# Privacy Policy
**Last updated:** 23 July 2026
**Controller:** Connect2Pakistan (“C2P”, “we”, “us”, or “our”)
This Privacy Policy explains how we collect, use, share, and protect personal data when you use the Connect2Pakistan B2B marketplace (the “Platform”).
> Template notice for Platform operations. Have privacy counsel review it for GDPR/UK GDPR, Pakistan, and other markets you serve.
## 1. Scope
This Policy applies to visitors, registered buyers and suppliers, organisation team members, and individuals whose data appears in RFQs, orders, messages, or verification materials. It does not cover third-party websites linked from the Platform.
## 2. Data we collect
**Account and profile data** — name, email, password hash, role (buyer/supplier/staff), organisation details, locale preferences, and profile settings.
**Business and transaction data** — RFQs, quotes, orders, invoices, shipping addresses, Incoterms, product catalogues, verification dossiers and documents, support tickets, and related status history.
**Communications** — messages and attachments exchanged through the Platform, and emails we send about account or order activity.
**Technical and usage data** — IP address, device/browser type, approximate location derived from IP, pages viewed, referring URLs, and diagnostic logs.
**Cookies and similar technologies** — see our Cookie Policy for details.
**Payment data** — payment status and identifiers needed to reconcile charges. Card details are generally processed by our payment provider (e.g. Stripe); we do not store full card numbers on our servers.
## 3. How we use data
We use personal data to:
- Provide, secure, and improve the Platform (accounts, listings, RFQs, messaging, orders, panels)
- Verify supplier organisations and operate trust/verification features
- Process payments, prevent fraud, and handle settlements where applicable
- Send transactional notices (login, quotes, order updates, security alerts)
- Provide customer support and investigate disputes, RMAs, or abuse
- Comply with law, enforce Terms, and protect rights and safety
- Produce aggregated or de-identified analytics about marketplace performance
Where required, we rely on one or more of: performance of a contract, legitimate interests (operating a B2B marketplace securely), consent (where we ask for it), and legal obligation.
## 4. Sharing
We may share data with:
- **Counterparties you interact with** (e.g. buyer ↔ supplier) as needed for RFQs, messages, and orders
- **Service providers** (hosting, database, email, analytics if enabled, payment processors, file storage) under contractual safeguards
- **Professional advisers** and auditors under confidentiality
- **Authorities** when required by law or to protect rights and safety
- A **successor** in connection with a merger, acquisition, or asset sale
We do not sell personal data.
## 5. International transfers
The Platform may be hosted and supported in multiple countries (including the EU/UK and other regions where our providers operate). Where we transfer personal data internationally, we use appropriate safeguards required by applicable law (such as standard contractual clauses where relevant).
## 6. Retention
We retain account and transaction records for as long as your account is active and thereafter as needed for legal, tax, dispute, and security purposes. Message and document retention follows operational needs and legal requirements. You may request deletion subject to Section 8 and lawful exceptions (e.g. outstanding orders or legal holds).
## 7. Security
We implement technical and organisational measures appropriate to a B2B marketplace (access controls, encrypted transport, least-privilege server credentials, and monitoring). No method of transmission or storage is completely secure; please use strong passwords and protect your devices.
## 8. Your rights
Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability or withdrawal of consent. You may also lodge a complaint with a supervisory authority.
To exercise rights, contact us through your account settings/support channels or the contact details published on the Platform. We may need to verify your identity. Organisation administrators may control team membership data for their company.
## 9. Children
The Platform is intended for business users, not children. We do not knowingly collect personal data from individuals under 16 (or higher age where required).
## 10. Automated decisions
We do not make solely automated decisions that produce legal or similarly significant effects about you without human involvement, except fraud/security controls that may temporarily block suspicious activity.
## 11. Changes
We may update this Policy by posting a revised version and changing the “Last updated” date. Material changes may be highlighted in-product or by email where appropriate.
## 12. Contact
Privacy requests: use panel support tools or the contact options published on the Platform.