zonapg Privacy Policy

This Privacy Policy applies to all users of the zonapg platform, including individuals who register for an account, visit the website without registering, interact with our customer support team, or otherwise engage with any zonapg service. By using zonapg, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. If you do not agree to these practices, you must cease using the zonapg platform.

1. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly. This includes, but is not limited to, name, email address, phone number, date of birth, residential address, bank account details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means the entity (zonapg) that determines the purposes and means of Processing Personal Data.
• "Data Processor" means a third party that Processes Personal Data on behalf of the Data Controller under a documented contractual arrangement.
• "User," "You," "Your" means any individual who accesses, registers with, or uses the zonapg platform.
• "Platform" means the zonapg website (zonapg.cam), its subdomains, and all associated services and applications.
• "KYC" means Know Your Customer — the identity verification process required to confirm a user's identity, age, and source of funds prior to processing withdrawals.

2. Data We Collect

zonapg collects several categories of Personal Data from users. The type of data collected depends on how you interact with the platform.

2.1 Identity and Account Data

• Full legal name (as it appears on your government-issued ID)
• Date of birth and age verification status
• Nationality and country of residence
• Indonesian National Identity Card number (KTP) or passport number (collected during KYC)
• Username and encrypted password
• Profile photograph (where submitted for KYC selfie verification)

2.2 Contact and Communication Data

• Email address (primary identifier for your account)
• Mobile phone number (used for two-factor authentication and account alerts)
• Residential address in Indonesia (or country of residence)
• Records of all communications with our customer support team (live chat transcripts, email threads)

2.3 Financial and Transaction Data

• Bank account details (account name, number, and bank name — e.g., BCA, BRI, BNI, Mandiri) used for deposits and withdrawals
• E-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Complete transaction history (deposits, withdrawals, wagers, bonuses, adjustments)
• Source of funds documentation (requested for high-volume accounts under AML protocols)

2.4 Technical and Usage Data

• IP address and geolocation data (country and city level)
• Device type, operating system, and browser version
• Device fingerprint and unique device identifiers
• Session timestamps, page visit logs, click patterns, and navigation paths
• Game activity logs (games played, bet amounts, win/loss records, session duration)
• Connection metadata (internet service provider, connection type)

2.5 Responsible Gaming Data

• Self-imposed deposit limits, loss limits, and session time limits
• Self-exclusion status and cooling-off period history
• Responsible gaming interaction records (support contacts regarding problem gambling)

3. How We Collect Your Data

3.1 Directly From You

The majority of the Personal Data we hold is provided directly by you during the account registration process, KYC verification, deposit and withdrawal requests, customer support interactions, and your completion of any forms or surveys on the platform.

3.2 Automatically During Platform Use

We automatically collect technical and usage data whenever you access or use the zonapg platform — including when you browse the website without logging in. This data is collected via server logs, cookies, web beacons, and similar tracking technologies as described in Section 7.

3.3 From Third-Party Sources

In some circumstances, we may receive or verify Personal Data from third-party sources, including:

• Payment processors and Indonesian banks (BCA, BRI, BNI, Mandiri, and e-wallet providers) — to confirm transaction authenticity and account ownership
• Identity verification service providers — third-party KYC tools that cross-reference your ID documents against official databases
• Fraud prevention and AML screening services — to screen accounts against sanctions lists and fraud databases
• Analytics providers — aggregated and anonymized data about platform usage patterns (no individual identifiers are shared with these providers)

4. Legal Basis for Processing

zonapg processes your Personal Data on one or more of the following legal bases, consistent with internationally recognized data protection frameworks:

Legal Basis	Examples of Processing Activities
Contractual Necessity	Account creation, processing deposits and withdrawals, settling bets, providing customer support, enforcing our Terms & Conditions
Consent	Marketing communications (where opted in), optional survey participation, cookie-based analytics beyond strictly necessary cookies
Legitimate Interests	Fraud prevention, security monitoring, platform abuse detection, improving user experience through anonymized analytics
Legal Obligation	KYC identity verification, AML transaction monitoring, responding to lawful requests from regulatory or licensing authorities
Vital Interests	Responsible gaming interventions where we have a duty of care concern for a player's welfare

5. How We Use Your Personal Data

zonapg uses the Personal Data we collect for the following specific purposes:

