Privacy Policy — zk266 Data Protection Statement

This Privacy Policy ("Policy") sets out the basis on which zk266 ("we", "us", "our", "Platform"), operated at https://zk266.cam, collects, uses, stores, discloses and otherwise processes personal data relating to users ("you", "your", "User") and visitors to the platform.

zk266 is an English-language online gaming and sports betting platform serving users including those based in Pakistan. We are committed to handling personal data responsibly, transparently and in accordance with applicable data protection principles. We collect only the data that is necessary to operate the platform, fulfill our legal obligations and provide you with a secure, functional and personalized experience.

This Policy should be read alongside our Terms & Conditions, which form the broader contractual framework governing your use of zk266. In the event of any conflict between this Policy and the Terms, this Policy prevails with respect to matters of data protection and privacy.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" — any information that identifies or could be used to identify a living natural person, either directly or indirectly. This includes names, email addresses, account identifiers, device identifiers and transaction history.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, transmission, erasure or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Data Controller is the operator of the zk266 platform.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller under a written data processing agreement.
• "KYC Data" — identity and verification documents submitted by a User during the Know Your Customer (KYC) verification process, including CNIC, passport, proof of address and liveness verification images.
• "Cookies" — small text files placed on your device by the platform or its third-party service providers, used to maintain session state, measure analytics and deliver relevant content.
• "Sensitive Data" — a subset of personal data that receives enhanced protection, including financial account details, identity document numbers and biometric verification outputs.

The Data Controller for all personal data collected through the zk266 platform is the operator of zk266, whose details are set out in the Terms & Conditions. The operator is responsible for ensuring that your personal data is collected and processed in compliance with applicable data protection law and the principles set out in this Policy.

Where zk266 engages third-party Data Processors — such as game technology providers, payment processing services, identity verification vendors or analytics providers — it does so under written contracts that impose data protection obligations on those processors. Data Processors are permitted to process your data only for the specific purposes authorized by zk266 and may not use it for their own commercial purposes.

zk266 does not transfer the role of Data Controller to any third party without user notification except where required by applicable law or where the transfer is part of a lawful business restructuring process.

zk266 collects personal data through several channels: directly from you when you register an account or contact support; automatically through your use of the platform; and from third-party verification and payment processing services. The categories of data collected are set out below.

zk266 does not knowingly collect or process data relating to racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or criminal conviction records, except where explicitly required by applicable AML law (e.g., in the context of court orders or regulatory requests).

zk266 processes personal data only where there is a lawful basis for doing so. The primary legal bases and corresponding purposes are set out below:

• Performance of a Contract: Processing registration data, KYC data, financial transaction data and account management data is necessary to fulfill our contractual obligations to you as a User of the platform. Without this processing, we cannot provide the Services.
• Legal Obligation: We are required to process KYC data, transaction records and certain communications data to comply with Anti-Money Laundering (AML) obligations, age verification requirements and other regulatory duties imposed by applicable law and the operator's licensing framework.
• Legitimate Interests: We process usage data, device data and platform interaction data to improve platform security, prevent fraud, detect prohibited conduct (as defined in our Terms & Conditions), maintain platform integrity and ensure responsible gambling controls function correctly.
• Consent: Where we send you marketing communications, personalized offers or non-essential cookies, we do so only where you have given express, informed consent. You may withdraw this consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

Your personal data is processed for the following specific operational purposes on the zk266 platform:

1. Account Creation and Management: Registering your account, maintaining your profile, processing password resets and managing account communications.
2. Identity and Age Verification: Conducting KYC verification to confirm your identity, age and country of residence as required by the operator's licensing obligations and responsible gambling requirements.
3. Transaction Processing: Processing deposits, recording wagering activity, settling bets, handling withdrawal requests and maintaining accurate financial records. Payment references familiar to Pakistani users — such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — are referenced as contextual payment method identifiers only. zk266 does not share your personal data with payment providers beyond what is strictly necessary to process a transaction.
4. Fraud Prevention and Security: Monitoring account activity for indicators of fraud, collusion, money laundering, bot usage and other prohibited conduct as defined in the Terms & Conditions.
5. Responsible Gambling Enforcement: Maintaining records of self-exclusion, deposit limits and cool-off periods to enforce those protections consistently and prevent reactivation in contravention of user-set controls.
6. Customer Support: Responding to queries, complaints and dispute submissions submitted through live chat or email.
7. Legal and Regulatory Compliance: Retaining records as required by applicable AML law, licensing regulations and lawful orders from competent authorities.
8. Platform Improvement: Using aggregated and anonymized analytics data to improve platform performance, game availability and user experience.

zk266 does not sell, rent or trade your personal data to third parties for their own commercial purposes. We share personal data only in the following circumstances and only to the extent necessary for the specified purpose:

• Identity Verification Providers: Third-party KYC service providers who verify identity documents and conduct liveness checks on behalf of zk266. These providers operate under strict data processing agreements and are not permitted to use your KYC data for any purpose other than verification.
• Payment Processing Partners: Payment facilitators required to process deposit and withdrawal transactions. Only the minimum data necessary to process the specific transaction is shared.
• Game Technology Providers: Platform game and sports data providers may receive session and wagering data necessary to deliver game functionality. No directly identifying personal data (e.g., full name, CNIC number) is shared with game providers beyond what the game technology architecture technically requires.
• Regulatory and Law Enforcement Authorities: zk266 will disclose personal data to competent regulatory, judicial or law enforcement authorities where required to do so by a lawful order or applicable legal obligation.
• Business Transfers: In the event of a merger, acquisition or sale of the platform operator's business, personal data may be transferred to the successor entity, subject to equivalent data protection commitments being maintained.

zk266 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable legal and regulatory obligations. Our general retention principles are as follows:

