done66 Privacy Policy — Your Data, Your Rights

This Privacy Policy applies to all individuals who access or use the done66 platform at done66.bet — including registered account holders, individuals who have commenced but not completed the registration process, and visitors who browse done66 without registering an account.

done66 is an English-language online betting and casino platform operated primarily for adult players in Pakistan. This Privacy Policy is written in English and reflects the data practices of done66 in relation to its Pakistan player base. By using done66, you acknowledge that you have read and understood this Privacy Policy.

This policy should be read alongside the done66 Terms & Conditions, which govern your use of the platform more broadly. In the event of any conflict between this Privacy Policy and the Terms & Conditions on a privacy-specific matter, this Privacy Policy shall prevail.

done66 collects personal data through three main channels: information you provide directly during registration and account management; information generated automatically through your use of the done66 platform; and information received from third-party payment providers and identity verification services.

Information You Provide Directly:

• Full legal name and date of birth, as required for age verification.
• Pakistan mobile number, for SMS two-factor authentication and account communications.
• CNIC number and photo identification documents, for KYC verification before withdrawal processing.
• Payment method identifiers — Easypaisa mobile number, JazzCash number, SadaPay, Raast, or Pakistan bank account details — to process PKR deposits and withdrawals.
• Username and password, which done66 stores in encrypted form only — your password is never visible to done66 staff.
• Communications you submit via done66's live chat, support tickets, or email to done66 support at [email protected].

Information Collected Automatically:

• IP address and approximate geographic location (country and city level, for fraud detection and security monitoring).
• Device type, browser type, and operating system version.
• Session start and end timestamps, pages visited, and features used within the done66 platform.
• Betting and gaming activity records including all stakes, results, and bonus interactions.

done66 does not collect biometric data, racial or ethnic origin data, political opinions, religious beliefs, health data, or any other special category of sensitive personal data, unless explicitly required for responsible gaming intervention and provided with your express consent.

done66 uses your personal data for the following purposes, each of which is necessary to operate the platform, protect players, and meet legal obligations:

• Account Creation and Management: Processing your registration, maintaining your done66 account record, and enabling your access to all platform products — sports betting, Casino, Jackpot Slots, Poker, and Cockfighting.
• Payment Processing: Verifying and processing PKR deposits from, and PKR withdrawals to, your registered Easypaisa, JazzCash, SadaPay, Raast, or Pakistan bank account.
• Identity and Age Verification: Confirming that all done66 account holders are aged 18 or over and that the identity provided matches the payment method registered to the account.
• Security and Fraud Prevention: Detecting, investigating, and preventing unauthorised account access, bonus abuse, money laundering, and any other conduct prohibited under done66's Terms & Conditions.
• Responsible Gaming: Monitoring gaming activity patterns to identify potential signs of problem gambling, enforcing deposit limits and self-exclusion requests, and communicating responsible gaming tools to players who may benefit from them.
• Customer Support: Responding to your queries, resolving disputes, and managing your support interactions through done66's 24/7 English-language support team.
• Legal and Regulatory Compliance: Meeting applicable anti-money-laundering, financial crime, and age verification obligations, and responding to lawful requests from relevant authorities.
• Platform Improvement: Analysing aggregate, anonymised usage patterns to improve platform performance, game selection, and user experience for Pakistan players.

done66 does not use your personal data to make fully automated decisions that have a legal or similarly significant effect on you without providing an opportunity for human review and explanation.

done66 processes personal data on the following legal bases:

• Contract Performance: Processing your data is necessary to register your done66 account, process your PKR deposits and withdrawals, and deliver the betting and gaming services you have signed up for.
• Legal Obligation: done66 is required by applicable law to conduct identity verification, retain financial transaction records, and cooperate with relevant regulatory and law enforcement authorities. These obligations cannot be waived by individual player consent choices.
• Legitimate Interests: done66 processes certain data — such as device information and session metadata — on the basis of its legitimate interest in preventing fraud, maintaining platform security, and improving service quality, where these interests do not override your own rights and freedoms.
• Consent: Where done66 requests your consent for a specific data processing activity — such as sending you personalised promotional offers — it will do so clearly and separately, and you may withdraw that consent at any time by contacting done66 support.

done66 does not sell your personal data to any third party. done66 shares personal data only with the following categories of recipients, and only to the minimum extent necessary for the specified purpose:

• Payment Providers: Easypaisa, JazzCash, SadaPay, Raast, HBL, UBL, MCB, and other Pakistan payment processors — solely to process your PKR deposits and withdrawals. done66 shares only the payment identifiers required to complete each transaction.
• Identity Verification Providers: Third-party KYC service providers who assist done66 in verifying the identity and age of account holders before processing withdrawal requests. These providers are contractually bound to process your data only for verification purposes.
• Game Content Providers: Software developers who supply Casino games, Jackpot Slots, and Poker platform technology to done66. These providers receive anonymised session data only — they do not receive your name, CNIC, or payment details.
• Legal and Regulatory Authorities: done66 will disclose personal data to law enforcement agencies, financial regulators, or other competent authorities where required by applicable law, a court order, or a legitimate regulatory request.
• Professional Advisors: Legal counsel, auditors, and financial advisors who assist done66 in complying with its obligations, all of whom are bound by professional confidentiality obligations.

All third-party recipients who process personal data on done66's behalf are required by contract to maintain appropriate security standards and to process your data only as instructed by done66.

done66 uses cookies and similar technologies to operate certain essential platform functions and to improve your experience on the done66 platform. Cookies used by done66 fall into three categories:

• Strictly Necessary Cookies: These cookies are essential for the done66 platform to function. They maintain your login session, remember your language and currency preferences (PKR), and ensure security features such as two-factor authentication work correctly. You cannot opt out of strictly necessary cookies without losing core platform functionality.
• Analytics Cookies: done66 uses anonymised analytics cookies to understand how players interact with the platform — which pages are visited, which games are opened, and how navigation flows. This data is aggregated and cannot be used to identify individual players. You may opt out of analytics cookies via your done66 account settings.
• Responsible Gaming Cookies: These cookies remember your responsible gaming preferences — session time limits, deposit limit settings, and self-exclusion status — to ensure your settings are applied consistently across every done66 session.

done66 does not use third-party advertising tracking cookies. No external advertising network receives cookies from the done66 platform.

done66 implements a comprehensive set of technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction:

• Encryption in Transit: All data transmitted between your device and done66's servers is protected by 256-bit TLS/SSL encryption — the same standard used by Pakistan's major banks and mobile payment platforms including Easypaisa and JazzCash.
• Encryption at Rest: Sensitive personal data — including CNIC information and payment identifiers — is stored in encrypted form. Passwords are stored using one-way cryptographic hashing; done66 cannot see or retrieve your password.
• Access Controls: Access to personal data within done66 is restricted on a strict need-to-know basis. Only staff roles with a legitimate operational need for a specific category of data are authorised to access it.
• Two-Factor Authentication: Your done66 account is protected by SMS-based two-factor authentication for new device logins and high-value withdrawal requests, using your registered Pakistan mobile number.
• Anomaly Detection: done66's security systems monitor login events for unusual IP locations, device changes, and access patterns. Suspicious activity triggers an automatic verification step before granting account access.
• Regular Security Reviews: done66 conducts periodic security assessments to identify and address potential vulnerabilities in its infrastructure and data handling practices.

Despite these measures, no internet-connected platform can guarantee absolute security. If you believe your done66 account has been compromised, contact done66 live chat support immediately to freeze your account pending investigation.

done66 retains personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable legal obligations. The following retention periods apply to the main categories of personal data held by done66:

• Account and Identity Data: Retained for the lifetime of your done66 account plus a minimum of 5 years following permanent account closure, to meet financial crime investigation and regulatory record-keeping obligations.
• Financial Transaction Records: PKR deposit and withdrawal transaction records are retained for a minimum of 7 years following the transaction date, in accordance with financial record-keeping obligations applicable to done66's operations.
• Gaming Activity Records: Bet history, game session records, and win/loss outcomes are retained for a minimum of 5 years from the date of the relevant activity, for dispute resolution and regulatory compliance purposes.
• Support Communications: Live chat transcripts and support correspondence are retained for 3 years from the date of the interaction, unless the matter is the subject of an ongoing dispute, in which case records are retained until that dispute is formally resolved.
• Technical and Security Logs: IP address logs and session metadata are retained for a maximum of 24 months for fraud detection and security monitoring purposes, after which they are deleted or fully anonymised.
• Self-Exclusion Records: Records of self-exclusion requests and their associated dates are retained indefinitely to prevent reactivation of excluded accounts in violation of done66's responsible gaming commitments.

Upon expiry of the applicable retention period, done66 securely deletes or anonymises the relevant personal data so that it can no longer be linked to any individual account holder.

As a done66 account holder, you have the following rights in relation to your personal data held by done66. To exercise any of these rights, contact done66 support via live chat — English-speaking agents are available 24/7 and will handle your request without requiring any special form or formality:

• Right of Access: You may request a copy of the personal data done66 holds about you. done66 will provide this within a reasonable timeframe at no charge.
• Right to Rectification: If any personal data held by done66 is inaccurate or out of date, you may request that it be corrected. For example, if your registered mobile number has changed, you may update it via account settings or through done66 support.
• Right to Erasure: In certain circumstances, you may request that done66 delete your personal data. Note that done66 cannot delete data that it is legally required to retain — such as financial transaction records and identity verification documents within applicable retention periods.
• Right to Restriction: You may request that done66 restrict its processing of your personal data where you contest its accuracy, object to its use, or require it for the establishment of a legal claim.
• Right to Object: You may object to done66 processing your data on the basis of its legitimate interests. done66 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where done66 processes your data on the basis of consent — such as for marketing communications — you may withdraw that consent at any time by contacting done66 support. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

done66 will acknowledge all data rights requests within 48 hours and resolve them within a reasonable period. If you are not satisfied with how done66 has handled your personal data, you have the right to complain to the relevant data protection authority in your jurisdiction.

done66 may send you marketing communications about promotions, new product launches, and platform updates via SMS to your registered Pakistan mobile number or by notification within the done66 platform, where you have consented to receive such communications or where done66 has a legitimate interest in informing you of relevant offers as an active account holder.

You may opt out of marketing communications at any time by contacting done66 support via live chat or by adjusting your communication preferences in your done66 account settings. Opting out of marketing does not affect your ability to receive essential account communications — such as deposit confirmations, withdrawal notifications, and security alerts — which done66 is required to send regardless of your marketing preferences.

done66 does not send marketing communications to self-excluded account holders under any circumstances. The done66 marketing system automatically removes self-excluded accounts from all marketing lists at the time the self-exclusion takes effect.

done66 is strictly for adults aged 18 and over. done66 does not knowingly collect, process, or retain personal data from any individual under the age of 18. All done66 registration processes include an age declaration and done66 requires identity verification — including CNIC documentation — for all withdrawal requests, which by design limits the ability of minors to access done66 services.

If done66 discovers at any point that personal data has been collected from a person under 18 years of age, done66 will immediately close the associated account, delete the personal data collected from that individual (subject to any legal obligations to report the matter to relevant authorities), and return any Real Funds deposited to the verified source of those funds where technically possible.

Parents and guardians who believe that a minor may have registered a done66 account are encouraged to contact done66 support immediately via live chat. done66 will investigate and act promptly on any such report.

done66 reserves the right to update this Privacy Policy at any time. When material changes are made — for example, introducing a new category of data collection or changing how data is shared — done66 will notify active account holders via SMS to the mobile number registered to their done66 account before the revised policy takes effect.

The revised Privacy Policy will be published at done66.bet/privacy-policy with an updated effective date. Your continued use of done66 after the effective date of any revision constitutes your acceptance of the updated policy. If you do not agree to the revised Privacy Policy, you should cease using done66 and may request account closure in accordance with done66's Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or how done66 handles your personal data, please contact done66 support through any of the following channels:

• Live Chat: Available 24/7 on every page of the done66 platform. done66's English-language support team can handle privacy queries, data access requests, and data correction requests in real time.
• Email (plain text — not a clickable link): [email protected] — for written privacy queries, data subject access requests, and formal complaints. done66 will acknowledge email queries within 48 hours.

done66 is committed to resolving privacy concerns promptly and transparently. If you submit a formal privacy complaint and are not satisfied with done66's response within 30 days, you retain the right to escalate the matter to any competent regulatory authority in your jurisdiction.

For responsible gaming support — including self-exclusion requests, deposit limit settings, and related privacy considerations — please visit the done66 Responsible Gaming page or raise the matter directly with done66 support via live chat at any time of the day or night.