• Account management: Creating, maintaining, and securing your zonapg account; processing logins and authentication.
• Identity verification: Conducting KYC checks to confirm your identity and age (21+) before processing withdrawals, consistent with our Terms & Conditions.
• Financial transactions: Processing deposits via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, Visa, and Mastercard; processing withdrawals; maintaining financial records.
• Game and betting operations: Enabling access to sports betting (football, including BRI Liga 1, EPL, and Champions League; badminton; MotoGP at Mandalika; and E-sports), casino games, and togel (traditional Indonesian numbers lottery) markets; settling wagers; applying bonuses and promotions.
• Customer support: Responding to enquiries, resolving disputes, and maintaining records of support interactions.
• Fraud and AML prevention: Monitoring transactions for suspicious patterns; conducting AML screening; preventing multi-accounting and bonus abuse.
• Responsible gaming: Administering self-exclusions, deposit limits, and cooling-off periods; identifying at-risk players and offering assistance.
• Platform improvement: Analyzing anonymized usage data to improve navigation, game selection, payment processing, and overall user experience.
• Legal compliance: Meeting obligations imposed by our international gaming licence and responding to lawful requests from competent authorities.
• Marketing (with consent): Sending promotional offers, bonus notifications, and seasonal promotions (such as Idul Fitri or Indonesian Independence Day specials) where you have opted in to receive such communications.

6. Data Sharing & Disclosure

zonapg does not sell, rent, or trade your Personal Data. We share data with third parties only in the circumstances described below, and only to the minimum extent necessary.

6.1 Service Providers (Data Processors)

We engage trusted third-party service providers who process Personal Data on our behalf under binding data processing agreements. These providers are contractually prohibited from using your data for any purpose other than providing the specific service to zonapg. Categories of such providers include: payment gateways and banking partners (for processing transactions with Indonesian banks and e-wallets), identity verification and KYC service providers, fraud detection and AML screening tools, cloud hosting and data storage providers, customer support platform operators, and email communication infrastructure providers.

6.2 Game Content Providers

Some aggregated, anonymized technical data (such as session information and game performance metrics) may be shared with our game studio partners — including Pragmatic Play, Evolution Gaming, Mic rogaming, NetEnt, Spribe, and Pocket Games Soft — for the purposes of game performance auditing, RTP verification, and technical troubleshooting. No personally identifiable information is shared with game studios.

6.3 Regulatory and Legal Disclosure

zonapg may disclose Personal Data to competent legal, regulatory, or governmental authorities when required to do so by applicable law, court order, or the terms of our international gaming licence. We will notify you of any such disclosure where we are legally permitted to do so. We will always seek to limit such disclosures to the minimum data required.

6.4 Business Transfers

In the event that zonapg undergoes a merger, acquisition, restructuring, or sale of all or part of its business assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the privacy terms applicable to your data under the new structure. The acquiring entity will be bound by the same data protection commitments set out in this Privacy Policy, or you will be given the opportunity to delete your account prior to the transfer completing.

6.5 Protection of Rights

We may disclose Personal Data where we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of zonapg, our users, or the public — including sharing information with fraud prevention agencies, law enforcement, or other third parties for the purposes of preventing or detecting criminal activity such as fraud, money laundering, or identity theft.

7. Cookies & Tracking Technologies

7.1 What Are Cookies?

Cookies are small text files stored on your device by your web browser when you visit a website. They allow the website to recognize your device across sessions, remember your preferences, and collect usage statistics. zonapg uses cookies and similar tracking technologies (including web beacons and local storage) to operate and improve the platform.

7.2 Types of Cookies We Use

Cookie Category	Purpose	Can Be Disabled?
Strictly Necessary	Session management, authentication, security tokens, CSRF protection, fraud detection	No — required for platform function
Functional	Remembering your language preference, display settings, and session continuity across pages	Yes — disabling may affect experience
Analytics	Collecting anonymized data on page views, user flows, and feature usage to improve the platform	Yes — opt out via support request
Responsible Gaming	Enforcing session time reminders, deposit limit checks, and self-exclusion status across page loads	No — required for player protection

7.3 Managing Cookies

You may configure your browser to refuse all cookies or to alert you when a cookie is being set. However, disabling strictly necessary cookies will prevent you from logging in and using core platform features. Instructions for managing cookies are available in your browser's settings or help documentation. Disabling analytics or functional cookies will not affect your ability to play on zonapg but may reduce the personalization of your experience.

8. Data Retention

zonapg retains Personal Data for as long as is necessary to fulfil the purposes described in this Privacy Policy, or for as long as required by applicable law, whichever is longer. Our standard retention periods are as follows:

Data Category	Retention Period	Reason
Account and identity data	Duration of account + 5 years post-closure	KYC compliance, licensing obligations, fraud investigation
Financial transaction records	7 years from transaction date	AML regulatory requirements, audit trail
Game and betting history	Duration of account + 3 years post-closure	Dispute resolution, RTP auditing, responsible gaming review
Customer support records	3 years from date of interaction	Dispute resolution, service quality review
Technical / log data	13 months on a rolling basis	Security monitoring, fraud detection
Marketing consent records	Until consent is withdrawn + 2 years	Proof of consent compliance
Self-exclusion records	Permanently retained	Responsible gaming — to prevent re-registration during exclusion periods

Upon expiration of the applicable retention period, Personal Data is securely and irreversibly deleted or anonymized so that it can no longer be associated with any identifiable individual.