• Active Account Data: Retained for the duration of the account relationship and for a defined period after account closure, as required by AML record-keeping obligations applicable under the operator's licensing framework.
• KYC Documents: Retained in accordance with AML regulatory requirements, which typically mandate retention for a minimum of five (5) years following the end of the account relationship or last transaction, whichever is later.
• Transaction Records: Financial records including deposit history and withdrawal records are retained for the minimum period required by applicable regulatory and tax law.
• Support Communications: Retained for a reasonable period following resolution of the relevant query or complaint, and for longer where the communication is relevant to an ongoing legal matter.
• Analytics and Usage Data: Aggregated and anonymized analytics data may be retained indefinitely as it does not constitute personal data once anonymization is complete.
• Self-Exclusion Records: Self-exclusion records are retained for the duration of the exclusion period and for a further period as required to enforce the exclusion effectively, including against re-registration attempts.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized in accordance with our data disposal procedures.

zk266 implements technical and organizational measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration or disclosure. These measures include, but are not limited to:

• SSL/TLS encryption for all data transmitted between your device and the platform;
• Encrypted storage of sensitive data at rest, including KYC documents and financial records;
• Access controls restricting internal access to personal data on a strict need-to-know basis;
• Two-factor authentication (2FA) options for user accounts;
• Regular security assessments and vulnerability monitoring of platform infrastructure;
• Staff training on data handling, phishing awareness and secure data practices.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, zk266 will notify affected users and, where applicable, the relevant supervisory authority in accordance with applicable breach notification obligations.

zk266 uses cookies and similar tracking technologies to operate the platform, maintain your session, improve performance and, where you have consented, to deliver relevant content. Cookies do not contain your full name, payment details or CNIC number.

• Strictly Necessary Cookies: These are essential for the platform to function — including session management, login state and security tokens. These cookies cannot be disabled without impairing platform functionality.
• Analytics Cookies: Used to measure platform usage patterns, understand how users navigate the site and identify performance issues. Analytics data is collected in aggregated form where possible.
• Functional Cookies: Store your preferences such as language settings, game lobby display options and responsible gambling tool settings.
• Marketing Cookies: Used only where you have given explicit consent. These cookies may track whether you have engaged with a specific promotional offer or arrived via a particular referral source. You may opt out of marketing cookies at any time.

You may manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the platform. zk266 does not currently respond to "Do Not Track" browser signals, but we respect cookie consent choices made through our consent management system.

The zk266 platform is strictly for adults aged 18 years or older, or the higher minimum age required by the operator's applicable license jurisdiction. We do not knowingly collect personal data from individuals under the applicable minimum age.

Age verification is enforced through the KYC process, which requires submission of a valid government-issued identity document confirming date of birth. Where we become aware that personal data has been collected from a minor — whether through an incorrect date of birth provided at registration or for any other reason — we will immediately suspend the relevant account, delete the associated personal data and, where applicable, return any deposited funds to the verified payment source.

If you believe that a minor has registered an account on zk266, please contact our support team immediately at [email protected] so that we can take prompt action.

As an online platform with globally distributed technology infrastructure, zk266 may transfer your personal data to servers and service providers located in jurisdictions outside Pakistan. Where such transfers occur, we take appropriate steps to ensure that your data receives a level of protection consistent with applicable data protection principles.

Protective measures for cross-border transfers may include contractual data transfer agreements with recipient entities, ensuring the recipient jurisdiction provides an adequate level of data protection, or applying other lawful transfer mechanisms recognized under applicable data protection frameworks.

You acknowledge that by using the zk266 platform, your personal data may be transferred to and processed in jurisdictions whose data protection laws may differ from those of Pakistan. Where such transfers are necessary to provide the Services, they are conducted only with appropriate safeguards in place.

Subject to applicable law and the nature of the data concerned, you may have the following rights in relation to your personal data held by zk266. To exercise any of these rights, please contact us using the details in Section 16.

We will respond to valid rights requests within a reasonable timeframe in accordance with applicable law — typically within 30 days, or longer in complex cases where extended time is permitted and you are notified accordingly. We may need to verify your identity before actioning a request. Exercising your rights is free of charge in most circumstances.

If you believe that zk266 has handled your personal data in a manner inconsistent with this Privacy Policy or applicable data protection law, you have the right to lodge a complaint. We encourage you to first raise the matter with us directly so that we can attempt to resolve it promptly.

Complaints may be submitted by email to [email protected] with the subject line "Privacy Complaint". Please include your registered account username, a clear description of your concern, and any relevant supporting information. We will acknowledge receipt and investigate the matter in good faith.

If you are not satisfied with our response, you may have the right to escalate your complaint to the data protection supervisory authority in the jurisdiction where the operator holds its applicable gaming or data license, as indicated in the operator's license documentation. The applicable supervisory authority will be identified in the operator's licensing information.

zk266 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements or platform functionality. Material changes will be communicated to registered users via a prominent notice on the platform prior to the amended Policy taking effect.

The effective date displayed at the top of this Policy indicates when the current version entered into force. Continued use of the platform following notification of any amendment constitutes your acceptance of the revised Policy. If you do not accept the revised Policy, you should cease using the platform and may request account closure through support.

Archived versions of this Policy are available on request by contacting [email protected].

If you have any questions, concerns or requests relating to this Privacy Policy or the handling of your personal data by zk266, please contact us through the following channels:

• Live Chat: Available 24/7 within the zk266 platform. The fastest channel for urgent privacy queries or data subject requests.
• Email: [email protected] (plain text — not a clickable link). For formal data subject requests and privacy complaints, please use the subject line "Privacy Request" or "Privacy Complaint" as applicable.
• Language: Privacy-related correspondence is handled in English as standard. Urdu-language assistance is available on request.