done77 Privacy Policy — How We Protect Your Data

01 Introduction

done77 is committed to protecting the privacy and personal data of every player who registers and plays on the done77 platform. This Privacy Policy sets out, in clear and transparent terms, the personal information done77 collects from Pakistani players, the purposes for which that information is processed, the safeguards in place to protect it, and the rights available to you as a data subject.

By registering an account on done77.app, accessing any part of the done77 platform, or submitting personal information to done77 through any channel, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

done77 takes its obligations under applicable data protection legislation seriously. Our data handling practices are aligned with internationally recognised privacy standards, including principles drawn from the General Data Protection Regulation (GDPR), and are reviewed regularly to ensure ongoing compliance with best-practice privacy frameworks. done77 does not sell your personal data to third parties for commercial marketing purposes — ever.

If you have any questions about this Privacy Policy or how done77 handles your personal data, please contact the done77 Data Protection team at the details provided in Section 14 of this document.

02 Data We Collect

done77 collects personal data in several categories, depending on the nature of your interaction with the platform. The categories of personal data we collect are set out in the table below:

done77 does not collect special categories of sensitive personal data (such as racial or ethnic origin, religious beliefs, or health data) except where directly relevant to a responsible gaming intervention and only with your explicit consent. done77 does not collect data from social media accounts unless you explicitly authorise a social login integration.

03 How We Use Your Data

done77 processes personal data only for defined, legitimate purposes. We do not use your data for any purpose incompatible with the purposes listed below:

• Account Management: To create, maintain, verify, and administer your done77 player account, including identity verification and KYC compliance checks required under anti-money laundering (AML) obligations;
• Service Delivery: To provide you with access to done77's cricket betting markets (including PSL and international fixtures), live casino games, slot titles, Cat Fishing, Ocean Lord, and all other gaming products on the platform;
• Financial Transactions: To process PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other accepted payment methods, and to maintain accurate transaction records;
• Regulatory Compliance: To comply with AML, counter-terrorism financing (CTF), and other applicable legal obligations, including the reporting of suspicious transactions to the relevant authorities where legally required;
• Responsible Gaming: To monitor player behaviour for signs of problem gambling, to administer self-exclusion requests and deposit limits, and to protect vulnerable players in accordance with done77's responsible gaming obligations;
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, unauthorised account access, multi-accounting, and any other prohibited conduct listed in done77's Terms & Conditions;
• Customer Support: To provide English and Urdu language customer support, to resolve disputes, and to respond to enquiries via live chat and email;
• Platform Improvement: To analyse usage patterns and technical data for the purpose of improving done77's platform performance, user interface, and game offerings;
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have provided consent or where done77 has a legitimate interest in doing so — subject to your right to opt out at any time (see Section 12).

04 Legal Basis for Processing

done77 processes your personal data on one or more of the following legal bases, depending on the nature of the processing activity:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and done77, including account registration, game access, and payment processing;
• Legal Obligation: Processing is required to comply with applicable legal and regulatory obligations, including AML, CTF, KYC, and responsible gaming requirements;
• Legitimate Interests: Processing is necessary for done77's legitimate interests, including fraud prevention, platform security, platform improvement, and responsible gaming monitoring, where those interests are not overridden by your data protection rights;
• Consent: Where done77 relies on consent as the legal basis — for example, for marketing communications or for processing certain categories of sensitive data in a responsible gaming context — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

If you wish to understand the specific legal basis applicable to a particular data processing activity carried out by done77, please contact the Data Protection team using the contact details in Section 14.

05 Data Sharing & Third Parties

done77 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. done77 shares personal data with third parties only in the following limited circumstances:

• Payment Processors: done77 shares financial data with payment service providers — including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other banking partners — strictly for the purpose of processing your PKR deposits and withdrawals. These providers are bound by their own privacy obligations and are not permitted to use your data for any other purpose;
• Identity Verification Providers: done77 works with third-party KYC and identity verification services to validate CNIC documents and confirm player eligibility. These providers process identity data under strict contractual data processing agreements;
• Game Content Providers: done77's gaming products — including slot titles, fishing games (Cat Fishing, Ocean Lord), and live casino tables — are powered by third-party game studios. These providers may receive anonymised technical data necessary to deliver game functionality. They do not receive your identity or financial data;
• Regulatory and Law Enforcement Authorities: done77 will disclose personal data to the relevant regulatory authority or law enforcement agency where legally required to do so — for example, in connection with an AML investigation, a court order, or a lawful regulatory direction. done77 will notify you of any such disclosure where legally permitted to do so;
• Professional Advisors: done77's legal, audit, and compliance advisors may have access to personal data where strictly necessary for the performance of their professional services. All such advisors are bound by professional confidentiality obligations.

