Privacy Policy — zk988

1.1 Scope. This Privacy Policy applies to all personal data collected, stored, and processed by zk988 in connection with your use of the website accessible at https://zk988.vu (the "Platform"), any associated member portal, and all communications between you and the zk988 support team.

1.2 Data Controller. For the purposes of applicable data protection law, the data controller is zk988, operating the Platform at https://zk988.vu. All inquiries relating to the use of your personal data should be directed to our Data Protection contact at the email address provided in Section 16 of this Policy.

1.3 Acceptance. By registering an Account on the Platform or by continuing to use the Platform after this Policy has been updated, you confirm that you have read, understood, and consented to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must cease use of the Platform immediately and may request Account closure in accordance with our Terms & Conditions.

1.4 Indonesia Market Context. zk988 primarily serves members who are residents of Indonesia. The Platform is designed to accommodate Indonesian payment infrastructure (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja) and to serve players across Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, and other major Indonesian cities. Data handling practices described in this Policy apply equally to all members regardless of their city of residence within Indonesia.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Account" — the individual member account registered on the Platform under a unique username and password.
• "Member" / "You" — any individual who has registered an Account on the Platform or who accesses the Platform as a visitor.
• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, identity document number, contact details, financial data, and device identifiers.
• "Processing" — any operation or set of operations performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
• "KYC" (Know Your Customer) — the identity and age verification process required by zk988 to comply with responsible gaming obligations and to confirm a Member's eligibility to use the Platform.
• "Third-Party Processor" — an external company or service provider engaged by zk988 to perform specific data processing functions on our behalf (e.g., payment processors, identity verification providers, fraud detection services).
• "Cookies" — small text files placed on your device by the Platform to enable session management, preference storage, and analytics functions.
• "Policy" — this Privacy Policy document, as amended from time to time.

3.1 Registration Data. When you create an Account, zk988 collects: full legal name, date of birth, residential address in Indonesia, email address, and mobile phone number. This data is required to open and maintain your Account.

3.2 Identity Verification (KYC) Data. To satisfy age verification and responsible gaming obligations, we may request copies of: government-issued National Identity Card (KTP), passport, driver's license, or other official identification recognized in Indonesia. We may also request proof of address and, in certain cases, proof of source of funds.

3.3 Financial & Transaction Data. We collect data relating to all deposits, withdrawals, and bet settlements on your Account, including: payment method details (bank name, account holder name, masked account number), transaction amounts in Indonesian Rupiah (IDR), timestamps, and transaction reference numbers. Full payment account numbers are never stored on zk988 servers — only masked identifiers are retained.

3.4 Gameplay & Betting Data. We record all gaming activity on your Account, including: games played (slots, live casino, crash games, fish shooting, sportsbook markets), bet amounts, outcomes, session durations, and wagering history. This data is used for account management, dispute resolution, bonus eligibility assessment, and responsible gaming monitoring.

3.5 Technical & Device Data. When you access the Platform, we automatically collect: IP address, browser type and version, operating system, device type (desktop/mobile), screen resolution, referring URL, pages visited, and session duration. This data is used for security monitoring, fraud detection, and platform optimization.

3.6 Communication Data. We retain records of all communications between you and the zk988 support team, including live chat transcripts, email correspondence, and support ticket content. These records are used for quality assurance and dispute resolution.

3.7 Voluntary Data. You may provide additional personal data voluntarily — for example, when completing a satisfaction survey, entering a promotion, or updating your Account profile. Such data is used only for the specific purpose for which it was submitted.

4.1 Directly From You. The majority of personal data we hold is provided directly by you during Account registration, KYC submission, deposit and withdrawal requests, support interactions, and voluntary profile updates.

4.2 Automatically. Technical and device data is collected automatically when you access the Platform through our web server logs, session management systems, and analytics tools. This collection occurs regardless of whether you are logged in to an Account.

