Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how zona69 ("zona69," "we," "us," or "our") collects, uses, discloses, stores, and protects personal information obtained from users ("you" or "your") of the zona69 website at https://zona69.cam and all associated services, mobile-optimised pages, and customer communications (collectively, the "Platform").

This Policy applies to all registered members and visitors located in Indonesia and in any other jurisdiction where zona69 provides services. By accessing or using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, you should discontinue use of the Platform immediately.

This Policy should be read alongside our Terms & Conditions, which govern the contractual relationship between you and zona69. In the event of a conflict between the two documents, the Terms & Conditions shall prevail for contractual matters and this Policy shall prevail for data-privacy matters.

2. Definitions

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, including but not limited to name, identification number, date of birth, address, email address, phone number, financial account details, and IP address.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, alteration, and deletion.
• "Data Controller" means zona69, which determines the purposes and means of processing Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of zona69 under a data-processing agreement.
• "Cookies" means small text files placed on your device by the Platform to enable functionality, analytics, and session management.
• "KYC" (Know Your Customer) means the identity-verification process through which zona69 confirms your age, identity, and, where required, your source of funds.

3. Information We Collect

3.1 Information You Provide Directly

When you register an account or interact with zona69 services, you provide the following categories of information:

• Identity Data: Full legal name, date of birth, gender, and government-issued identification number (Indonesian KTP number, passport number, or driver's license number).
• Contact Data: Email address, phone number (including WhatsApp), and residential address.
• Financial Data: Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), deposit and withdrawal transaction records, and balance history.
• KYC Documentation: Scanned or photographed copies of government-issued identification, proof-of-address documents, and selfie photographs submitted for identity verification.
• Communications Data: Records of your interactions with zona69 customer support via live chat, WhatsApp, Telegram, or email, including the content of messages and metadata.

3.2 Information Collected Automatically

When you access the Platform, we automatically collect the following technical and behavioural data:

• Device and Technical Data: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
• Usage Data: Pages visited, time spent on each page, links clicked, features used, search queries entered within the Platform, and session duration.
• Gaming Activity Data: Bet amounts, game types played (including sports betting, live casino, slot games, and togel number-prediction draws), win/loss records, bonus usage, and wagering history.
• Location Data: General geographic location inferred from IP address (country and city level). We do not collect precise GPS coordinates.
• Cookie and Tracking Data: Session identifiers, authentication tokens, analytics cookies, and preference cookies as described in Section 10 of this Policy.

3.3 Information From Third Parties

We may receive supplementary information about you from the following third-party sources:

• Payment Processors: Transaction confirmation data, payment status, and fraud-risk signals from banks and e-wallet providers to validate deposits and withdrawals.
• Identity Verification Services: Results of automated KYC checks conducted by third-party verification providers to confirm the authenticity of identification documents.
• Fraud Prevention Services: Device fingerprint data, behavioral anomaly scores, and risk classifications from fraud detection partners to protect against unauthorized account access and money laundering.
• Game Providers: Technical session data (game round IDs, RTP outcomes, game session timestamps) transmitted by licensed providers such as Pragmatic Play, Evolution Gaming, and Microgaming for the purpose of dispute resolution and game integrity monitoring.

4. How and Why We Use Your Information

zona69 processes your Personal Data only where we have a lawful basis for doing so. The table below sets out our primary processing activities and the legal basis for each.

5. Disclosure of Your Information

5.1 Internal Access

Access to your Personal Data within zona69 is restricted on a strict need-to-know basis. Only employees whose job function requires access to specific data categories are granted that access. All staff with access to Personal Data are bound by confidentiality obligations and receive regular data-protection training.