06 Cookies & Tracking Technologies

done77 uses cookies and similar tracking technologies on done77.app to ensure the platform functions correctly, to enhance your experience, and to analyse aggregate usage patterns for platform improvement purposes. The categories of cookies used by done77 are as follows:

• Strictly Necessary Cookies: These cookies are essential for done77 to function. They enable core features such as account authentication, session management, and security verification. These cookies cannot be disabled without impairing your ability to use the platform;
• Functional Cookies: These cookies remember your preferences — such as language selection, display settings, and game lobby filters — so that done77 delivers a more personalised experience on each visit;
• Analytics Cookies: done77 uses anonymised analytics data to understand how players navigate the platform, which game categories are most popular, and where technical issues arise. This data is processed in aggregate and is not linked to your individual identity;
• Security Cookies: Used for fraud detection, anti-bot verification, and ensuring that each login session originates from an authorised device.

done77 does not use third-party advertising or behavioural targeting cookies. No advertising network has access to your done77 browsing data. You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect the functionality of done77.app.

07 Data Retention

done77 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to the following minimum retention periods required by applicable legal and regulatory obligations:

• Account & Identity Data: Retained for a minimum of 5 years from the date of account closure, in accordance with AML and KYC record-keeping requirements;
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction, to comply with financial crime legislation and tax record obligations;
• Communications Data: Support correspondence and chat transcripts are retained for 2 years from the date of the interaction, for dispute resolution and quality assurance purposes;
• Responsible Gaming Records: Self-exclusion requests and responsible gaming intervention records are retained for the duration of the exclusion period plus 7 years, to prevent the circumvention of exclusion measures;
• Technical & Usage Data: Anonymised technical and usage data may be retained indefinitely in aggregate form for platform analytics purposes, as this data cannot be linked back to any individual player once anonymised.

Upon expiry of the applicable retention period, done77 will securely delete or anonymise your personal data. Where deletion is not immediately technically feasible — for example, where data exists in encrypted backup systems — done77 will isolate that data from active processing until deletion is completed at the next scheduled backup purge cycle.

08 Data Security

done77 implements robust technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:

• 256-Bit SSL Encryption: All data transmitted between your device and done77's servers is encrypted using 256-bit TLS/SSL protocols. This applies to all platform interactions, including account login, game play, and financial transactions;
• Encrypted Data Storage: Personal and financial data held in done77's databases is encrypted at rest using AES-256 encryption. Database access is restricted to authorised personnel on a strict need-to-know basis;
• Multi-Factor Authentication: done77 supports multi-factor authentication (MFA) for player accounts and enforces MFA for all administrative access to systems that hold personal data;
• Access Controls: done77's internal systems operate on a role-based access control model. Customer support staff, compliance personnel, and technical teams each have access only to the data categories necessary for their specific function;
• Penetration Testing: done77's platform undergoes regular third-party security audits and penetration tests to identify and remediate vulnerabilities before they can be exploited;
• Incident Response: In the event of a confirmed data security incident that affects your personal data, done77 will notify affected players and the relevant supervisory authority within the timeframes required under applicable data protection law.

09 Your Rights

As a data subject, you have a number of rights in relation to the personal data done77 holds about you. done77 is committed to facilitating the exercise of these rights promptly and without unnecessary bureaucratic barriers. Your rights are as follows:

• Right of Access: You have the right to request a copy of the personal data done77 holds about you, along with information about how that data is processed. done77 will provide this information within 30 days of a verified request;
• Right to Rectification: If any personal data done77 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You can update most account information directly through your done77 account settings;
• Right to Erasure: You have the right to request that done77 delete your personal data where there is no longer a legitimate purpose or legal obligation requiring its retention. Please note that done77 cannot always comply immediately with erasure requests where data must be retained for AML, KYC, or other regulatory purposes;
• Right to Restriction: You have the right to request that done77 restrict the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data or where you have objected to processing and that objection is being assessed;
• Right to Data Portability: Where done77 processes your data on the basis of consent or contractual necessity using automated means, you have the right to receive your personal data in a structured, machine-readable format and to transmit it to another controller;
• Right to Object: You have the right to object to the processing of your personal data on the basis of done77's legitimate interests, including direct marketing communications. done77 will cease processing for marketing purposes immediately upon receipt of your objection;
• Right to Withdraw Consent: Where done77 processes your data on the basis of consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

To exercise any of these rights, please contact done77's Data Protection team using the contact details in Section 14. done77 will verify your identity before processing any rights request. done77 does not charge a fee for the exercise of data subject rights unless a request is manifestly unfounded or excessive, in which case a reasonable fee may apply.