4.3 From Payment Processors. When you make a deposit or withdrawal via a local Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), the relevant payment processor may return transaction confirmation data to zk988 for the purpose of crediting or debiting your Account Balance.

4.4 From Identity Verification Partners. Where zk988 uses a third-party KYC service provider to assist with document verification, that provider may return a verification result (pass/fail/pending) and a risk signal to zk988. The raw identity documents themselves are handled by the KYC provider under their own data protection obligations.

4.5 From Fraud Detection Systems. Automated fraud and AML screening tools may flag transactions or Account activities and return risk scores to the zk988 compliance team. These signals inform human review decisions but do not automatically trigger punitive actions without manual assessment.

zk988 processes your personal data for the following specific, defined purposes:

• Account Creation and Management: Establishing and maintaining your Member Account, including authentication, password reset, and Account closure.
• Age and Identity Verification: Confirming that you are 21 years of age or older and that your identity matches the details provided during registration, in compliance with our responsible gaming commitment.
• Payment Processing: Receiving deposits and issuing withdrawals via your selected payment method, and maintaining transaction records for your Account ledger.
• Contractual Performance: Fulfilling our obligations under the zk988 Terms & Conditions, including settling bets, applying bonuses, and enforcing wagering requirements.
• Security and Fraud Prevention: Detecting and preventing unauthorized access, account takeovers, fraudulent transactions, money laundering, and bonus abuse.
• Responsible Gaming: Monitoring betting patterns and Account activity to identify potential signs of problem gambling, enforcing deposit limits and self-exclusion requests, and proactively contacting Members where a welfare concern is identified.
• Customer Support: Responding to your inquiries, resolving disputes, and providing technical assistance through live chat and email.
• Marketing Communications: Sending you information about promotions, seasonal offers (such as those tied to Idul Fitri, Ramadhan, or BRI Liga 1 fixtures), and Platform updates — only where you have provided consent or where such communications are permitted under applicable law. You may unsubscribe at any time.
• Legal and Regulatory Compliance: Retaining records as required by applicable anti-money laundering, counter-terrorism financing, and data protection regulations.
• Platform Improvement: Analyzing aggregated, anonymized usage data to improve the Platform's features, performance, and user experience.

zk988 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to fulfill our obligations to you under the Terms & Conditions — for example, processing deposits, settling bets, and issuing withdrawals.
• Consent: Where you have given explicit consent to a specific processing activity — for example, receiving marketing communications or providing biometric identification data for enhanced KYC.
• Legitimate Interests: Processing that is necessary for zk988's legitimate interests, provided those interests are not overridden by your data protection rights — for example, fraud detection, platform security monitoring, and aggregated analytics for service improvement.
• Legal Obligation: Processing required to comply with applicable legal obligations — for example, retaining transaction records for AML reporting purposes or responding to a lawful request from a competent authority.

Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to the withdrawal.

7.1 No Sale of Personal Data. zk988 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes under any circumstances.

7.2 Authorized Third-Party Processors. We share personal data with carefully selected Third-Party Processors who act on our behalf and under our documented instructions. These processors are contractually bound to handle your data in a manner consistent with this Policy and applicable data protection law. Current categories of authorized processors include:

• Payment Processors: Indonesian banking partners and e-wallet providers (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja) — for the sole purpose of executing deposit and withdrawal transactions.
• KYC & Identity Verification Providers: Third-party identity verification platforms that validate the authenticity of government-issued documents submitted during KYC.
• Fraud Detection & AML Screening Services: Automated risk screening tools that analyze transaction patterns for compliance purposes.
• Game Content Providers: Studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive a pseudonymous Member identifier to enable game session management. These providers do not receive your full name or contact details.
• Cloud Infrastructure & Hosting Providers: Secure hosting and data storage services that store encrypted Platform data on our behalf.
• Customer Support Platforms: Live chat and ticketing software providers used to deliver our 24/7 support service.

