Privacy Policy — dua66

1. Introduction

This Privacy Policy (hereinafter "Policy") describes how dua66 (hereinafter "dua66", "the Platform", "we", "us", "our"), accessible at https://dua66.cam/, collects, processes, stores and protects personal data belonging to Users of the Platform. It also explains the rights that Users hold in relation to their personal data.

By accessing or using the dua66 Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must discontinue use of the Platform immediately.

2. Definitions

For the purposes of this Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, postal address, IP address, device identifiers and financial account details.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, organisation, use, disclosure, transmission, restriction, erasure or destruction.
• "Data Controller" means dua66, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means a third party that processes Personal Data on behalf of dua66 under a written data processing agreement.
• "User" means any natural person who accesses, registers on or uses the Platform.
• "KYC" (Know Your Customer) refers to identity and age verification procedures required to verify a User's identity in compliance with anti-money-laundering and related regulatory obligations.
• "Cookies" refers to small text files placed on a User's device by the Platform for the purposes described in Section 7.
• "Sensitive Data" refers to categories of Personal Data warranting enhanced protection, including identity documents, biometric data collected during liveness checks and financial information.

3. Personal Data We Collect

dua66 collects Personal Data in the following categories, depending on how you interact with the Platform:

3.1 Registration & Account Data

• Full legal name;
• Date of birth;
• Email address;
• Mobile phone number;
• Residential address (city, country — e.g., Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan or Peshawar);
• Username and encrypted password.

3.2 Identity Verification (KYC) Data

• Government-issued photo identification (Pakistani CNIC or passport);
• Proof of address documentation;
• Selfie or liveness-check image for identity matching;
• Payment method verification documents (e.g., bank statement or mobile wallet screenshot).

3.3 Transaction & Financial Data

• Deposit and withdrawal transaction records;
• Payment method identifiers (e.g., partial mobile number for Easypaisa or JazzCash, bank account reference for Raast, HBL, UBL, Meezan Bank or Bank Alfalah transactions);
• Transaction timestamps and amounts in PKR or the operative currency;
• Bonus and promotional activity records.

3.4 Technical & Usage Data

• IP address and approximate geolocation;
• Device type, operating system and browser version;
• Session duration, pages visited and click-path data;
• Login timestamps and access logs.

3.5 Communications Data

• Records of support interactions via live chat or email;
• Feedback submissions and dispute correspondence;
• Marketing communication preferences and opt-in/opt-out records.

4. How We Use Your Personal Data

dua66 processes Personal Data for the following purposes:

5. Legal Basis for Processing

dua66 processes Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity — processing required to perform the contract between dua66 and the User, including account operation, payment processing and support;
• Legal obligation — processing required to comply with applicable law, including anti-money-laundering (AML) obligations, KYC requirements and regulatory reporting;
• Legitimate interest — processing necessary for dua66's legitimate business interests, including fraud detection, platform security, responsible gambling monitoring and service improvement, where such interests are not overridden by User rights;
• Consent — processing based on freely given, specific and informed consent, such as for direct marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6. Data Sharing & Disclosure

dua66 does not sell, lease or rent Personal Data to third parties. Personal Data may be shared in the following limited circumstances:

6.1 Service Providers & Data Processors

dua66 may engage third-party Data Processors to support platform operations — including payment processing infrastructure, identity verification technology providers, cloud hosting and customer support tools. All Data Processors are bound by written data processing agreements that restrict their use of Personal Data to the specified service purpose only.

6.2 Regulatory & Legal Disclosure

dua66 may disclose Personal Data to regulatory authorities, licensing bodies, law enforcement agencies or courts where required by applicable law, a valid legal order or a legitimate regulatory request. We will notify affected Users of such disclosures where permitted by law.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring or sale of assets involving dua66, Personal Data held by the Platform may be transferred to the successor entity, subject to equivalent data protection safeguards.

7. Cookies & Tracking Technologies

dua66 uses cookies and similar technologies to operate the Platform, maintain session security, remember user preferences and generate aggregated analytics.

7.1 Types of Cookies Used

• Strictly Necessary Cookies — essential for the Platform to function, including session management and security tokens. These cannot be disabled without impacting core functionality.
• Functional Cookies — remember your preferences such as language settings, layout choices and notification preferences.
• Analytics Cookies — collect aggregated, anonymised usage data to help dua66 understand how the Platform is used and improve the User experience. No individual User is identifiable from this data.

dua66 does not use third-party advertising cookies or sell behavioural data to ad networks. You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies may impair Platform functionality.

