Privacy Policy – zk266 Data Protection for Pakistan Players

zk266 is the data controller for all personal information collected through the zk266 platform. As data controller, we are responsible for determining how and why your personal data is processed. We do not operate as a mere data processor on behalf of another entity — the decisions about your data originate with and remain with zk266.

This Privacy Policy covers all data processing activities associated with your zk266 account, including registration data, gaming activity, payment records, communications with our support team and any data collected through cookies and similar tracking technologies on the zk266 website.

We have designed our data practices with Pakistani players specifically in mind. We understand that trust in how a platform handles your personal information — your CNIC details, your phone number, your Easypaisa or JazzCash account information — is as important as trust in how it handles your money. At zk266, both are treated with equal seriousness.

We collect personal data through several channels: the account registration form, KYC (Know Your Customer) verification, payment transactions, your gaming activity and your interactions with our support team. Here is a clear breakdown of what we collect and why:

We do not collect sensitive personal data such as religious beliefs, political opinions or biometric data beyond what is required for standard CNIC-based identity verification in Pakistan. We do not collect data from minors — anyone under 18 found to have provided data during account registration will have their data deleted and their account permanently closed.

Every use of your personal data at zk266 has a specific, legitimate purpose. We do not collect data and figure out what to do with it later. Here are the purposes for which we use the data we collect:

• Account management: Creating and maintaining your zk266 account, processing login requests, managing your preferences and account settings, and enabling access to all platform features.
• Identity and age verification: Confirming that you are who you say you are and that you meet the minimum age requirement of 18 years. This is a legal and ethical obligation that zk266 takes seriously.
• Processing transactions: Handling your deposits and withdrawals in PKR through your chosen payment method. Your financial data is used exclusively for this purpose and for maintaining your account transaction history.
• Providing and improving the platform: Understanding how players use zk266 — which games are most popular, where technical issues occur, which features need improvement — so we can make the platform better for everyone.
• Delivering promotions and VIP benefits: Determining your eligibility for current offers, calculating weekly cashback, processing bonus credits and managing your VIP Club tier status.
• Responsible gaming monitoring: Using gaming activity data to identify patterns that may indicate problematic gambling behaviour, enabling our responsible gaming team to reach out proactively when appropriate.
• Fraud prevention and security: Monitoring for suspicious activity, duplicate accounts, chargeback patterns and any other behaviour that could indicate fraud or abuse of the platform.
• Customer support: Using your account history, gaming records and communication history to resolve queries, disputes and complaints effectively.
• Legal and regulatory compliance: Maintaining records as required by applicable laws governing online gaming and financial transactions.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human review. Any significant account decision — such as suspension or withdrawal refusal — involves human review of the relevant data.

Financial privacy is a particularly sensitive matter for Pakistani players, and zk266 handles it with corresponding care. Here is exactly what happens with your payment data when you deposit or withdraw through any of our supported methods — Easypaisa, JazzCash, NayaPay, SadaPay, IBFT bank transfer or Visa/Mastercard.

What zk266 stores: We record your deposit and withdrawal history — the amount in PKR, the payment method category used, the date and time, and the transaction status. This forms your financial transaction history within the zk266 platform.

What zk266 does not store: We do not store your Easypaisa or JazzCash wallet credentials, your bank account number in full, your card number, card CVV or any other sensitive payment authentication credential. These are handled exclusively through our payment processor partners — certified third-party services that are contractually bound to process your data securely and only for the purpose of completing your transaction.

Why we require payment method ownership verification: Under our anti-money laundering obligations and for your own protection, all payment methods used at zk266 must be registered in your own name and match your verified account details. This is why we ask you to confirm your payment details during the KYC process — it protects you from unauthorised use of your payment methods as much as it protects the platform.

zk266 does not sell your personal data to anyone. We do not share your data with advertising networks for the purpose of targeting you with third-party advertisements. We do not provide player lists or contact databases to any external party for commercial gain.

We do share data with third parties in the following specific and limited circumstances:

• Payment processors: To process your deposits and withdrawals, we share the minimum necessary transaction data with our certified payment service providers (Easypaisa, JazzCash, NayaPay, SadaPay, IBFT networks and card payment processors). These providers operate under strict contractual obligations limiting how they may use your data.
• Identity verification providers: During the KYC process, your identity document and personal details are shared with our third-party KYC verification partner. This partner is certified for identity verification services and operates under a data processing agreement with zk266.
• Fraud detection services: We use a specialist fraud detection platform that processes technical data (IP address, device fingerprint, session behaviour) to identify fraudulent account activity. This service operates under strict contractual controls.
• Legal and regulatory authorities: We may be required by law to share your data with relevant authorities in response to a valid legal order, court order or regulatory investigation. We will only do so to the minimum extent required by the specific legal obligation.
• Responsible gaming partners: In limited circumstances related to player welfare, anonymised or aggregate gaming data may be shared with responsible gaming research or support organisations.