9. Data Security

zonapg implements a comprehensive set of technical and organizational security measures to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers
• AES-256 encryption at rest for all databases containing Personal Data and financial information
• Two-factor authentication (2FA) available and strongly encouraged for all player accounts
• Role-based access controls (RBAC) limiting internal data access strictly to personnel with a documented operational need
• Regular penetration testing conducted by independent cybersecurity firms to identify and remediate vulnerabilities
• Intrusion detection systems (IDS) and real-time security event monitoring
• Segregated player fund accounts ensuring that player deposits are held separately from operational funds
• Data breach response protocol — in the event of a confirmed data breach that poses a risk to your rights, we will notify affected users within 72 hours of becoming aware of the incident

While we apply industry-leading security standards, no system can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately if you suspect unauthorized access to your account.

10. Your Privacy Rights

Regardless of your location, zonapg respects your rights over your Personal Data. The following rights are available to all zonapg users:

• Right of Access: You may request a copy of all Personal Data we hold about you. We will provide this within 30 days of a verified request.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request its correction. For account details, many fields can be updated directly by contacting support.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data. Note that this right is subject to our legal retention obligations — we cannot delete data we are required to keep for AML, KYC, or licensing compliance purposes. Data subject to mandatory retention will be suppressed from active use rather than immediately deleted.
• Right to Restrict Processing: You may request that we limit how we use your Personal Data in certain circumstances — for example, while a dispute over data accuracy is under investigation.
• Right to Data Portability: You may request your Personal Data in a commonly used, machine-readable format (such as CSV or JSON) for transfer to another service provider.
• Right to Object: You may object to Processing of your Personal Data carried out on the basis of our legitimate interests, including profiling for fraud detection purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where Processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact our Data Protection team at [email protected] with the subject line "Privacy Rights Request." We will respond within 30 days. We may require identity verification before processing a request to protect against unauthorized access to another user's data.

11. Minors & Age Restriction

The zonapg platform is strictly intended for adults aged 21 years and older. We do not knowingly collect Personal Data from individuals under the age of 21. If we become aware that a minor has registered for or is using a zonapg account, we will immediately suspend the account, void any associated wagers or bonuses, and delete all Personal Data associated with the account to the extent permitted by our legal obligations.

If you are a parent or guardian and believe that a minor in your care has used the zonapg platform without authorization, please contact us immediately at [email protected]. We will investigate and take appropriate action promptly. We also encourage parents to make use of parental control software to restrict access to online gambling platforms on devices used by minors.

12. International Data Transfers

zonapg operates as an internationally licensed platform. Your Personal Data may be transferred to, stored in, or processed in countries other than Indonesia — including the jurisdiction in which our gaming licence is held and the locations of our cloud hosting providers. These countries may have data protection laws that differ from those applicable in Indonesia.

Where Personal Data is transferred outside of your country of residence, zonapg ensures that appropriate safeguards are in place to protect your data, including contractual clauses based on internationally recognized data protection standards, and that receiving parties are bound by equivalent data protection commitments. By using the zonapg platform, you acknowledge and consent to the transfer of your Personal Data across international borders as described in this section.

13. Changes to This Privacy Policy

zonapg reserves the right to update, amend, or revise this Privacy Policy at any time. When we make material changes, we will post the updated policy on this page with a revised "Last Updated" date at the top of the document. Where changes are significant — for example, a new category of data collection or a new third-party data sharing arrangement — we will provide additional notice via email or an in-platform notification to registered users.

Continued use of the zonapg platform following the posting of a revised Privacy Policy constitutes your acceptance of those changes. If you do not agree to any revised terms, you must discontinue use of the platform and may request account closure as described in our Terms & Conditions.

14. Contact & Data Requests

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your Personal Data, please contact the zonapg Data Protection team using the details below:

• Email: [email protected] (subject line: "Privacy Rights Request" or "Data Protection Enquiry")
• Live Chat: Available 24 hours a day, 7 days a week, directly on the zonapg platform
• Response Time: We aim to acknowledge all privacy-related enquiries within 24 hours (WIB) and to resolve them fully within 30 days
• Languages: Requests may be submitted in English or Bahasa Indonesia; our team includes native Indonesian-speaking staff