Privacy Policy — How zbaas Protects Your Data

1Introduction

This Privacy Policy ("Policy") describes how zbaas ("we", "us", or "our"), accessible at https://zbaas.app, collects, uses, stores, and protects personal information submitted by users ("you") when accessing or using the zbaas platform and all associated services. This Policy forms part of our Terms and Conditions and should be read alongside them.

By registering for or using the zbaas Platform, you acknowledge that you have read and understood this Policy and consent to the collection and use of your information as described herein. If you do not agree with this Policy, you must not use the Platform.

2Information We Collect

zbaas collects the following categories of personal data when you register, verify your account, make deposits or withdrawals, or interact with our support team:

3How We Use Your Information

zbaas uses the personal data we collect for the following specific purposes only:

• ▸To create and manage your account, verify your identity, and process your registration on the Platform.
• ▸To process deposits and withdrawals via bKash, Nagad, Rocket, and Upay, and to maintain accurate financial records for regulatory compliance.
• ▸To prevent fraud, detect suspicious activity, enforce our Terms and Conditions, and carry out anti-money laundering (AML) and Know Your Customer (KYC) checks as required.
• ▸To provide customer support, respond to your enquiries, and resolve disputes or complaints.
• ▸To send you service-related notifications such as deposit confirmations, withdrawal status updates, and important account alerts via SMS or email.
• ▸To analyse Platform usage, improve user experience, fix technical issues, and develop new features based on aggregate, anonymised behavioural data.

4Legal Basis for Processing

zbaas processes your personal data under the following lawful bases:

• ▸Contractual necessity — processing required to fulfil our obligations under the Terms and Conditions you accepted when registering, including account management and payment processing.
• ▸Legal obligation — processing necessary to comply with applicable law, including AML regulations, KYC requirements, fraud prevention obligations, and data retention mandates.
• ▸Legitimate interests — processing to protect the security of the Platform, detect and prevent fraud, improve our services, and communicate operationally important information to users.
• ▸Consent — where you have actively opted in to receive promotional communications or have consented to specific data uses at the time of collection. You may withdraw consent at any time by contacting support.

5Sharing Your Information

zbaas does not sell, rent, or trade your personal data. We may share your information with third parties only under the following limited circumstances:

• ▸Payment processors — we share the minimum necessary financial data with bKash, Nagad, Rocket, and Upay solely to execute deposit and withdrawal transactions you have initiated.
• ▸Game providers — certified game studios and providers (e.g. Pragmatic Play, Evolution Gaming) may receive anonymised session identifiers for game integrity and RNG certification audit purposes.
• ▸Legal authorities — we may disclose personal data to law enforcement, regulatory bodies, or courts when required to do so by applicable law, court order, or to protect the rights, property, or safety of zbaas or its users.
• ▸Service providers — trusted technical vendors (e.g. cloud hosting, cybersecurity, analytics) who process data on our behalf under strict data processing agreements that prohibit them from using your data for any independent purpose.

6Cookies and Tracking Technologies

zbaas uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and improve the user experience. The following types of cookies may be active during your session:

• ▸Essential cookies — required for the Platform to function correctly, including session authentication, security tokens, and login state management. These cannot be disabled without breaking core functionality.
• ▸Performance cookies — collect anonymised data about how users interact with the Platform (e.g. most visited pages, average session length) to help us identify areas for improvement. No personally identifiable information is captured.
• ▸Functional cookies — remember your preferences such as language setting and display options to personalise your experience on subsequent visits.

Most mobile browsers allow you to control cookie settings through your browser preferences. Disabling essential cookies may impair your ability to log in or use certain features of the Platform. By continuing to use the Platform, you consent to our use of cookies as described above.

7Data Retention

zbaas retains your personal data for as long as your account remains active and for a minimum of five (5) years following account closure. This retention period is required to meet our regulatory obligations under applicable anti-money laundering and financial record-keeping laws, and to resolve any disputes or legal claims that may arise after your account is closed.

Communications data (support chat records, emails) is retained for a minimum of two (2) years for quality assurance and dispute resolution purposes. Technical and log data is typically retained for ninety (90) days before being automatically purged or anonymised. When data is no longer required, it is securely deleted or irreversibly anonymised.

8Your Rights

As a user of the zbaas Platform, you have the following rights with respect to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request" and your registered mobile number for verification:

• ▸Right of access — you may request a copy of all personal data we hold about you, including the categories of data, the purposes for which it is used, and any third parties it has been shared with.
• ▸Right of rectification — if any personal data we hold is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• ▸Right of erasure — you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations described in Section 7.
• ▸Right to restrict processing — you may ask us to pause the processing of your personal data in certain circumstances, such as while a rectification request is being assessed.
• ▸Right to data portability — where processing is based on your consent or on a contract, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
• ▸Right to object — you have the right to object to processing based on our legitimate interests, including any direct marketing communications. We will honour such objections unless we can demonstrate a compelling legitimate ground that overrides your interests.

9Data Security

zbaas implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include SSL/TLS encryption for all data in transit, encrypted storage for sensitive data at rest, access controls limiting data access to authorised personnel only, regular security audits and penetration testing, and real-time fraud monitoring systems.

While zbaas takes all reasonable steps to safeguard your data, no method of electronic transmission or storage is 100% secure. In the unlikely event of a data breach that poses a risk to your rights, zbaas will notify affected users promptly and take all necessary remedial steps. You can contribute to account security by never sharing your password and by enabling any two-factor authentication options made available by the Platform.

10Children's Privacy

The zbaas Platform is strictly intended for adults aged 21 and above. zbaas does not knowingly collect, process, or retain personal data from any individual under the age of 21. If we become aware that personal data has been submitted by or on behalf of a person under 21, we will delete that data immediately and close the associated account without notice. If you believe that a minor has registered on the Platform, please contact us immediately at [email protected] so that we can take prompt corrective action.

11Third-Party Links and Services

The zbaas Platform may reference or integrate with third-party services such as certified game providers and payment processors. These third parties operate under their own independent privacy policies, and zbaas is not responsible for their data practices. We encourage you to review the privacy policy of any third-party service before sharing personal information with them. Where game providers receive data from us, it is limited to anonymised or pseudonymised session data strictly necessary for game integrity and RNG audit purposes.

12Changes to This Privacy Policy

zbaas reserves the right to update or replace this Privacy Policy at any time. When material changes are made, we will publish the revised Policy on this page with an updated "Last updated" date and, where practicable, notify registered users via SMS notification. The revised Policy takes effect immediately upon publication. Your continued use of the Platform following any update constitutes your acceptance of the revised Policy.