Privacy Policy

This Privacy Policy (hereinafter "the Policy") is issued by zas36 (hereinafter "zas36", "we", "us", or "the Platform") and governs the collection, use, storage, disclosure, and protection of personal data relating to individuals (hereinafter "you", "the User", or "the Member") who visit, register on, or interact with the website accessible at https://zas36.cam and any associated sub-domains or mobile interfaces (collectively, "the Platform").

zas36 is committed to handling your personal data responsibly and transparently. We recognise that players across Malaysia — from Kuala Lumpur and Penang to Johor Bahru, Petaling Jaya, and Shah Alam — entrust us with sensitive information when they register accounts, make deposits through services such as DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong, and participate in gaming activities. We take that trust seriously.

This Policy should be read in conjunction with our Terms & Conditions, which govern the overall terms of your use of the zas36 Platform.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, identification number, payment details, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, restriction, erasure, or destruction.
• "Data Controller" means zas36, which determines the purposes and means of the processing of personal data.
• "Data Processor" means a third party that processes personal data on behalf of zas36, such as payment processors, KYC verification providers, and cloud hosting services.
• "KYC" means Know Your Customer — the identity and age verification process required for account registration and withdrawal processing.
• "Cookies" means small text files placed on your device by the Platform to enable certain functionalities and gather usage analytics.
• "Sensitive Data" means a subset of personal data that warrants heightened protection, such as identification documents, financial account details, and health-related information.

zas36 collects personal data through several channels, including account registration, KYC verification, deposits and withdrawals, customer support interactions, and automated technical means. The categories of data we collect are set out in the table below.

zas36 does not collect or process special categories of sensitive personal data (such as racial or ethnic origin, religious beliefs, or biometric data) except where strictly required to fulfil KYC obligations under applicable anti-money laundering regulations.

zas36 processes personal data only for specified, explicit, and legitimate purposes. We do not use your data in any manner incompatible with the purposes for which it was originally collected. The primary purposes for which we process personal data are as follows:

• Account Management: To create, verify, maintain, and administer your zas36 account, including identity and age verification in accordance with KYC requirements.
• Transaction Processing: To process deposits and withdrawals through Malaysian payment channels including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong.
• Platform Provision: To deliver and improve the gaming services, including slots, live casino, sports betting, live football markets, and other products available on the Platform.
• Legal and Regulatory Compliance: To fulfil obligations under applicable anti-money laundering (AML), counter-terrorism financing (CTF), and data protection regulations, including record-keeping and reporting to relevant authorities where required.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, account compromise, bonus abuse, and other security threats to the Platform and its users.
• Responsible Gambling: To enforce responsible gambling measures, including monitoring unusual play patterns, implementing deposit limits, and administering self-exclusion requests.
• Customer Support: To respond to enquiries, resolve disputes, and provide assistance via live chat, email, and other support channels.
• Communications: To send transactional communications such as deposit confirmations, withdrawal updates, and account alerts. Promotional communications are sent only where you have provided consent or where a legitimate interest applies.
• Analytics and Improvement: To analyse usage patterns, improve Platform performance, and enhance the overall user experience using aggregated and, where necessary, individual-level data.

zas36 processes your personal data on one or more of the following legal bases, depending on the specific processing activity involved:

• Contractual Necessity: Processing is necessary to perform the contract between you and zas36 (i.e., providing access to gaming services, processing transactions, managing your account).
• Legal Obligation: Processing is required to comply with applicable laws and regulations, including KYC, AML, CTF, and financial record-keeping obligations.
• Legitimate Interests: Processing is necessary for the legitimate interests of zas36, including fraud prevention, platform security, and service improvement, provided these interests are not overridden by your fundamental rights and freedoms.
• Consent: Where required by applicable law, and particularly for non-essential cookies and certain marketing communications, we rely on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

zas36 does not sell your personal data. We may share personal data with the following categories of recipients strictly as necessary for the purposes described in this Policy:

• Payment Processors: Malaysian financial institutions and e-wallet providers (including DuitNow, FPX operators, Touch 'n Go, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong) for the processing of deposits and withdrawals.
• KYC and Compliance Providers: Accredited identity verification and age-checking service providers engaged to fulfil our legal obligations.
• Gaming Software Providers: Certified third-party game content providers whose platforms are embedded within zas36, to the extent necessary for game delivery and RNG auditing.
• Cloud and Infrastructure Providers: Hosting, storage, and content delivery network (CDN) providers that process data on our behalf under binding data processing agreements.
• Fraud Prevention Services: Third-party services used for real-time fraud detection, account security monitoring, and chargeback management.
• Regulatory Authorities: Government agencies, law enforcement bodies, financial intelligence units, and regulatory authorities where disclosure is required by applicable law, court order, or regulatory direction.
• Legal and Professional Advisers: Lawyers, auditors, accountants, and other professional advisers bound by duties of confidentiality, where necessary in connection with legal proceedings, disputes, or regulatory matters.

zas36 uses cookies and similar tracking technologies on the Platform to ensure essential functionality, measure performance, and maintain security. The types of cookies used are described below.

