Privacy Policy

1. Introduction & Commitment

Apki.shop ("we," "us," or "our") respects and protects the privacy of every visitor, customer, and user of our platform. This Privacy Policy explains what personal information we collect, how we use and protect it, and the choices you have regarding your data.

2. Scope of this Policy

This Privacy Policy applies to all information collected through:

• Our website apki.shop and any subdomains
• Our progressive web application (PWA) and mobile experience
• Customer support channels (phone, email, WhatsApp, social media)
• Affiliate program, seller onboarding, and account management portals

This policy does not apply to information collected by third parties (e.g., payment gateways, courier partners) operating their own independent privacy policies.

3. Information We Collect

3.1 Information You Provide to Us

Category	Examples	Required For
Account Data	Full name, email address, phone number, password (hashed)	Account registration, login, personalized experience
Shipping & Billing	Full name, delivery address, city, ZIP/postal code, billing address (if different)	Order fulfillment, courier dispatch, invoicing
Payment Information	Transaction ID, payment method (COD/easyPaisa/card), partial card last-4 digits for reference	Payment processing, order verification, refund issuance
Profile Data	Profile photo (optional), gender, date of birth (optional), communication preferences	Personalized recommendations, birthday offers
Communications	Support tickets, chat history, feedback, survey responses, review content	Customer service, dispute resolution, service improvement
Seller/Affiliate	Business name, NTN/CNIC, bank account details, address, KYC documents	Seller onboarding, payout processing, compliance

3.2 Information Collected Automatically

• Device & Technical Data: IP address, device type, operating system, browser type, screen resolution, language preferences
• Usage Data: Pages visited, search queries, click-stream data, time spent, referring/exit pages, products viewed/carted
• Location Data: Approximate geo-location (city-level) derived from IP address; precise GPS only if you grant permission in the app
• Transaction Data: Order history, items purchased, coupons redeemed, returns/exchanges processed

4. How We Use Your Information

We process your personal information for the following legitimate purposes, supported by applicable legal bases:

1. Order Fulfillment & Services: Process purchases, arrange dispatch with courier partners, track deliveries, manage returns and refunds, send order-related SMS/email notifications.
2. Account Management: Create and maintain your user account, authenticate logins, enable password recovery, customize your experience, and manage wishlists/cart state.
3. Communication: Send transactional alerts (order confirmations, shipping updates, password resets), promotional emails/SMS (only with your explicit consent), customer support responses, and important service announcements.
4. Personalization & Recommendations: Show relevant products, personalized offers, and search results based on your browsing, purchase history, and demographic data.
5. Security & Fraud Prevention: Detect and prevent fraud, unauthorized transactions, account takeovers, and other malicious activities; verify identity for high-value orders and seller payouts.
6. Analytics & Improvement: Understand platform usage patterns, optimize website performance, conduct surveys, and improve our products, features, and customer service.
7. Legal Compliance: Meet tax reporting requirements, respond to lawful requests from law enforcement authorities, and enforce our Terms & Conditions.
8. Marketing: (Opt-in only) Send promotional newsletters, exclusive deals, flash sales, and personalized marketing via email, SMS, WhatsApp, or push notifications.

5. Sharing Your Information

We do NOT sell your personal information to third parties for marketing purposes. We share data only with trusted partners under strict confidentiality agreements and only as necessary:

5.1 Service Providers (Contractors)

• Courier & Logistics Partners: Name, address, phone, and order details for delivery (TCS, Leopards, Call Courier, Pakistan Post, etc.)
• Payment Processors: Transaction details for payment processing, refunds, and fraud screening (EasyPaisa, JazzCash, PayFast, Visa/Mastercard acquirers)
• Cloud Hosting: Website and database hosting with industry-standard security (data is stored within Pakistan where feasible)
• Email/SMS Service Providers: For transactional and promotional communications delivery
• Analytics Tools: Aggregated, anonymized usage analytics to improve user experience

5.2 Legal & Regulatory

• Comply with court orders, subpoenas, or lawful government/regulatory requests
• Investigate potential fraud, security incidents, or violations of our Terms
• Protect the rights, property, and safety of Apki.shop, our users, and the public
• Tax authorities for invoicing and tax filing as required by Pakistani law

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, or asset sale, customer data may be transferred as part of the transaction, with the same or greater privacy protections.

6. Cookies & Tracking Technologies

We use cookies and similar technologies to deliver core functionality and improve your experience. You can control cookies through your browser settings.

