dua66 Privacy Policy — How We Protect Your Personal Data

1. About This Policy

This Privacy Policy applies to all personal data collected by dua66 through the dua66.bio website, any associated mobile applications, customer support channels, and any other service operated under the dua66 brand. It covers data collected from registered Players as well as from visitors who browse the Platform without registering an account.

This Policy should be read alongside the dua66 Terms & Conditions and Responsible Gaming page, both of which form part of the overall agreement between you and dua66. In the event of any conflict between this Policy and the Terms & Conditions regarding the handling of personal data, this Policy shall prevail.

2. Data Controller

For the purposes of applicable data protection law, dua66 acts as the Data Controller in respect of the personal data it collects from Players and Platform visitors. As Data Controller, dua66 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

If you have any questions about how dua66 processes your personal data, or wish to exercise any of your rights described in this Policy, please contact our data protection team using the contact details set out in Section 15.

3. Data We Collect

3.1 Data You Provide Directly

When you register an account, use our services, or contact our support team, dua66 collects personal data that you provide directly, including:

• Identity Data: Full legal name, date of birth, national identity number or passport number (where provided for KYC purposes), and profile photograph (where submitted).
• Contact Data: Email address, residential address (including city — Karachi, Lahore, Islamabad, Faisalabad, or otherwise), and mobile phone number.
• Financial Data: Payment method details, including JazzCash account numbers, EasyPaisa wallet identifiers, HBL/UBL/Meezan Bank account details, SadaPay identifiers, and USDT TRC20 wallet addresses. Full payment card numbers are not stored by dua66; card processing is handled by licensed third-party payment processors.
• Account Data: Username, password (stored in hashed form only — dua66 cannot view your plain-text password), account preferences, and communication preferences.
• Support Correspondence: Any messages, complaints, feedback, or other communications you send to dua66 support through any channel.

3.2 Data Collected Automatically

When you access or use the dua66 Platform, certain data is collected automatically through technical means:

• Device & Technical Data: IP address, browser type and version, operating system, device type and identifiers, screen resolution, and preferred language settings.
• Usage Data: Pages visited, games played, bets placed, session duration, navigation paths through the Platform, and feature interactions.
• Transaction Data: A complete record of all deposits, withdrawals, bets, game rounds, bonus activations, and account balance changes associated with your account.
• Location Data: Approximate geographic location derived from your IP address. dua66 does not collect precise GPS location data.
• Cookie Data: Data collected through cookies and similar tracking technologies as described in Section 6.

3.3 Data from Third Parties

dua66 may receive personal data about you from third parties in certain circumstances, including:

• Identity verification and KYC service providers who confirm the authenticity of documents you submit.
• Payment processors who confirm the success or failure of deposit and withdrawal transactions.
• Fraud prevention and anti-money laundering screening services.
• Responsible gaming databases, where you have previously registered a self-exclusion with an operator that shares such information with dua66.

4. How We Use Your Data

dua66 uses the personal data it collects for the following specific purposes:

Purpose	Data Used
Account registration and management	Identity, Contact, Account Data
Processing deposits and withdrawals	Financial, Identity, Transaction Data
Verifying player age and identity (KYC)	Identity Data, KYC Documents
Delivering gaming and betting services	Account, Usage, Transaction Data
Fraud detection and prevention	Device, Usage, Financial, Location Data
Anti-money laundering compliance	Identity, Financial, Transaction Data
Customer support and complaints handling	Identity, Contact, Support Correspondence
Responsible gaming monitoring and tools	Account, Usage, Transaction Data
Sending promotional communications (where consented)	Contact, Account, Preference Data
Platform analytics and improvement	Usage, Device, Cookie Data (anonymised)
Legal and regulatory compliance	All categories as required by law

5. Legal Basis for Processing

dua66 processes your personal data only where a valid legal basis exists under applicable data protection law. The primary legal bases relied upon are:

• Contractual Necessity: Processing that is necessary to perform the contract between you and dua66 — including account creation, payment processing, delivering gaming services, and handling support requests.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including anti-money laundering laws, age verification requirements, and financial record-keeping obligations.
• Legitimate Interests: Processing that is necessary for dua66's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and analytics — provided those interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for direct marketing communications. You may withdraw your consent at any time by contacting dua66 support or updating your account preferences.

6. Cookies & Tracking Technologies

6.1 What Are Cookies

Cookies are small text files placed on your device by the dua66 Platform when you visit or interact with it. They serve a variety of functions, from keeping you logged in to helping dua66 understand how Players use the Platform so it can be improved.

6.2 Types of Cookies Used by dua66

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled.
• Functional Cookies: Remember your preferences, such as language settings and game display options, to provide a more personalised experience.
• Analytics Cookies: Help dua66 understand aggregate usage patterns — which pages are visited most, where Players encounter difficulties, and how the Platform can be improved. Data collected by analytics cookies is anonymised before analysis.
• Marketing Cookies: Used to deliver relevant promotional content to Players who have opted in to receive marketing. These cookies track interactions with promotional material to measure effectiveness.

6.3 Managing Cookies

You can control and manage cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the dua66 Platform — in particular, disabling strictly necessary cookies will prevent you from logging in. A cookie preference centre is available on the dua66 Platform where you can manage your non-essential cookie preferences at any time.

