In short: shoppers give us what is needed to buy and deliver (addresses, phone, orders, payments made online through gateways, returns), and may write reviews, ask questions and chat with sellers. Sellers give us their store profile, verification and bank details. Each seller sees only the delivery details of its own orders. We do not sell anyone’s data. We do not sell personal data and we do not show advertising.
Who we are and our role
NVDRA Bazaar is provided by NVDRA Technologies. This policy explains how personal data is handled in NVDRA Bazaar.
- Data a seller puts into NVDRA Bazaar: the seller decides what to collect and why, and is responsible for it. We process this data only on its instructions, as set out in our Data Processing Terms. If your information was entered by a seller, please contact it first; we will help it answer you.
- Your personal use of NVDRA Bazaar: your orders, addresses, wishlist, reviews and chats are kept by NVDRA Technologies, which decides how that data is used and is responsible for it. The seller of each package receives your name, phone number and delivery address so it can deliver, and uses them only for that order.
- Data we use for our own purposes (your NVDRA account, billing, security logs, support requests, our public pages): NVDRA Technologies is responsible for it.
Pakistan does not yet have a general personal data protection law in force. We follow the Prevention of Electronic Crimes Act, 2016, the Electronic Transactions Ordinance, 2002 and the other laws that apply to us, and we have designed this policy around widely accepted data protection principles: collecting only what is needed, using it only for clear purposes, keeping it secure, and keeping it no longer than necessary. We will update this policy when a data protection law comes into force.
What personal data is processed
| Whose data | What | Where it comes from |
|---|---|---|
| Everyone with an NVDRA account | Name, email address, mobile / WhatsApp number, password (stored only as a one-way hash), the organisations and roles you belong to, sign-in history. | You, or the seller that invited you |
| Shoppers | Delivery addresses (name, mobile number, province, city, area, address), cart, wishlist, followed stores, recently viewed products (in your browser session), orders, returns (reason, photos, refund account for cash-on-delivery refunds), reviews with photos, product questions and chats with sellers. | You |
| Payments | For online payments: order reference, amount, gateway, gateway reference and result. Card and wallet details are entered on the gateway’s own page and never reach NVDRA Bazaar. | You and the payment gateway |
| Sellers | Store profile (name, logo, banner, about, phone, email, city, pickup and return addresses), owner CNIC and NTN for verification, bank account for payouts, team members and their roles, listings, vouchers, the ledger of earnings, service fees and payouts. | The seller |
| Reports | Reports of suspicious listings and who sent them. | Shoppers |
| Billing | The seller’s name and contact person, invoices and payment proofs (for example, bank transfer receipts). | The Owner |
| Technical data | IP address, browser and device type, sign-in sessions, security and error logs, push notification subscriptions. | Your browser or device |
Sellers’ CNIC, NTN and bank details are seen only by the seller’s owner and NVDRA staff. Shoppers’ refund accounts are seen only by NVDRA staff who send the refund.
How the data is used
- To take, pay, deliver, track, cancel and return orders, and to tell you about each step (bell, push and email notifications).
- To pass each seller the delivery details of its own packages, and to let you chat with sellers.
- To pay sellers their earnings, keep NVDRA’s service fee and keep the accounts NVDRA must keep by law.
- To keep the marketplace safe: reviewing shops and listings, acting on reports, hiding fake reviews and preventing payment fraud.
- To sign you in once across NVDRA applications through our single sign-on service.
- To bill sellers and verify payment proofs.
- To keep the Service and its users safe: preventing fraud and abuse and protecting accounts.
- To support you and to fix problems you report.
- To improve the Service using aggregated usage information (for example, how many organisations use a feature), not the contents of your records.
- To meet legal obligations, such as keeping records the law requires and responding to lawful requests.
Our reasons for processing are: performing our contract with the seller and with you; the seller’s instructions; consent where it is needed (for example, push notifications on your device); our legitimate interest in running a secure, reliable service; and legal obligations. We make no decisions about people based solely on automated processing that have legal or similarly significant effects.