7.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They enable core features such as session management, authentication, fraud prevention, and the enforcement of responsible gambling settings such as deposit limits and self-exclusion status. These cookies cannot be disabled without disrupting Platform functionality.

7.2 Performance & Analytics Cookies

These cookies collect anonymised data about how visitors use the Platform — including pages visited, time spent, and navigation paths — to help us identify performance issues and improve the overall user experience. Individual users are not identified by these cookies.

7.3 Functional Cookies

These cookies remember choices you make, such as your preferred language, layout settings, or last used payment method, to provide a more personalised experience on subsequent visits.

7.4 Security Cookies

These cookies support real-time fraud detection and session integrity checks, helping to protect your account from unauthorised access.

zas36 does not use third-party advertising cookies or cross-site tracking cookies for the purpose of building advertising profiles or selling data to ad networks.

zas36 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory obligations, and to resolve disputes or enforce our agreements. The following general retention periods apply:

• Account Data and KYC Records: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with applicable AML and financial record-keeping requirements.
• Transaction Records: Retained for a minimum of seven (7) years following each transaction, as required under applicable financial regulations.
• Gaming History: Retained for a minimum of three (3) years following the relevant gaming session, for dispute resolution and responsible gambling monitoring purposes.
• Support Communications: Retained for two (2) years from the date of the most recent interaction, unless longer retention is required for ongoing dispute resolution.
• Technical Logs: Retained for up to twelve (12) months for security and fraud investigation purposes.
• Marketing Preferences: Retained until you withdraw consent or request deletion, plus an additional period necessary to evidence that consent was properly managed.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised so that it can no longer be associated with an individual.

Subject to applicable law and the verification of your identity, you hold the following rights in relation to your personal data processed by zas36. You may exercise any of these rights at any time by contacting our support team via live chat or the support email address set out in Clause 14.

zas36 will respond to verified data rights requests within thirty (30) days of receipt. Where a request is complex or numerous, we may extend this period by a further thirty (30) days and will notify you accordingly. There is no charge for exercising your rights, unless requests are manifestly unfounded or excessive.

zas36 implements comprehensive technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data in transit between your device and Platform servers.
• AES-256 encryption for sensitive data at rest, including financial records and identity documents.
• Multi-factor authentication (MFA) available for account login.
• Real-time fraud monitoring and anomaly detection systems operating continuously across all account activity.
• Strict access controls limiting internal staff access to personal data on a need-to-know basis, with audit logging of all data access events.
• Regular independent security penetration testing and vulnerability assessments of Platform infrastructure.
• Incident response procedures enabling prompt notification and containment in the event of a data security incident.

The zas36 Platform may integrate with or reference third-party services, including payment gateways (such as DuitNow infrastructure, Boost, and GrabPay), game content providers, and analytics services. These third parties operate under their own privacy policies and are independent data controllers in respect of the data they process directly.

zas36 is not responsible for the privacy practices of third-party services accessed through or integrated into the Platform. We encourage you to review the privacy policies of any third-party service you engage with directly.

Where third parties act as Data Processors on behalf of zas36, they do so under binding contractual obligations requiring them to maintain data security standards consistent with this Policy and applicable law.

The zas36 Platform is strictly for individuals aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. If you are under 21, you must not register an account, deposit funds, or participate in any game or promotion on the Platform.

Where zas36 becomes aware that personal data has been collected from an individual under the age of 21, we will take immediate steps to delete that data, close the associated account, and return any deposited funds in accordance with our safeguarding obligations. Parents and guardians who believe their child may have registered on the Platform are encouraged to contact our support team immediately.

For more information about our responsible gambling tools, including parental controls and self-exclusion mechanisms, please visit our Responsible Gambling page.

zas36 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable laws, or the services we offer. Where material changes are made to this Policy, we will notify registered Members by email and/or by posting a prominent notice on the Platform at least seven (7) days before the changes take effect.

The "Last updated" date shown at the top of this page reflects the most recent revision. We encourage you to review this Policy periodically to stay informed of how zas36 protects your personal data. Continued use of the Platform following the effective date of any amendment constitutes your acceptance of the updated Policy.

If you wish to exercise any of your data rights, have a question about this Privacy Policy, or wish to raise a concern about how zas36 handles your personal data, please contact us through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the chat widget on the Platform. This is the fastest channel for most data rights requests.
• Support Email (plain text — not a clickable link):
  [email protected]
• FAQ: For quick answers on common account, payment, and data questions, visit our FAQ page.

We aim to acknowledge all privacy-related correspondence within 48 hours and to resolve substantive requests within 30 days of receiving a verified submission.