5.2 Authorised Third-Party Service Providers

zona69 engages the following categories of third-party Data Processors, each bound by contractual data-processing agreements that require them to protect your data in a manner consistent with this Policy:

• Payment Infrastructure Providers: Banks and e-wallet operators (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) process transaction data solely to execute financial transfers.
• Identity Verification Providers: Third-party KYC services receive identity document images and biometric selfie data for automated verification. This data is processed for verification purposes only and is not retained by the provider beyond the verification session.
• Fraud Detection and Cybersecurity Providers: Specialized security firms analyze behavioral and technical data to identify fraudulent activity. Data shared is limited to technical signals and pseudonymized identifiers.
• Cloud Infrastructure Provide rs: Servers and databases hosting zona69 data are operated by reputable cloud infrastructure providers with ISO 27001 and SOC 2 Type II certifications. Data is stored in encrypted form at rest.
• Game Content Providers: Licensed game studios (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, PG Soft, Spribe) receive session identifiers and game-round data necessary to render games and resolve disputes. They do not receive your full identity profile.
• Customer Communication Platforms: Live chat, WhatsApp Business API, and Telegram integration providers process message content solely to facilitate customer support. Communications are retained for 12 months for quality assurance and dispute resolution purposes.

5.3 Legal and Regulatory Disclosures

zona69 may disclose your Personal Data to government authorities, law enforcement agencies, or regulatory bodies where we are legally required or permitted to do so, including in connection with anti-money laundering investigations, court orders, subpoenas, or other legal process. We will notify you of any such disclosure where we are legally permitted to do so.

5.4 Business Transfers

In the event that zona69 undergoes a merger, acquisition, asset sale, or corporate restructuring, your Personal Data may be transferred to the successor entity as part of that transaction. We will notify affected users via email and prominent in-platform notice at least 30 days prior to any such transfer, and the acquiring entity will be bound by privacy obligations no less protective than this Policy.

5.5 What We Never Do

zona69 will never sell, rent, trade, or otherwise commercially transfer your Personal Data to marketing networks, data brokers, advertising exchanges, or any third party for commercial gain. We do not build advertising profiles from your gaming behavior for use by external advertisers.

6. Data Retention

We retain your Personal Data for as long as your account remains active and for a defined period thereafter, in accordance with the following schedule:

• Account and Identity Data: Retained for the duration of the account relationship and for 5 years following account closure, in compliance with international anti-money laundering record-keeping requirements.
• Financial Transaction Records: Retained for 7 years from the date of each transaction to satisfy financial record-keeping obligations.
• KYC Documentation: Retained for 5 years following account closure or the date of the last transaction, whichever is later.
• Customer Support Communications: Retained for 12 months from the date of the last interaction for quality assurance and dispute resolution purposes, then securely deleted.
• Gaming Activity Logs: Retained for 2 years for responsible gaming monitoring and dispute resolution. Aggregated, anonymized analytics may be retained indefinitely.
• Cookie and Session Data: Session cookies expire at the end of each browser session. Persistent analytics cookies are retained for up to 13 months from placement.
• Marketing Preferences: Retained until you withdraw consent. Upon withdrawal, marketing communications cease within 5 business days.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized using industry-standard methods such that it can no longer be attributed to any individual.

7. Your Privacy Rights

As a user of zona69 services, you have the following rights with respect to your Personal Data. To exercise any of these rights, contact our Data Protection Officer at the address provided in Section 12.

• Right of Access: You may request a copy of all Personal Data we hold about you, along with information about how it is used and with whom it has been shared.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you may request that we correct or update it.
• Right to Erasure ("Right to Be Forgotten"): You may request that we delete your Personal Data. Note that we may be unable to fulfil erasure requests where retention is required by law (for example, AML record-keeping obligations).
• Right to Restriction of Processing: You may request that we suspend the processing of your Personal Data in certain circumstances, for example while a rectification request is being resolved.
• Right to Data Portability: You may request a structured, machine-readable copy of the Personal Data you have provided to us, suitable for transfer to another service provider.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Object: You may object to processing based on legitimate interests where you believe your fundamental rights and freedoms override those interests.

We will respond to all verified privacy rights requests within 30 days. Where a request is particularly complex or numerous, we may extend this period by a further 30 days, with notice to you. We will not charge a fee for reasonable requests. Requests that are manifestly unfounded or excessive may be declined with a written explanation.