7.3 Legal Disclosure. zk988 may disclose personal data to competent government authorities, law enforcement agencies, or regulatory bodies where required to do so by applicable law, court order, or lawful government request. We will notify affected Members of such disclosures to the extent permitted by law.

7.4 Business Transfers. In the event of a merger, acquisition, or sale of all or part of zk988's business assets, personal data held by zk988 may be transferred to the acquiring entity. Members will be notified of any such transfer and of any resulting change to this Privacy Policy.

8.1 Cross-Border Processing. As an internationally operated platform, zk988 may transfer and process your personal data in countries outside Indonesia, including in jurisdictions where our hosting infrastructure, KYC providers, and game studio partners are located.

8.2 Transfer Safeguards. Where personal data is transferred to a jurisdiction that does not offer a level of data protection equivalent to that applicable in Indonesia, zk988 implements appropriate safeguards including contractual data processing agreements with receiving parties that impose obligations materially equivalent to those in this Policy.

8.3 Your Acknowledgment. By registering an Account and using the Platform, you acknowledge that your personal data may be transferred internationally as described in this section, and you consent to such transfers taking place under the safeguards described above.

9.1 Active Accounts. For as long as your Account remains open and active, zk988 retains all personal data necessary to operate your Account, process transactions, and comply with responsible gaming obligations.

9.2 Closed Accounts. Following the closure of your Account — whether at your request or by zk988 — we retain your personal data for a minimum of five (5) years from the date of closure. This retention period reflects our obligations under anti-money laundering and financial record-keeping requirements, and enables us to respond to any disputes, regulatory inquiries, or legal proceedings that may arise after closure.

9.3 Transaction Records. Financial transaction records (deposit and withdrawal history, bet settlement records) are retained for a minimum of seven (7) years from the date of each transaction, in accordance with financial compliance best practices.

9.4 KYC Documents. Identity verification documents submitted during KYC are retained for a minimum of five (5) years from the date of verification or from the date of Account closure, whichever is later.

9.5 Deletion. Upon expiry of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be associated with any identifiable individual. Anonymized aggregate data may be retained indefinitely for statistical and analytical purposes.

10.1 Technical Security. zk988 implements the following technical measures to protect your personal data against unauthorized access, loss, alteration, or disclosure:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the Platform is encrypted using industry-standard Transport Layer Security (TLS) protocols.
• Password Hashing: Member passwords are stored using one-way cryptographic hashing algorithms. No zk988 employee or system can view your password in plain text.
• Firewalls & Intrusion Detection: Platform servers are protected by enterprise-grade firewalls and continuous intrusion detection systems that monitor for and respond to suspicious access attempts in real time.
• Access Controls: Access to personal data within zk988's internal systems is restricted on a strict need-to-know basis. Staff with data access privileges are subject to background screening, confidentiality agreements, and regular access reviews.
• Data Minimization: We collect and retain only the data that is genuinely necessary for the purposes described in this Policy. Sensitive payment data (full card numbers, full bank account numbers) is never stored on our servers.

10.2 Organizational Security. In addition to technical controls, zk988 maintains documented information security policies, conducts regular staff training on data protection obligations, and performs periodic security assessments of its platform and third-party processor relationships.

10.3 Your Responsibility. While zk988 takes all reasonable steps to protect your data, you also play a critical role in keeping your Account secure. You are responsible for maintaining the confidentiality of your login credentials and for logging out of your Account on shared devices. If you suspect that your Account has been accessed without your authorization, contact our support team immediately via live chat.

10.4 Data Breach Notification. In the event of a personal data breach that poses a risk to your rights and freedoms, zk988 will notify affected Members as promptly as practicable and take immediate remedial action to contain the breach and secure affected data.

11.1 What Are Cookies? Cookies are small text files that are placed on your device when you visit the Platform. They are widely used to make websites function correctly, improve user experience, and provide analytical information to site operators.

