Privacy Policy

This policy explains what personal data ZABET1 collects when you use zabet1.com, why we hold it, who we share it with, how long we keep it and what you can ask us to do with it.

Last updated: 6 October 2026

1. Who we are and what this policy covers

ZABET1 operates the website at zabet1.com, together with the account, wallet, casino, live dealer and sportsbook services offered through it. In this policy "we", "us" and "ZABET1" mean the company that operates that website, and "you" means anyone who visits the site, registers an account or contacts us.

The company responsible for your personal data — the data controller — is:

This policy covers the website and the services delivered through it. It does not cover websites operated by other companies that you may reach from our pages — for example a payment provider's checkout screen or a game studio's own site. Those companies publish their own policies and you should read them separately.

1.1 Licensing and regulatory framework

Our gaming operations are conducted under an Internet Gaming Licence issued by Anjouan Licensing Services Inc. (Anjouan Gaming) and are subject to the applicable laws, regulations, licence conditions and regulatory requirements of the Autonomous Island of Anjouan, Union of Comoros. The licence held by U2IS Limited (registration number 16249) is ALSI-202601056-FI2.

That framework is not incidental to this policy — it is the reason several things in it are written the way they are. The licence conditions, and the anti-money-laundering code issued under them, are what require us to verify your identity before you withdraw, to report certain transactions whether or not they look suspicious, to notify our regulator of a breach within a fixed deadline, and to keep records for a minimum period even after you ask us to delete them. Where this policy says we cannot do something you have asked for, it is almost always this framework saying it, not us.

1.2 The data protection standard we apply

We process personal data in accordance with internationally recognised data protection principles, including the standards and principles established under the EU General Data Protection Regulation (GDPR), where applicable. In plain terms: we have taken the GDPR as the benchmark for how this service handles personal data — lawful basis, data minimisation, purpose limitation, retention limits, security, and a proper route for you to exercise your rights — and we hold ourselves to it as a matter of how we operate.

We describe that as the standard we apply rather than as a claim about which supervisory authority regulates us. Which data protection laws reach a given player depends on where that player is and on the markets we serve, and that is a legal question rather than something a policy page settles by asserting it. The practical effect for you is the same either way: the protections and the rights set out in section 9 are what we offer, and we do not make them conditional on you proving which regime covers you.

1.3 Privacy contact

For questions, requests or concerns regarding this policy or the processing of your personal data, please contact our privacy team at [email protected]. That is a single monitored address; we do not operate separate privacy or data-protection mailboxes, so please do not send data requests to any other address expecting them to be picked up faster.

We do not publish the name of a separate privacy officer or of a representative in another jurisdiction, because no such appointment is legally required of us and none has been made. Publishing a contact point that does not exist would be worse than publishing none. If we later become required to make such an appointment, we will make it, update this policy and publish the details in this section.

2. What data we collect

We collect different categories of data depending on how far you get into the service. Simply browsing the site produces far less data than registering, depositing and playing.

2.1 Account data

Our licence requires us to carry out customer due diligence when you register. At a minimum that means we collect and record your full legal name, a valid email address, your date of birth and your residential address. These are not optional fields we could choose to drop: an account cannot be opened without them, and the date of birth is what lets us confirm you meet the minimum age of 18.

• Username and password (stored in hashed form, never in plain text).
• Email address and mobile phone number, and the verification status of each.
• Full legal name, date of birth, residential address, country of residence and any other registration details you supply.
• Preferred language and currency, marketing preferences, and your account status.
• Where you signed up through an affiliate or referral link, the code that referred you.

2.2 Identity and verification (KYC) documents

Beyond the registration details above, our licence conditions require enhanced due diligence in defined circumstances. We are telling you the triggers plainly, because being asked for documents unexpectedly is one of the most common causes of frustration on a gambling site, and it is far easier to plan for if you know in advance when it happens.

Enhanced due diligence is mandatory:

• on your first withdrawal request, regardless of the amount — this one catches most people out, so to be explicit: even a small first withdrawal triggers it;
• when your aggregate lifetime deposits reach USD 10,000 or the equivalent in another currency, counted across the life of the account rather than per transaction;
• at any point where our risk assessment identifies elevated risk or suspicious activity.

When it is triggered we ask for a government-issued photo identity document, a utility bill or equivalent evidence of your residential address, and, where the risk assessment requires it, proof of the source of your funds. Depending on the case we may also ask for a selfie or liveness check, or proof that you own the payment method used.

Verification material is sensitive, and we hold it under stricter internal controls than ordinary account data. You can see and manage your verification status at Account Details.

2.3 Transaction and blockchain data

We record every deposit, withdrawal, bonus credit, adjustment and balance change on your account: amount, currency, timestamp and status. For crypto transactions we also hold the deposit and withdrawal addresses you use and the on-chain transaction identifiers.

Please understand what a public blockchain is. Transactions on a public chain are recorded permanently on a ledger that anyone can read, and neither we nor you can delete or alter them. An address you use with us can potentially be linked to other activity on that same chain by anyone analysing it. That part of the record is outside our control and outside the reach of any deletion request. Fees, minimums and confirmation behaviour for each supported coin are set out on our fees page.

2.4 Gameplay data

We record your betting and gaming activity: games opened, stakes, results, session length, bonus participation and wagering progress. We need this to settle bets correctly, to calculate bonuses and rewards, to resolve disputes, to meet our reporting duties and to spot patterns that suggest problem gambling or bonus abuse.

2.5 Device and technical data

• IP address and the approximate location derived from it.
• Browser type and version, operating system, device type and screen size.
• Login times, session identifiers and security events such as failed login attempts or password changes.
• Pages viewed on the site and how you moved between them.

Some of this is unavoidable — a server cannot deliver a page without an IP address to send it to. Some of it is deliberate: we use IP and device signals to detect account sharing, multi-accounting and access from countries where we cannot lawfully offer the service.

2.6 Communications with support

When you use live chat, email us, or submit a form through the help centre, we keep the content of those messages together with the time, the channel and the account they relate to. Chat transcripts are retained so that a later agent can see the history of an issue and so that we have a record if a complaint escalates.

2.7 Cookies and similar technologies

We and our service providers set cookies and use similar storage technologies in your browser. Section 11 explains this in more detail.

3. How we use your data

We use personal data for the following purposes, and not for unrelated purposes we have not told you about.

3.1 A note on marketing

If you receive promotional emails or messages from us, every one of them carries a way to stop them, and you can change your marketing preferences at any time in your account settings or by emailing us. Turning marketing off does not stop service messages — withdrawal confirmations, security alerts and account notices are part of operating your account, not advertising, and you cannot opt out of those while the account is open.

3.2 A note on automated decisions

Some checks run automatically: fraud scoring, bonus-abuse rules, responsible-gambling flags and payment screening. Running them by hand across every transaction would not be possible, and would catch less.

No automated check makes a final decision about you on its own. What the automation produces is a flag — a case queued for a person to look at. Where the outcome would meaningfully affect you, such as holding a withdrawal, restricting a bonus or limiting an account, a member of staff reviews the case and it is that person, not the rule that raised it, who decides. This is a deliberate design choice: automated rules are good at noticing patterns and bad at understanding circumstances, and the cost of a wrong automated block falls entirely on the player.

If a decision goes against you, you can:

• ask us why — write to [email protected] and we will explain the outcome in terms you can act on, so far as doing so does not defeat the purpose of a fraud or anti-money-laundering control;
• tell us anything we did not know, and have the case looked at again by someone who did not make the original decision;
• escalate it as a formal complaint under section 9.2, which carries the acknowledgement and resolution times fixed by our licence and, if we cannot resolve it, a binding independent review.

4. Legal bases for processing

Consistent with the data protection standard described in section 1.2, we identify a legal basis for each use of your data rather than treating any processing as self-justifying. The bases we rely on are:

• Performance of a contract — we cannot open an account, take a deposit, settle a bet or pay a withdrawal without processing the data involved. This covers most day-to-day operation of the service.
• Legal obligation — anti-money-laundering rules, age verification, licence conditions, tax and record-keeping duties, and responses to lawful orders.
• Legitimate interests — protecting the service and our players from fraud and abuse, keeping the platform secure, improving how it works, and defending legal claims. We weigh these interests against your rights and do not rely on this basis where your interests override ours.
• Consent — for non-essential cookies and analytics, and for marketing where the law requires consent rather than an opt-out. Where we rely on consent you can withdraw it at any time, and doing so does not affect processing that already happened.

5. Who we share your data with

We do not sell your personal data. We share it only with the categories of recipient listed below, only as far as each of them needs it, and under contracts that require them to protect it and to use it only for the purpose we gave it to them for.

• Payment and cryptocurrency processors — to credit deposits, send withdrawals and investigate failed transactions.
• Game providers and studios — to launch games, run rounds and settle bets. These providers typically receive a pseudonymous player identifier, your currency and your session, rather than your name and contact details.
• Identity verification and KYC providers — to check identity documents, confirm age and run the screening our licence and AML duties require.
• Fraud prevention and risk services — to detect multi-accounting, stolen payment instruments and account takeover.
• Live chat and communication providers — to run the chat widget and to send transactional email and SMS.
• Analytics and performance services — to understand how the site is used and where it fails.
• Hosting, infrastructure and security providers — the companies whose servers and networks the platform runs on.
• Affiliates — where you registered through an affiliate link, that partner receives aggregated or limited activity data for commission purposes, not your identity documents.
• Regulators, auditors and law enforcement — where a licence condition, court order, regulatory request or legal duty requires disclosure.
• Professional advisers and, in a corporate transaction, a buyer or successor — under confidentiality obligations.

5.1 Reporting we are required to make

Some disclosures are not ours to decline. Under our licence conditions and the anti-money-laundering code that applies to us:

• A transaction, or a set of linked transactions, exceeding USD 10,000 is reported to the regulator regardless of whether we find anything suspicious about it. The threshold alone triggers the report.
• Activity we assess as suspicious is reported to the regulator within 24 hours of detection.
• An independent anti-money-laundering audit of our controls is carried out every year, and the auditor has access to the records needed to perform it.

We are generally not permitted to tell you that a suspicious activity report has been made. That restriction is imposed on us by law, and it is the one situation in which we cannot be fully transparent with you about a disclosure.

5.2 Processors we can name

Two of the categories above are now settled, and we would rather name the companies than describe them abstractly. Personal data is shared with the following processors in the course of running the service:

• Game suppliers — Hacksaw Gaming, Playtech and FunTa Gaming. These suppliers operate integrated wallet connections with our platform: when you open one of their games we pass a pseudonymous player identifier, your currency and your session so that rounds can be launched and bets settled against your balance. They do not receive your name, your contact details or your identity documents.
• Payment processors — NOWPayments (crypto), SticPay (e-wallet) and PayLab (local payment methods, where offered). These partners process deposits and withdrawals. They receive the data needed to execute and reconcile a transaction, and each operates as a controller in its own right for the payment records it is legally required to keep. Their own privacy notices govern that processing and you should read them.
• Live chat — LiveChat (LiveChat Inc.). Our support chat is provided by LiveChat and runs inside your browser. Everything you type into a chat, together with the page you opened it from and technical details of your connection, is processed by LiveChat on our behalf. The widget loads only after you are signed in, so a visitor who is not logged in is not passed to it at all.
• Transactional email — SendGrid (Twilio Inc.). Account emails — verification, password reset, transaction and security notices — are delivered through SendGrid, which therefore receives your email address and the content of the message sent to you.
• Phone verification — Twilio. Where we verify a mobile number, the number and the one-time code are processed by Twilio to deliver the message.
• Site performance and delivery — Cloudflare. Cloudflare sits in front of the site, filters malicious traffic and measures page performance. In doing so it processes your IP address and request metadata.
• Web fonts — Google Fonts, used on a small number of screens. Loading a font makes a request to Google from your browser, which discloses your IP address to Google. No account data is sent.
• Licence seal — when a licence verification seal is shown in our footer, it is served by the regulator's own provider so that its validity can be checked live. Loading it discloses your IP address to that provider.
• Hosting — the servers described in section 6.1 are operated for us by a commercial hosting provider under a written data processing agreement. We do not publish that provider's name, for the same reason we do not publish our network architecture: naming the company that holds the infrastructure is useful mainly to someone attacking it. If you have a legitimate interest in knowing — you are a regulator, or you are exercising a data protection right and the answer matters to it — write to [email protected] and we will tell you.

These are the suppliers we use at the date of this policy. Suppliers may be added, paused or replaced; where that happens this section is updated.

We do not run advertising trackers, social-network pixels or third-party behavioural profiling on this site. There is no Google Analytics tag, no Meta pixel and no session-replay tool. That is a deliberate choice and not an oversight: an operator that already knows your identity, your balance and your play history has no business also selling a picture of your browsing to an advertising network.

We keep a full register of every processor, what it does and what it receives. It is not published as a list on this page, but it exists, it is kept current, and we can produce it.

6. International transfers

ZABET1 operates internationally, and the providers listed above are not all in one country. That means your data may be transferred to and processed in countries other than the one you live in, including countries whose data protection laws differ from your own.

Where such a transfer takes place and the law requires it, we put a recognised safeguard in place — for example standard contractual clauses approved by the relevant authority, an adequacy decision covering the destination country, or another lawful transfer mechanism — and we assess whether additional technical measures are needed. You can ask us for information about the safeguards that apply to a particular transfer.

6.1 Where your data is stored

Your personal data is stored on servers located in Asia, principally in Hong Kong and Singapore.

Cross-border transfer is not an edge case for this service — it is how the service works. U2IS Limited is incorporated in the Autonomous Island of Anjouan, Union of Comoros, and licensed there; the platform is hosted in the Asian data centres described above; and players reach it from many different countries. Personal data is therefore necessarily transferred across national borders in the ordinary course of running your account, and it will regularly be processed outside the country you live in. We would rather state that plainly than bury it.

Transfers are made only to recipients that are contractually required to apply the same standard of protection set out in this policy — the standard described in section 1.2 — regardless of where they are located. A supplier that will not commit to that standard in writing does not receive personal data from us.

Which individual supplier sits in which country, and which safeguard covers each particular transfer, is recorded in the processor register described in section 5.2 rather than printed here — that detail changes as suppliers change, and a list on a web page goes stale faster than the register does. Ask us at [email protected] about a transfer that concerns you and we will tell you where the data goes and what protects it.

7. How long we keep your data

We keep personal data for as long as we need it for the purpose we collected it, and then for as long as the law requires us to keep it — which, in this industry, is usually the longer of the two by a wide margin.

The anti-money-laundering code that applies under our licence requires us to retain due diligence and transaction records for a minimum of 5 years. That period runs from the end of the business relationship — in practice, from the closure of your account — not from the date the record was created. It covers:

• customer due diligence and enhanced due diligence material, including the identity documents, address evidence and source-of-funds evidence described in section 2.2;
• transaction records — deposits, withdrawals, adjustments and the balance history behind them;
• suspicious activity reports and the analysis supporting them;
• audit records, including those produced for the annual independent AML audit.

Broadly:

• Account, transaction and verification records — retained for at least 5 years after account closure.
• Gameplay and betting history — retained for the period our licence and dispute-handling obligations require, and in any case while it may be needed to resolve a dispute about a settled bet.
• Support conversations — retained while they may still be needed for a complaint, a dispute or an ADR referral.
• Technical and security logs — retained for a shorter operational period.
• Marketing preferences — a record of your opt-out is retained precisely so that we keep honouring it.

Records connected to a self-exclusion, a regulatory investigation, a complaint or a legal claim are kept until that matter is closed and any limitation period has run out, even where that is longer than the periods above. When a retention period ends we delete the data or irreversibly anonymise it so that it can no longer be linked to you.

8. How we protect your data

We take security seriously and we apply measures appropriate to the sensitivity of what we hold:

• Traffic between your browser and our servers is encrypted in transit.
• Passwords are stored as salted hashes, never in a form we could read back.
• Access to personal data inside the company is restricted to staff whose role requires it, and identity documents sit behind tighter controls than ordinary account data.
• Sessions expire after inactivity, and security-relevant events such as password changes and withdrawal address changes are logged.
• Systems are monitored, patched and reviewed, and we run a bug bounty programme so that researchers have a proper channel to report weaknesses to us.

No system is perfectly secure, and we will not pretend otherwise. Protect your side of it too: use a password you do not use anywhere else, keep your email account secure, and never share your login. If you believe your account has been accessed by someone else, contact us immediately.

8.1 If something goes wrong

Our licence conditions set a hard deadline for this, and we would rather publish it than leave it vague: a cybersecurity incident or data breach is reported to Anjouan Licensing Services Inc. (Anjouan Gaming) within 24 hours of us detecting it. That clock runs from detection, not from the point at which we finish investigating — we report first and complete the picture afterwards.

Where a breach is likely to result in a risk to your rights we will also notify you, and where the risk is high we will do so directly rather than only by a notice on the site. Any additional notification deadline set by a data protection regime that applies to us runs alongside the 24-hour duty above; where two deadlines apply, we work to the shorter one.

9. Your rights

Subject to applicable law, you may have the following rights over your personal data. We handle requests for all seven as a matter of the standard described in section 1.2, without first asking you to establish which regime covers you:

• Access — you can ask whether we hold data about you and receive a copy of it. In practice that means your account and profile details, your transaction and gameplay history, your support conversations and the verification material you sent us.
• Rectification — you can have inaccurate data corrected and incomplete data completed. Most account fields you can edit yourself at Account Details; a change to a verified name, date of birth or address goes through support because it has to be re-evidenced.
• Erasure — you can ask us to delete your data where we no longer have a lawful reason to keep it. This is the right most constrained by our licence, and the paragraph below explains exactly how far it reaches.
• Restriction of processing — you can ask us to pause using your data while a dispute about its accuracy or lawfulness is being resolved. We keep the data during that pause but stop acting on it, except where we still need it for legal claims or for a compliance duty.
• Objection to processing — you can object to processing we base on our legitimate interests, and we will stop unless we have grounds that override your objection. An objection to direct marketing is different: that one we always honour, with no balancing test and no reason required.
• Data portability — you can ask for the data you gave us in a structured, commonly used, machine-readable format, and ask us to send it to another provider where that is technically feasible. This covers what you supplied and what your activity generated, not our internal risk scoring or analysis.
• Withdrawal of consent — where we rely on your consent, such as non-essential cookies or marketing, you can withdraw it at any time. Withdrawal stops future processing on that basis; it does not make what happened beforehand unlawful, and it does not affect processing that rests on contract or on a legal obligation.

A right to complain to a supervisory authority sits alongside these seven rather than among them; section 9.2 covers it, together with our own complaints route.

9.1 How to exercise them

Email [email protected] from the address registered on your account, say clearly which right you are exercising, and give us enough detail to find the right records. We may ask you to verify your identity before we act — that check protects you, since handing an account's data to an impostor would be the worse failure.

We aim to respond within one month. If a request is complex or you have made several, we may extend that period and will tell you if we do. There is no charge for a reasonable request; we may charge a proportionate fee or decline where a request is manifestly unfounded or excessive, and we will explain our reasoning if that happens.

9.2 If you are not satisfied with our answer

Complaints — about this policy, about how we have handled your data, or about anything else — follow a route fixed by our licence conditions:

1. Tell us first. Email [email protected]. We acknowledge a complaint within 1 working day and aim to resolve it within 14 days.
2. If we cannot resolve it in that time, it escalates. An unresolved complaint goes to mandatory, binding Alternative Dispute Resolution. Binding means the outcome binds us — we do not get to decline a decision that goes against us.
3. You can also go to the regulator. Anjouan Licensing Services Inc. (Anjouan Gaming) supervises our licence and accepts complaints at [email protected]. Their address is 15619 Hamchako, Mutsamudu, Autonomous Island of Anjouan, Union of Comoros. For a concern specifically about responsible gambling, the regulator's contact is [email protected].

Separately from all of the above, where a data protection regime applies to you, you keep the right to complain to the data protection supervisory authority in your own country. Nothing in this section takes that right away or requires you to exhaust our process first.

10. Responsible gambling and self-exclusion data

If you set deposit or loss limits, take a cooling-off period or self-exclude, we must keep a record of it and enforce it. That record cannot be deleted on request while it is in force, and in most jurisdictions not for a period afterwards either — deleting it would let the exclusion be bypassed, which is exactly what it exists to prevent. Where a jurisdiction operates a national self-exclusion register, we may be required to share your details with it.

11. Cookies and similar technologies

Cookies are small files stored by your browser. The list below is the whole of what this site uses. Most gambling sites describe their cookies in vague categories because the real list would be embarrassing; ours is short enough to print in full.

11.1 Cookies we set ourselves

All four are first-party cookies, set by this site under this domain. None is used for advertising, and none is shared with anyone.

11.2 Cookies set by our providers

11.3 Things stored in your browser that are not cookies

Three small values are kept in your browser's own storage rather than in cookies. They are never transmitted to us — they exist so the page can remember something locally:

• rw1_age_verified — records that you confirmed you are over 18, so the age notice does not reappear on every page. Cleared when you close the tab.
• rw1_favorites — the games you starred, kept on your own device.
• lt_idle_activity — a timestamp shared between open tabs so that the inactivity timeout does not log you out of one tab while you are playing in another.

11.4 What we do not set

We do not set advertising cookies, retargeting pixels, social-network trackers or session-replay recorders, and there is no analytics tag that builds a profile of your browsing. Affiliate commission is attributed on the affiliate platform's own system when a partner link is followed, not by a tracking cookie planted on this site.

You can delete or block cookies in your browser settings. Blocking ci_session will break login and gameplay, so the practical effect is that you will not be able to use the service.

This site does not show a cookie consent banner. That is because there is nothing here that a banner would properly gate: the four cookies we set ourselves are the login session, your language choice, the email you asked us to remember, and whether you dismissed the welcome popup for the day, and the remaining ones are set by our chat and security providers in order to deliver those services. Were we to start using cookies for advertising or profiling, this section and that position would both change — and we would ask you first.

12. Children

ZABET1 is strictly for adults aged 18 or over, and older where local law sets a higher minimum. The minimum age of 18 is a condition of our licence, which is why date of birth is collected at registration and verified as part of the due diligence described in section 2.2. We do not knowingly collect data from anyone under that age, and we do not direct any part of the service at minors. If we find that an account belongs to someone underage we will close it, void the activity on it and handle the balance in the way our terms and our licence require.

If you believe a minor has registered or is using an adult's account, tell us at [email protected] so we can investigate. Parents and guardians who share a device should also consider filtering software that blocks gambling sites.

13. Changes to this policy

We may update this policy as the service, our providers or the law change. The "last updated" date at the top always reflects the current version. If a change materially affects your rights or how we use your data, we will give you notice through the site or by email before it takes effect where the law requires us to. Continuing to use the service after a change takes effect means the updated policy applies to you.

14. Contact us

For any question about this policy, about the data we hold on you, to exercise any of the rights in section 9, or to make a complaint, email [email protected]. One address covers all of it — we do not run separate privacy or complaints mailboxes. For account and payment questions, live chat through the support page is usually faster. To report a security vulnerability, use the bug bounty programme rather than general support.