Privacy Policy

We respect your privacy and are committed to handling your information responsibly and in accordance with applicable Pakistani law, including the Prevention of Electronic Crimes Act, 2016 (as amended by the Prevention of Electronic Crimes (Amendment) Act, 2025), the Digital Nation Pakistan Act, 2025, and any data-protection legislation in force from time to time (including the Personal Data Protection Bill / Act once enacted). This Policy applies to shoppers and shopkeepers, and to people who apply to work with us as field agents or supervisors, and to all information we process through the Platform. It does not apply to third-party services we link to, which have their own policies.

Information you give us

• Account details — name, email address, phone number, profile photo, password (managed by our authentication provider), and the city you select.
• Shop details (shopkeepers) — business name, category, description, address and map location, opening hours, contact numbers, products, prices, offers, and photos you upload.
• User content — reviews, ratings, photos, saved shops, and messages or enquiries you send.
• Communications — information you provide when you contact support or reach us by email or WhatsApp.

Information we collect automatically

• Usage & activity— searches you run, shops and products you view, taps on “Call”, “WhatsApp” and “Directions”, and other interactions, recorded as events to operate and improve the Platform.
• Device & technical data — IP address, browser and device type, operating system, app version, and similar diagnostic data.
• Location— approximate location derived from your city selection and, only with your permission, more precise device location used for directions and “near me” results.
• Cookies & local storage — used to keep you signed in, remember preferences (such as theme), and measure usage.

We collect information (a) directly from you when you register, list a shop, post content or contact us; (b) automatically as you use the Platform, through cookies, local storage and analytics events; and (c) from third parties such as our authentication provider (Google / Firebase) when you sign in with them, which may share your name, email, profile photo and a unique identifier with us.

We use your information to:

• create and manage your account and authenticate you;
• operate, provide and personalise the Platform, search and recommendations;
• display Listings, reviews and contact options, and connect shoppers with shops;
• process and support any paid services you choose;
• analyse usage and trends, measure and improve performance, develop new features, and produce aggregated/anonymised insights and reports;
• communicate with you about your account, security, updates and (where permitted) relevant features or offers, with notification preferences you can control;
• detect, prevent and address fraud, abuse, security issues and violations of our Terms; and
• comply with legal obligations and enforce our rights.

We process your information on the basis of your consent (which you give by using the Platform and may withdraw), the performance of our contract with you (these Terms), our legitimate interests in operating and improving the Platform and keeping it secure, and compliance with legal obligations. Where the law requires consent for a specific use (such as precise location or certain communications), we will ask for it.

We do not sell your personal information. We share it only as described below:

• With other users, as intended. Your public profile, listings, reviews and ratings are visible to others. When you contact a shop (call, WhatsApp, in-app message, enquiry), the relevant details are shared with that shopkeeper so they can respond. An in-app message shares your name and what you wrote — not your phone number.
• Service providers. With trusted vendors who process data on our behalf — for example authentication and hosting (Google / Firebase), cloud hosting and storage, mapping/directions, image storage, analytics, and (for paid services) payment processors — under obligations to protect your data.
• Legal & safety. Where we are required to disclose information by law or by a court order, formal statutory notice, or lawful written directive issued by a competent authority (including the National Cyber Crime Investigation Agency (NCCIA), the Digital Rights Protection Authority (DRPA), the Federal Investigation Agency (FIA) or the police), to enforce our Terms, or to protect the rights, safety or property of Dhundhlo, our users or the public. We do not hand over your information on a verbal or informal request.
• Business transfers. In connection with a merger, acquisition, financing, reorganisation or sale of assets, your information may be transferred to the successor entity, subject to this Policy.
• Aggregated/anonymised data that does not identify you may be shared or published freely.

Dhundhlo lets you message a shop directly inside the Platform, so you can ask questions, agree a price or arrange a time without sharing your phone number. We never show your number to a shopkeeper because you sent them a message.

