zeta9 Privacy Policy — How We Collect, Use, and Protect Your Data

1 Who We Are

zeta9 ("we", "us", "our", or "the Platform") operates an online sports betting and casino gaming platform accessible at zeta9.io. We serve users primarily located in Bangladesh, providing cricket outright betting, live casino tables, slot games, card games including Callbreak Quick, and live dealer products.

For the purposes of this Privacy Policy, zeta9 acts as the data controller in respect of all personal data collected from users of the platform. This means we determine the purposes and means by which your personal data is processed. Where we engage third-party service providers to process data on our behalf, those providers act as data processors under our instruction.

All questions relating to this Privacy Policy or the handling of your personal data should be directed to our support team at [email protected]. We aim to respond to all data-related enquiries within five (5) business days.

2 Personal Data We Collect

The categories of personal data zeta9 may collect, hold, and process about you are set out in the table below. The exact data points collected in each category depend on how you interact with the platform.

3 How We Collect Your Data

zeta9 collects personal data through the following channels:

• Direct submission: Data you provide when registering an account, completing KYC verification, submitting a deposit or withdrawal request, or contacting our support team.
• Automated technical collection: Data collected automatically during your session via server logs, cookies, and similar tracking technologies — including IP address, device identifiers, and browsing behaviour within the platform.
• Payment processors: Transaction confirmation data shared with us by bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Visa, and Mastercard when you initiate a financial transaction.
• Identity verification partners: Confirmation signals from third-party KYC and anti-fraud providers used to verify the authenticity of identity documents you submit.
• Publicly available sources: In limited circumstances related to fraud prevention, we may cross-reference data against publicly available records or sanctions lists.

4 Why We Use Your Personal Data

zeta9 processes your personal data for the following purposes:

• Account creation and management: To register your account, authenticate your identity at login, and maintain accurate account records throughout your relationship with zeta9.
• Transaction processing: To process BDT deposits via bKash, Nagad, Rocket, Upay, and bank transfers, and to execute withdrawal requests to your nominated payment method.
• Service delivery: To provide access to cricket outright betting markets, live casino tables, slot games, and other zeta9 products, and to record bet settlements and game outcomes accurately.
• Identity verification and KYC compliance: To verify that users are who they claim to be, confirm the 21+ age requirement, and satisfy anti-money-laundering (AML) obligations.
• Fraud prevention and security: To detect and investigate suspicious account activity, unauthorised access attempts, and patterns indicative of bonus abuse, collusion, or money laundering.
• Responsible gaming: To honour deposit limits, session time-outs, and self-exclusion instructions, and to monitor usage patterns for signs of problem gambling behaviour.
• Customer support: To respond to your enquiries, resolve disputes, and maintain records of support interactions for quality assurance.
• Marketing communications: Where you have opted in, to send you personalised promotional offers, bonus notifications, and event-based content (e.g., BPL season promotions, Eid offers, T20 World Cup specials).
• Platform improvement: To analyse aggregated, anonymised usage data to improve the platform's performance, user experience, and product range.
• Legal compliance: To comply with applicable laws, regulatory requests, court orders, and obligations imposed by financial intelligence authorities.

5 Legal Basis for Processing

zeta9 relies on the following legal bases to process your personal data, depending on the specific processing activity involved:

• Contractual necessity: Processing required to perform our contract with you — including account operation, transaction processing, and service delivery — is carried out on the basis that it is necessary for the performance of that contract.
• Legal obligation: Processing required to comply with applicable laws — including AML obligations, KYC requirements, and record-keeping mandates — is carried out on the basis of legal obligation.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and aggregated analytics is carried out on the basis of our legitimate interests, provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications is carried out solely on the basis of your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting any other processing.

6 Sharing Your Personal Data

zeta9 does not sell your personal data. We share your data only in the following limited and controlled circumstances:

• Payment processors: Transaction data is shared with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Visa, and Mastercard solely to initiate, process, and confirm financial transactions you have authorised.
• KYC and identity verification providers: Identity document data is shared with approved third-party verification partners to confirm your identity and age in accordance with our KYC policy.
• Anti-fraud and security partners: Technical and behavioural data may be shared with fraud detection service providers under data processing agreements to identify and prevent fraudulent activity.
• Game content providers: Anonymised session and gameplay data may be shared with game studios (such as Pragmatic Play, Evolution Gaming, Spribe, and Ezugi) for the purposes of fair play certification, RNG (Random Number Generator) auditing, and game performance reporting.
• Legal and regulatory authorities: We will disclose personal data to law enforcement agencies, financial intelligence units, or courts of competent jurisdiction where we are required to do so by law or valid legal process.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of the zeta9 business, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third-party processors engaged by zeta9 are required to process your data only on our documented instructions, to maintain appropriate technical and organisational security measures, and to delete or return data once the processing purpose is fulfilled.

