Privacy Policy — 365zk

1 Definitions

The following defined terms apply throughout this Privacy Policy. Terms that are capitalised but not defined here carry the meaning assigned to them in the 365zk Terms & Conditions.

• "365zk" / "we" / "us" / "our" — the operator of the 365zk online betting and gaming platform accessible at 365zk.lat, including all associated services, customer support channels, and payment processing infrastructure.
• "Player" / "you" / "your" — any individual who registers an Account on the 365zk platform or accesses the platform as a guest visitor from Indonesia or any other permitted jurisdiction.
• "Personal Data" — any information that identifies or could reasonably identify a natural person, including name, date of birth, Indonesian national identity number (NIK), email address, phone number, residential address, IP address, device identifiers, and financial account details.
• "Processing" — any operation performed on Personal Data, whether automated or manual, including collection, storage, retrieval, use, disclosure, transfer, restriction, erasure, and destruction.
• "Account" — the registered user profile created by a Player on the 365zk platform through which they access betting, casino, slot gacor (high-payout slot), togel (Indonesia's traditional numbers lottery), Mahjong, and crash game services.
• "KYC Data" — identity and address verification documents submitted by a Player as part of the Know Your Customer process, including copies of national identity cards (KTP), passports, utility bills, and payment method statements.
• "Cookies" — small data files placed on a Player's device by the 365zk platform for the purposes of session management, personalisation, analytics, and fraud prevention.
• "Third-Party Processor" — any external organisation that processes Personal Data on 365zk's behalf under a written data processing agreement, including payment providers, KYC verification vendors, and analytics platforms.

2 Personal Data We Collect

365zk collects the minimum Personal Data necessary to provide a safe, compliant, and high-quality betting and gaming experience to players across Jakarta, Surabaya, Bandung, Medan, Bali, and the rest of Indonesia. The categories of data we collect are as follows:

2.1 Registration Data

When you create a 365zk Account, we collect your full legal name, date of birth, email address, mobile phone number, Indonesian residential address, preferred username, and the password you choose (stored as a one-way cryptographic hash — we never store or transmit your plain-text password).

2.2 Identity Verification (KYC) Data

To comply with our international anti-money-laundering obligations and to confirm that you are at least 21 years of age and resident in Indonesia, we collect documentary KYC Data including a copy of your Indonesian national identity card (KTP) or passport, proof of residential address, and confirmation of your nominated payment method (e.g., a GoPay, OVO, DANA, BCA, BRI, BNI, or Mandiri account statement).

2.3 Financial Transaction Data

We record all deposit and withdrawal transactions processed through your Account, including the transaction amount in Indonesian Rupiah (IDR), the payment method used (e-wallet or bank transfer), the timestamp in WIB (Western Indonesia Time, UTC+7), and the transaction status. We do not store full bank account numbers or e-wallet PINs — only the last four digits of an account number are retained for reference purposes.

2.4 Betting & Gaming Activity Data

We collect a full record of your betting and gaming activity on the 365zk platform, including sportsbook wagers placed on BRI Liga 1, the EPL, La Liga, Champions League, and other markets; casino game sessions; slot game rounds (including slot gacor titles from Pragmatic Play, PG Soft, NetEnt, and Microgaming); crash game sessions; Mahjong Ways rounds; and any togel draw entries. This data is used for account management, responsible gaming monitoring, bonus settlement, and dispute resolution.

2.5 Technical & Device Data

When you access the 365zk platform, our servers automatically log your IP address, browser type and version, operating system, device type and model, screen resolution, time zone setting, referring URL, pages visited, session duration, and click-path data. This information is collected via server logs and, where you have consented, via analytics cookies.

2.6 Communications Data

We retain records of all communications between you and 365zk's customer support team, including live chat transcripts, emails sent to and received from [email protected], and any documents or screenshots you share with us in connection with a support query, complaint, or KYC submission.

2.7 Responsible Gaming Data

Where you voluntarily set deposit limits, loss limits, session time alerts, cooling-off periods, or a self-exclusion order via your Account dashboard, we record those instructions and the dates on which they were applied or modified. This data is retained beyond the standard Account lifetime to prevent circumvention of self-exclusion requests.

3 How We Collect Your Data

365zk collects Personal Data through the following channels:

• Directly from you — when you register an Account, complete KYC verification, make a deposit or withdrawal, place a wager, contact customer support, or respond to a survey or promotion.
• Automatically — through server logs, session cookies, analytics tags, and device fingerprinting technologies that operate when you browse the 365zk platform.
• From Third-Party Processors — our KYC verification partner may provide us with the results of identity and document checks; our payment processors (GoPay, OVO, DANA, ShopeePay, LinkAja, BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) confirm transaction completion status and flag suspicious payment activity.
• From fraud prevention services — we may receive risk-score data from third-party fraud detection vendors to assist in identifying patterns of bonus abuse, account takeover attempts, or money laundering activity.

