done99 Privacy Policy — Your Data, Explained

1Overview

done99 is an online gaming and sports betting platform serving players in Pakistan. To operate the platform, process deposits and withdrawals in PKR, verify player identities, and keep accounts secure, done99 necessarily collects and processes certain personal information.

This Privacy Policy sets out exactly what that information is, how it is collected, the purposes for which it is used, and the limited circumstances in which it may be shared with third parties. By registering an account or using done99, you acknowledge that you have read and understood this policy.

This policy should be read alongside the done99 Terms and Conditions. In any area of conflict between the two documents, the Terms and Conditions take precedence unless otherwise stated here.

2What We Collect

done99 collects personal information through two main routes: information you give us directly, and information generated automatically by your use of the platform.

Information you provide directly:

• Full name, date of birth, and gender provided at registration.
• Email address and mobile phone number used to set up and verify your account.
• CNIC or other identity document details submitted during account verification.
• Proof of payment method details submitted for deposit or withdrawal verification — for example, a screenshot or statement confirming ownership of a JazzCash or Easypaisa wallet, or a bank account.
• Any information included in messages you send to done99 support.

Information collected automatically:

• IP address and approximate geographic location derived from it.
• Device type, operating system, and browser version used to access done99.
• Pages visited, games played, bets placed, and time spent on specific areas of the platform.
• Session timestamps, login history, and logout events.
• Transaction records including deposit amounts, withdrawal amounts, and dates.
• Cookie and tracking data as described in Section 7.

3How We Use Your Data

The personal information done99 collects is used for the following purposes:

• Account creation and management: Your registration details are used to create and maintain your done99 account, verify your identity, and ensure one account per player.
• Transaction processing: Financial data is used to process PKR deposits and withdrawals via JazzCash, Easypaisa, Raast, bank transfer, and card payments accurately and securely.
• Identity verification: CNIC and related documents are used to confirm your identity and age (18+) as required before processing certain transactions or when flagged by our fraud controls.
• Fraud prevention and security: Usage data, IP addresses, device information, and transaction patterns are analysed to detect and prevent fraud, unauthorised access, and money laundering activity.
• Platform improvement: Aggregated, anonymised usage data helps done99 understand how the platform is used so we can improve the experience — faster load times, better game navigation, more relevant sports markets.
• Customer support: Information in support conversations is used to resolve your query accurately and to maintain a record of interactions for quality assurance.
• Legal compliance: Certain data is retained to comply with anti-money laundering (AML) requirements and other applicable legal obligations.
• Communications: We use your contact details to send account-related notifications — transaction confirmations, security alerts, and significant updates to platform terms or policies. Marketing communications are only sent where you have opted in.

4Legal Basis for Processing

done99 processes personal data on the following legal bases:

• Contract performance: Processing your registration details, account data, and transaction information is necessary to provide you with the service you have signed up for.
• Legal obligation: Certain data is processed because done99 is required to do so — for example, identity verification and transaction record-keeping for anti-money laundering compliance.
• Legitimate interests: Fraud prevention, platform security, and improving the service are legitimate interests that justify certain data processing, provided they do not override your rights.
• Consent: Where done99 sends you marketing messages or places non-essential cookies, this is done on the basis of your consent, which you may withdraw at any time.

5Who We Share Your Data With

done99 does not sell personal data to any third party. We share data only in the limited circumstances described below:

• Payment processors: Transaction data is shared with payment service providers including the operators of JazzCash, Easypaisa, Raast, bank networks, and card payment gateways solely to process your transactions.
• Identity verification providers: Where automated identity checks are used, your CNIC details may be processed by a third-party verification service operating under strict confidentiality obligations.
• Game providers: When you play a game hosted by a third-party software provider, that provider's systems process certain gameplay data. Game providers are contractually bound to handle this data securely and only for the purpose of delivering the game.
• Legal authorities: done99 will disclose personal data to law enforcement, regulatory bodies, or courts where required to do so by applicable law or a valid legal order. We will notify you of such disclosures where legally permitted.
• Platform security partners: Anonymised or pseudonymised data may be shared with cybersecurity partners to detect and prevent fraud, bot activity, or account compromise.

All third parties who receive personal data from done99 are required to handle it in accordance with applicable data protection standards and are prohibited from using it for any purpose beyond that for which it was shared.

6Payments & Financial Data

done99 processes all player transactions in Pakistani Rupees (PKR). Financial data is handled with particular care given its sensitivity. Here is how it works in practice:

• done99 does not store full debit or credit card numbers on its own servers. Card transactions are routed through a PCI-DSS certified payment gateway that handles card data in an isolated, secured environment.
• JazzCash and Easypaisa mobile wallet transactions are processed via the official APIs of those providers. done99 receives transaction confirmation references but does not store your JazzCash or Easypaisa PIN or wallet password.
• Raast and bank transfer transactions are processed through standard interbank channels. Bank account numbers provided for withdrawal are stored in encrypted form and used only for the purpose of completing that withdrawal.
• Transaction records — amounts, dates, and references — are retained for a minimum period to meet AML compliance requirements. These records are not used for any commercial purpose beyond compliance and dispute resolution.

