zaya9 Privacy Policy —
How We Protect Your Data

1 About This Policy

This Privacy Policy ("Policy") sets out the basis on which zaya9 ("the Platform", "we", "us", "our") collects and processes personal data from users ("you", "the User", "the Player") who access or use the services available at zaya9.ws.

We are committed to protecting your privacy and handling your personal data with transparency, integrity, and in compliance with applicable data protection principles. This Policy applies to all personal data we collect through the Platform, whether submitted directly by you during registration or account use, obtained automatically through your use of our services, or received from third parties in connection with your account.

This Policy should be read alongside our Terms & Conditions, which govern your overall use of the Platform. Terms defined in the Terms & Conditions have the same meaning when used in this Policy unless otherwise stated.

2 Data Controller

zaya9 acts as the data controller in respect of the personal data it processes about you. As data controller, zaya9 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

If you have any questions about how zaya9 handles your personal data, or if you wish to exercise any of your data rights described in this Policy, please contact our Data Protection team using the contact details provided in Section 15 of this Policy.

3 Data We Collect

The categories of personal data that zaya9 may collect about you include, but are not limited to, the following:

We do not collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) unless you voluntarily provide such information in the context of a responsible gaming self-assessment or support request, and only then with your explicit consent.

4 How We Use Your Data

zaya9 uses the personal data we collect for the following purposes:

• Account Management: To create, maintain, and administer your zaya9 player account, including verifying your identity and processing your registration.
• Service Delivery: To provide you with access to games, sports betting markets, promotions, and all other features of the Platform.
• Payment Processing: To process your deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported Bangladesh banking partners, and to maintain accurate financial records.
• Identity and Age Verification: To verify that you meet the minimum age requirement of 21 years and to confirm that the personal information you have provided is accurate and genuine.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, money laundering, and other forms of illegal or abusive activity on the Platform.
• Legal and Regulatory Compliance: To comply with applicable anti-money laundering (AML), know-your-customer (KYC), and other legal and regulatory obligations.
• Customer Support: To respond to your enquiries, complaints, and support requests in a timely and effective manner.
• Responsible Gaming: To monitor player behaviour patterns that may indicate problem gambling and to proactively offer responsible gaming tools where appropriate.
• Platform Improvement: To analyse usage patterns and player feedback in order to improve the functionality, performance, and content of the zaya9 Platform.
• Marketing Communications: To send you relevant promotional offers, bonus notifications, and news about zaya9 — but only where you have opted in to receive such communications. You may opt out at any time.

5 Legal Basis for Processing

zaya9 processes your personal data on the following legal bases, depending on the specific purpose of the processing:

• Contractual Necessity: Processing that is necessary to fulfil our contractual obligations to you under the Terms & Conditions — for example, managing your account, processing payments, and delivering gaming services.
• Legal Obligation: Processing that is required to comply with applicable laws and regulations, including AML, KYC, and fraud prevention obligations.
• Legitimate Interests: Processing that is necessary for our legitimate business interests — such as preventing fraud, improving Platform security, and understanding how our services are used — provided that these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing that is based on your freely given, specific, and informed consent — such as sending you optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6 Sharing Your Data

zaya9 does not sell, rent, or trade your personal data. We may share your personal data with the following categories of third parties only to the extent necessary to deliver our services and meet our legal obligations:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and other verified payment processors — to facilitate deposits and withdrawals.
• Identity Verification Providers: Specialist KYC and AML service providers who assist us in verifying the identity and age of new and existing players.
• Game Content Providers: Licensed game studios such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe — to the minimum extent required to deliver their game content through the Platform.
• IT and Infrastructure Providers: Cloud hosting, data storage, and security service providers who process data on our behalf under strict data processing agreements.
• Legal and Regulatory Authorities: Law enforcement agencies, regulatory bodies, tax authorities, and courts where we are required by law to disclose your information.
• Professional Advisers: Lawyers, auditors, and other professional advisers where necessary for the conduct of our business, all of whom are bound by confidentiality obligations.

All third parties with whom we share personal data are required to handle that data in accordance with applicable data protection standards and are bound by appropriate contractual data protection obligations.

7 Cookies & Tracking Technologies

zaya9 uses cookies and similar technologies (such as web beacons and local storage) to operate the Platform, remember your preferences, maintain your session, and understand how players interact with our services. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These cookies enable core features such as account authentication, session management, and security. They cannot be disabled.
• Functional Cookies: Allow the Platform to remember choices you have made — such as your preferred language or game settings — to provide a more personalised experience.
• Analytical Cookies: Help us understand how players use the Platform — such as which pages are visited most frequently and how long players spend on each section. This data is used in aggregate form to improve our services.
• Security Cookies: Used to detect and prevent fraudulent activity and to protect the integrity of player accounts.

zaya9 does not use third-party advertising cookies, retargeting cookies, or any cookie technology that tracks your behaviour across other websites for commercial advertising purposes.

Most browsers allow you to control cookie settings through your browser preferences. Please note that disabling strictly necessary cookies may impair the functionality of your zaya9 account and some Platform features may not work as expected.