11.2 Types of Cookies Used. zk988 uses the following categories of cookies:

11.3 Managing Cookies. Most web browsers allow you to control cookie settings through the browser's settings menu. You may block or delete cookies at any time; however, please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from logging in to your Account or completing transactions.

11.4 No Third-Party Advertising Cookies. zk988 does not place third-party advertising or behavioral targeting cookies on your device. We do not use cookies to build advertising profiles for sale to data brokers or advertising networks.

As a Member of the zk988 Platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact the zk988 support team using the details in Section 16:

• Right of Access: You have the right to request a copy of all personal data that zk988 holds about you. We will provide this information within 30 days of receiving a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections (e.g., email address updates) can be made directly via your Account settings.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent. Note that this right is subject to our legal retention obligations described in Section 9 — we may not be able to delete data that we are legally required to retain.
• Right to Restriction: You may request that we restrict the processing of your personal data in certain circumstances — for example, while a data accuracy dispute is being investigated.
• Right to Data Portability: You have the right to receive a copy of the personal data you have provided to zk988 in a structured, commonly used, machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on zk988's legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

13.1 Age Restriction. The zk988 Platform is strictly for adults aged 21 and over. We do not knowingly collect personal data from individuals under the age of 21. Any Account found to belong to a person under 21 will be suspended immediately and all associated personal data will be deleted or quarantined pending a compliance review.

13.2 Parental Responsibility. Adults in households where minors may have access to devices connected to the Platform are strongly encouraged to install parental control software and to safeguard their zk988 Account credentials from access by persons under 21.

13.3 Reporting Underage Access. If you believe that a minor has created an Account on the Platform or accessed your Account, please contact the zk988 support team immediately via live chat. We treat all such reports with the highest priority.

14.1 Game Studio Providers. The zk988 Platform hosts games supplied by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. When you launch a game, a secure session token is passed to the relevant studio to initialize your game session. Studios do not receive your personal identity information; they receive only a pseudonymous session identifier. Each studio operates under its own privacy policy with respect to any data collected within the game environment.

14.2 Payment Service Providers. When you initiate a deposit or withdrawal, you interact with the payment infrastructure of your chosen bank or e-wallet provider (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja). These providers operate under their own privacy policies and data protection obligations. zk988 has no control over data collected by payment providers during the payment authorization process on their own systems.

14.3 No External Links. The zk988 Platform does not contain links to external third-party websites. All navigation within the Platform is internal. zk988 is not responsible for the privacy practices of any website that you access independently outside of the Platform.

15.1 Right to Update. zk988 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform features. The "Last Updated" date at the top of this page will be revised whenever a material change is made.

15.2 Notification of Material Changes. Where a change materially affects how we process your personal data, we will notify you via a prominent notice on the Platform and, where applicable, via the email address registered to your Account, with a minimum of 14 days' notice before the change takes effect.

15.3 Continued Use. Your continued use of the Platform following the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must cease use of the Platform and may request Account closure in accordance with our Terms & Conditions.

16.1 Data Protection Inquiries. If you have any questions about this Privacy Policy, wish to exercise any of your data protection rights, or want to report a data concern, please contact the zk988 Data Protection team using the following details:

• Email: [email protected]
• Live Chat: Available 24/7 via the Platform after logging in to your Account
• Response Time: We aim to acknowledge all privacy inquiries within 2 business days (WIB, UTC+7) and to resolve them within 30 calendar days.

16.2 Language of Communication. While the zk988 Platform operates in English, our support team includes Indonesian-speaking agents available around the clock. You are welcome to contact us in either English or Bahasa Indonesia; however, formal Privacy Policy responses and data subject access request outputs will be issued in English as the Platform's official operating language.

16.3 Further Information. For further information about your rights as a data subject or about data protection law as it applies in your jurisdiction, we encourage you to consult with a qualified legal professional or the relevant data protection authority in your country of residence.