identifiers, and session duration) is transmitted to the relevant provider solely for the purpose of operating the game. Game providers operate under independent privacy policies and data processing agreements with zh8.

11.2 Payment Processors. When you initiate a deposit via JazzCash, EasyPaisa, or any bank transfer, your transaction data is processed by the relevant payment service provider under that provider's own terms and privacy policy. zh8 receives only the information necessary to confirm that the transaction has been completed.

11.3 No Responsibility for Third-Party Practices. zh8 is not responsible for the privacy practices of third-party service providers beyond ensuring that appropriate data processing agreements are in place. Players are encouraged to review the privacy policies of payment providers and other third parties they interact with directly.

12 Changes to This Privacy Policy

12.1 zh8 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — meaning they affect your rights or the purposes for which your data is used — zh8 will provide advance notice to registered Players via email to their registered address and via a notice displayed on the Platform for a minimum of 14 days prior to the changes taking effect.

12.2 Minor changes (such as corrections of typographical errors, updates to contact information, or clarification of existing practices without substantive change) may be made without prior individual notice, although the updated date at the top of this document will be revised accordingly.

12.3 Your continued use of zh8 following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised policy, you must request account closure before the effective date of the change.

13 Contact Us & Privacy Requests

For all privacy-related matters, including Subject Access Requests, rectification requests, marketing opt-outs, and data breach concerns, please contact the zh8 privacy team using the details below. Please include "Data Privacy Request" in the subject line to ensure your query is routed to the appropriate team member.

• Email: [email protected]
• Subject Line: Data Privacy Request
• Response Time: Within 30 calendar days
• Live Chat: Available 24/7 for general privacy queries

zh8's support team includes agents based in Karachi, Lahore, and Islamabad who handle privacy queries with full understanding of the local context. If you are concerned about a payment-related data query involving JazzCash or EasyPaisa transactions, our local team can assist with the specific nuances of Pakistani payment system data.