done11 Privacy Policy — How We Protect Your Data in Pakistan

1. Introduction

done11 takes privacy seriously. This document explains exactly how the platform collects, processes, stores, and protects the personal information of everyone who registers and plays on done11. It also explains what rights you have as a user and how you can exercise them.

done11 is a gaming and sports betting platform operating in the Pakistan market. Because the platform handles financial transactions — deposits and withdrawals in PKR via JazzCash, Easypaisa, Raast, bank transfer, and cards — collecting and securely managing user data is not just a legal requirement but also how we keep your account safe from fraud and unauthorised access.

This policy should be read alongside the done11 Terms and Conditions, which set out the overall rules for using the platform. If there is any conflict between this policy and the Terms and Conditions on a privacy matter, this policy takes precedence.

2. Data We Collect

done11 collects personal data in three main ways: information you provide directly when registering or updating your account, information generated automatically when you use the platform, and information obtained from third parties as part of verification processes.

3. How We Use Your Data

done11 uses the personal data collected for specific, legitimate purposes. We do not use your data for purposes beyond what is necessary to operate the platform and keep it secure. The main uses are:

• Running your account: Managing your login, balance, bets, and transaction history — the core of what done11 does.
• Processing payments: Verifying and completing PKR deposits via JazzCash, Easypaisa, Raast, bank transfer, and cards, and processing withdrawal requests to your verified payment method.
• Identity verification: Confirming your age, name, and ownership of the payment method used — required before high-value withdrawals and as part of standard account security checks.
• Fraud prevention: Monitoring activity patterns to detect and prevent unauthorised account access, bonus abuse, and financial fraud.
• Responsible gaming: Using account activity data to identify patterns that may indicate problem gambling behaviour, so that done11 can flag the account for a welfare check or apply tool-based interventions.
• Customer support: Using your account and communication history to resolve disputes, answer queries, and trace missing transactions.
• Platform improvement: Analysing aggregated, anonymised usage data to understand how players use done11 and improve performance, navigation, and game offerings.
• Communication: Sending you account-related notifications — password changes, security alerts, withdrawal confirmations — and, where you have opted in, promotional messages about done11 offers.

done11 does not use your data to make automated decisions that have a significant legal or financial effect on you without the opportunity for human review and appeal.

4. Payment Data & Financial Security

Financial transactions on done11 are processed through trusted, encrypted payment channels. done11 does not store your full card number, JazzCash PIN, Easypaisa PIN, or online banking credentials on its own servers. Payment details are handled directly by the respective payment processors under their own security standards.

What done11 does store is the information needed to match a payment to your account — the last four digits of a card, the registered mobile wallet number, or the bank account name — so that deposits can be credited correctly and withdrawals can be verified as going to the right person.

• All PKR transactions are logged with timestamps and references for dispute resolution purposes.
• Withdrawal requests are only processed to a payment method registered in the same name as the done11 account. This protects against unauthorised transfers.
• Transaction records are retained for the period required by applicable financial regulations.

5. Data Sharing

done11 does not sell your personal data to third parties for any purpose. The only organisations that receive any of your data are service providers who assist done11 in operating the platform — and they receive only the data required for the specific service they provide.

Categories of third parties with whom data may be shared:

• Payment processors: JazzCash, Easypaisa, Raast, banks, and card networks — to process your deposits and withdrawals in PKR.
• Identity verification providers: Services that check government-issued ID against national databases to confirm your identity and age. This is done securely and the provider does not receive your account activity data.
• Fraud prevention services: Third-party systems that analyse transaction patterns and device fingerprints to detect suspicious activity. This is done with aggregated or pseudonymised data where possible.
• Cloud and infrastructure providers: The servers and services that host done11's platform. These providers process data on done11's behalf under strict data processing agreements.
• Legal and regulatory bodies: done11 may share data with law enforcement or financial regulators where legally required — for example, in response to a court order or as part of an anti-money laundering inquiry.

All third-party service providers who receive your data are required to handle it securely and only for the specific purpose for which it was shared. They are not permitted to use your data for their own marketing or commercial purposes.

