zoya Privacy Policy — How We Handle Your Data

1 Introduction

This Privacy Policy ("Policy") describes how zoya ("zoya", "we", "us", "our"), the operator of the online casino and sports betting platform available at zoya.ws, collects, uses, stores, and protects the personal data of individuals ("you", "your", "Player", "User") who access or use the zoya platform.

zoya is committed to handling personal data responsibly and in accordance with applicable data protection principles. This Policy is designed to ensure you fully understand what data we hold about you, why we hold it, how it is used, and what rights you can exercise in relation to it.

By registering an account on zoya, depositing funds, participating in any game or promotion, or otherwise using any part of the zoya platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, you should not use the zoya platform.

2 Data We Collect

zoya collects personal data through several channels as part of operating the platform. The categories of data we collect include:

2.1 Account Registration Data

When you create a zoya account, we collect the information you provide during the registration process, which includes:

• Full legal name as it appears on your government-issued identity document
• Date of birth (used to verify you meet the 21+ age requirement)
• Email address (used for account communications and notifications)
• Mobile phone number (used for OTP-based authentication and account security)
• Residential address including city, postal code, and country
• Username and encrypted password credentials

2.2 Identity Verification (KYC) Data

As part of our Know Your Customer programme and anti-money laundering obligations, we may collect and process the following identity verification documents:

• Scanned copy or photograph of your National Identity Card (NID), passport, or other government-issued photo ID
• Proof of address document such as a recent utility bill, bank statement, or official government correspondence dated within the last three months
• Proof of payment method, such as a photograph of your bKash, Nagad, or Rocket wallet registration details
• Source of funds documentation where required for high-value transactions or enhanced due diligence reviews

2.3 Financial Transaction Data

For every deposit and withdrawal processed through the zoya platform, we record the following information:

• Transaction amount in Bangladeshi Taka (BDT, ৳)
• Payment method used (bKash, Nagad, Rocket, Upay, Visa, Mastercard)
• Transaction reference number provided by the payment provider
• Date, time (Bangladesh Standard Time, UTC+6), and status of the transaction
• Running account balance at the time of each transaction

2.4 Gameplay and Betting Data

We record detailed data related to your use of zoya's games and sports betting services, including:

• Games played, bet amounts placed, and outcomes of each game round or sports wager
• Session start and end times, total session duration, and gameplay patterns
• Bonus and promotional activity including which offers were claimed and their wagering progress
• Responsible gaming tool usage such as deposit limit settings, session time limits, and self-exclusion requests

2.5 Technical and Device Data

When you access the zoya platform, our servers automatically collect certain technical information about your device and connection:

• IP address and approximate geographic location derived from IP data
• Device type, operating system, and browser type and version
• Screen resolution and device language settings
• Referring URL (the page or link you clicked to reach zoya.ws)
• Pages visited within the platform, clicks, scroll depth, and time spent on each page
• Error logs and crash reports generated by the platform software

2.6 Summary of Data Categories

3 How We Use Your Data

zoya uses the personal data described in Section 2 for the following purposes:

3.1 Account Management

Your registration data is used to create and maintain your player account, authenticate you on each login, communicate account-related notifications (e.g., password resets, security alerts, transaction confirmations), and provide access to the full range of zoya services.

3.2 Payment Processing

Financial transaction data is used to process your deposits and withdrawals via your chosen payment method (bKash, Nagad, Rocket, Upay, Visa, or Mastercard), to reconcile your account balance accurately, and to resolve any payment disputes or discrepancies that may arise.

3.3 Regulatory Compliance and Anti-Money Laundering

zoya is obligated to screen player accounts and transactions for indicators of money laundering, fraud, and financial crime. Your identity, financial, and transaction data is used to fulfil these obligations, including conducting KYC checks, monitoring transaction patterns for suspicious activity, and maintaining records as required by applicable law.

