zoya9 Privacy Policy — How We Protect Your Personal Data

1. Who We Are

zoya9 ("we", "us", "our") operates the online casino and sports betting platform accessible at https://zoya9.bio. This platform is designed and operated for players resident in Bangladesh, offering live casino games, slot titles, cricket betting, and associated promotional services. All services are conducted in English and transactions are denominated in Bangladeshi Taka (BDT).

zoya9 is the data controller responsible for the personal data of all registered players and website visitors. If you have any questions about how your data is handled, you may contact our support team at any time using the contact details provided in Section 14 of this Policy.

This Privacy Policy applies to all personal data collected through the zoya9 website, mobile-optimised platform, any associated subdomains, and all direct communications between zoya9 and its players, including email, SMS, and live chat interactions.

2. Data We Collect

zoya9 collects several categories of personal data in order to operate the platform, verify player identity, process financial transactions, and comply with responsible gaming obligations. The categories of data we collect are set out in the table below.

Data Category	Specific Data Points	Collection Point
Identity Data	Full legal name, date of birth, gender, National ID number, passport number, photograph	Registration, KYC verification
Contact Data	Email address, Bangladesh mobile number, residential address including city (Dhaka, Chittagong, Sylhet, Khulna, etc.)	Registration, account updates
Financial Data	bKash/Nagad/Rocket/Upay account numbers, Visa/Mastercard details (masked), transaction history, deposit and withdrawal records	Cashier / payment processing
Gaming Data	Game session logs, bet history, win/loss records, bonus claims, wagering activity, sports betting selections	Platform activity
Technical Data	IP address, device type, operating system, browser type and version, screen resolution, session timestamps	Automatic collection
Communications Data	Live chat transcripts, support email correspondence, SMS interaction logs, feedback submissions	Customer support interactions
Preference Data	Language settings, notification preferences, marketing consent status, responsible gaming limits set	Account settings

3. How We Collect Data

3.1 Data You Provide Directly

The primary source of personal data is information you provide to zoya9 directly. This includes data submitted during the account registration process, information entered when completing KYC identity verification, payment details entered in the cashier section, and messages sent to our customer support team. You are responsible for ensuring that the information you provide is accurate and kept up to date.

3.2 Data Collected Automatically

When you visit the zoya9 platform, certain technical data is collected automatically by our servers and analytics systems. This includes your IP address, the type and version of browser you are using, your device's operating system, the pages you visit and the duration of each visit, and session timestamps. This data is collected using cookies and similar technologies, which are described further in Section 7 of this Policy.

3.3 Data From Third Parties

In certain circumstances, zoya9 may receive personal data about you from third-party sources. These include identity verification service providers who assist with KYC checks, payment processors including bKash, Nagad, Rocket, Upay, Visa, and Mastercard who provide transaction confirmation data, and fraud prevention services who flag high-risk account behaviour. Data received from these sources is handled under the same standards as data you provide directly.

4. Why We Use Your Data

zoya9 uses your personal data for a number of specific, documented purposes. We do not use your data for any purpose that is incompatible with the reasons for which it was originally collected. The primary purposes for which we process personal data are as follows:

• Account management: To create, maintain, and secure your zoya9 player account, including processing logins, managing account settings, and enabling password resets.
• Identity verification (KYC): To confirm that you meet the minimum age requirement of 21 years and to verify your identity before processing withdrawals, in accordance with responsible gaming and anti-money laundering obligations.
• Payment processing: To process deposits and withdrawals in Bangladeshi Taka via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and to maintain accurate financial transaction records.
• Customer support: To respond to your enquiries, resolve complaints, and provide ongoing assistance through our 24/7 support team.
• Responsible gaming: To monitor your gaming activity for signs of problem gambling, to enforce deposit limits and self-exclusion requests, and to provide proactive responsible gaming interventions where appropriate.
• Fraud and security: To detect, investigate, and prevent fraudulent transactions, money laundering, bonus abuse, and other prohibited activities on the platform.
• Service improvement: To analyse aggregated and anonymised usage data in order to improve the design, functionality, and content of the zoya9 platform.
• Marketing communications: To send you promotional offers, bonus notifications, and seasonal campaigns (such as BPL cricket season promotions or Eid special offers) where you have given your explicit consent to receive such communications. You may withdraw this consent at any time.
• Legal compliance: To meet obligations imposed by applicable law, including responding to lawful requests from regulatory authorities.

5. Lawful Basis for Processing

Every data processing activity conducted by zoya9 is supported by one of the following lawful bases:

• Contractual necessity: Processing that is required to perform our contract with you — for example, processing your deposits and withdrawals, managing your account, and delivering the games and services you have signed up for.
• Legal obligation: Processing that is required for zoya9 to comply with applicable laws — for example, KYC identity verification, anti-money laundering record-keeping, and responding to lawful authority requests.
• Legitimate interests: Processing that is necessary for zoya9's legitimate business interests, provided those interests are not overridden by your rights — for example, fraud detection, security monitoring, and platform analytics. We conduct a balancing test before relying on this basis.
• Consent: Processing based on your freely given, specific, and informed consent — for example, sending you direct marketing communications. You may withdraw consent at any time by contacting [email protected] or updating your account notification preferences.

6. Data Sharing & Transfers

6.1 Service Providers

zoya9 shares personal data with carefully selected third-party service providers who assist us in operating the platform. These include payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard), identity verification providers, game software providers (including Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, and Spribe), hosting and infrastructure providers, and customer support platform operators. All service providers are bound by data processing agreements that require them to handle your data in accordance with applicable data protection standards and to use it only for the purposes for which it was shared.

6.2 Legal Disclosures

zoya9 may disclose personal data to law enforcement agencies, regulatory authorities, or other government bodies where required to do so by applicable law, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of zoya9, its players, or the public.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets involving zoya9, personal data held about players may be transferred to the acquiring entity as part of the transaction. We will notify affected players of any such transfer and the privacy implications via the email address on file.

7. Cookies & Tracking

zoya9 uses cookies and similar tracking technologies to operate the platform correctly, remember your preferences, maintain your login session, and gather analytics data about how the platform is used. The main categories of cookies used are as follows:

• Strictly necessary cookies: These are required for the platform to function. They include session cookies that keep you logged in during a gaming session and security cookies that prevent cross-site request forgery. These cookies cannot be disabled without breaking core platform functionality.
• Functional cookies: These remember your preferences such as language settings and notification choices so you do not have to re-enter them on every visit.
• Analytics cookies: These collect aggregated, anonymised data about how players navigate the platform — which pages are visited most frequently, where users drop off, and how long sessions last. This data is used exclusively for internal platform improvement purposes.
• Security and fraud prevention cookies: These help us identify unusual or suspicious account behaviour and protect the platform from automated bots and malicious actors.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the zoya9 platform. zoya9 does not use third-party advertising or behavioural tracking cookies.

8. Data Retention

zoya9 retains personal data only for as long as it is needed for the purposes for which it was collected, or as required by applicable law. Our general data retention principles are as follows:

• Active account data: Retained for the full duration of your account relationship with zoya9, plus a minimum post-closure period as required by anti-money laundering and responsible gaming regulations.
• Financial transaction records: Retained for a minimum of five years from the date of the transaction, in accordance with financial record-keeping obligations.
• KYC verification documents: Retained for the duration of your account plus five years post-closure. Document images are stored in encrypted form.
• Customer support communications: Retained for three years from the date of the interaction, to allow us to reference prior communications in the event of a dispute.
• Technical and analytics data: Typically retained in anonymised or aggregated form after 24 months. Raw IP logs are retained for up to 12 months for security and fraud investigation purposes.
• Marketing consent records: Retained for the duration of the consent plus three years, to demonstrate compliance in the event of a complaint.

When data reaches the end of its retention period, it is securely deleted or irreversibly anonymised. Players who have requested account closure may submit a data deletion request as described in Section 10, subject to legal retention obligations that override deletion requests.

9. Data Security

zoya9 takes the security of your personal data seriously and has implemented a range of technical and organisational measures to protect it against unauthorised access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the zoya9 platform
• AES-256 encryption for sensitive data stored at rest, including financial data and identity documents
• Role-based access controls ensuring that only authorised zoya9 personnel can access personal data, limited to what their role requires
• Regular third-party security audits and penetration testing of the platform infrastructure
• Two-factor authentication options for player accounts, strongly recommended for all players
• Intrusion detection systems and real-time monitoring of the platform for suspicious activity
• Strict data processing agreements with all third-party service providers requiring equivalent security standards

Despite these measures, no internet-based service can guarantee absolute security. In the unlikely event of a data breach that poses a significant risk to your rights, zoya9 will notify affected players without undue delay and will take all reasonable steps to contain and remediate the breach.

10. Your Rights

As a zoya9 player whose data is processed under this Privacy Policy, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of all personal data zoya9 holds about you. We will provide this within 30 days of a verified request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. Many details can be updated directly through your account settings.
• Right to erasure: You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other lawful basis applies), or where processing is unlawful. This right is subject to overriding legal retention obligations.
• Right to restrict processing: You may request that we temporarily halt processing of your data while a rectification or objection request is being assessed.
• Right to data portability: You may request a copy of data you have provided to us in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on our legitimate interests. You also have an absolute right to object to processing for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of the above rights, please contact the zoya9 support team at [email protected] with the subject line "Data Rights Request" and a description of your request. We will verify your identity before processing the request and will respond within 30 days. Complex requests may require up to 60 days with prior notification.

11. Children's Privacy

The zoya9 platform is strictly intended for adults aged 21 years and older. We do not knowingly collect personal data from individuals under the age of 21. If we discover that an account has been registered by someone under the age of 21, we will immediately close the account, delete the associated personal data to the extent permitted by law, and forfeit any balance in accordance with our Terms and Conditions.

If you believe that a minor has registered an account on the zoya9 platform, please notify us immediately at [email protected] so that we can take appropriate action without delay.

12. Third-Party Links

The zoya9 platform may contain references to third-party game providers, payment services, or other external services. While zoya9 takes care to partner only with reputable organisations, we have no control over the privacy practices of third-party websites or services and are not responsible for their content or data handling. We recommend reading the privacy policy of any third-party service you interact with independently of the zoya9 platform.

13. Policy Amendments

zoya9 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or platform features. Material changes will be communicated to registered players via the email address on file and by a prominent notice on the platform prior to the changes taking effect. The date of the most recent revision is shown at the top of this page.

Your continued use of the zoya9 platform following the publication of a revised Privacy Policy constitutes your acceptance of those changes. If you do not agree with any amendment, you may request account closure in accordance with the procedure described in our Terms and Conditions.

14. Contact & Complaints

If you have any questions, concerns, or complaints about how zoya9 handles your personal data, or if you wish to exercise any of the rights described in Section 10, please contact us using the details below. Our data protection team monitors this channel and will respond to all privacy-related enquiries promptly.

• Email: [email protected] (subject line: "Privacy Enquiry" or "Data Rights Request")
• Availability: 24/7 — Bangladesh Standard Time (UTC+6)
• Response time: We aim to acknowledge all privacy enquiries within 2 business days and to resolve them fully within 30 days.