Privacy Policy — How zeta7 Collects, Uses, and Protects Your Personal Data

This Privacy Policy ("Policy") describes how zeta7 ("we", "us", "our", "the Platform") collects, uses, stores, discloses, and protects the personal data of individuals ("you", "your", "the Player") who access or use the zeta7 website, mobile interface, casino games, sportsbook, and all associated services available at zeta7.io.

zeta7 is committed to handling your personal data with integrity, transparency, and respect. We recognise that players in Bangladesh and across our user base trust us with sensitive personal and financial information, and we take that responsibility seriously. Every data processing activity described in this Policy is carried out for a defined, legitimate purpose and is subject to appropriate safeguards.

This Policy is incorporated by reference into the zeta7 Terms and Conditions. By registering an account or using the zeta7 platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy is effective as of 1 January 2026 and supersedes all prior privacy notices published by zeta7. The most recent revision date is always displayed at the top of this document. We recommend reviewing this Policy periodically to stay informed of any updates.

zeta7 collects personal data across several categories depending on how you interact with the platform. The specific data collected at each stage is detailed below.

We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, or health data, except to the extent that health-related information is voluntarily disclosed by a player in the context of a responsible gaming request or self-exclusion application.

zeta7 collects personal data through the following channels and mechanisms:

• Direct provision by you: Information you provide when completing the registration form, submitting KYC documents, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated collection during platform use: Technical and usage data collected automatically through cookies, session tracking, server logs, and analytics tools each time you access the zeta7 platform.
• Payment providers: Transaction confirmation data received from mobile wallet operators (bKash, Nagad, Rocket, Upay) and banking partners when you make deposits or request withdrawals.
• Identity verification services: Where zeta7 engages third-party KYC verification providers, those providers may return identity verification results and risk scores to us based on the documents you submit.
• Fraud prevention and security tools: Automated fraud detection systems may collect behavioural signals during your session to identify unusual activity patterns. This data is used solely for platform security purposes.
• Publicly available sources: In limited circumstances, zeta7 may verify certain information against publicly available records for the purpose of AML compliance or fraud prevention.

zeta7 processes your personal data exclusively for the following defined purposes. We do not process personal data for any purpose not listed here without first obtaining your explicit consent.

• Account creation and management: To register your account, maintain your profile, authenticate your identity at login, and manage account settings and preferences.
• Identity and age verification (KYC): To confirm that you meet the 21+ age requirement and satisfy applicable identity verification obligations before processing withdrawals or activating full account functionality.
• Payment processing: To facilitate deposits, process withdrawal requests, reconcile transactions, and handle payment disputes or chargebacks in cooperation with our payment partners.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeover attempts, and other prohibited conduct on the platform.
• Responsible gaming compliance: To monitor wagering patterns for signs of problem gambling behaviour and to apply responsible gaming tools (deposit limits, self-exclusion, cool-off periods) at the player's request or at zeta7's discretion in the interest of player welfare.
• Legal and regulatory compliance: To meet our obligations under applicable anti-money laundering (AML), counter-terrorism financing (CTF), and data protection legislation, including the retention of records as required by law.
• Customer support: To respond to account queries, process complaints, provide technical assistance, and maintain records of support interactions for quality assurance purposes.
• Platform improvement and analytics: To analyse aggregated, anonymised usage data in order to improve the functionality, performance, and game offering of the zeta7 platform.
• Promotional communications: To send you personalised offers, bonus notifications, and promotional updates by email or SMS, where you have provided consent or where such communications relate directly to your active account. You may opt out at any time.

Each data processing activity carried out by zeta7 rests on one of the following recognised legal bases:

• Contractual necessity: Processing is necessary to perform the contract between you and zeta7 — specifically, to operate your account, process your bets, and execute payment transactions.
• Legal obligation: Processing is required to comply with applicable laws and regulations, including AML/CTF obligations, KYC requirements, and record-keeping mandates imposed by relevant authorities.
• Legitimate interests: Processing is necessary for zeta7's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where processing is based on consent (for example, sending marketing communications or processing health-related responsible gaming disclosures), we rely on your freely given, specific, and informed consent. You have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

zeta7 does not sell, rent, or trade your personal data. We share your data only with trusted third parties where such sharing is necessary to deliver our services or to comply with legal obligations, and only to the extent required for those specific purposes.

Categories of third parties with whom we may share your personal data include:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank, as necessary to process deposits and withdrawals.
• Identity verification and KYC providers: Third-party services engaged to verify the authenticity of identity documents and to conduct AML screening.
• Game software providers: Casino game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive limited technical data (such as session tokens and bet records) necessary to operate the games on the zeta7 platform.
• IT infrastructure and hosting providers: Cloud hosting and data storage providers who maintain the servers on which zeta7 data is held. These providers are contractually bound to process data only on our instructions.
• Legal and compliance authorities: Regulatory bodies, law enforcement agencies, financial intelligence units, and courts where disclosure is required by applicable law or valid legal process.
• Professional advisors: Legal counsel, auditors, and accountants engaged by zeta7 under obligations of professional confidentiality.

All third-party data processors engaged by zeta7 are required to enter into data processing agreements that impose obligations consistent with the privacy standards described in this Policy. zeta7 remains responsible for ensuring that third-party processors handle your data appropriately.

zeta7 uses cookies and similar tracking technologies (including web beacons and local storage objects) to operate the platform, maintain session security, and analyse usage patterns. The following categories of cookies are used:

• Strictly necessary cookies: These cookies are essential for the platform to function. They maintain your login session, store your language preferences, and keep your account secure. They cannot be disabled without impairing platform functionality.
• Performance and analytics cookies: These cookies collect anonymised information about how players interact with the platform — such as which pages are visited most frequently, how long sessions last, and where navigation errors occur. This data is used to improve platform performance.
• Functional cookies: These cookies remember your preferences (such as display settings and notification choices) to provide a more personalised experience on return visits.
• Security cookies: These cookies help detect and prevent fraudulent activity and unauthorised access attempts by linking your current session to verified account credentials.