8 Data Retention

zaya9 retains personal data for as long as is necessary to fulfil the purposes described in this Policy, including compliance with our legal and regulatory obligations. The following general retention guidelines apply:

• Account Data: Retained for the duration of your account and for a period of five (5) years following account closure, to meet legal and audit obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years following the date of each transaction, in accordance with applicable financial record-keeping requirements.
• Identity Verification Documents: Retained for five (5) years following account closure or the completion of the relevant KYC process, whichever is later.
• Customer Support Communications: Retained for three (3) years following the date of the last communication in a given thread.
• Technical and Usage Data: Typically retained for thirteen (13) months from the date of collection, after which it is aggregated or deleted.
• Marketing Consent Records: Retained for as long as you hold an active account plus three (3) years, to demonstrate the basis for marketing communications sent to you.

At the end of the applicable retention period, personal data is securely deleted, anonymised, or pseudonymised so that it can no longer be attributed to a specific individual. We review our retention schedules periodically and update them where required by changes in law or business practice.

9 Data Security

zaya9 takes the security of your personal data seriously and has implemented a range of technical and organisational measures designed to protect it against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption at rest for sensitive stored data, including payment details and identity documents.
• Strict access controls ensuring that employee access to personal data is limited to those with a genuine business need.
• Regular security audits, penetration testing, and vulnerability assessments of our Platform infrastructure.
• Intrusion detection systems and real-time monitoring for suspicious activity on our servers and networks.
• Staff training on data protection principles and security best practices.
• Incident response procedures to ensure that any data breach is promptly identified, contained, and, where required by law, reported to the appropriate authority and to affected individuals.

Despite these measures, no system can guarantee absolute security. You play an important role in keeping your account secure by maintaining the confidentiality of your login credentials and notifying us immediately of any suspected unauthorised access to your account.

10 Your Rights

Subject to applicable law, you have the following rights in relation to the personal data that zaya9 holds about you:

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how we use it.
• Right to Rectification: You have the right to ask us to correct any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: In certain circumstances, you have the right to request that we delete the personal data we hold about you. This right is subject to overriding legal obligations that may require us to retain certain data.
• Right to Restriction: You have the right to request that we restrict the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of your data is being resolved.
• Right to Data Portability: Where processing is based on your consent or on a contract, you have the right to receive the personal data you have provided to us in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data that is based on our legitimate interests, including profiling for marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact our support team at [email protected] with the subject line "Data Rights Request". We will respond to all verified requests within thirty (30) calendar days. In cases of complexity or volume, this period may be extended by a further thirty (30) days, in which case we will notify you of the extension.

11 Children's Privacy

The zaya9 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or store personal data relating to individuals under the age of 21. If we become aware that personal data has been collected from a person under 21 without appropriate parental or guardian consent, we will take immediate steps to delete that data and close the associated account.

If you believe that a minor may have registered on or be using the zaya9 Platform, please notify us immediately at [email protected]. We take the protection of minors very seriously and will investigate all such reports without delay.

Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gambling platforms. zaya9 cooperates fully with responsible gaming organisations that provide filtering and blocking tools for this purpose.

12 International Data Transfers

In order to deliver certain Platform services — including payment processing, identity verification, and cloud-based infrastructure — your personal data may be transferred to and processed in countries outside of Bangladesh. When such transfers occur, zaya9 takes appropriate steps to ensure that your personal data receives an equivalent level of protection to that which it would receive in Bangladesh.

These steps may include entering into data transfer agreements with the relevant third parties that incorporate appropriate data protection safeguards, or ensuring that the recipient operates in a jurisdiction that provides an adequate level of data protection.

By using the zaya9 Platform and submitting your personal data to us, you acknowledge that your data may be transferred, stored, and processed in jurisdictions outside of Bangladesh in the manner described in this section.

13 Third-Party Links

The zaya9 Platform may contain links to or integrations with third-party services, including game studios and payment processors, whose privacy practices are governed by their own privacy policies. zaya9 is not responsible for the privacy practices of these third parties, and this Privacy Policy does not apply to any data collected by them.

We encourage you to review the privacy policies of any third-party services you interact with in connection with the zaya9 Platform. If you have concerns about the privacy practices of a third-party provider integrated into zaya9, please contact us and we will try to assist where possible.

14 Policy Updates

zaya9 reserves the right to update or amend this Privacy Policy at any time. When we make material changes to this Policy, we will publish the revised version at zaya9.ws/privacy-policy with an updated effective date. For significant changes that materially affect how we process your personal data, we will notify you via the email address registered to your account at least fourteen (14) days before the change takes effect.

Your continued use of the Platform following notification of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should cease using the Platform and may request account closure in accordance with our Terms & Conditions.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way zaya9 handles your personal data, please contact our team using the details below. We are committed to handling all privacy-related enquiries with care and professionalism.

Email: [email protected]

When contacting us about a privacy matter, please include your registered account username, a clear description of your query or request, and any relevant supporting information. We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within thirty (30) calendar days.