Privacy Policy

This Privacy Policy applies to all personal data collected, processed, and stored by zk889 in connection with your use of the website at https://zk889.cam and all associated services, mobile interfaces, and communication channels (collectively, "the Platform").

The data controller responsible for your personal data is the operating entity behind zk889, an internationally licensed online gaming and sports-betting platform. For the purposes of this Policy, "zk889", "we", "us", and "our" refer to that operating entity. Contact details for the data controller are provided in Section 14 of this Policy.

This Policy applies to all registered Players, prospective Players who browse the Platform without registering, and individuals who contact zk889 via any support or communication channel. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy.

zk889 collects personal data in the following categories. The specific data points collected depend on how you interact with the Platform:

2.1 Identity & Registration Data

• Full legal name
• Date of birth (used to verify that you are at least 21 years of age)
• Gender (optional, for personalization)
• National identity number (KTP number for Indonesian nationals, or equivalent for other nationalities)
• Username and encrypted password

2.2 Contact Data

• Email address
• Mobile phone number (used for account security and, where opted in, promotional communications)
• Residential address

2.3 Financial & Payment Data

• Bank account details (account holder name, account number, bank name — e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon)
• E-wallet account details (OVO, DANA, GoPay, ShopeePay, or LinkAja account identifiers)
• Deposit and withdrawal transaction history
• Account balance and gaming balance records

2.4 KYC Verification Documents

• Copies of government-issued identity documents (KTP or passport)
• Proof of address documents
• Selfie photographs taken during identity verification

2.5 Technical & Usage Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser type
• Session timestamps, login history, and session duration
• Pages visited, features used, and navigation patterns within the Platform
• Bet placement history, game play logs, and wagering activity

2.6 Communications Data

• Records of live chat, email, and in-app messaging conversations with our support team
• Support ticket content and resolution records
• Responses to surveys or feedback forms (where voluntarily completed)

zk889 collects personal data through the following means:

• Directly from you: When you register an account, complete the KYC verification process, make a deposit or withdrawal, contact our support team, or respond to a survey.
• Automatically: Through cookies, server logs, and analytics tools that record technical and usage data when you visit or interact with the Platform. See Section 7 for full details on cookies.
• From third-party service providers: KYC and identity verification providers may supply us with verified identity data. Payment processors transmit transaction confirmation details. Fraud-detection partners may provide risk-scoring data associated with an account or transaction.
• From publicly available sources: In limited cases where regulatory compliance requires it, zk889 may verify information against publicly available records such as sanctions lists or politically exposed persons (PEP) databases.

The table below sets out the primary purposes for which zk889 processes personal data, the categories of data used for each purpose, and the legal basis that justifies that processing:

zk889 does not use personal data for purposes that are incompatible with those listed above without first obtaining your explicit consent or establishing a separate lawful basis.

zk889 does not sell personal data to third parties. We share personal data only in the following circumstances and only to the extent strictly necessary for the stated purpose:

5.1 Payment Processors

To process deposits and withdrawals via Indonesian bank channels (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), we share the minimum financial and identity data required to authorize and confirm each transaction. These processors operate under their own privacy policies and are contractually prohibited from using your data for any purpose beyond the specific transaction.

5.2 KYC & Identity Verification Providers

Identity documents and verification selfies are shared with regulated third-party KYC service providers to confirm your identity and age. These providers are contractually bound by strict data security and confidentiality obligations.

5.3 Game Content Providers

Game studios and live dealer platform providers (such as Pragmatic Play, Evolution Gaming, and similar) receive limited session data — typically a pseudonymized player identifier and game session token — necessary to deliver game content and record results. They do not receive your full name, national ID, or financial data.

5.4 Fraud Prevention & Security Services

Technical and usage data, including IP addresses and device fingerprints, may be shared with specialized fraud-detection and cybersecurity services to identify and prevent account abuse, unauthorized access, and money laundering.

5.5 Legal & Regulatory Authorities

zk889 will disclose personal data to regulatory bodies, law enforcement agencies, or courts when required to do so by law, court order, or the regulatory requirements of the jurisdiction in which the Platform is licensed. We will notify you of such disclosure wherever legally permissible.

5.6 Corporate Transactions

In the event of a merger, acquisition, or sale of substantially all assets of the zk889 operating entity, personal data held by the Platform may be transferred to the successor entity. Players will be notified of any such transfer and the privacy practices of the successor entity prior to the transfer taking effect.

zk889 operates an internationally licensed platform. As a result, personal data collected from Indonesian players may be transferred to and processed in countries outside of Indonesia, including the jurisdiction in which zk889 is licensed and incorporated, as well as the locations of our KYC, payment, and game-technology partners.

Where personal data is transferred internationally, zk889 takes the following safeguards to ensure that your data receives an equivalent level of protection to that afforded under applicable Indonesian data protection principles:

• Transfer only to jurisdictions with recognized data protection standards, or to recipients who have signed contractual data protection clauses consistent with international best practice.
• Contractual requirements placed on all data processors obliging them to process personal data only as instructed and to apply security measures no less stringent than those applied by zk889.
• Regular review of international transfer arrangements as part of zk889's compliance audit cycle.

