Privacy Policy

This Privacy Policy ("Policy") sets out the basis on which zh99 ("Platform", "we", "us", "our"), operating the website at https://zh99.cam, collects, processes, stores and shares personal data relating to individuals ("Users", "you", "your") who access or use the zh99 online gambling platform and its associated services.

zh99 is an English-language online gambling information and platform site directed at Pakistani users. Our services include sports betting (with a particular focus on cricket markets including PSL, ICC T20 and international bilateral series), live casino products, slot games, table games and related informational content.

We take data protection seriously. This Policy is intended to be read alongside our Terms & Conditions and Responsible Gambling Policy, both of which form part of the overall agreement governing your use of zh99.

For the purposes of this Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, contact details, financial data, device identifiers and behavioural data where these can identify an individual.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, erasure and destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this case, zh99 or its designated operator entity.
• "Data Processor" means a third party that processes Personal Data on behalf of the Data Controller, subject to written instructions and data processing agreements.
• "KYC Data" means identity verification documents and associated materials collected during the Know Your Customer process, including CNIC scans, passport copies and liveness-check images.
• "Cookies" means small text files placed on your device by the Platform or third parties integrated into the Platform, used to remember session state, preferences and analytical data.
• "Special Category Data" means Personal Data that is particularly sensitive, including health or wellbeing data, which may be relevant in the context of responsible gambling tools such as self-exclusion records.

The Data Controller responsible for your Personal Data in connection with the zh99 Service is the operator entity holding the applicable license under which zh99 operates, as specified in the operator's licensing and registration documentation.

zh99 does not claim to be licensed, authorised or approved by the Government of Pakistan, the Pakistan Telecommunication Authority (PTA), the State Bank of Pakistan, or any provincial authority within Pakistan. Users in Pakistan should be aware that the applicable data protection and privacy laws governing their rights may differ from the laws of the jurisdiction in which the Data Controller is incorporated or licensed.

For data protection queries, you may contact the zh99 Data Protection team via the Support channels described in Section 15 of this Policy.

zh99 collects the following categories of Personal Data in connection with your use of the Service:

4.1 Registration & Account Data

• Full legal name, date of birth and gender;
• Residential address (including city — e.g., Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar);
• Email address and mobile phone number;
• Username and encrypted password hash.

4.2 Identity Verification (KYC) Data

• Government-issued photo identity document — a valid Pakistani CNIC (Computerised National Identity Card) or passport;
• Proof of residential address where requested (e.g., utility bill or bank statement);
• Selfie or liveness verification image;
• Payment method verification materials (e.g., transaction screenshot from JazzCash, Easypaisa or bank transfer confirmation).

4.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps and payment method references;
• Account balance history and wagering activity records;
• Payment method identifiers (e.g., masked mobile wallet numbers, bank account references) — full payment credentials are not stored by zh99 but by the relevant payment processor.

4.4 Gambling Activity Data

• Betting history — including market selections, stake amounts and outcomes across sports betting (cricket, football, UFC, esports) and casino products;
• Session duration, login/logout timestamps and in-session activity logs;
• Responsible gambling tool settings — including any deposit limits, session limits or self-exclusion status.

4.5 Technical & Device Data

• IP address, device type, operating system and browser type;
• Geolocation data (country/region level, derived from IP address);
• Cookie identifiers and session tokens as described in Section 8.

4.6 Communications Data

• Records of communications with zh99 Support, including live chat transcripts, email correspondence and Help Centre ticket history;
• Feedback and survey responses where voluntarily submitted.

zh99 collects Personal Data through the following means:

• Directly from you — when you register an Account, complete KYC verification, make a deposit or withdrawal, contact Support, or use responsible gambling tools;
• Automatically — through cookies, session tracking technologies and server logs when you browse or interact with the Platform;
• From third-party service providers — including identity verification services, fraud detection providers and payment processors, where these parties share data with us under applicable data processing agreements;
• From publicly available sources — where this is necessary for fraud prevention or AML compliance purposes.

zh99 processes your Personal Data for the following purposes and on the following legal bases:

zh99 does not use Personal Data for automated decision-making that produces significant legal effects on Users without human review, except where required by AML or fraud-detection obligations.

zh99 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following indicative retention periods apply:

Where Personal Data is no longer required for any legitimate purpose and no legal retention obligation applies, we will securely delete or anonymise it.

zh99 uses cookies and similar tracking technologies on the Platform. Cookies are small data files stored on your device that enable the Platform to recognise your browser, maintain session state and collect analytical information.

8.1 Cookie Categories Used by zh99

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember user preferences such as language settings, responsible gambling tool configurations and display preferences across sessions.
• Analytical Cookies: Used to collect aggregated, anonymised data about how users interact with the Platform — including page views, session duration and navigation patterns — to inform Platform improvements. These do not identify individual users.
• Security Cookies: Used to detect and prevent fraudulent sessions, bot activity and account takeover attempts.

