TD77 Privacy Policy — How We Protect Your Data in Pakistan

When you interact with TD77 — whether you are registering an account, making a deposit, playing a game, or contacting customer support — certain information is collected. TD77 only collects information that is necessary to operate the platform, process transactions, and meet legal obligations. Here is a breakdown of the main categories:

Account Registration Data

When you create a TD77 account, you provide your full name, date of birth, mobile number, and email address. This information is used to create and manage your account, verify your identity, and communicate important account updates. Date of birth is collected specifically to verify that you are 18 or older — TD77 does not accept registrations from minors under any circumstances.

Identity Verification (KYC) Data

Pakistani regulations and international anti-money laundering standards require TD77 to verify the identity of players at certain stages of their account activity. For this purpose, TD77 may request a copy of your CNIC (Computerised National Identity Card), passport, or driving licence, along with proof of your residential address in the form of a recent utility bill or bank statement. These documents are stored securely and used exclusively for identity verification purposes.

Technical and Device Data

When you access TD77, technical data is automatically collected. This includes your IP address, browser type and version, operating system, device model, screen resolution, and session timestamps. This data is used to maintain platform security, detect unusual access patterns, prevent fraud, and optimise the platform's performance across different devices. TD77 does not use this data to build advertising profiles.

Gameplay and Transaction Data

TD77 records every transaction — deposits, withdrawals, bonuses credited and wagered — and every game round you play. This includes bet amounts, game names, round outcomes, and session durations. This data is required for account management, dispute resolution, responsible gaming monitoring, and compliance with legal record-keeping obligations. TD77 retains this data for a minimum of 24 months.

TD77 collects personal data for specific, legitimate purposes only. The information you provide is never collected speculatively or stored for vague future use. Below are the legal bases and practical reasons behind each type of collection:

TD77 uses your contact information to send transactional messages — deposit confirmations, withdrawal notifications, security alerts, and account verification codes. These messages are sent because they are operationally necessary, not because you have opted into a marketing list. You cannot opt out of transactional messages while your TD77 account is active because they are essential to account security and operation.

If you have consented to promotional communications from TD77 — by ticking the relevant box during registration or subsequently enabling marketing preferences in your account settings — you may receive emails or SMS notifications about new promotions, game launches, and special offers. You can withdraw this consent at any time from your account settings or by contacting support. Withdrawal of marketing consent does not affect your account or your eligibility for promotions that you actively seek out on the Promotions page.

Gameplay data is used for responsible gaming purposes — TD77's automated systems monitor for patterns that may indicate problem gambling behaviour, such as rapidly increasing bet sizes, unusually long sessions, or accelerating deposit frequency. Where such patterns are detected, TD77 may prompt responsible gaming tools or contact the player directly. This monitoring is in the interest of player wellbeing and is a core part of TD77's responsible gaming commitment.

Data security at TD77 is treated as infrastructure — not an optional layer applied after the fact. The platform was built with security controls embedded at every level, from the way data is transmitted to the way it is stored and accessed internally.

Encryption in Transit

All data transmitted between your browser or mobile device and TD77 is encrypted using TLS 1.3 (the current standard for transport layer security), with a 256-bit encryption key. This means that even if network traffic were intercepted, the data would be unreadable without the correct decryption key. Every page on TD77 — not just payment pages — operates over HTTPS.

Encryption at Rest

Personal data stored on TD77 servers is encrypted at rest using AES-256 encryption. Passwords are never stored in plain text — they are hashed using bcrypt with a unique salt per account before storage. TD77 does not have access to your actual password, only the hash. If you forget your password, it must be reset — it cannot be retrieved.

Access Controls

Access to TD77 player data internally is restricted on a strict need-to-know basis. Customer support staff can see your account details and transaction history when actively helping with a query, but cannot see payment card numbers or wallet PINs. Financial data is accessible only to the payment processing team under audit-logged access. All internal access is logged and reviewed regularly.

Infrastructure Security

TD77 servers are hosted in secure, ISO-27001 certified data centres with physical access controls, 24/7 monitoring, redundant power systems, and intrusion detection systems. Regular penetration testing is conducted by independent third-party security firms. Identified vulnerabilities are addressed under a responsible disclosure and remediation programme.

TD77 does not share your personal data freely or broadly. Sharing occurs only where it is operationally necessary to run the platform, legally required, or where you have explicitly consented. The following categories of third parties may receive limited personal data:

Payment Processors

To process your deposits and withdrawals in PKR, TD77 shares transaction data with the relevant payment service providers — Easypaisa, JazzCash, NayaPay, SadaPay, and banking partners for IBFT and card payments. This data includes the transaction amount, your account identifier, and the minimum information required by each provider to route the payment. Payment processors are contractually bound to use this data only for payment processing and to maintain appropriate security standards.

Game Software Providers

TD77 hosts games developed by independent software providers. When you play a game, certain technical data — including your account session identifier — is shared with the game provider's servers to enable gameplay and record the round result. Game providers do not receive your full name, contact details, or payment information. They receive only what is needed to run the game and return the result to your TD77 account.

Regulatory and Legal Authorities

TD77 may be required by law or a valid legal order to disclose personal data to regulatory bodies, law enforcement agencies, tax authorities, or courts. When such requests are received, TD77 complies with applicable law. Where legally permissible, TD77 will attempt to notify you of such a request before disclosing your data.