Most web browsers allow you to manage cookie settings through the browser's privacy or settings menu. You may choose to block or delete cookies; however, doing so may impair the functionality of the zeta7 platform, particularly features that require an active authenticated session such as placing bets, viewing account history, and requesting withdrawals.

zeta7 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.

The following retention periods apply as a general guide:

• Active account data: Retained for the full duration of your registered account with zeta7.
• KYC and identity documents: Retained for a minimum of 5 years following account closure, in compliance with AML record-keeping obligations.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction, in compliance with applicable financial record-keeping requirements.
• Support and communications records: Retained for 3 years following the closure of each support interaction or complaint, for quality assurance and dispute resolution purposes.
• Technical and usage logs: Retained for 12 months from the date of collection, after which they are anonymised or deleted.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where anonymisation is applied, the resulting data is no longer personal data and may be retained indefinitely for statistical and research purposes.

You may request early deletion of your personal data by contacting [email protected]. Requests for deletion are subject to zeta7's legal obligations to retain certain categories of data, which may prevent full deletion in all cases. We will inform you of any limitations that apply to your specific deletion request.

zeta7 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• SSL/TLS encryption: All data transmitted between your browser or mobile device and the zeta7 platform is encrypted in transit using Transport Layer Security (TLS) with a minimum of 256-bit encryption.
• Encrypted data storage: Personal data and financial records stored on zeta7 servers are encrypted at rest using industry-standard encryption algorithms.
• Access controls: Access to systems containing personal data is restricted to authorised zeta7 personnel on a strict role-based, need-to-know basis. All access events are logged and monitored.
• Multi-factor authentication: Internal systems holding personal data require multi-factor authentication for staff access.
• Intrusion detection and monitoring: zeta7 employs continuous network monitoring and intrusion detection systems to identify and respond to security threats in real time.
• Regular security assessments: The platform undergoes periodic security audits and vulnerability assessments conducted by qualified security professionals.

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. In the event of a personal data breach that poses a risk to your rights and freedoms, zeta7 will notify affected players without undue delay and will take all reasonable steps to mitigate the impact of the breach.

As a zeta7 player, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact [email protected] with a clear description of your request. We will respond within a reasonable period and in any event no later than 30 days from receipt of a valid request.

• Right of Access: You have the right to request a copy of all personal data that zeta7 holds about you, together with information about the purposes for which it is processed and the categories of recipients with whom it has been shared.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. Minor corrections (such as email address updates) can also be made directly within your account settings.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where processing is unlawful. This right is subject to overriding legal retention obligations.
• Right to Restrict Processing: You have the right to request that zeta7 restricts the processing of your personal data in certain circumstances, for example while the accuracy of data is being contested.
• Right to Data Portability: You have the right to receive a copy of personal data you have provided to zeta7 in a structured, commonly used, machine-readable format and to request that it be transmitted to another controller, where technically feasible.
• Right to Object: You have the right to object to processing of your personal data that is based on legitimate interests, including profiling. You also have an unconditional right to object to processing for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

zeta7 is a gambling platform intended exclusively for adults aged 21 years and above. We do not knowingly collect, use, or store personal data from any individual under the age of 21. Providing gambling services to minors is strictly prohibited under the zeta7 Terms and Conditions.

Age verification procedures are applied at registration and prior to the first withdrawal to confirm that each account holder meets the 21+ requirement. If zeta7 discovers that an account has been registered by or on behalf of a person under the age of 21, the account will be closed immediately, all funds returned to the originating payment method, and all personal data associated with that account deleted in accordance with applicable law.

If you are a parent or guardian and believe that a minor in your care has registered an account on zeta7, please contact [email protected] immediately. We will investigate and take appropriate action without delay.

zeta7 operates as an internationally licensed platform. In the course of delivering our services, your personal data may be transferred to, stored, or processed in countries outside Bangladesh. This may occur, for example, when data is processed by game providers, cloud infrastructure providers, or KYC verification services whose servers are located in other jurisdictions.

Where personal data is transferred internationally, zeta7 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that described in this Policy. These safeguards may include:

• Data processing agreements incorporating standard contractual clauses that impose data protection obligations on the receiving party.
• Transfers to countries or territories recognised as providing an adequate level of data protection by applicable international standards.
• Binding corporate rules or equivalent mechanisms where data is transferred within a group of companies.

By using the zeta7 platform, you acknowledge that your personal data may be transferred internationally as described above. If you wish to obtain further information about the safeguards in place for any specific international transfer, please contact [email protected].

zeta7 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform functionality. The effective date of the most recent version is displayed at the top of this document.

Where a material change to this Policy is made — for example, a change that affects the categories of data we collect, the purposes for which we process it, or the rights available to you — zeta7 will endeavour to notify registered players by email to the address associated with their account at least 7 days prior to the change taking effect.

Your continued use of the zeta7 platform following the publication of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you must stop using the platform and may request account closure by contacting [email protected].

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by zeta7, please contact our support team through the following channel:

• Email: [email protected] (plain text only — not a clickable link)
• Support Hours: 24 hours a day, 7 days a week
• Response Language: English
• Time Zone: Bangladesh Standard Time (BST, UTC+6)

When submitting a data rights request, please include your full registered name, the email address associated with your zeta7 account, and a clear description of your request. This will allow us to locate your records and respond efficiently.

zeta7 takes all privacy-related queries seriously and will respond to every request within 30 days of receipt. Where a request is complex or involves a large volume of data, we may extend this period by a further 30 days and will notify you of the extension.