7 Cookies & Tracking Technologies

zeta9 uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device when you visit the site. The types of cookies we use are as follows:

• Strictly necessary cookies: Required for the platform to function correctly. These include session authentication tokens, load balancing cookies, and security cookies. They cannot be disabled without impairing platform functionality.
• Functional cookies: Used to remember your preferences — such as language settings (English) and your most recently viewed game categories — to personalise your experience.
• Analytics cookies: Used to collect aggregated, anonymised data about how users navigate the platform, which pages are most visited, and where users encounter friction. This data is used to improve the platform.
• Marketing cookies: Placed only with your consent, used to serve relevant promotional content and to measure the effectiveness of our campaigns (e.g., BPL season offers, Eid promotions).

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies will affect your ability to log in and use core platform features. Disabling analytics or marketing cookies will not impair platform access.

8 Data Retention

zeta9 retains personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, subject to the following specific retention periods:

• Active account data: Retained for the full duration of your account being active on the platform.
• Post-closure account data: Following account closure (whether voluntary or due to a terms violation), identity, transaction, and betting history records are retained for a minimum of five (5) years to meet AML and financial record-keeping obligations.
• KYC documents: Identity verification documents are retained for a minimum of five (5) years after the end of the business relationship.
• Support communications: Customer support records are retained for three (3) years from the date of the last interaction.
• Marketing data: Opt-in consent records are retained for the duration of your account plus three (3) years, to evidence consent in the event of a complaint.
• Technical/log data: Server logs and session data are retained for up to twelve (12) months, after which they are anonymised or deleted.

Where data is no longer required for the purposes for which it was collected and no legal obligation requires continued retention, zeta9 will securely delete or anonymise the data.

9 Security Measures

zeta9 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the zeta9 platform.
• Bcrypt or equivalent secure hashing for stored passwords — we never store plain-text credentials.
• Role-based access controls ensuring that only authorised personnel can access sensitive user data, on a need-to-know basis.
• Regular internal security reviews and penetration testing of platform infrastructure.
• Multi-factor authentication (MFA) options for user accounts to add a second layer of login security.
• Automated fraud detection systems that monitor account activity for anomalies in real time.

10 Your Privacy Rights

As a user of zeta9, you hold the following rights in respect of your personal data. To exercise any of these rights, submit a written request to [email protected] with the subject line "Privacy Rights Request". We will respond within five (5) business days.

• Right of access: You may request a copy of all personal data zeta9 holds about you, along with information about how and why it is being processed.
• Right to rectification: You may request that inaccurate or incomplete personal data held by zeta9 be corrected without undue delay.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to any overriding legal retention obligations (see Section 8).
• Right to restriction of processing: You may request that zeta9 restrict the processing of your data in certain circumstances — for example, while the accuracy of data you have contested is being verified.
• Right to data portability: You may request that data you have provided to zeta9 be returned to you in a structured, machine-readable format.
• Right to object: You may object to processing carried out on the basis of legitimate interests, including profiling for fraud prevention, where you believe your individual rights and freedoms outweigh those interests.
• Right to withdraw consent: Where processing is based on consent (e.g., marketing emails), you may withdraw consent at any time via account settings or by emailing [email protected]. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

11 Children & Minors

zeta9 operates a strict 21+ age policy. The platform is not directed at, and does not knowingly collect personal data from, any person under the age of 21. If zeta9 becomes aware that personal data has been collected from a user who is under 21 years of age, we will immediately suspend the associated account, reverse any transactions where possible, and permanently delete all personal data associated with that account.

If you are a parent or guardian and believe that a minor under your care has created a zeta9 account, please contact us immediately at [email protected] with the subject line "Minor Account Report". We will investigate and act on all such reports within 24 hours.

12 Updates to This Privacy Policy

zeta9 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. The most current version of this policy will always be published at zeta9.io/privacy-policy and will display the effective date of the most recent revision at the top of the page.

Where a change to this Privacy Policy materially affects how we process your personal data, we will notify active account holders via email to the address registered on your account at least seven (7) days before the change takes effect. Your continued use of the zeta9 platform after the revised policy takes effect constitutes your acknowledgement of the updated terms.

13 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please reach out to the zeta9 data protection team using the contact details below. All privacy-related correspondence should be submitted in writing to ensure an accurate record is maintained.

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data requests: "Privacy Rights Request"
• Subject line for minor reports: "Minor Account Report"
• Response time: Within five (5) business days for standard enquiries
• Support hours: 24/7, Bangladesh Standard Time (BST, UTC+6)

For account security emergencies (suspected unauthorised access, account compromise), please mark your email subject line "URGENT — Account Security" to ensure your message is routed to the security team immediately.