done77 Privacy Policy

done77 acts as the data controller for all personal data collected through the done77 platform. As data controller, done77 determines the purposes and means by which personal data is processed. Where done77 engages third-party service providers to process data on its behalf — such as payment processors or fraud prevention services — those parties act as data processors under binding data processing agreements that restrict their use of your data strictly to the purpose for which it was shared.

All privacy-related enquiries, data subject access requests, and complaints regarding done77's handling of personal data should be directed to our dedicated privacy contact at [email protected] with the subject line "Privacy Request."

done77 collects personal data across several categories depending on the nature of your interaction with the platform. The table below sets out the specific categories of data collected, with the primary purpose for each category.

done77 collects personal data through the following channels and mechanisms:

• Direct Submission: Data you provide voluntarily during account registration, KYC document upload, deposit or withdrawal requests, live chat sessions, or email communications with done77 support.
• Automated Collection: Technical and usage data collected automatically when you access or interact with the done77 platform, including through cookies, server logs, and session tracking technologies embedded in the platform.
• Payment Processors: Transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, Raast, and other payment partners when you initiate deposits or withdrawals. done77 does not receive your full payment credentials — only confirmation references and masked identifiers.
• Third-Party Verification: In certain circumstances, done77 may use licensed identity verification or fraud screening services to cross-reference data you provide during registration or KYC. Any such third party is bound by a data processing agreement with done77.
• Responsible Gaming Tools: Data generated through your voluntary use of self-exclusion, deposit limit, and cooling-off features within your done77 Account settings is recorded to enforce your chosen restrictions across your account.

done77 processes personal data only where a valid lawful basis exists for doing so. The primary lawful bases applicable to done77's data processing activities are as follows:

• Contractual Necessity: Processing required to open your Account, verify your identity, process deposits and withdrawals, and deliver gaming and betting services under the done77 Terms & Conditions.
• Legal Obligation: Processing required to comply with anti-money laundering (AML) obligations, age verification requirements, and reporting obligations under the international gaming regulatory framework under which done77 operates.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and protection of the integrity of the gaming environment — where such processing does not override your fundamental privacy rights.
• Consent: Processing for optional marketing communications, promotional notifications, and non-essential cookies — where you have provided clear, informed, and freely given consent. You may withdraw consent at any time by updating your Account notification preferences or contacting done77 support.

done77 uses the personal data we collect for the following specific purposes. We do not use your data for any purpose incompatible with those disclosed at the time of collection without your prior consent.

• Account Management: Creating, maintaining, and securing your done77 Account, including password reset communications and two-factor authentication processes.
• Identity & Age Verification: Conducting KYC checks to confirm that you are who you say you are and that you meet the 21+ age requirement before withdrawals are processed.
• Payment Processing: Facilitating PKR deposits via JazzCash, EasyPaisa, and bank transfers, and processing withdrawal requests to your verified payment method.
• Fraud Prevention & Platform Security: Monitoring account activity for signs of unauthorised access, duplicate accounts, collusion, bonus abuse, money laundering, or other prohibited conduct as defined in the done77 Terms & Conditions.
• Responsible Gaming: Monitoring your gaming activity patterns to identify signs of problem gambling behaviour and to enforce any self-exclusion, deposit limit, or cooling-off restrictions you have activated on your Account.
• Customer Support: Resolving your account queries, processing complaints, and maintaining communication records for dispute resolution and quality assurance purposes.
• Regulatory Compliance: Fulfilling reporting obligations to applicable gaming regulatory bodies and financial intelligence authorities where required by law.
• Platform Improvement: Analysing aggregate, anonymised usage data to improve the done77 platform experience — including game loading performance, interface usability, and payment flow optimisation.
• Marketing Communications: Sending you personalised promotional offers, bonus notifications, and PSL betting updates — but only where you have given explicit opt-in consent.

done77 does not sell, rent, or otherwise commercially transfer your personal data to any third party. We share data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.

• Payment Partners: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, Raast, 1LINK, and our USDT TRC20 processing partner receive only the transaction data necessary to process your deposit or withdrawal. These partners are independently regulated financial institutions operating under their own regulatory frameworks.
• KYC & Identity Verification Providers: Licensed third-party KYC service providers may process your CNIC data and identity documents for verification purposes under a binding data processing agreement with done77.
• Fraud Prevention Services: done77 may share technical and usage data with specialist fraud screening services to detect and prevent prohibited activities. Such sharing is conducted under strict data processing agreements that prohibit any secondary use of your data.
• Gaming Regulatory Authorities: done77 is obligated to share specified member data with the international gaming regulatory body under whose licence done77 operates, and with relevant financial intelligence units, where legally required.
• Self-Exclusion Registries: Where you activate a self-exclusion through done77, relevant identification data may be shared with recognised inter-operator self-exclusion schemes to enforce your exclusion across participating platforms.
• Legal & Law Enforcement: done77 will disclose personal data where required to do so by a valid court order, regulatory direction, or law enforcement request under applicable law.

done77 uses cookies and similar technologies — including local storage and session tokens — to operate the platform correctly, maintain your logged-in session, remember your preferences, and analyse how the platform is used in aggregate. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication tokens, CSRF protection cookies, and load-balancing cookies. These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your preferences such as language settings, preferred deposit method, and lobby display options. Disabling these cookies will not prevent you from using the platform but will remove personalisation.
• Analytics Cookies: Collect anonymised, aggregate data about how members navigate and interact with the done77 platform — for example, which game categories are most accessed and where users encounter friction in the deposit flow. This data is never associated with your individual identity.

done77 does not deploy third-party advertising cookies, social media tracking pixels, or any cross-site tracking technologies. You can manage or disable cookies through your browser's settings at any time. Note that disabling strictly necessary cookies will prevent you from logging in to your done77 Account.

done77 retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, subject to any mandatory minimum retention periods imposed by applicable gaming regulations and anti-money laundering law. The following standard retention periods apply:

• Account & Identity Data: Retained for the duration of your active Account plus a minimum of 5 years following account closure, in accordance with applicable AML regulatory requirements.
• Transaction Records: All deposit and withdrawal records retained for a minimum of 5 years from the date of the transaction, as required for financial regulatory compliance.
• KYC Documents: CNIC copies and payment method verification documents retained for the duration of the Account and for 5 years post-closure.
• Communications Data: Live chat transcripts and email records retained for 2 years from the date of the communication for dispute resolution and quality assurance purposes.
• Technical & Usage Data: Session logs and IP records retained for 12 months for fraud prevention and security purposes, after which they are anonymised or purged.
• Marketing Consent Records: Records of your opt-in consent for marketing communications are retained for the duration of your Account and for 2 years after opt-out, as evidence of the consent basis.

Upon expiry of the applicable retention period, done77 will securely delete or irreversibly anonymise your personal data so that it can no longer be associated with you as an individual.

done77 takes the security of your personal data seriously and has implemented a range of technical and organisational safeguards commensurate with the sensitivity of the data we process and the risks associated with operating an online gaming platform.

• Encryption in Transit: All data transmitted between your device and the done77 platform is encrypted using TLS 1.3. Unencrypted HTTP connections are automatically redirected to HTTPS.
• Encryption at Rest: Sensitive personal data — including CNIC numbers, payment references, and KYC documents — is stored using AES-256 encryption on done77's infrastructure.
• Access Controls: Access to personal data within done77 is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and subject to periodic access review.
• Payment Tokenisation: done77 does not store raw payment credentials. JazzCash and EasyPaisa account references are stored as tokenised identifiers provided by the respective payment processor.
• Two-Factor Authentication: done77 offers two-factor authentication (2FA) for member accounts and strongly recommends its use. Internal staff access to member data systems requires 2FA as a mandatory control.
• Penetration Testing: done77's platform undergoes periodic security assessments and penetration testing by independent security specialists to identify and remediate vulnerabilities before they can be exploited.

As a done77 member, you hold the following rights in relation to the personal data we process about you. To exercise any of these rights, contact done77 support at [email protected] with the subject line "Privacy Request" and your registered email address. We will respond to all data rights requests within 30 calendar days.

done77 operates a strict 21+ only policy. The done77 platform is not directed at, and does not knowingly collect personal data from, any individual under the age of 21. If you are under 21 years of age, you are not permitted to register an Account or use the done77 platform in any capacity.

During the registration process, done77 collects date of birth and requires KYC verification via CNIC to confirm age eligibility. Where done77 has reasonable grounds to suspect that a member may be under the age of 21, the Account will be suspended pending verification, and any funds held in the Account will be frozen until the matter is resolved.

If done77 discovers that personal data has been collected from an individual under 21 years of age without appropriate parental or guardian consent, we will immediately delete that data and close the associated Account. If you believe that a minor has registered on the done77 platform, please report this to [email protected] immediately.

done77 reserves the right to update or amend this Privacy Policy at any time. When material changes are made, done77 will notify active members via the email address registered to their Account and will update the "Last Updated" date displayed at the top of this page. The revised Policy will take effect 14 days after the notification date, giving you time to review the changes before they apply to your Account.

Continued use of the done77 platform after the effective date of a revised Privacy Policy constitutes acceptance of the updated terms. If you do not agree with any changes made to this Policy, you should cease using the done77 platform and request account closure by contacting done77 support prior to the effective date of the revision.

Minor changes — such as correcting typographical errors, clarifying existing language, or updating contact details — may be made without advance notice. Such changes will not materially affect how done77 processes your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or to done77's handling of your personal data, please contact our privacy team using the details below. We aim to acknowledge all privacy enquiries within 24 hours and to provide a substantive response within 30 calendar days.

• Privacy Enquiries & Data Subject Requests: [email protected] — Subject line: "Privacy Request"
• General Support: [email protected]
• Platform: done77.vip

When submitting a data subject request, please include your registered email address and a brief description of the right you wish to exercise. done77 may ask you to verify your identity before processing any request that involves access to, modification of, or deletion of personal data — this is to ensure that we do not inadvertently disclose or alter the data of another member.