Privacy Policy —
How ZS666 Handles Your Data

This Privacy Policy (hereinafter referred to as "Policy") describes how ZS666, operating through the domain zs666.cam (hereinafter referred to as "ZS666", "Platform", "we", "us" or "our"), collects, uses, stores, shares and protects the personal data of individuals who access or use the Platform (hereinafter referred to as "User", "you" or "your").

ZS666 is committed to handling personal data responsibly and in a manner consistent with applicable data protection standards. This Policy applies to all personal data collected through the Platform — whether submitted during account registration, gathered through automated means during your use of the site, or provided during interactions with our customer support team.

By registering an account on ZS666 or by continuing to use the Platform after being presented with this Policy, you acknowledge that you have read and understood its contents. Where we rely on your consent as the lawful basis for processing a particular category of data, your continued use after notice constitutes that consent. You may withdraw consent at any time where it is the stated basis for processing — see Section 13 (Your Data Rights) for details.

The following terms are used throughout this Policy with the meanings set out below:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living individual, directly or in combination with other data.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. In the context of this Policy, ZS666 is the Data Controller for data collected through the Platform.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller, under contractual instruction and subject to confidentiality obligations.
• "Cookies" — small text files placed on a User's device by the Platform to facilitate session management, analytics and personalisation functions.
• "KYC Data" — identity and age verification documents and associated personal information collected as part of the Know Your Customer process, including CNIC, passport, proof of address and biometric liveness data.
• "Sensitive Data" — special categories of personal data that warrant heightened protection, including financial account information, identity documents and data relating to a User's gambling activity and patterns.

ZS666, operating through the domain zs666.cam, acts as the Data Controller in respect of all personal data collected through the Platform. ZS666 determines the purposes for which personal data is collected and the means by which it is processed.

Where ZS666 engages third-party service providers — such as payment processors, identity verification providers, fraud detection services, game studios or cloud hosting providers — those third parties act as Data Processors operating under contractual data processing agreements. They are permitted to use personal data only for the specific purposes for which they were engaged by ZS666 and are required to maintain appropriate technical and organisational security measures.

ZS666 collects personal data through several channels. The categories of data collected and the context in which each arises are summarised in the table below:

ZS666 processes personal data only where a valid lawful basis exists. The following lawful bases are relied upon, depending on the category of data and the purpose of processing:

• Contractual Necessity: Processing required to perform our agreement with you — including account creation, payment processing, game delivery and withdrawal handling. Without this processing, the Platform services cannot be delivered.
• Legal Obligation: Processing required to comply with applicable legal requirements, including Anti-Money Laundering (AML) obligations, identity verification requirements, tax reporting obligations and responses to lawful regulatory or law enforcement requests.
• Legitimate Interests: Processing necessary for ZS666's legitimate business interests, including fraud prevention, platform security, abuse detection, responsible gambling monitoring and service improvement — provided those interests do not override your fundamental rights.
• Consent: Processing for specific purposes where you have provided clear, freely given, informed and unambiguous consent — such as receiving marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

Personal data collected by ZS666 is used for the following purposes:

1. Account Administration: Creating, maintaining and securing your registered account, including processing login events, managing account settings and facilitating password resets.
2. Identity & Age Verification (KYC): Verifying your identity, confirming you meet the minimum age requirement (18+, or the higher minimum required by the operator or license jurisdiction), and satisfying our AML obligations.
3. Payment Processing: Facilitating deposits and withdrawals, reconciling transactions, detecting and preventing fraudulent payment activity, and maintaining financial records as required by law.
4. Game Delivery: Providing access to the games, sports betting markets, live casino content and other Platform features you have chosen to use.
5. Responsible Gambling: Monitoring gaming activity patterns to identify potential problem gambling behaviour, applying limits you have set, managing self-exclusion requests, and sending reality-check notifications where applicable.
6. Fraud Prevention & Security: Detecting, investigating and preventing fraudulent accounts, multi-accounting, bonus abuse, money laundering, unauthorised access and other forms of prohibited conduct.
7. Customer Support: Responding to queries, resolving complaints, managing escalations and maintaining records of support interactions for quality assurance purposes.
8. Platform Analytics & Improvement: Analysing usage patterns, identifying performance issues, testing new features and improving the overall user experience — using aggregated or anonymised data where possible.
9. Legal & Regulatory Compliance: Meeting our obligations under applicable laws, responding to regulatory enquiries, court orders or law enforcement requests.
10. Marketing Communications (with consent only): Sending you information about promotions, bonuses, new games and other ZS666 updates where you have opted in to receive such communications. You may unsubscribe at any time.

