Done 55 Privacy Policy – How We Protect Your Data in Pakistan

1. Introduction

Done 55 takes its responsibilities around personal data seriously. This is not a checkbox exercise — done 55 was built for Pakistani players who trust the platform with real financial transactions, real identity documents, and real personal information. That trust is something done 55 works to deserve every day.

This Privacy Policy sets out, in plain English, what personal data done 55 collects from players, how that data is used, who it may be shared with, how it is protected, and what rights you have over your own information. If anything in this document is unclear, the done 55 support team is available 24/7 and can explain any section — in Urdu if you prefer.

Done 55 operates as a data controller in relation to the personal data of its registered players. This means done 55 makes decisions about how and why your data is processed, and is responsible for ensuring that processing complies with applicable data protection principles.

2. Personal Data We Collect

Done 55 collects only the data genuinely needed to run the platform, verify player identity, process PKR transactions, and comply with applicable legal and compliance requirements. The table below summarises the main categories of personal data collected:

Done 55 does not collect or store your Easypaisa PIN, JazzCash MPIN, online banking password, or full card number. These are entered directly in your mobile wallet app or through our PCI-DSS certified payment processor and never pass through done 55 servers.

3. How Done 55 Collects Your Data

Done 55 collects personal data through the following methods:

• Registration: When you create a done 55 account, you provide your name, mobile number, email address, date of birth, and CNIC number. This information is entered directly by you into the registration form.
• Identity verification (KYC): Before your first withdrawal, done 55 asks you to upload images of your CNIC (front and back) and a current selfie holding your CNIC. This is standard KYC practice for financial platforms. The documents are reviewed by done 55's compliance team and a trusted third-party identity verification service.
• Payment transactions: When you make a deposit or request a withdrawal, done 55 records the transaction details — method, amount, date, and reference number. Your wallet number or bank account number is stored as a verified payout destination.
• Gameplay: The done 55 platform automatically logs your gaming activity — which games you played, stakes, session lengths, game outcomes. This data is used for responsible gaming monitoring, platform improvement, and dispute resolution.
• Technical data: Standard web server logs capture IP address, device information, and session data automatically whenever you access the done 55 platform. This is standard practice for all online platforms and is used for security monitoring and fraud prevention.
• Communications: When you contact done 55 via live chat or email, the content of that communication is stored for service quality, training, and dispute resolution purposes.

4. Why Done 55 Uses Your Data

Every piece of personal data done 55 collects has a specific, legitimate purpose. The main reasons your data is used are:

• To operate your account: Your registration data is required to create and maintain your done 55 account, authenticate your login, and provide a personalised platform experience.
• To process deposits and withdrawals: Done 55 needs your payment method details and verified identity to process PKR deposits and send withdrawals back to your Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT, or card account.
• To verify your identity: CNIC verification is required before first withdrawal to confirm you are who you say you are, that you are 18 or over, and that your account is not being used fraudulently.
• For responsible gaming: Gaming activity data enables done 55 to monitor for patterns that may indicate problem gambling — excessive session lengths, rapidly escalating stakes, chasing-loss behaviour. This allows done 55 to apply responsible gaming interventions where appropriate.
• For fraud prevention and security: Technical data, IP addresses, and device fingerprints help done 55 detect and prevent fraudulent activity, multi-accounting, bot use, and payment fraud.
• To comply with the law: Transaction records, KYC documents, and account history are retained for periods required by applicable anti-money laundering regulations and financial compliance obligations.
• To improve the platform: Aggregated, anonymised gaming activity data helps done 55 understand how players use the platform and where improvements can be made to the experience.

5. Who Done 55 Shares Your Data With

Done 55 does not sell your personal data. It is shared only in the following specific, limited circumstances:

• Payment processors: To process your PKR deposits and withdrawals, done 55 shares relevant transaction data with the payment processor handling your chosen method (Easypaisa network, JazzCash network, 1-Link for IBFT, or card processor). These processors handle your data under their own regulated data protection obligations.
• Identity verification service: Your CNIC documents and selfie are shared with a trusted third-party KYC verification provider to validate your identity. This provider operates under strict confidentiality agreements with done 55.
• Game software providers: Done 55 uses game software from third-party providers (such as Pragmatic Play, Microgaming, NetEnt). These providers may receive technical session data — such as your anonymised player ID and bet amounts — to operate their games. They do not receive your name, CNIC, or payment details.
• Legal and regulatory requirements: Done 55 may be required to disclose personal data to law enforcement, regulatory authorities, or courts in response to a lawful order. Done 55 will not disclose more than is strictly required by such an order.
• Fraud prevention services: Anonymised technical data (IP addresses, device fingerprints) may be checked against shared fraud databases operated by industry security services to prevent known fraudulent actors from accessing the platform.

In every case where done 55 shares data with a third party, done 55 takes reasonable steps to ensure that party operates appropriate data protection standards. Done 55 does not share personal data with marketing companies, data aggregators, or social media platforms.

6. Payment Data and PKR Transactions

Given that done 55 handles real-money PKR transactions for Pakistani players, payment data security deserves its own dedicated section.

All card payments at done 55 are processed through a PCI-DSS Level 1 certified payment gateway. This means your card number, CVV, and expiry date are captured directly by the payment processor — not by done 55 — and immediately tokenised. The token (a random reference code) is what done 55 stores, not your actual card details. Even in the hypothetical scenario of a done 55 data breach, your card number could not be recovered from done 55's systems.

For Easypaisa, JazzCash, NayaPay, and SadaPay transactions: your mobile wallet credentials (MPIN, PIN) are entered in your mobile wallet app and are never transmitted to done 55. Done 55 initiates the payment request through the wallet's API and receives a confirmation — your authentication credentials never leave your device.

For bank IBFT transfers: you initiate the transfer from your own banking app using the account details shown in the done 55 deposit form. Done 55 does not have access to your internet banking credentials at any point.

Transaction records — amounts, dates, methods, and reference numbers — are retained by done 55 for compliance purposes for the period required by applicable financial regulations. These records may be reviewed in the event of a dispute or audit.

7. Cookies and Tracking Technologies

Done 55 uses cookies and similar browser-based technologies to make the platform work correctly and to improve your experience. Here is what is used and why:

• Essential session cookies: These keep you logged in while you navigate between pages and maintain your session state while playing. Without these, the platform cannot function. They expire when you close your browser or log out.
• Security cookies: Used to detect and prevent fraudulent login attempts, CSRF attacks, and session hijacking. These are essential for platform security.
• Preference cookies: Remember your language preference and any display settings you have chosen on the platform. These are optional but improve convenience.
• Analytics cookies: Done 55 uses aggregated, anonymised analytics to understand how players navigate the platform — which pages are visited, how long sessions last, which features are used. This data does not identify individual players and is used only to improve the platform.

Done 55 does not use third-party advertising cookies that track your behaviour across other websites to build advertising profiles. The cookies used at done 55 are strictly limited to the operational and analytics purposes described above.

You can manage cookies through your browser settings. Note that disabling essential session cookies will prevent you from logging in or playing at done 55, as these are required for the platform to function.

8. How Long Done 55 Keeps Your Data

Done 55 does not keep personal data for longer than necessary. Retention periods are determined by the purpose for which the data was collected and by applicable legal obligations:

• Active account data: Kept for as long as your account remains active. If you close your account, done 55 will delete or anonymise most personal data within 90 days of account closure, subject to the exceptions below.
• KYC and identity documents: CNIC copies and verification records are retained for a minimum of 5 years after account closure, as required by anti-money laundering regulations applicable to financial platforms.
• Transaction records: Deposit and withdrawal records, including amounts, dates, and reference numbers, are retained for a minimum of 5 years for financial compliance purposes.
• Support communications: Live chat transcripts and email correspondence are retained for 2 years after the date of the communication, or longer if the communication is relevant to an ongoing dispute or investigation.
• Gaming activity logs: Session and gameplay logs are retained for 2 years after the relevant session, primarily for responsible gaming monitoring and dispute resolution purposes.
• Accounts closed for breach: Where an account was closed due to fraud, multi-accounting, or other breach of done 55's Terms and Conditions, relevant records may be retained indefinitely for security and fraud prevention purposes.

9. Your Privacy Rights

As a done 55 player, you have the following rights over your personal data. To exercise any of these rights, contact done 55 support via live chat or email at support@done55.run. Done 55 will respond to verifiable requests within 30 days.

10. Children's Privacy and the 18+ Rule

Done 55 is strictly for adults aged 18 and above. The platform does not knowingly collect personal data from individuals under the age of 18, and the CNIC verification process is specifically designed to confirm that all withdrawing players have reached the age of majority.

If done 55 discovers that an account has been registered by or on behalf of a person under 18, that account will be immediately closed. Any deposits made to the account will be returned to the originating payment method after a review. Done 55 will not retain any personal data relating to a verified minor beyond what is required for the refund process and a short record for our age verification failure logs.

If you believe a minor has accessed done 55 using your payment method or personal details without your consent, contact done 55 support immediately. Done 55 takes underage access seriously and will handle all such reports as a priority.

11. How Done 55 Secures Your Data

Done 55 implements multiple layers of technical and operational security to protect player data:

• Transport encryption: All data transmitted between your device and done 55 is encrypted using TLS 1.3 with 256-bit AES encryption. This is the same standard used by major banks.
• Data at rest: Personal data stored on done 55 servers is encrypted at rest. Database access requires authentication and is limited to authorised personnel with a documented business need.
• Access controls: Done 55 follows a least-privilege model — employees can only access the personal data required for their specific role. Support agents can see account and transaction data; they cannot access raw CNIC images without additional authorisation.
• Intrusion detection: Done 55's infrastructure is monitored around the clock for unusual access patterns, login anomalies, and signs of attack. Automated systems flag suspicious activity for immediate review.
• Third-party audits: Done 55's payment processing infrastructure is subject to PCI-DSS compliance auditing. Platform security is reviewed periodically by independent security assessors.
• Incident response: In the event of a security incident, done 55 has an incident response procedure that includes isolating affected systems, notifying affected users, and reporting to relevant authorities as required.

While done 55 takes every reasonable technical precaution, no online platform can guarantee absolute security against all possible attacks. Players can reduce their own risk by using a strong, unique password for their done 55 account and keeping their mobile device secure.

12. Changes to This Privacy Policy

Done 55 may update this Privacy Policy from time to time — for example, if new payment methods are added, if legal obligations change, or if the platform introduces new features that involve new types of data processing.

When changes are material — meaning they affect how your data is used in a significant way — done 55 will notify you by email to your registered address and/or by a prominent notification within the platform before the changes take effect. Your continued use of done 55 after the effective date of a policy update constitutes your acceptance of the updated terms.

The "Last updated" date at the top of this page always reflects when the policy was most recently revised. You can check back here at any time to see the current version of the done 55 Privacy Policy.