Cookie Type	Purpose	Required
Essential / Strictly Necessary	Maintain session state, cart/wishlist data, CSRF tokens, authentication status, currency/theme preferences	✅ Yes
Functional	Remember your settings (language, region, view preference), enable saved addresses/payment methods	Optional (improves experience)
Analytics	Anonymous usage analytics: pages viewed, traffic sources, conversion rates, error tracking	Optional
Marketing / Retargeting	Personalized ads across social media and web; abandoned cart reminders (Opt-in only)	Optional (opt-in)

6.1 LocalStorage & Session Storage

Our platform uses browser localStorage/sessionStorage to store your cart, wishlist, and theme preferences on your device. This data stays on your device and is not transmitted to third parties. You can clear it at any time via your browser settings.

7. Data Security

We implement appropriate technical, administrative, and physical safeguards to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Security measures include:

• Encryption: TLS/HTTPS encryption for all data in transit; sensitive fields (passwords, tokens) are hashed/encrypted at rest
• Access Controls: Role-based access for employees; need-to-know principle; multi-factor authentication for admin panels
• Security Audits: Regular vulnerability assessments, penetration testing, and code review
• Payment Security: Payment processing through PCI-DSS Level-1 compliant gateways; full card details are never stored on our servers
• Incident Response: Documented data breach response plan; regulatory notification within required timelines (72 hours where mandated)

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Policy, or as required by law. Standard retention periods:

• Account data: Retained for the lifetime of your account plus 3 years after deletion (for dispute resolution and legal compliance)
• Order & transaction data: Retained for 7 years from the date of transaction (tax record-keeping requirement under Pakistani law)
• Marketing consent records: Retained for 2 years after you unsubscribe
• Customer support records: Retained for 5 years from case closure
• Analytics & logs: Server logs retained for 12 months; aggregated/anonymized analytics retained indefinitely

9. Your Privacy Rights

Subject to applicable law, you have the following rights regarding your personal data. To exercise any of these rights, please contact us using the information at the end of this Policy. We will respond within 30 calendar days.

1. Right of Access: Obtain a copy of the personal data we hold about you
2. Right to Rectification: Request correction of inaccurate or incomplete data (e.g., wrong shipping address, name misspelling)
3. Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal retention obligations
4. Right to Restrict Processing: Limit how we use your data in specific circumstances
5. Right to Data Portability: Receive your data in a machine-readable format for transfer to another provider
6. Right to Object: Object to processing based on legitimate interests or for direct marketing purposes
7. Right to Withdraw Consent: Withdraw any consent previously given (e.g., marketing opt-in) without affecting lawfulness of prior processing
8. Right to Lodge a Complaint: File a complaint with the relevant data protection authority in your jurisdiction if you believe our processing violates applicable law

9.1 How to Exercise Rights

You can exercise most rights directly from your account settings:

• Update profile information: My Account
• Manage saved addresses and payment methods: Account Dashboard
• Unsubscribe from marketing emails: Click "Unsubscribe" at the bottom of any promotional email
• Delete account: Go to Account Settings → Privacy → Delete Account (or contact support)

10. Children's Privacy

Apki.shop is not intended for use by individuals under the age of 13. We do not knowingly collect, solicit, or process personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take immediate steps to delete that information. If you believe a child under 13 has provided data to us, please contact us immediately at privacy@apki.shop.

Teenagers aged 13–17 may use the Platform only with the consent and supervision of a parent or legal guardian, and only for transactions permitted under applicable law.

11. Third-Party Links & Services

Our Platform may contain links to external websites, services, or social media platforms that are not owned or operated by Apki.shop (e.g., Facebook, Instagram, TikTok, payment gateways, courier tracking pages). Clicking these links will direct you away from Apki.shop and is subject to the respective third party's own privacy policy and terms.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. We encourage you to review their policies before providing any personal information.

12. International Data Transfers

Apki.shop is headquartered and operates primarily in Pakistan. Most of your personal data is processed and stored within Pakistan. In limited cases (e.g., cloud hosting, payment processing, or global analytics tools), your data may be transferred to countries outside Pakistan.

When international transfers occur, we ensure:

• Transfers are based on adequacy decisions or appropriate safeguards (contractual clauses)
• Data is processed only to the extent necessary for the purposes stated in this Policy
• Recipients are bound by confidentiality and security obligations equivalent to this Policy

13. Updates to this Privacy Policy

We may revise this Privacy Policy from time to time. Material changes (e.g., changes to data practices, rights, or legal basis) will be communicated via:

• A prominent notice on the homepage and/or in your account dashboard
• An email notification to registered users (for significant changes)
• Updating the "Last updated" date at the top of this page

Your continued use of the Platform after the effective date of the revised Policy constitutes acceptance of the changes. We recommend reviewing this Policy periodically.

14. Contact Us

For privacy-related inquiries, requests, or concerns, please contact our Data Protection Officer: