Privacy Policy — done5 Platform

1. Introduction

done5 (referred to as "we", "us", or "the platform" throughout this document) takes the privacy of its users seriously. This Privacy Policy explains how personal information is collected, processed, stored, and protected when you use the done5 website at done5.app or the done5 Android application.

This policy applies to all registered account holders on done5 who are based in Pakistan. By creating an account and using the platform, you confirm that you have read and understood this Privacy Policy and that you consent to the collection and use of your personal data as described here.

If you have any questions about this policy that are not addressed below, you can contact done5 support via live chat within the platform or by email at [email protected].

2. Data We Collect

done5 collects personal information at various points during your use of the platform. The categories of data collected are set out below.

Registration data — when you create an account, you provide your full name, date of birth, mobile number, email address, and a password. This information is required to create and identify your account.

Identity verification data — to comply with our internal Know Your Customer (KYC) process, we collect your CNIC number and, in some cases, a copy of your CNIC for identity confirmation. This is a one-time requirement and is used only for verification purposes.

Payment data — when you make a deposit or request a withdrawal, we collect information about the payment method used, including your JazzCash or Easypaisa account number, bank account details, or debit card information. This data is processed securely and is used only for transaction processing.

Gameplay and transaction data — we maintain a record of all bets placed, games played, deposits made, and withdrawals requested on your account. This data is used to operate your account balance accurately and to resolve any disputes about transactions.

Device and access data — when you access done5, we collect technical information including your device type, operating system, browser type, IP address, and session timestamps. This data is used for security monitoring and fraud detection.

Communications data — if you contact done5 support via live chat or email, a record of that communication is kept as part of your account history.

3. How We Use Your Data

The personal information done5 collects is used for the following purposes:

• Creating and managing your done5 account, including your PKR wallet balance and transaction history.
• Processing PKR deposits via JazzCash, Easypaisa, Raast, bank transfer, and debit card, and processing withdrawal requests to verified payment accounts.
• Verifying your identity and age as part of the KYC process required before withdrawal processing.
• Communicating with you about your account — including transaction confirmations, support responses, and promotional communications where you have not opted out.
• Detecting and preventing fraud, multi-accounting, money laundering, and other forms of platform abuse.
• Analysing gameplay and platform usage patterns to improve the platform, identify technical issues, and plan product development.
• Enforcing the done5 Terms and Conditions and this Privacy Policy where a breach is suspected.

done5 does not use your personal data for automated decision-making that produces legal or similarly significant effects on you without human review involvement.

4. Legal Basis for Processing

done5 processes your personal data on the following grounds:

• Contractual necessity — processing your registration data, payment information, and account history is necessary to deliver the service you signed up for. Without this data, we cannot operate your account.
• Legitimate interests — processing device and access data for security monitoring, fraud detection, and platform improvement serves our legitimate interest in maintaining a secure and functional platform.
• Consent — sending promotional communications and non-essential personalisation is done on the basis of your consent. You may withdraw consent for marketing communications at any time via your account settings or by contacting support.
• Compliance — identity verification and transaction record-keeping are conducted to comply with our internal policies and operational standards.

5. Sharing Your Data

done5 shares your personal information only where necessary to deliver the service or protect the platform. Specifically, your data may be shared with:

• Payment processors — JazzCash, Easypaisa, Raast, and banking partners receive the payment information needed to process your transactions. These providers operate under their own privacy policies and security standards.
• Identity verification services — third-party KYC providers may receive your CNIC information to assist with identity verification. These services are selected based on their data security practices.
• Fraud detection services — device fingerprinting and behavioural analytics tools may process your technical access data to identify suspicious patterns. This data is processed under strict confidentiality agreements.
• Game studio partners — game providers integrated into the done5 platform may receive session data necessary to deliver gameplay outcomes and resolve technical disputes. Personal identification data is not shared with game studios.
• Internal teams — customer support, compliance, and technical operations staff at done5 may access your account data where required to perform their role.