ZS666 does not sell, rent or commercially transfer your personal data to third parties. We share personal data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Payment Processors: Personal and transactional data is shared with third-party payment service providers to facilitate deposits and withdrawals. These providers process data under their own privacy policies and applicable financial regulations. Payment providers familiar to Pakistani users — such as those offering bank transfers via HBL, UBL, Meezan Bank or Bank Alfalah, or mobile wallet services referencing Easypaisa, JazzCash or Raast — operate under their own independent terms and are not gambling partners or endorsers of ZS666.
• Identity Verification Providers: KYC data is shared with third-party identity verification service providers to validate identity documents, perform liveness checks and assess fraud risk. These providers are contractually required to process data only for verification purposes.
• Game Content Providers: Technical session data (excluding full identity information) may be shared with game studio providers to deliver gameplay, resolve disputes about game outcomes, and confirm RNG integrity.
• Fraud Detection & Security Services: Device data, IP addresses and behavioural signals may be shared with third-party fraud prevention services to detect prohibited conduct, multi-accounting and suspicious activity.
• Legal Authorities: Personal data may be disclosed to competent legal, regulatory or law enforcement authorities where required by a valid legal order, regulatory obligation or statutory duty. ZS666 will endeavour to notify you of such disclosure where legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, restructuring or sale of assets, personal data held by ZS666 may be transferred to the acquiring entity, subject to the acquirer maintaining equivalent privacy protections.

ZS666 may transfer personal data to service providers, data centres or processing facilities located outside the country in which you reside. This includes transfers to jurisdictions that may have different levels of data protection law compared to your home country.

Where personal data is transferred internationally, ZS666 takes steps to ensure an adequate level of protection is maintained, including through the use of contractual data processing agreements, standard contractual clauses or equivalent data transfer mechanisms that impose obligations on the recipient consistent with applicable data protection standards.

Pakistani users should be aware that Pakistan currently operates under the Personal Data Protection Act framework, which is developing. ZS666 does not warrant that its data practices satisfy every requirement of Pakistani data protection legislation, as the Platform is not licensed or regulated in Pakistan. Users proceed on the basis of their own legal assessment.

ZS666 retains personal data for as long as is necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by applicable law. The following general retention principles apply:

• Active Account Data: Personal data associated with an active account is retained for the duration of the account's active status and for a defined period after account closure to meet our legal and regulatory obligations.
• KYC & AML Records: Identity verification documents and AML-related transaction records are retained for a minimum of five years following the end of the business relationship, in accordance with common AML regulatory requirements. This retention period may be extended in cases of ongoing investigation or litigation.
• Financial Transaction Records: Deposit, withdrawal and wagering records are retained for a period consistent with applicable financial record-keeping obligations.
• Support Communications: Customer support records are retained for a period sufficient to resolve disputes, manage recurring queries and satisfy legal hold obligations.
• Marketing Data: Where processing was based on consent, marketing preference data is retained until consent is withdrawn and for a reasonable period thereafter to evidence the consent record.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

ZS666 uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device by a website. Cookies allow the Platform to recognise your device across sessions, maintain your login state and collect anonymised analytics data.

The categories of cookies used on the ZS666 Platform are as follows:

• Essential / Strictly Necessary Cookies: Required for the Platform to function. These cookies manage your login session, maintain security tokens, load balance server traffic and prevent cross-site request forgery. They cannot be disabled without breaking core Platform functionality.
• Analytics & Performance Cookies: Collect aggregated, anonymised data about how users interact with the Platform — which pages are visited most frequently, how long users remain on specific sections and where navigation paths lead. This data helps us improve the Platform experience.
• Functional Cookies: Remember your preferences such as language settings, display options and responsibly set limits so you do not need to reconfigure them on each visit.
• Marketing & Personalisation Cookies (consent-based): Where you have consented, these cookies enable us to tailor content and promotional information based on your preferences and browsing history on the Platform. You may withdraw consent to these cookies at any time through your account settings or browser controls.

ZS666 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. Measures in place include:

• TLS/SSL encryption for all data transmitted between your device and ZS666 servers.
• Encryption of sensitive data at rest, including KYC documents and password hashes.
• Access controls limiting personal data access to authorised personnel who require it for their job function.
• Regular security assessments and penetration testing of Platform infrastructure.
• Logging and monitoring of access events to detect anomalous or unauthorised behaviour.
• Data minimisation practices that limit the volume of personal data retained in live systems.

No security measure is completely infallible. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, ZS666 will take prompt steps to contain the breach and notify affected users as required under applicable data protection obligations.

ZS666 is strictly an adults-only platform. We do not knowingly collect or process personal data of individuals under the age of 18, or under the higher minimum age required by the applicable operator or license jurisdiction. The Platform is not directed at minors and we do not permit minors to register, deposit or play.

Age verification is conducted as part of the KYC process. If ZS666 becomes aware that personal data has been collected from an individual who does not meet the minimum age requirement, that account will be closed immediately, all associated balances will be handled in accordance with our Terms and Conditions and applicable legal obligations, and the collected data will be deleted or anonymised where retention is not legally required.

Adults who share devices with minors are encouraged to use parental control software to prevent access to online gambling platforms, and to ensure their ZS666 login credentials are not accessible to underage individuals in their household.

Subject to applicable data protection law and any overriding legal obligations (such as AML retention requirements), you hold the following rights in respect of your personal data held by ZS666. To exercise any of these rights, contact our support team at the details provided in Section 16.

When Pakistani users make deposits or withdrawals using payment methods familiar to the local market — including bank transfers associated with institutions such as HBL, UBL, Meezan Bank and Bank Alfalah, or mobile wallet services such as Easypaisa, JazzCash and Raast — relevant transaction data is processed by those payment service providers under their own privacy terms and applicable financial regulations in Pakistan.

ZS666 does not receive, store or process your full banking credentials, IBAN, or mobile wallet PIN. The payment interface routes you to the relevant third-party payment processor, which handles the financial transaction independently. ZS666 receives only transactional confirmation data (amount, method type, status) necessary for crediting your account balance.

Pakistani users should note:

• Payment providers referenced on this Platform are mentioned as familiar contextual examples only. None of them endorse, approve, support or facilitate gambling transactions in partnership with ZS666.
• The State Bank of Pakistan and Pakistani financial institutions may impose restrictions on transactions to or from online gambling platforms. Users are responsible for understanding and complying with applicable rules set by their own financial service providers.
• ZS666 does not hold a license from any Pakistani authority and cannot guarantee the continued availability of any specific payment method for Pakistani users.

ZS666 reserves the right to amend this Privacy Policy at any time. The date of the most recent update is displayed at the top of this page. Where a change is material — meaning it significantly alters how your personal data is used or your rights in relation to it — we will notify registered users via email or via a prominent notice on the Platform before the change takes effect.

For non-material updates, such as corrections of typographical errors or clarifications of existing language, the revised Policy will be published on this page and the "Last Updated" date will be amended accordingly. We encourage you to review this Policy periodically.

Continued use of the Platform following any amendment to this Policy constitutes acceptance of the revised terms. If you do not accept a material change, you may close your account and withdraw your available balance before the change comes into effect.

For any questions, concerns or requests relating to this Privacy Policy — including requests to exercise your data rights under Section 13 — please contact the ZS666 support and data team using the details below: