done66 Privacy Policy

01 Who We Are

This Privacy Policy is issued by done66 ("done66", "we", "us", "our"), the operator of the online gaming platform available at done66.org. done66 acts as the data controller in respect of personal data collected from players who access or use our platform.

done66 operates under a valid international gaming licence and is committed to maintaining the highest standards of data protection. Our privacy practices are aligned with internationally recognised data protection principles, including those set out in the General Data Protection Regulation (GDPR), which we apply as a benchmark standard regardless of where our players are located.

This Privacy Policy applies to all personal data collected through the done66 website, any associated mobile applications, customer support channels, and related services offered to players in Pakistan and internationally.

02 Personal Data We Collect

done66 collects personal data that is necessary and proportionate to the purposes for which it is processed. The categories of personal data we collect include the following:

03 How We Collect Your Data

done66 collects personal data through several channels, depending on how you interact with our platform:

• Direct Collection: When you register a done66 account, you voluntarily provide identity and contact data. Additional data is collected during KYC verification when you submit documentary proof of identity and address.
• Transaction Activity: Financial data is generated automatically when you make deposits or request withdrawals through our supported Pakistani payment channels including JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank.
• Platform Interaction: Technical data such as your IP address, device identifiers, and browsing behaviour on done66 is collected automatically via cookies, log files, and similar tracking technologies when you use our platform.
• Customer Support: When you contact done66 support via email or live chat, we collect and retain the content of those communications for quality assurance and dispute resolution purposes.
• Third-Party Sources: done66 may receive data about you from third-party identity verification providers used in our KYC process, payment processors, and fraud detection services. This data is used solely for the purposes described in this Policy.

04 Legal Basis for Processing

done66 processes your personal data only where a valid legal basis exists under applicable data protection law. The legal bases we rely upon are as follows:

• Contractual Necessity: Processing is necessary to perform our contract with you — specifically, to operate your done66 account, process PKR transactions, and deliver the gaming services you have requested.
• Legal Obligation: Processing is required to comply with done66's obligations under its international gaming licence, including KYC, anti-money laundering (AML), and responsible gaming requirements.
• Legitimate Interests: done66 processes certain technical and behavioural data on the basis of legitimate interests, including fraud prevention, platform security, and improving the overall player experience. Such processing does not override your rights and interests as a data subject.
• Consent: Where done66 sends you marketing communications or uses non-essential cookies, we do so only on the basis of your freely given, specific, and informed consent. You may withdraw your consent at any time by contacting [email protected] or adjusting your account preferences.

05 How We Use Your Personal Data

done66 uses the personal data we hold about you for the following specific purposes:

• To create, verify, and manage your done66 player account.
• To process your PKR deposits and withdrawal requests via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank.
• To conduct identity verification (KYC) as required by our international gaming licence.
• To detect, investigate, and prevent fraud, money laundering, and other prohibited activities on the done66 platform.
• To monitor and enforce compliance with done66's responsible gaming commitments, including identifying players who may be at risk and applying account limits or restrictions where necessary.
• To provide customer support and resolve complaints or disputes relating to your done66 account.
• To send you transactional and account-related communications, including deposit confirmations, withdrawal notifications, and security alerts.
• To send you promotional communications about done66 bonuses, offers, and new features — but only where you have provided your express consent to receive such communications.
• To analyse platform usage patterns and improve the performance, security, and content of the done66 platform.
• To comply with applicable laws, regulatory requirements, and orders issued by competent courts or authorities.

06 Sharing Your Personal Data

done66 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share your data only in the following limited circumstances:

• Payment Processors: We share necessary financial data with JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank solely to process your PKR deposits and withdrawals.
• KYC & Identity Verification Providers: We share identity documents and data with accredited third-party KYC verification providers to fulfil our regulatory obligations under our gaming licence.
• Fraud Prevention & Security Services: We may share technical and behavioural data with specialist fraud detection and cybersecurity service providers to protect the integrity of the done66 platform.
• Regulatory Authorities: done66 is obligated to disclose player data to relevant regulatory bodies, law enforcement agencies, and licensing authorities where required by law, court order, or regulatory instruction.
• Platform Technology Providers: We work with carefully selected technology partners who provide infrastructure, analytics, and support services for done66. These partners process data on our behalf and are contractually bound to process it only in accordance with our instructions and applicable data protection law.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of done66's business, player data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third parties with whom done66 shares personal data are required to maintain appropriate technical and organisational security measures and to process your data only for the specified purpose.

07 International Data Transfers

done66 operates internationally and your personal data may be transferred to and processed in countries outside of Pakistan, including countries where done66's servers, technology partners, or licensing authority are located.

Where personal data is transferred internationally, done66 ensures that appropriate safeguards are in place to protect your data, including:

• Transferring data only to countries or organisations that provide an adequate level of data protection as determined by internationally recognised standards.
• Implementing standard contractual clauses or equivalent data transfer mechanisms with third-party recipients located in jurisdictions without an adequacy determination.
• Applying binding corporate rules or other approved transfer mechanisms where applicable.

08 Data Retention

done66 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our international gaming licence obligations.

The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your done66 account plus a minimum of five (5) years following account closure, as required by AML and gaming licence regulations.
• Financial Transaction Data: Retained for a minimum of five (5) years from the date of each transaction in accordance with financial record-keeping requirements.
• Gaming Activity Data: Retained for the duration of your account and up to two (2) years following closure for dispute resolution and regulatory audit purposes.
• Customer Support Communications: Retained for up to three (3) years from the date of the most recent communication in the relevant thread.
• Marketing Consent Records: Retained until you withdraw your consent plus one (1) year thereafter to demonstrate compliance with our consent obligations.
• Technical and Log Data: Retained for up to twelve (12) months from the date of collection, unless required longer for active security investigations.

Upon expiry of the applicable retention period, done66 will securely delete or anonymise your personal data in accordance with our internal data disposal procedures.

09 Cookies & Tracking Technologies

done66 uses cookies and similar tracking technologies on its platform to enhance your gaming experience, maintain session security, and analyse platform performance. The types of cookies we use are as follows:

• Strictly Necessary Cookies: These cookies are essential for the done66 platform to function correctly. They enable core features such as account login session maintenance, security token validation, and navigation. These cookies cannot be disabled without impairing platform functionality.
• Analytical / Performance Cookies: These cookies collect anonymised data about how players interact with the done66 platform — such as which pages are visited most frequently and how long sessions last. This information helps us improve platform performance and usability. These cookies are only set with your consent.
• Functional Cookies: These cookies remember your preferences, such as language settings and responsible gaming limit configurations, to provide a more personalised experience. These cookies are only set with your consent.
• Marketing Cookies: done66 may use marketing cookies to track your engagement with promotional content where you have opted in to marketing communications. These cookies are strictly consent-based.

10 Your Data Protection Rights

As a done66 player, you have the following rights in relation to your personal data. done66 is committed to honouring these rights promptly and without undue delay:

To exercise any of the above rights, please submit a written request to [email protected]. done66 will acknowledge your request within 72 hours and provide a substantive response within 30 calendar days. Where requests are complex or numerous, this period may be extended by a further 60 days, and you will be notified accordingly.

done66 may request proof of identity before processing any data subject request to ensure your data is not disclosed to an unauthorised third party.

11 Children's Privacy

The done66 platform is strictly intended for adults aged 21 years and over. done66 does not knowingly collect personal data from persons under the age of 21. Age verification is performed as part of the registration and KYC process, and accounts found to belong to underage individuals will be immediately suspended and all associated data deleted.

12 Security Measures

done66 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Our security framework includes:

• Encryption: All personal data transmitted between your device and the done66 platform is encrypted using industry-standard TLS (Transport Layer Security) protocols. Data at rest is encrypted using AES-256 encryption.
• Access Controls: Access to personal data within done66 is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and audited.
• Penetration Testing: done66 conducts regular security assessments, including third-party penetration testing, to identify and remediate vulnerabilities in our platform infrastructure.
• Incident Response: done66 maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in risk to your rights, done66 will notify you and the relevant regulatory authority within the timeframes required by applicable law.
• Employee Training: All done66 personnel who handle personal data receive mandatory data protection training as part of their onboarding and on an ongoing basis.

While done66 takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your done66 account credentials and for notifying us immediately if you suspect unauthorised access to your account.

13 Changes to This Privacy Policy

done66 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or our international gaming licence requirements. The most current version of this Policy will always be accessible on the done66 platform at done66.org/privacy-policy.

Where changes to this Policy are material — meaning they affect how we process your data in a way that may impact your rights — done66 will notify registered players by email or via an in-platform notification at least 14 days before the changes take effect.

Your continued use of the done66 platform following the effective date of any updated Privacy Policy constitutes your acknowledgment of the revised terms. If you do not accept the changes, you must cease using the platform and may request account closure by contacting [email protected].

14 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or done66's data processing practices, please contact our Privacy Team directly:

• Privacy Enquiries: [email protected]
• General Support: [email protected]
• Response Time: done66 will acknowledge all privacy-related enquiries within 72 hours and aim to provide a full response within 30 calendar days.
• Support Hours: 24 hours a day, 7 days a week

If you are not satisfied with done66's response to your privacy concern, you have the right to lodge a complaint with the data protection supervisory authority in your jurisdiction or with the regulatory authority overseeing done66's international gaming licence. done66 will cooperate fully with any such regulatory investigation.