8. Data Retention

Personal Data is retained only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. General retention periods are as follows:

• Account and registration data — retained for the duration of the active Account relationship, and for a further period following closure as required by AML and regulatory obligations (typically five to seven years, depending on jurisdiction);
• KYC and identity documents — retained for the minimum period required by applicable anti-money-laundering legislation;
• Transaction records — retained in line with financial record-keeping requirements under applicable law;
• Support communications — retained for up to three years from the date of the last interaction, or longer where required for ongoing dispute resolution;
• Marketing preferences — retained until you withdraw consent or request deletion.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised.

9. Your Rights

Subject to applicable law and any restrictions arising from legal or regulatory obligations, you hold the following rights in respect of your Personal Data:

• Right of Access — to obtain confirmation of whether dua66 holds your Personal Data and to receive a copy of that data;
• Right to Rectification — to request correction of inaccurate or incomplete Personal Data;
• Right to Erasure — to request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to overriding legal retention obligations;
• Right to Restriction — to request that processing of your Personal Data be restricted in certain circumstances (e.g., while the accuracy of data is contested);
• Right to Data Portability — to receive your Personal Data in a structured, machine-readable format and to transmit it to another controller, where technically feasible and legally permitted;
• Right to Object — to object to processing carried out on the basis of legitimate interest, including profiling;
• Right to Withdraw Consent — where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, contact our support team using the details in Section 15. We will respond within 30 days of receiving a valid, verified request. We may request proof of identity before processing rights requests to protect against unauthorised access.

10. Data Security

dua66 implements technical and organisational security measures appropriate to the risk level of each category of Personal Data. These include:

• HTTPS encryption for all data transmitted to and from the Platform;
• Access controls limiting Personal Data access to authorised personnel on a need-to-know basis;
• Regular security assessments and penetration testing of Platform infrastructure;
• Two-factor authentication options for User accounts;
• Encrypted storage for Sensitive Data including KYC documents and financial records;
• Staff training on data protection and security obligations.

Despite these measures, no internet-based transmission or storage system is guaranteed to be 100% secure. In the event of a data breach materially affecting your rights, dua66 will notify you and relevant supervisory authorities in accordance with applicable legal requirements.

11. Minors & Age Restriction

The dua66 Platform is strictly intended for adults aged 18 or older, or the higher minimum age required by the applicable licensing jurisdiction. dua66 does not knowingly collect or process Personal Data belonging to individuals below the applicable minimum age.

If we become aware that Personal Data has been collected from a minor, we will take immediate steps to delete that data and close the associated account. If you believe that a minor has provided Personal Data to dua66, please contact us immediately using the details in Section 15.

12. International Data Transfers

dua66 operates internationally and may transfer Personal Data to countries outside the User's country of residence, including for the purposes of cloud hosting, KYC processing and payment infrastructure. Where Personal Data is transferred to a country that does not provide an equivalent level of data protection, dua66 ensures appropriate safeguards are in place, which may include standard contractual clauses, binding corporate rules or other lawful transfer mechanisms.

13. Third-Party Services & External Links

The Platform may reference third-party services, including payment providers, for informational context. dua66 is not responsible for the privacy practices of any third-party services or websites referenced on the Platform. Users should review the privacy policies of any third-party provider they interact with directly — including Easypaisa, JazzCash, Raast and any banking institution — before sharing personal data with them.

14. Policy Amendments

dua66 reserves the right to modify this Privacy Policy at any time to reflect changes in applicable law, platform functionality or data processing practices. The revised Policy will be published on this page with an updated "Last Reviewed" date. Where changes are material, dua66 will make reasonable efforts to notify registered Users through the Platform or by email prior to the changes taking effect.

Continued use of the Platform after a revised Policy is published constitutes acceptance of the updated terms. If you do not agree to the updated Policy, you must discontinue use of the Platform and contact support to request account closure and data deletion.

15. Contact Us

For all enquiries relating to this Privacy Policy, to exercise your data rights, or to report a data protection concern, please contact the dua66 team using the following details:

• Email: [email protected]
• Live Chat: Available 24/7 via the on-site chat feature (operator provided)
• Response Time: Within 30 days for formal data rights requests; within 24 hours for general support queries

When submitting a data rights request, please provide your registered email address and a brief description of your request. We may require proof of identity before processing your request to protect against unauthorised access.