By registering an account with zk889, you explicitly consent to the transfer of your personal data internationally as described in this section, subject to the safeguards above.

zk889 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyze usage patterns, and improve the player experience. The following categories of cookies are used:

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary or fraud-prevention cookies may prevent you from accessing certain features of the Platform or may compromise your account security.

zk889 retains personal data for the minimum period necessary to fulfill the purposes outlined in this Policy, subject to any longer retention periods required by applicable law or our licensing conditions. The following retention schedule provides general guidance:

• Active account data (identity, contact, financial): Retained for the duration of the account relationship plus five (5) years after account closure, to satisfy anti-money laundering and regulatory record-keeping requirements.
• KYC documents: Retained for five (5) years from the date of verification, consistent with international AML standards.
• Transaction records: Retained for five (5) years from the date of each transaction.
• Support communications: Retained for three (3) years from the date of the last interaction, for quality assurance and dispute resolution purposes.
• Analytics and usage data: Retained in aggregated, anonymized form indefinitely; raw usage logs retained for up to twelve (12) months.
• Marketing consent records: Retained for the duration of the opted-in relationship plus two (2) years after opt-out, as evidence of consent management compliance.

At the end of the applicable retention period, personal data is securely deleted using industry-standard data destruction methods or, where deletion is not technically feasible, permanently anonymized.

zk889 implements a layered security architecture designed to protect personal data against unauthorized access, disclosure, alteration, and destruction. Key technical and organizational security measures in place include:

• 256-bit SSL/TLS encryption for all data in transit between the Player's browser and the Platform.
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records.
• Two-factor authentication (2FA) available for all Player accounts and enforced for all administrative staff accounts.
• Role-based access controls ensuring that personal data is accessible only to staff members who require it to perform their specific job functions.
• Access logs maintained for all administrative interactions with personal data, reviewed regularly by the compliance team.
• Regular independent penetration testing and security audits of the Platform's infrastructure.
• Automated fraud-detection systems that monitor account activity in real time and flag anomalies for review.
• Formal incident response procedures with defined escalation paths and regulatory notification timelines in the event of a data breach.

The Platform is strictly intended for adults aged 21 years and older. zk889 does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the registration and KYC process to enforce this requirement.

If zk889 discovers or is informed that personal data belonging to an individual under the age of 21 has been collected, the associated account will be immediately suspended, any balance will be reviewed in accordance with the Platform's Terms & Conditions, and the personal data will be deleted from our systems without undue delay.

If you are a parent or guardian and believe that your child has registered an account on the Platform, please contact our support team immediately at [email protected]. We will investigate and act promptly.

As a player whose personal data is processed by zk889, you hold the following rights. These rights are subject to applicable legal limitations and the Platform's regulatory obligations:

To exercise any of the above rights, please contact our Data Protection Officer (DPO) using the details in Section 14. We will respond within 30 days of a verified request. We may need to verify your identity before processing a rights request to protect against unauthorized access to another person's data.

zk889 sends promotional communications — including bonus offers, seasonal promotions tied to Indonesian cultural dates such as Idul Fitri, Indonesian Independence Day (17 August), and Ramadhan, as well as platform news and sports-betting alerts — only to Players who have explicitly opted in to receive them.

You may opt in to marketing communications during account registration or at any time through the notification preferences section of your account dashboard. Separate opt-in options are available for email communications and SMS/mobile notifications.

You may withdraw your consent to marketing communications at any time. To opt out:

• Use the unsubscribe link included in every marketing email.
• Adjust your notification preferences in your account dashboard under Settings > Communications.
• Contact our support team at [email protected] and request removal from all marketing lists.

Opting out of marketing communications does not affect the delivery of transactional messages that are necessary for the operation of your account, such as deposit confirmations, withdrawal notifications, and security alerts. These cannot be disabled while your account is active.

zk889 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When a material change is made, we will endeavour to notify registered Players via email or an in-platform notification before the change takes effect.

The current version of this Policy, including its effective date, is always available at https://zk889.cam/privacy-policy. Your continued use of the Platform after any published amendment constitutes your acceptance of the revised Policy. If you do not accept the revised Policy, you should close your account and cease using the Platform.

If you have any questions, concerns, or complaints about this Privacy Policy or about how zk889 handles your personal data, you may contact us through the following channels:

• General Privacy Inquiries & Rights Requests: Contact our 24/7 support team via live chat within the Platform or by email at [email protected] (plain text — not a clickable link).
• Data Protection Officer (DPO): For formal data protection matters, rights requests, or regulatory complaints, please address your communication to the Data Protection Officer at the registered address of the zk889 operating entity, available upon request.
• Response Time: zk889 aims to acknowledge all privacy-related inquiries within 48 hours and to provide a substantive response within 30 days. Complex requests involving large volumes of data may take up to 60 days; we will notify you if an extension is required.

If you are not satisfied with zk889's response to a privacy complaint, you may have the right to escalate the matter to the relevant data protection supervisory authority in the jurisdiction where the Platform is licensed. Details of the applicable supervisory authority are available upon request from our DPO.