zc22 Privacy Policy

1. Who We Are

zc22 is an internationally licensed online gaming and sports betting platform operating at zc22.org. We offer Pakistani players a full suite of gaming products — cricket and PSL betting, live casino, slots, basketball markets, and speciality games such as Gold Toad Fishing — all denominated in Pakistani Rupees (PKR) and supported by local payment methods including JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank.

For the purposes of this Privacy Policy, zc22 acts as the data controller — meaning we determine the purposes and means of processing your personal information. This policy applies to all personal data collected through the zc22 platform, its associated mobile interfaces, customer support channels, and marketing communications directed at registered and prospective users in Pakistan and other permitted jurisdictions.

If you have any questions about how zc22 handles your personal data, you may contact our Data Protection team using the contact details provided in Section 9 of this policy. We are committed to responding to all privacy-related queries within a reasonable timeframe.

2. Information We Collect

zc22 collects personal information in several ways — directly from you when you register or interact with the platform, automatically through your use of our services, and in certain circumstances from third-party sources such as identity verification providers and payment processors. The categories of information we collect are set out below.

2.1 Information You Provide Directly

• Registration data: Full legal name, date of birth, gender, residential address (city, province, country), email address, and mobile number.
• Identity verification (KYC) documents: Copy of your Pakistani CNIC (Computerised National Identity Card, front and back), passport, or other government-issued photo ID; utility bills or bank statements confirming your address; and source-of-funds documentation where required under our licensing obligations.
• Financial information: Details of the payment instruments you use to deposit and withdraw funds — including mobile wallet identifiers (JazzCash, EasyPaisa) and bank account references (HBL, UBL, Meezan Bank) — though we do not store full card numbers or banking credentials on our servers.
• Communications: Records of correspondence you send to zc22 customer support via live chat, email, or our in-platform messaging system, including any attachments you provide.
• Responsible gaming preferences: Self-exclusion requests, deposit and loss limit settings, cooling-off periods, and any other responsible gaming elections you make within your Account dashboard.

2.2 Information Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage and behavioural data: Pages visited, features accessed, games played, bets placed, session duration, click-stream data, and search queries entered within the platform.
• Location data: Approximate geographic location derived from your IP address, used for regulatory compliance and fraud prevention purposes. We do not collect precise GPS coordinates.
• Transaction logs: A complete record of all deposits, withdrawals, wagers, game results, bonus activations, and PKR wallet movements within your Account.
• Cookies and similar technologies: As described in Section 6 of this policy.

2.3 Information from Third Parties

• Identity verification providers: Where zc22 uses third-party KYC service providers to verify your identity and age, those providers may return verification results and associated data to us.
• Payment processors: Transaction confirmation data and, where applicable, risk-scoring information provided by our payment gateway partners.
• Fraud and AML screening: Data returned from anti-money-laundering (AML) and politically exposed persons (PEP) screening services maintained by our compliance partners.

3. How We Use Your Information

zc22 uses the personal information we collect for clearly defined, legitimate purposes. We do not sell your personal data to third parties, and we do not use it for purposes incompatible with those described below.

4. Legal Basis for Processing

zc22 processes your personal data only where a recognised legal basis exists. The primary legal bases on which we rely are as follows:

• Contractual necessity: Processing that is necessary to perform the contract between you and zc22 — including Account registration, KYC verification, payment processing, game delivery, and customer support.
• Legal obligation: Processing required to comply with our obligations under our international gaming licence, AML regulations, and lawful directions from regulatory or law enforcement authorities.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and analytics, where our legitimate business interests are not overridden by your privacy rights.
• Consent: Processing for direct marketing communications and the placement of non-essential cookies, where you have provided explicit, freely given, and revocable consent.

5. Sharing Your Information

zc22 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your information only in the circumstances described below, and only to the extent strictly necessary for the specified purpose.

• Identity verification and KYC providers: Third-party services that assist zc22 in verifying your CNIC, age, and address as part of our mandatory onboarding process.
• Payment processors and financial institutions: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other payment infrastructure providers involved in processing your PKR deposits and withdrawals.
• AML and fraud screening services: Compliance technology providers that assist zc22 in meeting its anti-money-laundering obligations and detecting fraudulent activity.
• Game and technology providers: Third-party game studios and platform technology providers whose games and software are hosted within the zc22 platform, where access to transactional data is necessary for game delivery and result verification.
• Regulatory and law enforcement authorities: Government agencies, regulators, or law enforcement bodies where disclosure is required by law, court order, or our licensing obligations.
• Professional advisers: Legal, audit, and compliance advisers engaged by zc22 under appropriate confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of zc22's business assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third parties with whom zc22 shares personal data are contractually required to process that data only for the specified purpose, to maintain appropriate security standards, and to comply with applicable data protection obligations.

6. Cookies & Tracking Technologies

zc22 uses cookies and similar tracking technologies (such as web beacons and local storage) to operate and improve the platform. The categories of cookies we use are described below.

