Privacy Policy

Effective Date: 1st July, 2026

Welcome to Pact.pk (the "Platform," "We," "Us," or "Our"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our platform, which connects freelancers and clients through a secure escrow-based payment system operating under Pakistani law.

By creating an account or using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our platform.

1. Information We Collect

We collect several types of information to provide, maintain, and improve our Services.

1.1 Information You Provide to Us

Account & Profile Data: Name, email address, phone number, password (hashed), profile picture, bio, skills, hourly rate, portfolio links, and location details.
KYC & Identity Verification Data: CNIC (Computerized National Identity Card) number, selfie photographs, address proof, and other government-issued identification required for freelancer or client verification, PSEB registration, NTN filing, and SMC incorporation.
Project & Financial Data: Project details, scope of work, budgets, milestone descriptions, bank account details, IBAN, and transaction histories.
Communication Data: Messages, chat logs, files, images, and documents exchanged between freelancers and clients through our platform.

1.2 Information Collected Automatically

Technical Data: IP address, device type, browser type, operating system, and access times.
Usage Data: Pages visited, features used, interactions, and time spent on the platform.
Cookies: We use essential cookies for platform functionality and analytics cookies to improve your experience. You can manage cookie preferences in your browser settings.

1.3 Information from Third Parties

Payment Processing: RapidPay, our payment gateway partner, may share transaction status information with us to facilitate escrow payments and settlements.
Verification Services: We may receive identity verification reports from third-party KYC service providers to confirm your identity and comply with legal requirements.

2. How We Use Your Information

We process your personal data for the following legitimate purposes:

To Provide and Improve Our Services: Facilitate project creation, contract signing, milestone-based escrow payments, dispute resolution, and platform functionality.
To Verify Identity and Prevent Fraud: Conduct KYC checks, prevent scams, detect suspicious activity, and maintain a safe environment for all users.
To Facilitate Payments: Process payments and refunds through RapidPay, manage escrow balances, and calculate tax deductions.
To Communicate: Send notifications about project updates, invoices, contract signing, and dispute resolution. Send promotional communications (you may opt out at any time).
To Ensure Legal Compliance: Comply with Pakistan's tax laws (FBR), anti-money laundering (AML) regulations, the Personal Data Protection Bill, and other applicable laws.
To Enforce Platform Policies: Investigate violations, resolve disputes, and take appropriate action against bad actors.

3. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We may share your data in the following circumstances:

With Other Users: Freelancers and clients can view each other's profile information, project details, and transaction history as necessary to complete a project.
With Payment Processors: RapidPay receives payment-related information (name, email, bank details, transaction amounts) to process payments and manage escrow accounts.
With Service Providers: Hosting providers (e.g., Hostinger), cloud storage services, AI API providers (if used), and email delivery services that help us operate the platform. These providers are contractually obligated to protect your data.
With Legal Authorities: We may disclose information if required by law, court order, or government regulation, or to protect the rights, property, or safety of Pact.pk, our users, or others.
With Your Consent: We may share information with third parties when we have your explicit consent to do so.

Important: We never store your full payment card details. RapidPay handles all sensitive payment information and uses tokenization and encryption to secure your financial data.

4. Data Security

We implement robust security measures to protect your information:

Encryption: All data is encrypted in transit using SSL/TLS (HTTPS). Sensitive data at rest is encrypted using AES-256 encryption.
Access Control: Only authorized personnel have access to user data, and all access is logged and monitored.
Payment Security: RapidPay is PCI-DSS compliant and employs tokenization, meaning your card details are never stored on our servers.
Session Security: WhatsApp automation sessions are encrypted using AES-256 and stored securely.

5. Your Rights

Under Pakistan's Personal Data Protection Bill 2023, you have the following rights regarding your personal data:

Right to Access: You can request a copy of the personal data we hold about you.
Right to Correction: You can update or correct inaccurate or incomplete information.
Right to Deletion: You can request the deletion of your account and personal data (subject to legal retention requirements).
Right to Withdraw Consent: You can withdraw consent for optional data processing activities (e.g., marketing emails) at any time.
Right to Object: You can object to the processing of your data for certain purposes.

To exercise these rights, please contact us at privacy@pact.pk.

6. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy:

Active Accounts: Your data is retained while your account is active.
Deleted Accounts: Upon account deletion, we will delete your personal data, except where we are required to retain it for legal, tax (FBR), accounting, or dispute resolution purposes (typically 5-7 years).
Inactive Sessions: WhatsApp session data is automatically deleted after 30 days of inactivity.
Logs & Transaction Records: Financial and transaction records may be retained for compliance with SBP and FBR regulations.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience:

Essential Cookies: Required for platform functionality, login, and security.
Analytics Cookies: Help us understand how users interact with the platform (via anonymized data).
Preference Cookies: Remember your language, dark mode, and other preferences.

You can control cookies through your browser settings. Disabling essential cookies may affect platform functionality.

8. Cross-Border Data Transfers

We primarily store data on servers located in Pakistan. However, some of our service providers (such as cloud hosting, email, and AI services) may process data outside Pakistan. When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

Data Encryption: All transferred data is encrypted.
Contractual Protections: Our service providers are bound by contracts that require them to protect your data in accordance with applicable laws.

We comply with the Personal Data Protection Bill's requirements regarding cross-border data transfers.

9. Data Protection Officer (DPO)

As required by Pakistan's Personal Data Protection Bill, we have designated a Data Protection Officer (DPO) to oversee our data protection practices.

DPO Contact:
Name: Muzammil Zafar
Email: dpo@pact.pk

10. Third-Party Payment Processing (RapidPay)

Our platform uses RapidPay as our payment gateway partner. When you make or receive payments through Pact.pk, the following applies:

Secure Tokenization: RapidPay uses tokenization, so your card details are never stored on our servers.
PCI-DSS Compliant: RapidPay maintains PCI-DSS compliance, ensuring your payment information is processed securely.
Data Sharing: We share only the minimum necessary payment information (transaction amounts, user name, email, bank details) with RapidPay to process your transactions.
RapidPay's Privacy Policy: RapidPay has its own privacy policy governing how they handle your financial information. We encourage you to review it.

11. Children's Privacy

Our platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we discover that we have inadvertently collected data from a minor, we will take steps to delete it promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will:

Notify Users: We will notify you via email or through an in-platform notification.
Update Effective Date: The "Effective Date" at the top of this policy will be revised.
Review Periodically: We encourage you to review this policy periodically to stay informed about how we are protecting your data.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Email: privacy@pact.pk
Support: support@pact.pk