4 Purpose & Legal Basis for Processing

The table below summarises the primary purposes for which 365zk processes your Personal Data and the legal basis upon which each processing activity rests:

5 Data Sharing & Disclosure

365zk does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We share Personal Data only in the following strictly limited circumstances:

5.1 Third-Party Processors

We engage selected Third-Party Processors who handle Personal Data solely on our behalf and under written data processing agreements that require them to maintain confidentiality and implement appropriate technical and organisational security measures. These processors include KYC verification providers, payment processing partners (GoPay, OVO, DANA, BCA, BRI, BNI, Mandiri, and others), cloud infrastructure providers, live chat and customer support software vendors, and fraud detection services.

5.2 Game Content Providers

When you play games sourced from third-party studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PG Soft (Pocket Games Soft), Spribe, and others — certain technical data (session tokens, game round IDs, wager amounts) is exchanged between 365zk's platform and the game provider's servers to render the game correctly and settle outcomes. This data exchange is governed by licence agreements with each provider.

5.3 Legal and Regulatory Disclosure

365zk may disclose Personal Data to international regulatory authorities, law enforcement agencies, or courts of competent jurisdiction where we are legally required to do so, including in connection with anti-money-laundering investigations, tax reporting obligations, or court orders. We will notify you of any such disclosure to the extent permitted by applicable law.

5.4 Business Transfers

In the event that 365zk undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, your Personal Data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and of any material change in the privacy practices applicable to your data before the transfer takes effect.

5.5 Aggregate and Anonymised Data

365zk may share aggregated, anonymised statistical data — such as total number of active players in Jakarta or average deposit size via GoPay — with business partners, advertisers, or the public. Such data cannot reasonably be used to identify any individual Player and does not constitute a disclosure of Personal Data.

6 Cookies & Tracking Technologies

365zk uses cookies and similar tracking technologies to deliver a functional, secure, and personalised betting experience. The following cookie categories are used on the platform:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in to your 365zk Account, CSRF protection tokens, and load-balancing cookies. These cookies cannot be disabled without breaking core platform functionality.
• Performance & Analytics Cookies: Used to understand how Players navigate the 365zk platform — which game categories are most visited, where users drop off during the registration flow, and how long sessions last. This data helps us improve platform usability. Analytics cookies are only set with your prior consent.
• Functional Cookies: Remember your preferences, such as your preferred language setting, the last game category you browsed, and whether you have acknowledged a specific promotional banner. These cookies improve your experience across sessions.
• Fraud Prevention & Security Cookies: Used to detect abnormal browsing behaviour, flag potential account takeover attempts, and identify patterns consistent with bonus abuse or multi-accounting. These cookies are classified as strictly necessary from a security standpoint.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using 365zk's core betting and gaming services, though some personalisation features may be affected. Note that clearing all cookies will log you out of your current session.

7 Data Retention

365zk retains Personal Data for as long as is necessary to fulfil the purposes outlined in this Privacy Policy, subject to the following minimum retention periods:

• Account and Registration Data: Retained for the lifetime of the Account and for a minimum of five (5) years following permanent Account closure, in line with standard international anti-money-laundering record-keeping requirements.
• KYC Data: Retained for a minimum of five (5) years from the date of the last transaction on the Account, or longer if required by applicable regulatory obligations.
• Financial Transaction Data: Retained for a minimum of five (5) years from the date of each transaction.
• Betting & Gaming Activity Data: Retained for a minimum of three (3) years from the date of each wager for dispute resolution and responsible gaming monitoring purposes.
• Responsible Gaming Data (including self-exclusion records): Retained indefinitely to prevent re-registration during an active exclusion period and to maintain an audit trail of protective measures applied to the Account.
• Communications Data: Retained for two (2) years from the date of the last communication, unless the communication forms part of a formal complaint or legal dispute, in which case it is retained until the matter is fully resolved.
• Technical & Device Data (server logs): Retained for ninety (90) days in raw form; aggregated anonymised summaries may be retained indefinitely for analytics purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised using industry-standard data destruction procedures.

8 Data Security

365zk employs a layered security architecture designed to protect your Personal Data against unauthorised access, accidental loss, disclosure, alteration, and destruction. Our key security measures include:

• Transport Layer Security: All data transmitted between your browser or app and 365zk's servers is encrypted using TLS 1.3 with 256-bit AES cipher suites. Our platform enforces HTTPS on every endpoint — unencrypted HTTP connections are automatically redirected.
• Password Security: Player passwords are never stored in plain text. We use industry-standard bcrypt hashing with a high work factor to store password credentials. 365zk will never ask you for your password via email, live chat, or any other channel.
• Access Controls: Internal access to Personal Data is governed by the principle of least privilege. Only authorised staff members with a documented operational need may access identifiable player records. All internal access is logged and subject to periodic audit.
• Infrastructure Security: 365zk's platform infrastructure is hosted in ISO 27001-aligned data centres with physical access controls, redundant power supplies, and 24/7 network monitoring. Regular penetration tests and vulnerability assessments are conducted by independent security firms.
• Fraud Detection: Automated systems monitor all Account activity in real time for indicators of unauthorised access, account takeover attempts, and unusual transaction patterns. Suspicious activity triggers an immediate Account review and, where warranted, a temporary hold on withdrawals.

