Privacy Policy

This Privacy Policy ("Policy") describes how done66 ("we", "us", "our", "the Platform") collects, uses, stores, discloses and protects personal data obtained from users ("you", "your") who access or use the done66 website at https://done66.cam.

Done66 is an English-language online sports betting and live casino information hub designed for Pakistani users. While done66 functions primarily as an information and content platform — and does not itself accept bets, deposits or wagers directly — users may interact with operator services referenced through the Platform, and data may be processed in connection with account registration, identity verification and support communications.

This Policy applies to all personal data collected through the Platform, including data gathered via the website, any associated features, support channels and correspondence. It should be read alongside our Terms & Conditions. By using the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

Done66 does not operate under Pakistani data-protection law and makes no claim of regulation by the Pakistan Telecommunication Authority (PTA) or the State Bank of Pakistan. This Policy reflects international data-privacy best practices. Users in Pakistan should be aware that local laws, including the Prevention of Electronic Crimes Act 2016 (PECA), may also apply to the processing of their personal data.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

Done66 collects personal data across the following categories, depending on how you interact with the Platform:

3.1 Identity & Registration Data

• Full name and date of birth (where account registration is applicable).
• Username and password (stored in encrypted form — never in plain text).
• Email address and, where provided, a contact phone number.
• City or region of residence within Pakistan (e.g., Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan or Peshawar) where disclosed during registration or support contact.

3.2 Identity Verification (KYC) Data

• CNIC (Computerised National Identity Card) number and a scan or photograph of the document.
• Passport details, where provided as an alternative identity document.
• Proof of address documentation (such as a utility bill or bank statement) where required.
• Selfie photographs or liveness-check data where required by the operator's verification process.

3.3 Financial & Payment Reference Data

• Partial payment account details (e.g., masked bank account or wallet identifiers) used for withdrawal verification purposes.
• Records of deposit and withdrawal transactions as required for AML compliance. Familiar Pakistani payment references — including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — may be referenced in transaction records as familiar local options. None of these institutions are affiliated with or endorse done66.

3.4 Technical & Usage Data

• IP address and approximate geolocation data derived from it.
• Browser type, version and language preference.
• Device type, operating system and screen resolution.
• Pages visited, time spent on each page, referring URLs and exit pages.
• Session duration and click-path data collected through analytics tools.

3.5 Communications Data

• Content of support enquiries, feedback submissions or other written communications sent to done66 via email or the Platform.
• Records of support ticket exchanges and their resolution.

Done66 collects personal data through the following means:

• Directly from you — when you register an account, complete identity verification, submit a support enquiry, opt in to a promotion or otherwise interact with the Platform.
• Automatically — through cookies, web beacons, server logs and similar tracking technologies that operate when you browse the Platform, as described in Section 9 of this Policy.
• From third-party operators — where done66 acts as an information gateway to operator-managed services, data may be shared between done66 and the relevant operator in accordance with their separate privacy policies.
• From payment processors — in connection with deposit and withdrawal transactions, limited transactional data may be received from payment intermediaries to confirm successful processing.

Done66 processes the personal data it collects for the following purposes:

Done66 processes personal data only for the purposes described above and does not use personal data for unrelated commercial activities without your explicit consent.

Where international data protection frameworks apply, done66 relies on one or more of the following legal bases for processing personal data:

• Contractual necessity: Processing required to perform the contract between you and done66 — including account registration, transaction processing and support services.
• Legitimate interests: Processing that serves done66's legitimate business interests — such as fraud prevention, platform security, analytics and responsible gambling monitoring — where those interests are not overridden by your privacy rights.
• Legal obligation: Processing required to comply with applicable legal obligations, including anti-money laundering (AML) regulations, KYC mandates and law enforcement requests.
• Consent: Where you have freely given, informed and specific consent for a particular processing activity — such as receiving marketing communications. You may withdraw consent at any time by contacting support.

Done66 does not sell your personal data to third parties. We may share your data in the following limited circumstances:

7.1 Operator Partners

Where done66 facilitates access to operator-managed services, relevant personal data (such as account registration data and KYC documents) may be transmitted to the relevant licensed operator to enable account creation, verification and transaction processing. Each operator operates under its own privacy policy and is an independent data controller in respect of data processed by them.

7.2 Service Providers (Data Processors)

Done66 engages third-party service providers to assist with platform operations, including web hosting, cloud infrastructure, analytics, email delivery and fraud prevention tools. These providers process data only on done66's instructions and are contractually bound to maintain data confidentiality.

7.3 Legal & Regulatory Authorities

Done66 may disclose personal data to law enforcement agencies, regulatory bodies or courts where required by applicable law, a court order or a legally enforceable government request. We will endeavour to notify you of such disclosures where legally permitted to do so.

7.4 Business Transfers

In the event of a merger, acquisition, sale of assets or restructuring of done66, personal data held by done66 may be transferred to the successor entity as part of the transaction. Users will be notified of any such transfer that materially affects their data rights.

Done66 retains personal data only for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required by law or legitimate business necessity. The following general retention guidelines apply:

• Account data: Retained for the duration of your account and for a reasonable period following account closure, to allow for dispute resolution and re-activation requests.
• KYC documents: Retained for the period required by applicable AML and identity verification regulations — typically a minimum of five years from account closure, or longer if required by law.
• Transaction records: Retained for a minimum of five years following the transaction date for regulatory and audit purposes.
• Support communications: Retained for a period of up to three years following resolution of the relevant matter, unless a longer period is required for legal proceedings.
• Analytics data: Aggregated or anonymised analytics data may be retained indefinitely as it no longer constitutes personal data once anonymised.

When data is no longer required, it is securely deleted or anonymised in accordance with industry-standard data destruction practices.

Done66 uses cookies and similar tracking technologies to operate the Platform, improve the user experience and analyse usage patterns. The following categories of cookies may be active on the Platform:

9.1 Strictly Necessary Cookies

Essential for the Platform to function. These include session management cookies that keep you logged in during a visit and security tokens that protect against cross-site request forgery (CSRF). These cookies cannot be disabled without disrupting Platform functionality.

9.2 Performance & Analytics Cookies

Used to collect aggregated, anonymised data about how users navigate the Platform — such as which pages are visited most frequently, average session duration and error rates. This data helps done66 improve content quality and platform performance for Pakistani users.

9.3 Functional Cookies

Enable the Platform to remember your preferences — such as language settings and display options — to provide a more personalised experience.

9.4 Managing Cookies

You may control or disable cookies through your browser settings. Please note that disabling strictly necessary cookies may impair your ability to use certain features of the Platform. Most modern browsers allow you to review and delete stored cookies at any time. Refer to your browser's help documentation for specific instructions.

Subject to applicable law and the limitations described below, you have the following rights in relation to your personal data held by done66:

• Right of Access: You may request a copy of the personal data we hold about you. We will respond to verified access requests within a reasonable timeframe, generally within 30 days.
• Right to Rectification: If your personal data is inaccurate or incomplete, you may request that it be corrected or updated. You can update basic account information directly through your account settings where available.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (where consent was the legal basis). This right is subject to legal retention obligations, including AML and KYC record-keeping requirements, which may override erasure requests.
• Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances — for example, while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request a copy of your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including profiling. Done66 will assess whether compelling legitimate grounds override your objection.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact done66 support using the details in Section 16. We may require you to verify your identity before processing your request.

Done66 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration and destruction. These measures include:

• HTTPS / TLS Encryption: All pages on the done66 Platform are served over HTTPS with TLS encryption, protecting data in transit between your browser and our servers.
• Password Hashing: User passwords are never stored in plain text. They are cryptographically hashed using industry-standard algorithms before storage.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Staff with access to sensitive data are subject to confidentiality obligations.
• Secure KYC Handling: Identity verification documents must be submitted only through the operator's secure HTTPS verification portal. Done66 strongly discourages sending CNIC, passport or financial documents via email or unsecured messaging applications.
• Ongoing Security Monitoring: Done66 monitors the Platform for unusual access patterns, security vulnerabilities and potential data breach indicators.

No security system is completely impenetrable. In the event of a data breach that poses a risk to your rights and freedoms, done66 will notify affected users and relevant authorities within the timeframes required by applicable law.

The done66 Platform is strictly intended for adults aged 18 and over, or the higher minimum age required by the relevant operator or applicable licence jurisdiction. Done66 does not knowingly collect personal data from individuals under the applicable minimum age.

If done66 becomes aware that personal data has been collected from a minor, such data will be deleted promptly from our systems. If you believe that a minor has submitted personal data to done66, please contact us immediately using the details in Section 16 so that we can investigate and take appropriate action.

The done66 Platform may reference or provide contextual information about third-party operator platforms, payment services or sports data providers. Any such references do not constitute endorsement, affiliation or a recommendation to use those services.

Done66 is not responsible for the privacy practices, content or security of any third-party platforms. Once you navigate away from done66 to an external platform — including any operator site — you are subject to that platform's own privacy policy. Done66 strongly encourages you to read the privacy policy of any third-party service before sharing personal data with them.

Done66 operates internationally and may transfer personal data to, or store data on servers located in, countries outside Pakistan. These countries may have data protection laws that differ from those applicable in Pakistan.

Where personal data is transferred internationally, done66 takes steps to ensure that appropriate safeguards are in place — such as standard contractual clauses, data processing agreements or other mechanisms recognised under applicable data protection frameworks — to protect the data to a standard equivalent to that applied within the Platform.

By using the Platform, you acknowledge that your personal data may be processed in countries outside your own. If you have concerns about international data transfers in relation to your personal data, please contact us using the details in Section 16.

Done66 reserves the right to update or amend this Privacy Policy at any time. Where material changes are made to how we process personal data, we will endeavour to notify registered users via reasonable means, which may include updating the "Last Updated" date shown at the top of this page or posting a notice on the Platform.

We recommend that you review this Policy periodically to remain informed of how done66 handles your personal data. Your continued use of the Platform following publication of an updated Policy constitutes acceptance of those changes.

If any provision of this Policy is found to be invalid or unenforceable, the remaining provisions will continue in full force and effect.

If you have questions, concerns or requests relating to this Privacy Policy or your personal data, please contact the done66 support team. The email address below is displayed as plain text and is not a clickable link.

For further information about your rights and responsible gambling resources, please visit our Responsible Gambling page or review our Terms & Conditions.