In-app messages are not end-to-end encrypted, and we can read them. We are telling you this plainly because it matters. We hold this ability for a narrow set of reasons: to investigate a report of harassment, abuse or fraud; to resolve a dispute between a customer and a shopkeeper when one of you asks us to; and where disclosure is required by law or a lawful request from a competent authority.

We do not read conversations for advertising, profiling, or curiosity. Message contents are encrypted at rest in our systems, and every time a member of our team opens a conversation it is recorded in an internal audit log together with who opened it and why. Push notifications about a new message deliberately do not include the message text, so what you write does not appear on a locked phone screen.

Either side can close a conversation at any time, which stops new messages. Closed conversations remain stored, because they may be the evidence if the conversation is later reported. You can report a conversation to us from within it.

Shopkeepers can see the reviews, ratings and enquiries directed to their shop and may receive your name and the contact method you choose to use (for example your WhatsApp number when you message them). We may also provide shopkeepers with aggregated, non-identifying insights — such as how many people viewed their shop or which search terms surfaced it. Shopkeepers are independent third parties responsible for their own handling of any information you share with them directly.

This section applies only to people who apply to work with us as a Dhundhlo field agent or supervisor. It does not apply to shoppers or shopkeepers, and nothing described here is collected from you as a user of the Platform.

What we collect

• Application details — name, phone number, city, and the answers you give on the application form.
• Identity documents (on approval only) — your CNIC number, photographs of your CNIC (front and back), a photograph taken at the time of approval, your address, and the name and phone number of one local reference.
• Engagement records — your signed agreement, who approved you and when, the shops you register, the fees you collect and deposit, and the commission earned and paid to you.
• Performance records — how many shops you register and over what period, how many go live, how long you hold cash before depositing it, and any target set for you. We use these to decide whether an engagement continues.
• Complaints and concerns raised about you — what was said, who said it (which may be a shopkeeper, another agent, or us), when, what we did about it, and how it was resolved.

If a complaint is recorded about you

• You will be told what it says before it is used to change or end your engagement, and you will have the chance to give your side. We record that too.
• A complaint is visible only to us. It is not shown to other agents, to supervisors outside your own line, to shoppers, or to shopkeepers.
• We keep it with your engagement records and it is deleted on the same schedule below. A complaint we dismissed is marked as dismissed rather than quietly removed, so the record of what we decided stays honest.

Why we collect it

Field agents represent Dhundhlo in person and handle registration fees paid by shopkeepers. We verify and record who they are so that a shopkeeper can be told who signed them up, so that money can be traced to a named person, so that we can meet our tax and record-keeping obligations, and so that a dispute can be resolved on evidence.

How it is protected

• CNIC images are held in private storage that is never served publicly, kept separate from the storage that serves shop photos.
• Your CNIC number is encrypted at rest.
• Every access to an identity document is logged — who looked, and when.
• Identity documents are never shown to shopkeepers or shoppers and are never published. We disclose them only where the law requires it, on a lawful request from a competent authority, or to our professional advisers or bank where necessary.

How long we keep it

• If you are engaged — for as long as you work with us, and then for six (6) years after you leave, the period for which Pakistani company and tax law requires business records to be kept. The identity documents are then deleted.
• If your application is not approved — the application is deleted within twelve (12) months.

To ask what we hold about you as an agent, or to raise a concern, write to [email protected].

The Platform relies on third-party services including Google / Firebase (authentication), mapping and directions providers, WhatsApp, cloud hosting and content-delivery providers, advertising and measurement providers (Meta — see “Advertising & measurement” below), and payment processors for paid services. These providers process certain data under their own privacy policies, which we encourage you to review. We are not responsible for the privacy practices of third parties.

We advertise Dhundhlo on Facebook and Instagram, and we use the Meta pixel on our public pages to measure whether those advertisements work — for example, how many people who saw a hiring advertisement went on to submit an application. The pixel reports the address of the page and standard technical information (such as your device and browser) to Meta, which may use it to measure and target advertising under its own policies.