6. Security Measures

done11 implements technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, and modification. These include:

• Encryption in transit: All data transmitted between your device and done11's servers is encrypted using TLS (Transport Layer Security). The padlock icon in your browser confirms this connection is secure.
• Encryption at rest: Sensitive data stored on done11's servers — including identity documents and payment references — is encrypted at rest.
• Access controls: Access to personal data within done11's systems is restricted to staff who need it to perform their job. All internal access is logged and audited.
• Two-factor authentication: done11 supports two-factor authentication for account login and offers it as an option to all registered players.
• Fraud monitoring: Automated systems monitor account activity around the clock for signs of unauthorised access or suspicious transactions. Unusual activity triggers security alerts and may result in a temporary account hold pending verification.

No security system is completely infallible. In the event of a data breach that affects your personal information, done11 will notify affected users promptly and take immediate steps to contain and investigate the breach.

7. Cookies & Tracking

done11 uses cookies — small text files stored on your device — and similar technologies to make the platform work correctly and to understand how it is used. Here is how done11 uses cookies:

• Essential cookies: Required for the platform to function. These keep you logged in, maintain your session, and remember your in-app preferences. These cannot be disabled without breaking the platform.
• Analytics cookies: Used to collect anonymised data about how players navigate done11 — which pages are visited, how long sessions last, where users drop off. This data helps done11 improve the user experience. No personally identifiable information is transmitted.
• Security cookies: Used to detect fraud and protect against CSRF attacks and session hijacking.

You can manage and delete cookies through your browser settings. Disabling non-essential cookies will not stop you from using done11 but may affect some performance tracking features. The done11 mobile app uses equivalent technologies within the app environment, managed by your device's app settings.

8. Data Retention

done11 retains your personal data for as long as your account is active and for a defined period after account closure. The specific retention period for each category of data depends on the legal and business reason for which it was collected.

• Account data (name, contact details, date of birth) is retained for the duration of your account and for a minimum of five years after account closure to comply with financial record-keeping requirements.
• Transaction records (deposit and withdrawal history, bet history) are retained for a minimum of five years after each transaction to comply with anti-money laundering regulations.
• Identity verification documents are retained for as long as legally required following submission — typically aligned with financial compliance requirements.
• Support communications are retained for three years after the last interaction, so that done11 can refer back to prior exchanges if a similar issue arises.
• Device and technical logs are retained for up to 12 months for security and fraud investigation purposes, then deleted or anonymised.

When retention periods expire, data is securely deleted or anonymised so that it can no longer be linked to an individual account.

9. Your Rights Over Your Data

You have rights over the personal data that done11 holds about you. Here is what you can request and how:

10. Minors

done11 is strictly for adults aged 18 and over. done11 does not knowingly collect or process personal data belonging to anyone under the age of 18. Age verification checks are applied during registration and before withdrawals to enforce this.

If done11 discovers that an account has been created by or on behalf of a minor, the account will be closed immediately, all balances will be forfeited, and any deposits made will be returned to the payment method used — subject to identity verification. If you believe a minor has registered on done11 using false information, please contact support immediately so the account can be reviewed and closed.

11. Changes to This Policy

done11 may update this Privacy Policy from time to time to reflect changes in how the platform operates, changes in applicable law, or improvements to our data handling practices. When the policy is updated, the revised version will be published on this page with a new "Last Updated" date.

For changes that materially affect how your personal data is handled — such as a new category of third-party sharing or a significant change in retention periods — done11 will notify registered users through their account or by their registered contact details before the change takes effect.

Continuing to use done11 after a policy update is published constitutes acceptance of the updated version. If you disagree with any change, please contact support to discuss closing your account and withdrawing your balance before the change takes effect.

12. Contact & Privacy Enquiries

If you have any questions about this Privacy Policy, want to exercise your data rights, or have a concern about how done11 has handled your personal information, please reach out through the done11 support centre available in your account.

done11's support team handles privacy enquiries and will escalate to the relevant internal team if the matter requires specialist review. Response times for privacy requests are typically within five business days, though complex access or deletion requests may take longer.