10 Children & Minors

done77 is strictly an adult platform. done77's services are not directed at, and may not be accessed by, persons under the age of 21. done77 does not knowingly collect personal data from any person under the age of 21.

done77 employs age verification checks at the point of registration and at subsequent stages of the account lifecycle to confirm that all players meet the 21+ age requirement. Where done77 has reasonable grounds to suspect that an account is held by a person under the age of 21, that account will be suspended immediately pending verification, all gameplay activity will be voided, and any funds held in the account will be returned to the verified payment method after investigation.

Parents and guardians in Pakistan are encouraged to use parental controls and filtering software to prevent minors from accessing online gambling platforms. If you believe a minor has accessed done77's services and their personal data has been inadvertently collected, please contact done77 immediately and we will take prompt steps to delete that data.

11 International Data Transfers

done77's primary data processing infrastructure is located in secure data centre facilities that operate under international data protection standards. In certain circumstances — for example, when using third-party KYC verification providers or game content partners — your personal data may be transferred to and processed in a country outside your country of residence.

Where done77 transfers personal data internationally, we take the following steps to ensure that your data receives an adequate level of protection regardless of where it is processed:

• Transfers are made only to countries or processors that provide an adequate level of data protection as recognised under applicable privacy frameworks;
• Where transfers are made to countries without a formal adequacy determination, done77 implements Standard Contractual Clauses (SCCs) or equivalent contractual safeguards to protect your data;
• done77 conducts Transfer Impact Assessments (TIAs) where required to assess the data protection risks associated with a specific international transfer before it takes place.

By using done77's services, you acknowledge that your personal data may be transferred internationally in accordance with the safeguards described in this section. If you have concerns about a specific international transfer of your personal data, please contact done77's Data Protection team.

12 Marketing Communications

done77 may send you marketing communications — including bonus offers, promotional emails, and platform update notifications — where you have consented to receive such communications during registration, or where done77 has a legitimate interest in communicating with you as an existing player about services similar to those you have already used.

done77's marketing communications are delivered by email and, where you have provided consent, by SMS to your registered Pakistani mobile number. done77 does not send unsolicited promotional communications via third-party channels, social media direct messages, or WhatsApp without your explicit prior consent.

You have the right to opt out of marketing communications at any time. You can exercise this right by:

• Clicking the "Unsubscribe" link in any marketing email sent by done77;
• Adjusting your communication preferences directly within your done77 account settings dashboard;
• Contacting done77's support team and requesting removal from all marketing communications.

Opting out of marketing communications will not affect your ability to receive essential transactional communications — such as deposit confirmations, withdrawal notifications, KYC requests, and responsible gaming alerts — which are sent on the basis of contractual necessity and cannot be disabled while your account is active.

13 Amendments to This Policy

done77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable data protection legislation, regulatory guidance, or done77's internal data processing practices. Where changes to this Privacy Policy are material — meaning they affect your rights or the nature of data processing in a significant way — done77 will provide advance notice by email to your registered address and by displaying a prominent notice on done77.app prior to the changes taking effect.

The "Last Updated" date at the top of this page reflects the date on which the most recent revision was made. Your continued use of done77's platform following the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree to the amended terms, you should stop using done77 and request account closure before the effective date.

Previous versions of this Privacy Policy are available upon written request to done77's Data Protection team. done77 maintains an internal policy version register to ensure full traceability of all amendments.

14 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or done77's handling of your personal data, please contact done77's Data Protection team through the following channels:

done77 aims to respond to all data protection enquiries and subject access requests within 30 calendar days. For complex requests, this period may be extended by a further 60 days, in which case done77 will notify you of the extension and the reasons for it within the initial 30-day period.

If you are not satisfied with done77's response to a data protection complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. done77 will cooperate fully with any investigation carried out by a supervisory authority in connection with a complaint about done77's data processing practices.