Where it does not run. The pixel is deliberately excluded from every signed-in area of the Platform — your dashboard, orders, checkout, profile and settings, our admin panel, and the field-agent panel. What you do inside your account is not reported to Meta. It is also excluded from search results pages, so what you search for is never sent to Meta — including when you search for a medicine or a pharmacy.

You can limit this through your Facebook or Instagram ad settings, your browser’s cookie controls, or a tracking blocker. Doing so does not affect how the Platform works for you.

Some of the services above run on global cloud infrastructure, which means your information may be transferred to and processed on servers outside Pakistan. Where that happens we use providers that maintain recognised international security standards and contractual protections, and we transfer only what the service needs to function. By using the Platform you acknowledge this transfer.

We use cookies and local storage to keep you signed in, remember preferences (such as your chosen theme and city), enable core functionality, understand and improve how the Platform is used, and — on public pages only — measure our advertising as described above. You can control or clear cookies through your browser settings, but disabling them may affect how the Platform works. By using the Platform, you consent to our use of cookies and local storage as described in this Policy.

We keep your personal information for as long as your account is active and you use the Platform, so that we can provide and personalise the service for you. We do not automatically delete an active user’s account information or activity simply because time has passed.

• While your account is active — we retain your profile, listings, reviews and activity history to operate, personalise and improve the Platform.
• You stay in control — you can clear specific activity (such as your browse history) yourself at any time, and you can ask us to delete your account.
• When you delete your account — we delete or anonymise the personal information and activity associated with it. Financial records are the exception: registration-fee receipts, invoices, transaction ledgers and commission records must be kept for six (6) years under the Companies Act, 2017 and the Income Tax Ordinance, 2001, and are destroyed at the end of that period. We also keep whatever we need to resolve an open dispute or enforce our agreements.
• Anonymous activity — usage events that are not linked to a registered account are kept only for a limited period and are then deleted or anonymised.
• Long-dormant accounts — we may delete or anonymise data from accounts that have been inactive for an extended period.
• Field agent identity records — kept while the agent works with us and for six (6) years afterwards, then deleted. See Field agents & contractors.

Aggregated or anonymised statistics that do not identify you may be retained indefinitely to understand trends and improve the Platform.

We use reasonable technical and organisational measures to protect your information — including encryption in transit (HTTPS), access controls, and reputable infrastructure providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential.

If a security incident or data breach affects your personal information, we will take all reasonable steps to contain it, and we will notify the affected users and the competent regulatory authorities as the law requires and as quickly as we reasonably can. We will tell you what happened, what information was involved, and what you can do about it.

Subject to applicable law, you may:

• access, review and update your account information in your profile settings;
• request correction of inaccurate information or deletion of your account;
• manage your notification and communication preferences;
• control location and other device permissions through your device settings; and
• withdraw consent for optional processing (this will not affect processing already carried out, or processing on other lawful grounds).

To exercise any of these, contact us at [email protected]. We may need to verify your identity, and some information may be retained where the law allows or requires.

The Platform is not intended for children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us at [email protected] and we will take appropriate steps to delete it.

We and our service providers may store and process your information on servers located in Pakistan and in other countries. Where information is transferred across borders, we take reasonable steps to ensure it is treated in line with this Policy and applicable law.

We may update this Privacy Policy from time to time. When we make material changes we will update the “Last updated” date and, where appropriate, notify you through the Platform. Your continued use of the Platform after a change takes effect means you accept the updated Policy.

This Privacy Policy is governed by the laws of the Islamic Republic of Pakistan. Any dispute relating to it is subject to the governing-law, jurisdiction and dispute- resolution provisions of our Terms & Conditions.

For privacy questions or requests, contact us at:

• Email (privacy): [email protected]
• Email (support): [email protected]
• WhatsApp: +92 303 6960827
• Dhundhlo — Pakistan