Fraud Prevention and KYC Services

TD77 may use third-party identity verification and fraud detection services to validate documents submitted during KYC checks and to detect fraudulent account activity. These services receive only the minimum data required for their specific function and are bound by strict data processing agreements.

TD77 uses cookies and similar technologies on the platform. A cookie is a small text file stored on your device by your browser when you visit a website. Cookies allow the site to remember certain information about your visit — such as your login session or display preferences — so that the experience is consistent and functional.

Essential Cookies

These cookies are required for TD77 to function. They maintain your login session so that you do not have to re-authenticate on every page, store your language and display preferences, and enable the shopping cart functionality used during the deposit flow. You cannot opt out of essential cookies while using TD77 — without them, the platform cannot operate correctly.

Analytical Cookies

TD77 uses anonymised analytics data to understand how players navigate the platform — which pages are visited most frequently, where players spend time, and which parts of the platform may have usability issues. This data is aggregated and does not identify individual players. It is used purely to improve the platform experience. You can opt out of analytical cookies from your browser settings or the TD77 cookie preferences panel.

Security Cookies

TD77 uses security-related cookies to detect and prevent fraudulent activity — including CSRF (cross-site request forgery) protection tokens, bot detection markers, and session integrity checks. These are part of the platform's security infrastructure and cannot be disabled without affecting account security.

You can manage cookie preferences through your browser settings. Most modern browsers allow you to view, clear, and block cookies from specific sites. Note that blocking essential cookies will affect your ability to log in and use TD77 normally.

Financial data receives the highest level of protection on TD77. The platform was designed so that sensitive payment credentials never touch TD77 servers directly.

When you make a deposit using Easypaisa or JazzCash, the payment is authorised through your mobile wallet's own secure authentication system — your Easypaisa or JazzCash PIN is entered in their app, not on TD77. TD77 receives only a confirmation token confirming that the payment was authorised and the amount transferred.

Card payments on TD77 are processed through a PCI-DSS Level 1 certified payment gateway. Your 16-digit card number, CVV, and expiry date are entered in an encrypted form served directly by the payment gateway — not TD77. This means TD77's servers never receive or store your raw card data. What TD77 stores is a tokenised reference that identifies your payment method without containing the sensitive card details themselves.

Bank IBFT transfer details — your account number, IBAN, and bank name — are stored only for the purpose of routing your withdrawal and for the compliance record-keeping required under anti-money laundering regulations. This data is accessible only to TD77's payment operations team under audit-logged access controls.

TD77's same-name payment policy — requiring that all deposits and withdrawals use accounts in your name — is partly a financial data protection measure. It ensures that your winnings can only be withdrawn to accounts you personally control, preventing unauthorised withdrawals even if your account credentials are compromised.

As a TD77 player, you have specific rights over your personal data. TD77 is committed to honouring these rights promptly and without unnecessary obstacles. Here is what you are entitled to:

TD77 retains personal data only for as long as it is needed for the purpose it was collected, or as required by applicable law. Below is a summary of our standard retention periods:

• Account data (name, contact details, date of birth): retained for the duration of account activity and for 5 years after account closure, to comply with anti-money laundering record-keeping requirements.
• KYC documents (CNIC copies, proof of address): retained for 5 years after the KYC process was completed or after account closure, whichever is later.
• Transaction records (deposit and withdrawal history): retained for 5 years in accordance with financial compliance obligations.
• Gameplay data (bet history, game round records): retained for 24 months for dispute resolution and responsible gaming monitoring purposes.
• Customer support correspondence: retained for 2 years from the date of the last message in a conversation.
• Device and technical data (IP logs, session data): retained for 12 months for security and fraud detection purposes.
• Marketing consent records: retained for as long as you are opted in, and for 2 years after you opt out (to demonstrate that we have a record of your consent and withdrawal of consent).

When a retention period expires, data is securely deleted or anonymised so that it can no longer be linked to you personally. Anonymised aggregate data (such as overall platform usage statistics) may be retained indefinitely as it does not constitute personal data.

TD77 is strictly for adults aged 18 and above. The platform does not knowingly collect personal data from anyone under 18 years of age. Age verification is required during registration — providing a false date of birth during registration is a violation of TD77's Terms and Conditions and may constitute fraud under applicable law.

If TD77 becomes aware that personal data has been collected from a person under 18 — through a failed age verification check, a report from a guardian, or any other mechanism — the following steps are taken immediately:

• The account is suspended and access is blocked.
• Any bonus funds are voided.
• Any net deposits (deposits minus gameplay losses) are returned to the payment method used.
• All personal data associated with the account is deleted within 30 days, except where there is a legal obligation to retain specific records.

TD77 reviews this Privacy Policy regularly to ensure it accurately reflects current data practices, platform features, and applicable legal requirements. When material changes are made — meaning changes that significantly affect how your data is used or what rights you have — TD77 will notify you in advance through one or more of the following channels:

• A notification banner displayed within your TD77 account.
• An email to your registered address with a summary of what has changed.
• A pop-up notification on your next login prompting you to review the updated policy.

Minor and non-material changes — such as clarifications of existing language, formatting corrections, or the addition of information that does not affect player rights — may be made without prior notification. The effective date at the top of this page will always reflect when the most recent version came into effect.

Continued use of TD77 after the effective date of any policy update constitutes your acceptance of the revised Privacy Policy. If you disagree with any changes, you have the right to close your account and request return of any real-money balance — contact support to initiate this process.

This Privacy Policy was last updated on 1 January 2025 and applies to all TD77 accounts active as of that date, as well as accounts registered thereafter.