8.2 Managing Cookies

You may control non-essential cookies through your browser settings. Most modern browsers allow you to block, delete or restrict cookies on a per-site basis. Please note that disabling strictly necessary cookies will impair or prevent your ability to log in and use the Platform.

zh99 does not sell, rent or trade your Personal Data to third parties for commercial purposes. We may share your Personal Data with the following categories of recipients only where necessary and under appropriate safeguards:

• Identity Verification Providers: Third-party KYC and AML compliance services that process identity documents and liveness checks on our behalf under data processing agreements;
• Payment Processors: Payment service providers that process deposit and withdrawal transactions. Note that familiar payment references used in Pakistan — such as Easypaisa, JazzCash, Raast, and bank transfer providers including HBL, UBL, Meezan Bank and Bank Alfalah — operate as independent entities with their own privacy policies. zh99 does not imply that any such provider endorses gambling activity;
• Fraud Detection & Security Providers: Services used to detect fraudulent accounts, bot activity and financial crime;
• Regulatory and Law Enforcement Authorities: Where disclosure is required by applicable law, court order or the instructions of a competent regulatory authority;
• Platform Technology Providers: Hosting, infrastructure and analytics providers operating as Data Processors under binding contractual agreements that restrict use of data to the purposes specified by zh99;
• Corporate Transactions: In the event of a merger, acquisition or sale of business assets, Personal Data held by zh99 may form part of the transferred assets, subject to the same data protection obligations as set out in this Policy.

Depending on the data protection laws applicable to your jurisdiction and the legal basis for processing, you may have some or all of the following rights in relation to your Personal Data held by zh99:

• Right of Access: You have the right to request a copy of the Personal Data we hold about you and information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete Personal Data. Some information (such as KYC documents) cannot be amended without re-verification.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose collected, where you withdraw consent (where consent was the basis), or where processing is unlawful — subject to legal retention obligations that override erasure requests.
• Right to Restriction: You may request that we restrict processing of your Personal Data in certain circumstances, for example while a rectification request is being resolved.
• Right to Data Portability: Where processing is based on contract or consent and carried out by automated means, you may request your data in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests where your individual circumstances provide compelling grounds. You may also object to processing for direct marketing at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact our Data Protection team via the channels described in Section 15. We will acknowledge your request within a reasonable period and respond substantively within 30 days, or notify you if an extension is required.

zh99 implements appropriate technical and organisational measures to protect Personal Data against unauthorised access, accidental loss, alteration, disclosure or destruction. Our security measures include:

• SSL/TLS encryption for all data in transit across the Platform;
• Encryption of sensitive data fields at rest, including password hashes, KYC data references and payment identifiers;
• Role-based access controls limiting internal access to Personal Data to authorised personnel with a legitimate business need;
• Regular security assessments and vulnerability monitoring;
• Two-factor authentication options for Account access;
• Audit logging of access to sensitive data systems.

Notwithstanding these measures, no internet-based system can guarantee absolute security. In the event of a Personal Data breach that is likely to result in a risk to your rights and freedoms, zh99 will notify affected Users without undue delay in accordance with applicable legal obligations.

You are responsible for maintaining the security of your Account credentials. If you suspect unauthorised access to your Account, contact Support immediately via live chat or email.

The zh99 Service is strictly intended for adults aged 18 years and over — or the higher minimum age required by the operator's license jurisdiction. zh99 does not knowingly collect Personal Data from any person under the age of 18.

If we become aware that Personal Data has been collected from a person under 18, we will take immediate steps to delete that data and close the associated Account. Any winnings or balances associated with an underage Account will be voided.

Parents and guardians who believe their minor child has registered an Account on zh99 are encouraged to contact Support immediately. We will investigate and act on valid reports promptly.

zh99 may transfer Personal Data to countries outside Pakistan in connection with the operation of the Service — including to the jurisdiction in which our Data Controller is incorporated or licensed, and to jurisdictions where our technical infrastructure providers are located.

Where Personal Data is transferred internationally, zh99 ensures that appropriate safeguards are in place to protect your data, such as standard contractual clauses, data processing agreements with binding obligations, or transfers to jurisdictions that provide an adequate level of data protection as determined by the applicable regulatory framework.

By registering an Account and using the zh99 Service, you acknowledge that your Personal Data may be transferred to and processed in jurisdictions outside Pakistan.

zh99 reserves the right to update or amend this Privacy Policy at any time. Where a material change is made that affects the way we process your Personal Data, we will provide reasonable prior notice via an on-site notification or email to registered Account holders.

The date of the most recent revision is displayed at the top of this page. We encourage you to review this Policy periodically. Your continued use of the Service following the publication of an updated Policy constitutes your acceptance of the revised terms.

For any questions, concerns or requests relating to this Privacy Policy or your Personal Data, please contact the zh99 Data Protection team. Support is available 24 hours a day, 7 days a week via the Help Centre and live chat within your Account dashboard.

For formal data subject requests or written privacy complaints, please use the following contact details. Note that the email address below is displayed as plain text only and is not a clickable link:

We will acknowledge receipt of your request within a reasonable period and aim to provide a substantive response within 30 calendar days. Complex requests may require an extension, in which case we will notify you of the revised timeline.

If you are not satisfied with our response to a privacy complaint, you may have the right to lodge a complaint with the competent data protection supervisory authority in the jurisdiction of the Data Controller, as identified in Section 3 of this Policy.