Despite these measures, no system is entirely immune from security risks. If you suspect that your 365zk Account has been compromised, you must contact our support team immediately at [email protected] or via live chat. We will act promptly to secure your Account.

9 Your Data Subject Rights

As a registered player on 365zk, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 24 hours and respond in full within 30 calendar days.

• Right of Access: You may request a copy of all Personal Data that 365zk holds about you, along with information about how it is processed, the purposes of processing, and the categories of Third-Party Processors to whom it has been disclosed.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you may request that it be corrected. You may update certain details (such as your email address or residential address) directly via your Account dashboard; other corrections require a formal request to our support team.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where processing was unlawful. Note that we are not required to erase data that we are legally obliged to retain — for example, KYC and financial transaction records subject to anti-money-laundering retention requirements.
• Right to Restriction of Processing: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of the data is being contested, or where you have objected to processing based on legitimate interests.
• Right to Data Portability: You may request a copy of the Personal Data you have provided to 365zk in a structured, commonly used, machine-readable format (JSON or CSV) for transfer to another service provider, where technically feasible.
• Right to Object: You may object at any time to processing of your Personal Data for direct marketing purposes. You may also object to processing carried out on the basis of legitimate interests, in which case we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing emails, analytics cookies), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

10 Marketing Communications

With your prior consent, 365zk may send you promotional communications by email or SMS relating to new game releases, seasonal deposit bonuses (including promotions tied to Idul Fitri, Ramadhan, Nyepi, Chinese New Year, and Indonesian Independence Day), sportsbook enhanced odds for BRI Liga 1 fixtures, and platform updates. You will be asked to opt in to marketing communications during registration; you are not required to consent in order to create an Account.

You may unsubscribe from marketing emails at any time by clicking the "Unsubscribe" link in any promotional email or by contacting our support team at [email protected]. Please allow up to 48 hours for your unsubscribe request to take effect across all mailing systems. Opting out of marketing communications does not affect transactional messages (e.g., deposit confirmations, withdrawal notifications, KYC status updates, and responsible gaming alerts), which are sent regardless of marketing consent status.

11 Third-Party Services & External Links

The 365zk platform integrates with third-party game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PG Soft, Spribe, Pocket Games Soft), payment infrastructure providers (GoPay, OVO, DANA, ShopeePay, LinkAja, BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata), and operational software vendors (live chat, analytics, fraud detection). Each of these third parties operates under its own privacy policy and data processing terms, which are independent of this Privacy Policy.

365zk is not responsible for the privacy practices or the content of any third-party service or website. Where our platform links to third-party resources for informational purposes, we recommend that you review the applicable privacy policy of any third-party service before submitting personal information to it.

12 Minors & the 21+ Policy

365zk's services are strictly for adults aged 21 and over. We do not knowingly collect Personal Data from individuals under the age of 21. All Account registrations are subject to mandatory KYC verification to confirm age compliance. Where 365zk discovers that Personal Data has been collected from a person under 21 — whether through KYC review, parental notification, or other means — the Account will be immediately suspended, all balances will be forfeited, and all associated Personal Data will be securely deleted within 30 days, except where retention is required for legal or regulatory purposes.

If you are a parent or guardian and believe that a minor in your care has registered an Account on 365zk, please contact us immediately at [email protected]. We take underage gambling extremely seriously and will act promptly on any credible notification.

13 Amendments to This Policy

365zk reserves the right to update or revise this Privacy Policy at any time. Where amendments are material — for example, changes to the categories of data collected, a new Third-Party Processor relationship, or a change in the legal basis for processing — we will provide at least 14 days' advance notice via email to the address registered to your Account and via a prominent notice on the 365zk platform. The updated policy will display a revised "Last Updated" date at the top of this page.

Your continued use of the 365zk platform after the effective date of any amended Privacy Policy constitutes acceptance of the revised terms. If you do not agree to the revised policy, you must cease using the platform and may request Account closure and data deletion in accordance with Clause 9 above.

14 Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which 365zk handles your Personal Data, please contact us through the following channel:

• Email: [email protected] — subject line: "Privacy Enquiry" or "Data Rights Request"
• Live Chat: Available 24/7 via the chat widget on the 365zk platform — Indonesian-speaking agents available around the clock
• Response Time: Privacy enquiries acknowledged within 24 hours; full response within 30 calendar days

If you are not satisfied with 365zk's response to a privacy complaint, you may escalate the matter by sending a follow-up email with the subject line "Formal Privacy Escalation". Our compliance team will review the escalation independently of the original support agent and provide a final written response within 10 WIB business days.