done999 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is published by done999 ("done999," "we," "us," or "our"), the operator of the online gaming platform accessible at done999.im. This Policy applies to all personal data collected from players, visitors, and prospective registrants who access or use the done999 website, mobile interface, and associated services (collectively, the "Platform").

done999 is committed to handling your personal data responsibly, transparently, and in accordance with internationally recognised data protection principles. We understand that Pakistani players entrust us with sensitive personal and financial information, and we take that responsibility seriously at every level of our operations.

This Policy should be read in conjunction with done999's Terms & Conditions and Responsible Gaming Policy, both of which are available on the Platform and incorporated herein by reference.

2 Data Controller

For the purposes of this Privacy Policy, done999 acts as the data controller in respect of all personal data collected from players and visitors to the Platform. As data controller, done999 determines the purposes and means by which your personal data is processed.

done999 operates under international gaming licence standards and maintains data processing records in accordance with the compliance requirements of the regulatory framework under which it is licensed. All data processing activities conducted by done999 are documented, auditable, and subject to periodic review by the done999 compliance function.

If you have any questions regarding done999's role as data controller or wish to understand the legal basis on which your data is processed, please contact the done999 Data Protection team via the contact details set out in Section 16 of this Policy.

3 Information We Collect

done999 collects personal data in the following categories, depending on how you interact with the Platform:

done999 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health data unless specifically required for responsible gaming assessments and only with your explicit consent.

4 How We Use Your Data

done999 uses the personal data it collects for the following defined purposes:

• Account Management: To create, maintain, verify, and administer your done999 player account, including processing deposits and withdrawals in PKR via JazzCash, EasyPaisa, and other supported payment methods.
• Identity Verification: To conduct KYC checks, verify your age (minimum 21 years), and confirm your identity in compliance with our AML obligations and international gaming licence requirements.
• Service Delivery: To provide access to done999's full suite of gaming products including cricket betting, live casino, slots, sports betting, and wheel games — and to personalise your experience based on your platform activity.
• Transaction Processing: To process, record, and reconcile all financial transactions conducted through your done999 account, and to handle any disputes or discrepancies arising from those transactions.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, bonus abuse, money laundering, unauthorised account access, and any other conduct that may violate done999's Terms & Conditions or applicable law.
• Responsible Gaming: To monitor gaming behaviour for indicators of problem gambling, to apply self-exclusion or deposit limit requests, and to contact players where there is a welfare concern in accordance with our Responsible Gaming Policy.
• Legal & Regulatory Compliance: To meet our obligations under the gaming regulatory framework, AML legislation, and any lawful requests from competent authorities.
• Customer Support: To respond to your queries, resolve complaints, and maintain records of communications for quality assurance and audit purposes.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve the performance, security, and user experience of the done999 platform.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — only where you have opted in to receive such communications and subject to your right to withdraw consent at any time.

5 Legal Basis for Processing

done999 processes your personal data on the following legal grounds, depending on the nature and purpose of the processing activity:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you accepted upon registration — including account management, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with AML regulations, KYC obligations, and any lawful order from a regulatory or law enforcement authority with jurisdiction over done999's operations.
• Legitimate Interests: Processing conducted to protect done999's legitimate business interests, including fraud detection, security monitoring, platform analytics, and responsible gaming oversight — where these interests do not override your fundamental privacy rights.
• Consent: Processing of data for optional purposes such as marketing communications and certain cookies — where done999 has obtained your prior, freely given, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

6 Payment Data & Financial Information

done999 processes financial data in connection with all deposit and withdrawal transactions conducted through your player account. The payment methods supported by done999 — including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, Raast, and USDT — each operate under their own privacy and security frameworks, and transactions are routed through their respective PCI-compliant payment infrastructures.

done999 does not store full mobile wallet credentials, bank account passwords, or card verification values (CVV) on its own servers. Payment details are tokenised or processed directly through the relevant third-party payment gateway, limiting done999's direct exposure to raw financial credentials.

• Transaction records — including amounts, timestamps, payment method identifiers, and reference numbers — are retained by done999 for a minimum of five (5) years in compliance with AML record-keeping requirements.
• done999 may request source-of-funds documentation where deposits exceed defined thresholds or where transaction patterns indicate a potential compliance concern. Such requests are made in accordance with our AML Policy.
• Withdrawals are only processed to a payment method verified as belonging to the registered account holder. Third-party withdrawals are strictly prohibited.

7 Data Sharing & Disclosure

done999 does not sell, rent, or exchange your personal data with third parties for commercial marketing purposes under any circumstances. Personal data may be shared with the following categories of recipients only to the extent strictly necessary for the purposes described in this Policy:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, Raast, and USDT processors — to facilitate deposits and withdrawals in PKR or cryptocurrency.
• Identity Verification Providers: Third-party KYC service providers engaged by done999 to verify the identity and age of registering players in compliance with regulatory requirements.
• Gaming Software Providers: Licensed game studios and sports data providers whose products are integrated into the done999 platform — limited to technical data necessary for game delivery and bet settlement.
• Regulatory & Law Enforcement Authorities: Where done999 is legally required or permitted to disclose personal data to competent regulatory bodies, financial intelligence units, or law enforcement agencies — without prior notice to the player where disclosure is legally restricted.
• Professional Advisers: Legal counsel, auditors, and compliance consultants engaged by done999 on a confidential basis where their services require access to personal data.
• Platform Infrastructure Providers: Cloud hosting, data storage, and cybersecurity service providers who process data on behalf of done999 under binding data processing agreements that impose equivalent data protection obligations.

All third-party service providers with whom done999 shares personal data are required to maintain the confidentiality of that data and to process it only in accordance with done999's documented instructions and applicable data protection standards.

8 International Data Transfers

done999 operates as an internationally licensed gaming platform, and some personal data processing activities may involve the transfer of data to service providers or infrastructure located outside Pakistan. Where such transfers occur, done999 ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that described in this Policy.

Safeguards used by done999 for international data transfers include:

• Contractual clauses in agreements with third-party processors that impose data protection obligations equivalent to those applicable under international gaming regulatory standards;
• Transfers to jurisdictions that maintain recognised data protection frameworks with adequate protections for personal data subjects;
• Technical and organisational measures including encryption in transit and at rest, access controls, and regular security assessments of recipient systems.

If you would like further information about the specific safeguards applied to any particular international transfer of your personal data, please contact the done999 Data Protection team using the details in Section 16.

9 Data Retention

done999 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable regulatory and legal obligations. The following general retention guidelines apply:

• Active Accounts: Personal data associated with an active done999 player account is retained for the duration of the account relationship and for a defined period thereafter, to facilitate re-activation requests and audit requirements.
• Closed Accounts: Following account closure, done999 retains identity, financial transaction, and KYC documentation data for a minimum of five (5) years in compliance with AML record-keeping obligations.
• Marketing Data: Personal data processed solely for marketing communications is deleted within twelve (12) months of the withdrawal of your consent, unless retained for other legitimate purposes.
• Support Communications: Customer support transcripts and correspondence are retained for a minimum of two (2) years from the date of the interaction for quality assurance and dispute resolution purposes.
• Technical & Log Data: Server logs, IP records, and session data are retained for a maximum of thirteen (13) months from the date of collection, unless a longer period is required for an active fraud investigation or legal proceeding.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised aggregated data may be retained indefinitely for statistical and platform improvement purposes.

10 Cookies & Tracking Technologies

done999 uses cookies and similar tracking technologies on the Platform for the purposes described below. A cookie is a small text file placed on your device by the done999 server when you visit the Platform. Cookies do not contain executable code and cannot access other data stored on your device.

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They manage your authenticated session, maintain your login state, and ensure platform security. These cookies cannot be disabled without disrupting your use of done999.
• Performance & Analytics Cookies: These cookies collect anonymised information about how players use the Platform — such as which pages are visited most frequently and whether error messages are encountered. This data is used to improve platform performance and is not linked to individual player identities.
• Functional Cookies: These cookies allow done999 to remember your preferences — such as your preferred language, display settings, and recent game history — to provide a more personalised experience on return visits.
• Marketing Cookies: Where you have provided explicit consent, done999 may use cookies to track your interactions with promotional content and to measure the effectiveness of marketing campaigns. These cookies do not track your activity on external websites.

11 Security Measures

done999 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:

• Transport Encryption: All data transmitted between your device and the done999 Platform is encrypted using 256-bit SSL/TLS protocols.
• Data-at-Rest Encryption: Personal data stored on done999 servers is encrypted at rest using industry-standard symmetric encryption algorithms.
• Access Controls: Access to personal data within done999's systems is restricted on a strict need-to-know basis. done999 staff are granted access permissions commensurate with their specific operational roles, and all access events are logged.
• Two-Factor Authentication: done999 offers optional two-factor authentication (2FA) for player accounts, adding an additional layer of protection against unauthorised access.
• Penetration Testing: done999 conducts regular third-party security assessments and penetration tests to identify and remediate vulnerabilities in the Platform's infrastructure.
• Incident Response: done999 maintains a documented data breach incident response procedure. In the event of a confirmed breach affecting your personal data, done999 will notify affected players and relevant regulatory authorities within the timeframes required by applicable obligations.

While done999 takes all reasonably practicable steps to protect your data, no system of data transmission over the internet or electronic storage can be guaranteed as completely secure. Players are encouraged to use strong, unique passwords and to enable 2FA on their done999 accounts.

12 Your Rights as a Data Subject

As a player on the done999 Platform, you hold the following rights in relation to your personal data. done999 will respond to all valid data rights requests within thirty (30) calendar days of receipt:

• Right of Access: You have the right to request a copy of all personal data done999 holds about you, together with information about how it is being used and shared.
• Right to Rectification: You have the right to request the correction of any inaccurate or incomplete personal data held about you. You may update certain details — such as your email address and mobile number — directly through your done999 account settings.
• Right to Erasure: In certain circumstances, you have the right to request that done999 delete your personal data. This right does not apply where done999 is required to retain your data to comply with a legal obligation, including AML record-keeping requirements.
• Right to Restriction of Processing: You may request that done999 restrict the processing of your personal data pending the resolution of a dispute about its accuracy or the legal basis for processing.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on done999's legitimate interests. done999 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based solely on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact the done999 Data Protection team using the contact details provided in Section 16. done999 may request identity verification before processing your request to protect against unauthorised data access.

13 Children & Minors

The done999 Platform is strictly intended for adults aged 21 years and above. done999 does not knowingly collect, process, or retain personal data from individuals under the age of 21. The 21+ minimum age requirement is enforced through our registration process, KYC verification procedures, and ongoing account monitoring.

If done999 becomes aware that personal data has been collected from an individual who does not meet the minimum age requirement, that account will be immediately suspended, all associated balances will be frozen pending investigation, and the personal data will be deleted in accordance with our data retention procedures, subject to any regulatory reporting obligations.

14 Third-Party Links & Integrations

The done999 Platform may, from time to time, contain references or integrations involving third-party services — such as payment gateways (JazzCash, EasyPaisa) and licensed game software providers. When you interact with these third-party services, you may be subject to their own separate privacy policies and data processing practices, which are outside done999's control.

done999 is not responsible for the privacy practices or content of any third-party services accessed through or in connection with the Platform. done999 recommends that you review the privacy policies of any third-party service you interact with, particularly in connection with payment transactions.

done999 conducts due diligence on all third-party service providers with whom it shares personal data and requires them to maintain appropriate data protection standards as a condition of their engagement. However, done999 cannot guarantee the practices of independent third parties beyond the scope of its contractual obligations.

15 Amendments to This Policy

done999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or done999's data processing practices. The version date displayed at the top of this document indicates when this Policy was most recently updated.

Where material changes are made to this Policy, done999 will notify registered players via the email address associated with their done999 account or by displaying a prominent notice on the Platform at least seven (7) days before the amended Policy takes effect, where operationally practicable.

Your continued use of the done999 Platform following the effective date of any amendment constitutes your acknowledgement of the revised Policy. If you do not agree with the revised Policy, you must cease using the Platform and contact support to close your account before the revised terms come into force.

16 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or done999's handling of your personal data, please contact the done999 Data Protection team through the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line for data rights enquiries
• Live Chat: Available in-platform 24/7 in English and Urdu
• Response Time: done999 acknowledges all privacy-related requests within 48 hours and aims to resolve them within 30 calendar days of receipt

If you are not satisfied with done999's response to your privacy concern, you have the right to escalate your complaint in writing to [email protected] with the subject line "Formal Privacy Complaint." done999 will issue a final written response within 14 calendar days of receiving a formal escalation.