All third parties with whom zk266 shares data are subject to written data processing agreements that limit how they may use your information, require them to protect it to a standard at least equivalent to ours and prohibit them from sharing it further without our explicit consent.

The zk266 website uses cookies and similar tracking technologies to operate correctly, improve your experience and maintain the security of your session. A cookie is a small text file stored on your device by your browser when you visit a website. Here is what we use and why:

Most browsers allow you to view, manage and delete cookies through their settings menu. Disabling non-essential cookies will not prevent you from using zk266 but may affect some personalisation features. We do not use third-party advertising cookies or allow external ad networks to place tracking cookies on the zk266 website.

Data security at zk266 is not a single feature — it is a layered set of technical and organisational measures that work together to protect your information at every stage of its lifecycle. Here is what is in place:

• Encryption in transit: All data transmitted between your device and zk266 servers is encrypted using 256-bit SSL/TLS. The padlock icon in your browser confirms this is active.
• Encryption at rest: Personal data and financial records stored on zk266 servers are encrypted at rest, meaning that even in the unlikely event of a server breach, the raw data would not be readable without the decryption keys.
• Access controls: Access to personal data within the zk266 team is restricted strictly to staff who require it to perform their role. Access logs are maintained and reviewed regularly. No staff member has blanket access to all player data.
• Two-factor authentication: Available on all player accounts and strongly recommended. The zk266 internal admin systems also require two-factor authentication for all staff access.
• Regular security audits: zk266 conducts periodic security reviews and vulnerability assessments to identify and address potential weaknesses before they can be exploited.
• Incident response: In the event of a data security incident affecting personal data, zk266 has an incident response protocol that includes notifying affected players promptly and taking immediate remedial action.

As a zk266 player, you have meaningful rights over your personal data. These are not just statements — they are rights you can actually exercise by contacting our support team at any time.

To exercise any of these rights, contact us at support@zk266.ws with the subject line "Privacy Rights Request" or raise it through the live chat in your account. We will acknowledge your request within 48 hours and fulfil it within 30 days. Some requests may take longer for complex cases — you will be informed of the expected timeline if so.

Note that certain data must be retained even after an account closure for legal compliance reasons (for example, financial transaction records required under anti-money laundering regulations). We will always be clear about what data is retained and why if you make a deletion request.

zk266 retains personal data only for as long as is necessary for the purposes it was collected, or as required by applicable law. The following general retention periods apply:

• Active account data: Retained for the lifetime of your zk266 account plus a period of 5 years after account closure. This covers account registration data, gaming activity records and transaction history.
• KYC identity documents: Retained for a minimum of 5 years following your last transaction, in accordance with standard financial record-keeping requirements applicable to online gaming and payment platforms.
• Financial transaction records: Retained for a minimum of 6 years to meet financial record-keeping obligations.
• Support communications: Live chat transcripts and email communications retained for 2 years from the date of the interaction, or longer if related to an ongoing dispute or investigation.
• Technical log data (IP addresses, session logs): Retained for 12 months for security and fraud investigation purposes, then automatically deleted.
• Marketing preferences: Retained while your account is active. Deleted promptly upon request or account closure.

When data reaches the end of its retention period, it is securely deleted or anonymised so that it can no longer be linked to you as an individual. Anonymised aggregate data — for example, statistics about overall platform usage that contain no personally identifiable information — may be retained indefinitely for analytical purposes.

If your account is suspended due to a suspected breach of our Terms and Conditions, relevant account data may be retained for longer than the standard period while the investigation is ongoing and for a reasonable period thereafter.

zk266 reserves the right to update this Privacy Policy at any time. Updates will be published on this page with a revised "Last Updated" date shown prominently at the top of the document. We recommend checking this page periodically, particularly before making any major account changes such as updating your payment method or requesting a large withdrawal.

If we make a significant change to how we process your personal data — for example, adding a new category of data or changing our data sharing arrangements — we will make a reasonable effort to notify you through your registered email address or via an in-platform notification when you next log in. However, the revised policy is effective from the date it is published regardless of whether you received a notification, so please keep your contact details current in your account settings.

This Privacy Policy should be read alongside our Terms and Conditions and Responsible Gaming policy, both of which contain provisions that intersect with data privacy matters.

We take every privacy request seriously. Responses are provided within 48 hours of receipt. Complex requests involving data exports or deletion across multiple systems may take up to 30 days — you will always be informed of the expected timeline for your specific request.