3.4 Age Verification

Your date of birth and identity documents are used to verify that you are at least 21 years of age, in compliance with zoya's minimum age policy. This verification may be conducted at registration or at any later point during your use of the platform.

3.5 Responsible Gaming

Gameplay data, session durations, and betting patterns are monitored to support our responsible gaming programme. Where our systems detect patterns that may indicate problematic gambling behaviour, we may use this data to present responsible gaming notifications, apply account safeguards, or prompt you to review your deposit and session limits.

3.6 Platform Improvement and Analytics

Technical and device data, along with aggregated (anonymised) gameplay data, is used to analyse platform performance, identify and fix bugs, test new features, and improve the overall user experience on zoya.

3.7 Fraud Prevention and Security

IP addresses, device data, and behavioural analytics are used to detect and prevent fraudulent activity, including multi-accounting, bonus abuse, unauthorised access attempts, and payment fraud. Where suspicious activity is detected, we reserve the right to flag the account, restrict access, and share relevant data with payment providers or law enforcement as required.

3.8 Marketing Communications

With your explicit consent, we may use your email address and phone number to send you promotional communications about zoya offers, bonuses, and seasonal promotions. You may withdraw your consent to marketing communications at any time by contacting support at [email protected] or by using the opt-out mechanism in any marketing email you receive. Withdrawal of consent to marketing will not affect your ability to use the zoya platform.

4 Legal Basis for Processing

For each category of personal data processing described in Section 3, zoya relies on one or more of the following legal bases:

5 Data Sharing & Third Parties

zoya does not sell, rent, or otherwise disclose your personal data to third parties for their own marketing purposes. Data sharing is strictly limited to the following categories of recipients, each of whom is bound by confidentiality obligations and data processing agreements:

5.1 Payment Service Providers

To process your deposits and withdrawals, zoya shares the minimum necessary financial data with the payment service providers you select, including bKash, Nagad, Rocket, Upay, Visa, and Mastercard. These providers process data under their own privacy policies, which we recommend you review separately.

5.2 Identity Verification Partners

zoya may use third-party identity verification and KYC service providers to assist with document verification and fraud screening. These providers are contractually prohibited from using your data for any purpose beyond the specific verification service they provide to zoya.

5.3 Game Software Providers

The casino games available on the zoya platform are supplied by third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive technical data (such as session tokens and game round IDs) necessary to operate their games within the zoya environment. They do not receive your personally identifiable registration data.

5.4 Legal and Regulatory Authorities

zoya may be required to disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required by applicable law. In such cases, zoya will disclose only the minimum data required to comply with the relevant legal obligation and, where legally permissible, will notify you of such disclosure.

5.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of the assets of zoya, player personal data may be transferred to the acquiring entity. You will be notified of any such transfer via your registered email address prior to your data being transferred and becoming subject to a different privacy policy.

6 Cookies & Tracking Technologies

zoya uses cookies and similar tracking technologies to operate the platform effectively and to improve your experience. The types of cookies we use are as follows:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They manage your login session, maintain your account authentication state, and ensure that security features operate correctly. These cookies cannot be disabled without preventing you from using the platform.
• Functional Cookies: These cookies remember your preferences, such as your selected language, preferred game category, and responsible gaming settings, so that they persist across sessions without you needing to reconfigure them each time.
• Analytics Cookies: zoya uses aggregated, anonymised analytics data to understand how players navigate the platform, which features are most used, and where technical issues arise. This data does not identify you personally.
• Security Cookies: These cookies assist with fraud detection and abuse prevention by helping zoya identify unusual patterns of activity associated with your session or device.

You can manage cookie preferences through your browser settings. Blocking strictly necessary cookies will prevent you from logging in and using the platform. Blocking functional or analytics cookies will not affect your ability to play games or process transactions but may degrade certain aspects of your experience.

7 Data Retention

zoya retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention periods required by applicable law or regulatory obligation. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that ensures it can no longer be attributed to any identifiable individual.

8 Your Rights

Subject to applicable law, you have the following rights in relation to your personal data held by zoya. To exercise any of these rights, please contact us at [email protected] with your registered username and a clear description of your request. We will respond within 30 calendar days.

• Right of Access: You have the right to request a copy of all personal data zoya holds about you, together with information about how it is used and with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated promptly.
• Right to Erasure ("Right to be Forgotten"): You may request that zoya delete your personal data where it is no longer necessary for the purposes for which it was collected, subject to our overriding legal retention obligations.
• Right to Restriction of Processing: You may request that zoya restrict the processing of your data in certain circumstances, such as while a rectification request is pending or where you contest the lawfulness of processing.
• Right to Data Portability: Where processing is based on your consent or on a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interest, including profiling for marketing purposes. You may also withdraw marketing consent at any time without affecting the lawfulness of prior processing.
• Right Not to be Subject to Automated Decision-Making: Where zoya uses automated systems to make decisions that significantly affect your account (such as automated fraud flagging), you have the right to request human review of those decisions.

9 Data Security

zoya implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, accidental loss, and destruction. Our security programme includes the following controls:

• 256-bit SSL/TLS Encryption: All data in transit between your browser or app and the zoya platform is encrypted using TLS 1.2 or higher, preventing interception by third parties.
• Encrypted Data Storage: Sensitive data fields including passwords, payment method identifiers, and identity document references are encrypted at rest using AES-256 encryption.
• OTP-Based Authentication: Sensitive account actions, including large withdrawals and password changes, require one-time password (OTP) verification sent to your registered mobile number.
• Access Controls: Internal access to player data is strictly role-based. Only authorised personnel with a demonstrated operational need can access personal data, and all access is logged and audited.
• Penetration Testing: zoya engages independent security professionals to conduct periodic penetration testing and vulnerability assessments of the platform infrastructure.
• Incident Response: zoya maintains a documented incident response plan. In the event of a confirmed data breach, affected players will be notified via their registered email address without undue delay.

While zoya takes all reasonable precautions to protect your data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own login credentials and for ensuring that you access zoya only from trusted, secure devices and networks.

10 Children's Privacy

The zoya platform is strictly intended for adults aged 21 and above. We do not knowingly collect, process, or store personal data from individuals under the age of 21. The registration process includes age verification steps specifically designed to identify and prevent underage access.

If zoya becomes aware that personal data has been inadvertently collected from a person under the age of 21, we will immediately suspend the associated account, delete the data as promptly as possible consistent with our legal obligations, and take appropriate steps to prevent further access by that individual.

11 Third-Party Links

The zoya platform may contain references to third-party payment providers or game studio names. zoya does not control the privacy practices of these third parties and is not responsible for the content or privacy policies of any external service. We encourage you to review the privacy policies of any third-party service you use in connection with your zoya account, in particular your mobile financial service provider (bKash, Nagad, Rocket, or Upay) and any card network (Visa or Mastercard).

12 Changes to This Policy

zoya reserves the right to update or amend this Privacy Policy at any time. When material changes are made, we will notify registered players via email to their registered address and update the "Last Reviewed" date at the top of this page. Continued use of the zoya platform following notification of any changes constitutes your acceptance of the revised Policy.

We recommend bookmarking zoya.ws/privacy-policy and reviewing this page periodically. If a proposed change is significant and affects the basis on which we process your data, we will provide at least 14 days' advance notice before the change takes effect, giving you sufficient time to exercise any relevant data rights before the new terms apply.

13 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data zoya holds about you, please contact our Data Support team using the details below. We are committed to responding to all privacy-related enquiries promptly and transparently.

All formal data rights requests (access, erasure, rectification, portability) must be submitted in writing to [email protected] with your registered username clearly stated. We may ask you to verify your identity before processing any such request to ensure your data is not disclosed to an unauthorised party.