You may manage your cookie preferences through the cookie consent panel available on the zc22 platform. Please note that disabling certain functional cookies may affect your experience on the platform. Strictly necessary cookies cannot be disabled as they are essential to platform operation and security.

7. Data Retention

zc22 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by our international gaming licence and applicable law. The following retention principles apply:

• Active Account data: Retained for the duration of your Account and for a minimum of five (5) years following permanent Account closure, in accordance with AML and gaming regulatory requirements.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of Account closure or the date of the last transaction, whichever is later.
• Transaction records: Complete PKR transaction logs are retained for a minimum of five (5) years for audit, regulatory, and dispute resolution purposes.
• Customer support records: Retained for three (3) years from the date of the last support interaction, unless a longer period is required for an ongoing dispute.
• Marketing consent records: Retained for the period during which consent is active plus three (3) years, to demonstrate compliance with consent obligations.
• Self-exclusion records: Retained indefinitely to prevent inadvertent re-registration by self-excluded users.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. Anonymised data (from which you cannot be identified) may be retained indefinitely for statistical and platform improvement purposes.

8. Data Security

zc22 takes the security of your personal data seriously. We have implemented a layered set of technical and organisational measures designed to protect your information against unauthorised access, disclosure, alteration, or destruction.

• 256-bit SSL/TLS encryption: All data transmitted between your device and the zc22 platform is encrypted using industry-standard 256-bit SSL/TLS protocols.
• Encryption at rest: Sensitive personal data, including KYC documents and financial information, is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within zc22's systems is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and regular security training.
• Two-factor authentication (2FA): 2FA is available to all registered zc22 Account holders and is strongly recommended as an additional layer of Account security.
• Penetration testing and audits: zc22 conducts regular third-party security audits and penetration tests to identify and remediate vulnerabilities in our systems.
• Incident response: zc22 maintains a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify affected users and relevant authorities in accordance with our licensing obligations.

9. Your Rights

As a zc22 user, you hold a number of rights in relation to the personal data we hold about you. zc22 is committed to honouring these rights in a timely and transparent manner. To exercise any of the rights described below, please contact the zc22 Data Protection team by email at [email protected] — plain text only; do not send sensitive data via email without encryption.

• Right of access: You may request a copy of the personal data zc22 holds about you, together with information about how it is used and shared.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data held in your zc22 Account.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected — subject to our overriding legal and regulatory retention obligations.
• Right to restrict processing: You may request that zc22 restrict its processing of your personal data in certain circumstances, for example while a rectification request is being resolved.
• Right to data portability: You may request a copy of the personal data you have provided to zc22 in a structured, commonly used, machine-readable format.
• Right to object: You may object at any time to processing of your personal data for direct marketing purposes. You may also object to processing based on zc22's legitimate interests, subject to our demonstrating compelling legitimate grounds.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting prior processing.

zc22 will respond to all verified rights requests within thirty (30) days of receipt. Where a request is complex or numerous, we may extend this period by a further sixty (60) days, in which case we will notify you of the extension and the reasons for it. We will not charge a fee for handling rights requests unless a request is manifestly unfounded or excessive.

10. Children & Minors

If a parent, guardian, or responsible adult in Pakistan believes that a person under the age of 21 has registered an Account or provided personal data to zc22, they should contact our customer support team immediately at [email protected]. Upon receipt of a verified report, zc22 will promptly close the relevant Account and delete the associated personal data, subject to any mandatory regulatory retention obligations.

zc22 supports the use of parental control software and third-party tools that help parents and guardians prevent minors from accessing online gaming platforms. We strongly encourage all households in Karachi, Lahore, Islamabad, Faisalabad, and across Pakistan with minors to use such tools as an additional safeguard.

11. International Data Transfers

zc22 operates as an internationally licensed platform. In the course of providing our services to Pakistani users, your personal data may be transferred to and processed in countries outside Pakistan — including the jurisdiction in which our gaming licence is held and the locations of our third-party service providers.

Where such transfers occur, zc22 ensures that appropriate safeguards are in place to protect your personal data, including contractual data transfer agreements with service providers that impose data protection obligations equivalent to those set out in this Privacy Policy. We do not transfer your personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate contractual and technical safeguards.

By registering an Account and using the zc22 platform, you acknowledge and consent to the international transfer of your personal data as described in this section, subject at all times to the protections described herein.

12. Changes to This Privacy Policy

zc22 reserves the right to update and amend this Privacy Policy at any time to reflect changes in our practices, the services we offer, our legal and regulatory obligations, or applicable data protection standards. The date of the most recent revision is displayed at the top of this page.

Where changes to this Privacy Policy are material — meaning they significantly affect your rights or how we use your personal data — zc22 will use reasonable efforts to notify registered users via the email address associated with their Account prior to the changes taking effect. For non-material updates, publication of the revised policy on the zc22 platform will constitute sufficient notice.

Your continued use of the zc22 platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you should cease using the platform and may request closure of your Account by contacting zc22 customer support.

This Privacy Policy should be read in conjunction with the zc22 Terms & Conditions and Responsible Gaming Policy, all of which together govern your relationship with the zc22 platform.