Buying from independent sellers
Every product page names the seller. The seller receives your name, mobile number and delivery address for the packages you buy from it, and may use them only to deliver and support that order. Chats with a seller are visible to that seller’s team and, for safety and disputes, to NVDRA staff.
Online payments are processed by the payment gateway you choose (JazzCash or Easypaisa) under its own terms and privacy policy. NVDRA receives only the payment result.
Who receives the data
We do not sell or rent personal data. It is shared only as follows:
- Sellers: the delivery details, items and notes of the packages you buy from them; your public name initial on reviews.
- Payment gateways (JazzCash, Easypaisa): the amount, order reference and the email / mobile number needed to take an online payment.
- Couriers chosen by sellers: the delivery details printed on the packing slip.
- The public: shop pages, listings, answered questions and reviews (shown with your first name and initial) are public.
- Service providers who help us run NVDRA Bazaar and may only use the data to do so: hosting and backup providers, email delivery providers, and the push services of browser and phone makers (such as Google, Apple and Mozilla).
- Other NVDRA applications the seller connects, which receive only the data needed for the connection.
- Authorities, when required by law, a court order, or a lawful request of an investigating agency under the Prevention of Electronic Crimes Act, 2016, or when needed to protect someone’s safety. Where the law allows, we tell the seller first.
- A buyer or successor of our business, under the same protections, if the Service is transferred. We will tell sellers before that happens.
Where the data is stored
NVDRA Bazaar is hosted on servers operated by our hosting providers, which may be located in Pakistan or abroad. Some providers listed above process data in other countries. When data is processed outside Pakistan we use providers that apply recognised security standards, and we limit what they receive to what is needed. If Pakistani law requires certain data to be kept in Pakistan, we will comply.
How long data is kept
- Seller records are kept while the seller’s account is open and as long as the seller keeps them.
- After a seller closes its account, its data stays available for export for 30 days and is then deleted from the live system within a further 60 days. Backups are overwritten on a rolling cycle of up to 90 days.
- Orders, payments and seller ledgers: kept for 10 years for tax and accounting.
- Chats: kept while both accounts are open; review and return photos are kept with the review or return.
- Contact-us messages: kept for 2 years.
- Your NVDRA account is kept until you ask us to delete it or it has been inactive for a long period and is no longer linked to any organisation.
- Billing records are kept for as long as tax and accounting laws require.
- Security and access logs are kept for at least one year, as service providers are required to retain traffic data under the Prevention of Electronic Crimes Act, 2016, and longer if needed for an investigation.
How the data is protected
- All connections use HTTPS encryption, and passwords are stored only as one-way hashes; we cannot see them.
- Access is based on roles, so each person sees only what their role needs. Private files are stored outside the public web folder and served only to people allowed to see them.
- Card and wallet details never reach NVDRA Bazaar: you pay on the gateway’s page, and every gateway reply is checked with its secure hash before an order is marked paid.
- Access by NVDRA staff is limited to authorised people for support, security and legal reasons. When a senior administrator signs in as a User from the NVDRA Admin Panel, a reason is required, a banner shows it is NVDRA access, and the session is recorded in audit logs.
If a security incident affects personal data, we will inform the affected seller without undue delay so that it can inform the people concerned, and we will take steps to limit the harm.
Your choices and rights
You can ask to see the personal data held about you, to correct it, to delete it where it is no longer needed, to receive a copy in a common format, or to object to a use of it. You can also turn push notifications off in your browser or phone settings, and change your name, email, phone and password in your NVDRA account.
For records kept by a seller, please contact the seller; it decides on the request and we help it. For anything else, write to support@nvdra.com. We will reply within 30 days. We may need to confirm your identity first, and some data may have to be kept for legal reasons; if so, we will explain why.
Cookies
NVDRA Bazaar uses only the cookies and browser storage needed for signing in, security and remembering your choices. It does not use advertising or tracking cookies. See the Cookie Policy.
Changes to this policy
We will update this policy when our practices or the law change, and show the date of the latest version at the top. If a change materially affects how personal data is used, we will tell you by email or in the app before it takes effect.
Contact
NVDRA Technologies
Email: support@nvdra.com