7. Third-Party Data Sharing

dua66 does not sell, rent, or trade your personal data to third parties. Data is shared only in the following limited and controlled circumstances:

• Payment Service Providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and our cryptocurrency processing partners receive the minimum data required to process your deposit and withdrawal transactions.
• KYC & Identity Verification Providers: Licensed third-party services that verify the authenticity of identity documents submitted during account verification. These providers are bound by strict contractual data processing agreements.
• Fraud & AML Screening Services: Specialist providers who screen transactions and account activity against fraud and money laundering risk indicators. These services are operated under strict data processing agreements.
• Technology Infrastructure Providers: Cloud hosting, database, and content delivery providers who process data solely on dua66's instructions and may not use it for their own purposes.
• Regulatory and Law Enforcement Authorities: Where dua66 is required by applicable law, court order, or regulatory directive to disclose personal data, it will comply with such requirements. Where legally permitted, dua66 will notify the affected Player before making such a disclosure.

All third-party service providers who process personal data on dua66's behalf are required to enter into data processing agreements that bind them to process data only in accordance with dua66's instructions and applicable data protection law.

8. International Data Transfers

The dua66 Platform serves Players primarily in Pakistan. However, some of our third-party service providers operate data processing infrastructure in other jurisdictions. Where personal data is transferred outside Pakistan, dua66 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable Pakistani data protection legislation.

Such safeguards may include standard contractual clauses, data processing agreements, or reliance on adequacy decisions where applicable. If you would like further information about the specific safeguards applied to international transfers of your personal data, please contact us using the details in Section 15.

9. Data Retention

dua66 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulation. The following general retention principles apply:

• Active Account Data: Retained for the duration of the account relationship and for a period of five (5) years following account closure, to meet anti-money laundering record-keeping obligations.
• Transaction Records: All financial transaction records are retained for a minimum of five (5) years following the date of the transaction, in accordance with financial record-keeping requirements.
• KYC Documents: Identity verification documents are retained for five (5) years from the date of submission or from the date of account closure, whichever is later.
• Support Correspondence: Customer support interactions are retained for three (3) years from the date of the interaction.
• Marketing Data: Marketing preference data and opt-in records are retained for three (3) years from the date of last interaction, or until you withdraw consent, whichever comes first.
• Analytics Data: Anonymised analytics data may be retained indefinitely as it cannot be linked back to any individual.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where deletion is not immediately possible due to technical constraints, the data will be isolated and protected from further processing until deletion is complete.

10. Your Data Rights

Subject to applicable law and certain limited exceptions, you have the following rights in respect of the personal data dua66 holds about you:

• Right of Access: You may request a copy of the personal data dua66 holds about you, along with information about how it is processed.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected or updated. For basic account information, you can make corrections directly via your account settings.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to dua66's legal and regulatory retention obligations.
• Right to Restriction: You may request that dua66 restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to its processing.
• Right to Data Portability: Where processing is based on your consent or contractual necessity, you may request that dua66 provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or carried out for direct marketing purposes. Where you object to direct marketing, dua66 will cease processing for that purpose immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

11. Children's Privacy

The dua66 Platform is strictly intended for adults aged 21 and above. dua66 does not knowingly collect personal data from individuals under the age of 21. Age verification checks are conducted as part of the account registration and KYC process specifically to prevent underage individuals from accessing the Platform.

If dua66 discovers or is notified that personal data has been collected from an individual under the age of 21, that account will be suspended immediately, the associated personal data will be deleted as soon as reasonably practicable, and any funds held in that account will be handled in accordance with applicable regulatory requirements. If you believe a minor may have registered an account on dua66, please notify our support team immediately.

12. Marketing Communications

dua66 may send you promotional emails, SMS messages, or in-platform notifications about bonuses, new games, special events, and platform updates where you have provided your consent to receive such communications. You can withdraw your consent to marketing at any time by:

• Clicking the "Unsubscribe" link at the bottom of any marketing email.
• Updating your communication preferences in your dua66 account settings.
• Contacting dua66 support and requesting removal from marketing communications.

Please note that withdrawing marketing consent does not affect the sending of transactional communications, such as deposit confirmations, withdrawal notifications, account security alerts, and policy update notices. These service communications are sent regardless of marketing preferences as they form part of the contractual relationship between you and dua66.

13. Data Security

dua66 implements and maintains a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the dua66 Platform.
• Encryption of sensitive data at rest, including financial data and identity documents.
• Passwords stored exclusively in salted, hashed form using industry-standard cryptographic algorithms — dua66 staff cannot view your plain-text password at any time.
• Role-based access controls ensuring that only authorised personnel with a legitimate business need can access personal data.
• Regular security assessments, vulnerability scans, and penetration testing of Platform infrastructure.
• Two-factor authentication available for all Player accounts and mandatory for internal administrative access.
• Audit logging of all access to personal data within dua66's systems.

While dua66 takes every reasonable step to protect your personal data, no digital platform can guarantee absolute security. You are responsible for keeping your account login credentials confidential and for notifying dua66 immediately if you suspect any unauthorised access to your account.

14. Changes to This Policy

dua66 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. When material changes are made, dua66 will notify registered Players via the email address associated with their account at least 14 days before the changes take effect, and will update the "Last Updated" date at the top of this document.

Your continued use of the dua66 Platform after the effective date of an updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with the updated Policy, you should cease using the Platform and may request account closure by contacting dua66 support. For non-material changes — such as minor clarifications of existing practices — dua66 may update the Policy without prior notice.

15. Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way dua66 handles your personal data, please contact our support team. All data-related enquiries will be handled by personnel with appropriate data protection training.

Contact email (plain text — not a link): support@dua66.bio

dua66 aims to resolve all data-related queries promptly and professionally. If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction.