Privacy Policy

1. Introduction & Scope

At Zadqa (“we,” “our,” “us,” or the “Company”), we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you access or use our website and services (collectively, the “Platform”).

This Privacy Policy applies to all users of the Platform, including visitors, donors, fundraisers, and registered account holders. By accessing or using our Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with our policies and practices, please do not use our Platform.

This Privacy Policy should be read in conjunction with our Terms of Service, which govern your use of the Platform.

2. Information We Collect

We collect several types of information from and about users of our Platform:

2.1 Personal Information

Information that identifies you as an individual, including:

• Identity Data: Full name, username, and profile information
• Contact Data: Email address, mobile number
• Account Data: Login credentials and account preferences
• Fundraiser Identity Data: CNIC number and image (fundraisers only, for verification purposes)
• Banking Data: Bank name, account holder name, and account number (fundraisers only, for fund disbursement)

2.2 Campaign & Donation Information

• Campaign details including title, story, category, location, and photos
• Fundraising goal amounts and progress
• Donation amounts, references, and optional donor names and emails
• Supporting documents uploaded for campaign verification

2.3 Technical Data

• IP address and approximate location
• Browser type, version, and language settings
• Operating system and device information
• Session data and access timestamps
• Page views and navigation patterns (via Vercel Analytics)

3. How We Collect Information

3.1 Direct Collection

• When you create an account or sign in with Google OAuth
• When you complete the campaign submission form
• When you make or confirm a donation
• When you contact our support team
• When you complete the onboarding or fundraiser upgrade form

3.2 Automated Collection

• Through session cookies required for authentication
• Through Vercel Analytics for anonymised page view data
• Through server logs that automatically record technical data

4. How We Use Your Information

4.1 Service Delivery

• To operate, maintain, and improve the Platform
• To verify campaign applications and fundraiser identities
• To display active campaigns to donors
• To record and attribute donations

4.2 Account Management

• To create and manage your user account
• To authenticate your identity and maintain session security
• To provide customer support and respond to enquiries

4.3 Security & Fraud Prevention

• To detect, prevent, and respond to fraudulent campaigns or abuse
• To verify fundraiser identity through CNIC checks
• To enforce our Terms of Service and policies

4.4 Legal Compliance

• To comply with applicable Pakistani laws and regulations
• To respond to lawful requests from public authorities
• To protect our rights, safety, or property

5. Legal Basis for Processing

We process your personal data based on one or more of the following legal grounds:

• Consent: Where you have given clear consent, such as when signing up or submitting a campaign.
• Contractual Necessity: Where processing is necessary to fulfil our obligations to you, such as verifying your identity before approving a campaign.
• Legitimate Interests: Where processing is necessary for fraud prevention, platform security, or improvement, provided these interests do not override your fundamental rights.
• Legal Obligations: Where we are required to process your data to comply with applicable laws.

6. Data Sharing & Disclosure

6.1 Donors and Fundraisers

When you make a donation, your name (unless you donate anonymously) and the donation amount may be visible to the campaign fundraiser and shown publicly on the campaign page.

6.2 Service Providers

We engage trusted third-party companies to perform services on our behalf, including hosting (Vercel), database (Supabase), and authentication (Google OAuth). These providers have access to your data only to perform specific tasks and are contractually obligated to protect it.

6.3 Legal Requirements

We may disclose your information if required by Pakistani law or in response to valid legal requests by public authorities, including law enforcement or courts.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such change.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected.

• Active Accounts: Data retained for as long as your account remains active.
• Closed Accounts: Retained for up to 3 years after account closure to comply with legal obligations.
• Transaction & Donation Records: Retained for 7 years for accounting and legal compliance.
• Security Logs: Retained for up to 12 months.
• CNIC & Identity Documents: Deleted within 90 days of campaign closure or rejection.

When personal data is no longer required, we securely delete or anonymise it.

8. Your Rights

You may have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request that we correct inaccurate or incomplete data.
• Right to Deletion: Request that we delete your personal data, subject to legal exceptions.
• Right to Restriction: Request that we limit how we process your data in certain circumstances.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Object: Object to processing for direct marketing or based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent at any time where processing is consent-based.

To exercise any of these rights, email us at zadqa.pakistan@gmail.com. We will respond within 30 days. We may need to verify your identity before processing your request.

9. Security Measures

We implement appropriate technical and organisational security measures to protect your data:

• Encryption of data in transit using TLS/HTTPS
• Encrypted session tokens via NextAuth
• Access controls limiting data access to authorised personnel only
• CNIC and identity documents stored securely and never displayed publicly
• Security logging and monitoring

While we strive to protect your personal data, no method of transmission over the internet is 100% secure. You are responsible for maintaining the confidentiality of your account credentials. Please notify us immediately if you suspect unauthorised access.

10. International Data Transfers

Your personal data may be stored and processed outside Pakistan. Our hosting provider (Vercel) operates servers in the United States and other regions. Our database provider (Supabase) may store data in various regions.

When we transfer personal data internationally, we ensure appropriate safeguards are in place through data processing agreements with our service providers. By using our Platform, you consent to these transfers.

11. Children’s Privacy

Our Platform is not intended for children under the age of 16. We do not knowingly collect or maintain personal data from anyone under 16 years of age. If you are under 16, please do not register for the Platform or submit any personal information.

If we learn that we have collected personal data from a child under 16, we will promptly delete it. If you believe we might have any such information, please contact us at zadqa.pakistan@gmail.com.

12. Policy Updates

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Post the revised policy on our Platform
• Notify you via email or a prominent notice on the Platform for significant changes

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us:

We will make every effort to resolve your concerns promptly. We aim to respond to all privacy-related requests within 30 days.

Have questions about your privacy?

Our team is here to help with any questions about how we handle your data.