7Cookies & Tracking

done99 uses cookies and similar tracking technologies to keep the platform working correctly and to understand how players use it. A cookie is a small text file stored on your device by your browser when you visit done99.

The types of cookies done99 uses are as follows:

done99 does not use third-party advertising cookies or allow ad networks to place tracking cookies on done99.win. Analytics data is used only internally to improve the platform and is not shared with advertisers.

You can manage or delete cookies through your browser settings at any time. Disabling essential or security cookies will affect your ability to use the platform normally.

8How Long We Keep Your Data

done99 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and for as long as required by applicable legal obligations. The general retention periods are:

• Active account data: Retained for the full duration your account remains active on done99.
• Transaction and financial records: Retained for a minimum of five years after the transaction date, in line with standard AML compliance requirements.
• Identity verification documents: Retained for five years after account closure or the last transaction, whichever is later.
• Support correspondence: Retained for three years from the date of the last interaction, to allow for dispute resolution and quality review.
• Analytics data: Anonymised and aggregated analytics data may be retained indefinitely as it does not identify individuals.

When data is no longer needed and no legal obligation requires its retention, done99 securely deletes or anonymises it. Deletion requests from players are handled as described in Section 10.

9Security Measures

done99 takes the security of player data seriously and applies multiple layers of protection:

• Encryption in transit: All data exchanged between your device and done99 servers is encrypted using TLS (HTTPS). You should always check for the padlock icon in your browser address bar when using the platform.
• Encryption at rest: Sensitive data — including identity documents and financial records — is encrypted when stored on done99 servers.
• Access controls: Access to personal data within done99 is restricted to staff who need it to do their job. Access is logged, monitored, and reviewed regularly.
• Session security: Done99 uses session tokens with automatic expiry. Leaving your account idle for an extended period will require you to log in again for security purposes.
• Fraud monitoring: done99 operates automated systems that monitor account activity and transaction patterns for signs of fraud, account compromise, or unusual behaviour.

While done99 applies industry-standard security measures, no internet-connected system can be guaranteed completely secure. You play an important role in keeping your account safe by using a strong, unique password and not sharing your login credentials with anyone.

10Your Rights Over Your Data

You have meaningful rights over the personal data done99 holds about you. These rights are:

• Right of access: You can request a copy of the personal data done99 holds about you. We will provide this within a reasonable timeframe.
• Right to correction: If any data we hold about you is inaccurate or incomplete, you can ask us to correct it. For basic account details, you can update many of these yourself within your account settings.
• Right to deletion: You can request that done99 delete your personal data. We will act on this where there is no overriding legal obligation to retain the data — for example, transaction records that must be kept for AML compliance cannot be deleted early.
• Right to restriction: You can ask done99 to limit how your data is used in certain circumstances — for example, while a correction request is being processed.
• Right to withdraw consent: Where done99 processes your data on the basis of your consent — such as for marketing emails — you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing that took place before you withdrew.

To exercise any of these rights, contact done99 support with your request. We will verify your identity before acting on any data request to ensure we are speaking with the correct account holder. Requests will be handled promptly and in any case within 30 days.

11Minors

done99 is strictly an adults-only platform. We do not knowingly collect or process personal data belonging to anyone under the age of 18. If you are under 18, you must not register an account or use done99.

If done99 discovers or is informed that an account belongs to someone under 18, the account will be closed immediately and any personal data associated with it will be deleted, subject to any legal retention obligations relating to the transactions that occurred.

If you are a parent or guardian and believe that a minor has registered on done99 using your details or their own, please contact our support team immediately so we can investigate and act.

12Changes to This Policy

done99 may update this Privacy Policy from time to time to reflect changes in how the platform operates, changes in applicable law, or improvements in how we communicate privacy matters to players.

When we make changes, the updated policy will be published on this page with a revised "Last Updated" date at the top. For material changes — changes that significantly affect your rights or how your data is used — done99 will make reasonable efforts to notify active players directly by email or in-platform notification.

Your continued use of done99 after any update to this policy constitutes acceptance of the revised terms. We recommend checking this page periodically, particularly if you have been away from the platform for some time.

13Contact Us About Privacy

If you have any questions about this Privacy Policy, want to exercise any of your data rights, or have a concern about how done99 has handled your personal information, please reach out to the support team:

When contacting done99 about a privacy matter, please include your registered username and a clear description of your request or concern. This allows us to locate the correct records and respond accurately. We aim to acknowledge all privacy-related queries within 2 business days.