6. Data Retention

done5 retains your personal data for as long as your account is active and for a reasonable period after account closure to allow for dispute resolution, fraud investigation, and compliance with our internal record-keeping requirements.

• Account registration data is retained for the lifetime of the account and for a minimum of two years after closure.
• Transaction records (deposits, withdrawals, gameplay history) are retained for a minimum of five years to allow for investigation of any disputed transactions.
• KYC documents (CNIC copies) are retained for the duration of the account and deleted within a reasonable period after permanent account closure.
• Support chat and email records are retained for two years from the date of each communication.
• Technical access logs are retained for 90 days as part of our security monitoring cycle.

When data is no longer required for the purposes for which it was collected and the retention period has expired, it is securely deleted or anonymised.

7. Security Measures

done5 uses a range of technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse:

• All data transmitted between your device and the done5 platform is encrypted using TLS (Transport Layer Security).
• Account passwords are stored using one-way hashing — done5 staff cannot view your password in plain text.
• Sensitive payment data is processed through secure, PCI-compliant payment channels and is not stored on done5 servers in full form.
• Access to personal data within done5 is role-restricted — only staff members who require the data to perform their specific function can access it.
• Unusual account access patterns trigger automated security alerts and may result in a temporary account hold pending verification.

While done5 takes data security seriously and uses industry-standard measures, no platform can guarantee absolute security. In the event of a data breach that affects your account, done5 will notify affected users as soon as practicably possible.

8. Cookies and Tracking

done5 uses cookies — small data files stored in your browser — and similar tracking technologies to operate the platform and improve your experience. The main types of cookies used are:

• Session cookies — keep you logged into your account during your visit. These are deleted when you close your browser.
• Preference cookies — remember your settings such as language preference and display options across sessions.
• Analytics cookies — track how the platform is used (pages visited, time spent, features accessed) in aggregate form to help us improve the platform. Individual behaviour is not shared externally.
• Security cookies — help detect unusual access patterns or suspicious behaviour on your account.

You can manage or disable cookies through your browser settings. Note that disabling session cookies will prevent you from staying logged in, and disabling security cookies may affect our ability to protect your account.

9. Minors

done5 is strictly for users aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18. If we discover that an account has been registered by a minor, that account will be immediately suspended and all associated data will be deleted.

Parents and guardians are responsible for preventing minors in their household from accessing done5. If you believe a minor has registered an account, please contact support immediately so the account can be reviewed and closed.

10. Your Rights Over Your Data

As a done5 account holder, you have the following rights regarding your personal data:

To exercise any of these rights, contact done5 support via live chat within the platform or by email at [email protected]. Please include your registered mobile number so the support team can locate your account.

11. Data Transfers

Some of done5's technical infrastructure, game providers, and security services may operate from outside Pakistan. Where your personal data is processed by such services, done5 ensures that contractual safeguards are in place to maintain an equivalent level of data protection. Personal identification data is not sent to third parties outside of what is strictly necessary for identity verification or payment processing.

12. Policy Updates

done5 may update this Privacy Policy from time to time to reflect changes in the platform, payment systems, or data handling practices. The date of the most recent update is displayed at the top of this page.

When significant changes are made to this policy, account holders will be notified via the platform interface or through the registered mobile number or email address on the account. Continued use of done5 after a policy update constitutes acceptance of the updated terms. If you disagree with a change, you should stop using the platform and contact support to close your account.

13. Contact Us

If you have any questions about this Privacy Policy, how done5 handles your personal data, or you wish to exercise any of your data rights, please contact the support team:

• Live Chat — available 24/7 within the done5 platform. Fastest channel for most queries.
• Email — [email protected] — for data access requests, deletion requests, or detailed privacy questions. Response within 24 hours on business days.

When contacting us about a data rights request, please include your registered mobile number and a brief description of your request so the team can respond accurately and efficiently.