Privacy Policy

zCasino Ltd ("zCasino", "we", "our", "us") operates the zCasino online gaming platform. We are the data controller responsible for personal data collected through our website and services. We are licensed by Curaçao eGaming (License No. 8048/JAZ). For data protection enquiries, contact our DPO at privacy@zcasino.com.

2.1 Account Data: Name, date of birth, email address, username, encrypted password, phone number, nationality, residential address. 2.2 Identity Verification Data: Government-issued ID documents, selfie/biometric data (for liveness check), proof of address documents, source of funds declarations. 2.3 Financial Data: Payment method details (card numbers are tokenised and never stored in full), transaction history, deposit/withdrawal records. 2.4 Gaming Data: Game session logs, bet history, win/loss records, game preferences, bonus activity. 2.5 Technical Data: IP address, device identifiers, browser type and version, operating system, cookies and similar tracking technologies, session logs. 2.6 Communications: Support tickets, live chat transcripts, email correspondence, survey responses.

3.1 To provide and operate the Platform: Process registrations, manage accounts, facilitate deposits and withdrawals, deliver gaming services. 3.2 Regulatory compliance: Verify your identity and age (KYC), monitor for Anti-Money Laundering (AML) indicators, comply with licensing obligations. 3.3 Responsible gaming: Detect problem gambling patterns, apply player protection tools, action self-exclusion requests. 3.4 Security: Detect fraud, prevent account takeover, investigate suspicious activity. 3.5 Communications: Send account notifications, promotional offers (where consented), respond to support requests. 3.6 Analytics and improvement: Understand how players use the Platform, improve UX, conduct A/B testing (on aggregated, anonymised data).

We process personal data under the following legal bases: • Contract: Data required to deliver services you have requested. • Legal obligation: KYC, AML, and regulatory reporting requirements. • Legitimate interests: Fraud prevention, security, analytics (where not overridden by your interests). • Consent: Marketing communications and non-essential cookies. You may withdraw consent at any time.

5.1 Payment processors: To process deposits and withdrawals. Processors handle card data under their own PCI-DSS compliance. 5.2 Game providers: Game studios receive a session token and player ID to deliver gameplay. They do not receive full personal details. 5.3 Identity verification providers: For KYC document checks and biometric verification. 5.4 Regulatory bodies: We are obliged to report certain activities to Curaçao eGaming and other competent authorities. 5.5 Self-exclusion registers: We share player identifiers with GAMSTOP and equivalent registers to enforce cross-operator exclusions. 5.6 We do not sell your personal data to third parties for their own marketing purposes.

We retain personal data for as long as your account is active and for a minimum of 5 years after account closure, in compliance with anti-money laundering regulations. Gaming history and financial records are retained for 7 years. After retention periods expire, data is securely deleted or anonymised.

Depending on your jurisdiction, you may have the right to: • Access: Request a copy of the personal data we hold about you. • Rectification: Correct inaccurate or incomplete data. • Erasure: Request deletion of your data (subject to legal retention obligations). • Restriction: Ask us to limit how we process your data. • Portability: Receive your data in a machine-readable format. • Objection: Object to processing based on legitimate interests or for direct marketing. • Withdraw consent: For consent-based processing, withdraw at any time. Submit rights requests to privacy@zcasino.com. We will respond within 30 days.

Our servers are located in the European Union. Some service providers may process data in other jurisdictions. Where data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

We implement appropriate technical and organisational measures to protect your personal data, including TLS encryption in transit, AES-256 encryption at rest for sensitive fields, access controls, and regular security assessments. No system is completely secure; please use a strong unique password and enable two-factor authentication.

We may update this Privacy Policy periodically. Material changes will be communicated via email or in-platform notice. The "Last Updated" date at the top of this page indicates the most recent revision.