Privacy Policy — zs111

This Privacy Policy ("Policy") is issued by the operator of the zs111 online gaming platform, accessible at zs111.org ("zs111," "we," "us," or "our"). It applies to all personal data that zs111 collects, processes, stores, and shares in connection with the operation of our Platform and the provision of gaming, betting, payment, and support services to players — including the many Pakistani players who access zs111 from Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, and across Pakistan.

This Policy should be read alongside the zs111 Terms and Conditions (available at /terms-conditions), which govern your overall use of the Platform and which incorporate this Policy by reference. By registering an account on zs111 or continuing to use the Platform after this Policy has been updated, you acknowledge that you have read and understood its contents and consent to the data processing activities described herein.

If you have any questions about this Policy or about how zs111 handles your personal data, please contact our support team before using the Platform. Contact details are provided in Section 15 of this document.

zs111 collects personal data that falls into the following categories. We collect only the data that is necessary for the specific purposes outlined in Section 4 of this Policy:

zs111 does not collect or store full payment card numbers, CVV codes, or JazzCash/EasyPaisa PINs. Payment processing is handled by our certified third-party payment processors, and only the minimum necessary payment reference data is retained by zs111.

We do not collect special categories of sensitive personal data (such as health, biometric, or political data) as part of our standard Platform operations. The only exception is age-related verification, which is conducted to comply with our strict 21+ age policy and responsible gaming obligations.

zs111 collects personal data through the following channels and mechanisms:

• Direct provision by you: When you register an account on zs111, you directly provide your mobile number and set a password. When you complete KYC verification, you provide identity documentation. When you make deposits or withdrawal requests, you provide payment details. When you contact support via live chat or email, you provide communications data.
• Automated collection during Platform use: When you access and use the zs111 Platform, we automatically collect technical data including your IP address, device information, browser type, and session activity logs. This data is collected through server-side logging and first-party cookies as described in Section 9.
• Third-party payment processors: When you make deposits or withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or cryptocurrency networks, our payment processing partners confirm transaction status and relevant reference data to zs111. These partners operate under their own privacy policies and security standards.
• Game software providers: Our certified game providers (such as Pragmatic Play, Evolution Gaming, and others) may provide session and outcome data for gaming rounds completed on their platforms through zs111. This data is used for account management, dispute resolution, and regulatory record-keeping.
• Identity verification services: Where third-party KYC verification services are used to validate identity documents, those providers transmit verification results (pass/fail, along with the data points verified) to zs111.

zs111 processes your personal data only for specific, defined purposes. The following table summarises the primary purposes for which we process each category of data:

• Account creation and management: Your contact data, account data, and identity data are used to create, maintain, and secure your zs111 account. This includes password recovery, OTP verification, session management, and account settings.
• Age verification and KYC compliance: Identity data and KYC documentation are used to verify that you meet the 21+ age requirement and to comply with anti-money laundering (AML) and know-your-customer (KYC) obligations. This processing is mandatory — zs111 cannot provide services to unverified players beyond the initial registration threshold.
• Payment processing: Financial data is used to process PKR deposits from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and cryptocurrency channels, and to process withdrawal requests to verified payment methods registered in your name.
• Gaming service delivery: Gaming activity data is used to deliver the games and betting services you access through zs111, to record game outcomes, to calculate and credit winnings, to apply bonus terms, and to maintain accurate account balances in PKR.
• Fraud prevention and security: Technical data, financial data, and gaming activity data are analysed to detect and prevent fraudulent activity, account takeover attempts, money laundering, bonus abuse, and other prohibited conduct as described in the Terms and Conditions.
• Responsible gaming monitoring: Gaming activity data, session data, and account settings data are used to monitor for signs of problematic gambling behaviour and to apply responsible gaming tools (deposit limits, loss limits, self-exclusion) activated by you or, where appropriate, by zs111's responsible gaming team.
• Customer support: Communications data is used to investigate and resolve player queries, complaints, and disputes. Support records are retained for dispute resolution and service improvement purposes.
• Marketing and promotions: Where you have consented to receive marketing communications, your contact data is used to send you relevant promotional offers, bonus notifications, and platform news via SMS or on-platform notification. You may withdraw this consent at any time — see Section 11.
• Legal and regulatory compliance: zs111 processes and retains data as required by applicable legal and regulatory obligations, including AML record-keeping requirements, licensing conditions, and responses to lawful requests from competent authorities.

zs111 relies on the following legal bases for the processing of your personal data, consistent with applicable data protection principles:

• Contractual necessity: Much of our data processing — including account management, payment processing, game delivery, and customer support — is necessary to perform the contract between zs111 and you as a registered Player under the Terms and Conditions. Without this processing, we cannot provide the services you have registered to access.
• Legal obligation: KYC verification, AML record-keeping, age verification, and compliance-related data processing are carried out because zs111 is legally and contractually required to perform them as a condition of its operating licence and regulatory status.
• Legitimate interests: Fraud detection, security monitoring, responsible gaming analytics, and service improvement activities are carried out based on zs111's legitimate interest in operating a safe, secure, and compliant gaming platform. We conduct balancing tests to ensure that our legitimate interests do not override the fundamental rights and freedoms of our Players.
• Consent: Marketing communications are sent only where you have provided explicit consent during registration or through your account settings. This consent can be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

zs111 does not sell your personal data to third parties for their own commercial purposes. We share personal data with third parties only in the specific circumstances described below, and only to the extent necessary for the specified purpose:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and cryptocurrency processing partners receive transaction data necessary to process your PKR deposits and withdrawals. These providers are bound by their own data protection obligations and are not permitted to use your data for any purpose other than processing the specific transaction.
• Game software providers: Our game providers (e.g., Pragmatic Play, Evolution Gaming) receive session identifiers and betting data necessary to run the games and record outcomes. These providers are internationally certified and operate under strict data security standards.
• KYC and identity verification services: Third-party identity verification providers receive identity documents submitted during KYC verification for the sole purpose of confirming their authenticity and validity. Verification results are returned to zs111, and documents are processed in accordance with the provider's data protection standards.
• Fraud prevention and AML services: Technical data and transaction data may be shared with fraud detection and AML screening services for the purpose of detecting suspicious activity and maintaining the integrity of the Platform.
• Legal and regulatory authorities: zs111 will disclose personal data to competent legal, regulatory, or law enforcement authorities where required to do so by applicable law, by court order, or by the conditions of our operating licence. We will not disclose more data than is required by the specific legal obligation.
• Professional advisers: zs111's legal, accounting, and compliance advisers may have access to personal data on a strictly need-to-know basis in connection with the provision of professional services to zs111. All such advisers are bound by professional confidentiality obligations.

zs111 implements technical and organisational security measures appropriate to the nature of the personal data we process and the risks associated with online gaming platforms. Our security infrastructure includes, but is not limited to:

• 256-bit SSL/TLS encryption: All data transmitted between your device and zs111's servers is encrypted using bank-grade 256-bit SSL/TLS encryption. The padlock icon displayed in your browser address bar when accessing zs111.org confirms this encryption is active.
• Password encryption: Player passwords are stored in an irreversibly hashed format. zs111 employees cannot access or recover your actual password — only reset it through the authorised recovery process involving your registered Pakistani mobile number.
• SMS OTP verification: Sensitive account actions — including login from unrecognised devices and certain withdrawal requests — require verification via a one-time password sent to your registered Pakistani mobile number, ensuring that only you can authorise these actions.
• Access controls: Access to personal data held by zs111 is strictly limited to employees and contractors who require it to perform their specific job functions. Access logs are maintained and reviewed regularly.
• Segregated player funds: While not directly a data security measure, the financial segregation of player funds from zs111's operational accounts is maintained as a structural protection for the financial assets associated with your account data.
• Penetration testing and security audits: The zs111 Platform and its data systems are subject to regular independent security testing and vulnerability assessments.
• Data breach response: zs111 maintains a data breach response protocol. In the event of a breach affecting personal data, affected Players will be notified in a timely manner and appropriate remediation steps will be taken.

While zs111 takes all reasonable and appropriate steps to protect your personal data, no online platform can guarantee absolute security. Players are also responsible for maintaining the security of their account credentials — including their password and their registered mobile number — as described in the Terms and Conditions.

zs111 retains personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with an individual player. Self-exclusion records are retained permanently as a safeguard to prevent circumvention of self-exclusion protections through new registrations.

zs111 uses cookies and similar tracking technologies on the Platform to enable core functionality, improve user experience, and support security and analytics operations. We do not use third-party advertising or behavioural tracking cookies.

The types of cookies used by zs111 are as follows:

• Essential / Strictly Necessary Cookies: These cookies are required for the Platform to function correctly. They include session authentication cookies that keep you logged in, security tokens used for CSRF protection, and preference cookies that remember your settings. These cookies cannot be disabled without breaking core Platform functionality.
• Functional Cookies: These cookies remember your language preferences, display settings, and previously accessed game categories to provide a more personalised experience across sessions. They are not strictly essential but significantly improve usability.
• Analytics Cookies (First-Party): zs111 uses first-party analytics to understand how players interact with the Platform — which pages are most accessed, where users encounter difficulties, and how the gaming lobby is navigated. This data is aggregated and not linked to individual player profiles for marketing purposes.
• Security Cookies: Short-lived cookies used as part of the login OTP verification process and session integrity checking to detect and prevent session hijacking and account takeover attempts.

You can manage cookie preferences through your browser settings. Disabling essential cookies will prevent the Platform from functioning correctly and will log you out of your session. On mobile browsers commonly used by Pakistani players — including Chrome for Android and Safari for iOS — cookie settings can be accessed through the browser's Privacy or Settings menu.

As a player on the zs111 Platform, you have the following rights with respect to your personal data. These rights can be exercised by contacting zs111's support team as described in Section 15:

• Right of Access: You have the right to request confirmation of whether zs111 holds personal data about you and, if so, to receive a copy of that data along with information about how it is being processed.
• Right to Rectification: If you believe that personal data we hold about you is inaccurate or incomplete, you have the right to request its correction or completion. You can update many account details — such as contact information — directly through your account settings.
• Right to Erasure: In certain circumstances, you may request that zs111 delete your personal data. However, please note that this right is subject to our legal and regulatory obligations — specifically, we are required to retain certain transaction and identity records for extended periods under AML and licensing requirements. Erasure requests that conflict with these obligations cannot be fully accommodated until the applicable retention period has expired.
• Right to Restriction of Processing: In certain circumstances (for example, while the accuracy of data is disputed, or where processing is unlawful but you prefer restriction over erasure), you may request that we restrict the processing of your personal data.
• Right to Data Portability: Where processing is carried out on the basis of consent or contractual necessity and is performed by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of our legitimate interests. We will consider your objection and will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time through your account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

zs111 will respond to data rights requests within 30 days of receipt. For complex requests, this period may be extended by an additional 60 days, in which case you will be informed of the extension within the initial 30-day period. All requests are processed free of charge unless they are manifestly unfounded or excessive.

zs111 sends marketing communications — including promotional bonus offers, deposit match notifications, PSL betting tips, and platform news — only to Players who have explicitly consented to receive such communications at the time of registration or subsequently through account settings.

Marketing communications from zs111 are delivered via:

• SMS to your registered Pakistani mobile number — short promotional messages about current offers and platform updates.
• On-platform notifications — notifications displayed within your zs111 account dashboard when you are logged in, covering available bonuses, upcoming promotions, and responsible gaming reminders.

You can update your marketing communication preferences at any time through the Notifications section of your zs111 account settings. You may opt out of all marketing communications without affecting your ability to use the Platform or your eligibility for promotions (though opting out of notifications means you may miss time-sensitive promotional offers).

Responsible gaming communications — such as deposit limit reminders, session time alerts, and self-exclusion confirmations — are classified as operational communications and cannot be opted out of while your account is active. These are sent in accordance with our responsible gaming obligations and are designed to protect your interests as a player.

zs111 takes its age verification obligations seriously. During registration, Players are required to confirm that they are aged 21 or above. Where reasonable grounds exist to suspect that a player may be underage, zs111 will suspend the account pending identity and age verification, and no withdrawals will be processed during this period.

If zs111 becomes aware or has reasonable cause to believe that a player who has registered on the Platform is under the age of 21, we will:

• Immediately suspend the account and restrict all access to gaming services.
• Void all bets and gaming activity undertaken by the underage player from the point at which we identify the age ineligibility.
• Return any real-money deposits (net of losses from ineligible play) to the payment method used for deposit.
• Delete the personal data associated with the underage account, except where retention is required for regulatory or legal purposes relating to the investigation of the underage registration.

Parents or guardians who are concerned that a minor may have accessed zs111 should contact our support team immediately via live chat or email. We will investigate and respond to such reports as a matter of priority.

The zs111 Platform may contain references to or integrations with third-party services — specifically our certified game providers, payment processors, and identity verification services as described in Section 6. These third-party providers operate under their own privacy policies and data protection frameworks, and zs111 is not responsible for the data practices of these third parties beyond the contractual obligations we impose on them through our vendor agreements.

zs111 selects third-party providers carefully and requires contractual commitments regarding data security, data minimisation, and confidentiality as part of our due diligence process. We do not integrate third-party social media tracking tools, advertising networks, or data broker services into the Platform.

Players should review the privacy policies of any third-party payment services they use (such as JazzCash or EasyPaisa) independently, as those policies govern how those providers handle your mobile wallet and financial data on their own platforms.

zs111 may update this Privacy Policy from time to time to reflect changes in our data processing activities, applicable law, regulatory requirements, or our operational practices. The date at the top of this document will be updated whenever a revision is made.

Where amendments are material — meaning they significantly affect the way in which we process your personal data or alter your rights — we will notify Players through on-platform notification at least 14 days before the revised Policy takes effect. This gives you the opportunity to review the changes and, if you do not accept them, to close your account before the new Policy applies to you.

Non-material amendments — such as corrections, clarifications, or updates that do not substantively alter your rights or our data practices — may be made with immediate effect. The current version of this Policy is always accessible at zs111.org/privacy-policy. We encourage Players to review this Policy periodically to remain informed of how zs111 manages personal data.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by zs111, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week through the chat widget on the zs111 Platform. This is the fastest channel for general privacy enquiries.
• Email: [email protected] — for formal data rights requests, written privacy complaints, or any matter requiring a documented response. Please include your registered Pakistani mobile number and a clear description of your request or concern. We aim to respond to all privacy-related email enquiries within 5 business days.

When submitting a formal data rights request (such as a request for access, rectification, or erasure under Section 10), please provide your registered account mobile number, the specific right you wish to exercise, and any supporting information that will assist us in locating and processing the relevant data. We will acknowledge receipt of your request within 3 business days and provide a substantive response within 30 days.

If you are not satisfied with zs111's response to a privacy complaint or data rights request, you have the right to escalate the matter to the relevant supervisory authority under the data protection laws applicable to your jurisdiction.