8. Data Security

zona69 implements a comprehensive, layered security framework to protect your Personal Data against unauthorized access, disclosure, alteration, and destruction. Key technical and organizational measures include:

• Encryption in Transit: All data transmitted between your device and zona69 servers is encrypted using TLS 1.3 with AES-256 cipher suites. HTTP Strict Transport Security (HSTS) is enforced to prevent downgrade attacks.
• Encryption at Rest: Personal Data and financial records stored in zona69 databases are encrypted at rest using AES-256. Encryption keys are managed by a dedicated key management service with hardware security module (HSM) protection.
• Access Controls: Access to production systems containing Personal Data is restricted to authorized personnel, enforced through multi-factor authentication (MFA), role-based access control (RBAC), and privileged access management (PAM) solutions.
• Network Security: The Platform is protected by web application firewalls (WAF), distributed denial-of-service (DDoS) mitigation, intrusion detection systems (IDS), and regular penetration testing by independent security firms.
• Monitoring and Logging: All access to systems containing Personal Data is logged and monitored continuously. Anomalous access patterns trigger automated alerts and human review.
• Incident Response: zona69 maintains a documented data breach response plan with defined escalation paths. In the event of a breach affecting your Personal Data, we will notify you within 72 hours of discovery as described in Section 9.
• Staff Training: All zona69 employees with access to Personal Data receive mandatory annual data-protection and security awareness training.

While we employ robust security measures, no system connected to the internet can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately if you suspect unauthorized access to your account.

9. Data Breach Notification

In the event that zona69 becomes aware of a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to your Personal Data, we will take the following steps:

• Contain the breach and conduct an immediate forensic investigation to determine scope and impact.
• Assess the risk to affected individuals, considering the type of data involved, the likelihood of harm, and the severity of potential consequences.
• Notify affected users via the email address registered to their zona69 account within 72 hours of determining that a breach has occurred, detailing the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed.
• Report the breach to relevant regulatory authorities where required by applicable law.
• Implement remediation measures to prevent recurrence and document all actions taken.

10. Cookies and Tracking Technologies

10.1 Types of Cookies We Use

zona69 uses the following categories of cookies and similar tracking technologies on the Platform:

• Strictly Necessary Cookies: Essential for the Platform to function. They enable core services such as user authentication, session management, fraud prevention, and load balancing. These cookies cannot be disabled.
• Functional Cookies: Remember your preferences such as language settings, saved payment methods, and interface customizations to provide a more personalized experience.
• Analytics Cookies: Collect aggregated, anonymized data about how users navigate the Platform (pages viewed, time on page, click paths) to help us improve usability and performance. We use first-party analytics rather than third-party advertising analytics.
• Security Cookies: Support our fraud detection systems by maintaining session integrity signals and detecting anomalous access patterns.

10.2 Managing Cookies

You can control non-essential cookies through your browser settings. Most modern browsers allow you to view, delete, and block cookies from specific or all websites. Note that disabling functional or analytics cookies may affect your experience on the Platform—for example, your preferences may not be saved between sessions. Strictly necessary cookies cannot be disabled via browser settings without disrupting core Platform functionality.

11. Children and Minors

zona69 services are strictly for adults aged 21 and above. We do not knowingly collect Personal Data from individuals under the age of 21. If we become aware that an account has been created by or on behalf of a minor, we will immediately suspend the account, delete all associated Personal Data, and void any financial transactions. If you have reason to believe that a minor has created a zona69 account, please contact us immediately at [email protected].

12. Changes to This Privacy Policy

zona69 reserves the right to update this Privacy Policy at any time. Material changes—those affecting the categories of data collected, the purposes for which data is used, or your rights under this Policy—will be communicated to registered users via email at least 14 days before taking effect. Non-material changes (such as formatting corrections or clarifications that do not alter the substance of your rights) will be effective immediately upon posting and reflected in the "Last Updated" date at the bottom of this page. Your continued use of the Platform after any update constitutes acceptance of the revised Policy.

13. Contact and Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy or the processing of your Personal Data, please contact zona69 through the following channels:

• Email (Data Protection): [email protected] — subject line "Privacy Request"
• Live Chat: Available 24/7 on the zona69 Platform
• Response Time: All privacy-related inquiries receive a written response within 5 business days; formal rights requests are resolved within 30 days.

For escalated complaints that remain unresolved after engaging our Data Protection Officer, you may contact the relevant data-protection supervisory authority in the jurisdiction under which zona69 is licensed.