GDPR & Data Protection

Your rights

Whether you're covered by GDPR, Pakistan's Personal Data Protection Bill, or any similar framework, Nafaa honors these rights:

• Right of access: Get a copy of all data we hold about you
• Right to rectification: Correct inaccurate personal data
• Right to erasure: Request complete deletion (see data deletion)
• Right to portability: Export your data in machine-readable format
• Right to restrict processing: Pause specific uses of your data
• Right to object: Opt out of marketing and profiling
• Right to withdraw consent: Revoke any consent at any time

Legal basis for processing

• Contract: Processing needed to deliver Nafaa services you subscribed to
• Legal obligation: FBR compliance, tax records, SBP requirements
• Legitimate interest: Product improvement, fraud prevention, security
• Consent: Marketing communications (opt-in, revocable)

Data transfers

Your data is stored primarily on servers in Pakistan and Singapore. Any cross-border transfers use standard contractual clauses and encryption in transit and at rest.

Data protection officer

Contact our DPO at privacy@nafaa.pk. Response guaranteed within 30 days, usually within 48 hours.

Complaints

You have the right to lodge a complaint with your local data protection authority. In Pakistan, this is the Ministry of Information Technology and Telecommunication.