Privacy & Data Protection Policy

1. Who We Are

Waw (waw.com.pk) is a multi-vendor e-commerce marketplace operated in the Islamic Republic of Pakistan by WAW TECHNOLOGIES (SMC-PRIVATE) LIMITED (NTN K330611, SECP Corporate Unique Identification No. 0359566). This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have over it. It applies whenever you browse, order from, or sell on Waw.

• Data Controller / Contact: care@waw.com.pk
• Support Hours: WhatsApp helpline available 24/7
• Complaints: You may raise a privacy complaint at any time by emailing care@waw.com.pk with the subject line “Privacy Complaint”. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.

2. Data We Collect

We only collect the data needed to run a trustworthy marketplace. What we collect depends on how you use Waw:

• Buyers (registered): name, phone number, delivery addresses, order history, returns and refunds records, loyalty and referral points.
• Guests (guest checkout): phone number and delivery address, limited to fulfilling that specific order.
• Sellers: CNIC details, bank IBAN, payout history, store profile and listings, plus supporting KYC documents.
• Technical data: IP address, device and browser type, and app interaction events, used for security, delivery of service, and (only with your consent) analytics.

3. Legal Bases for Processing

Where required by law, we process your personal data only with a valid legal basis:

• Contract performance: to register your account, process orders, take payments, arrange delivery, and handle returns and refunds.
• Legitimate interest: to prevent fraud, abuse, and chargebacks; verify identities at checkout; and secure our platform.
• Consent: for marketing communications and Google Analytics 4 measurement, both of which you can withdraw at any time via Cookie Settings in the footer or by contacting us.
• Legal obligation: to comply with Pakistani tax, AML/CFT, and record-keeping laws.

4. Processors & Subprocessors

We share personal data only with vetted processors that help us operate the marketplace, each bound by contractual data-protection obligations:

• Supabase / Postgres — hosted application database and authentication.
• Safepay — payment processing and card/wallet acquiring (cards, Easypaisa, and Raast QR).
• PostEx / TCS — courier, delivery, and reverse pickup services.
• Meta WhatsApp Business Platform — order confirmations, receipts, and support messages.
• Google Analytics 4 — aggregated usage analytics (loaded only after you consent).
• Sentry — error monitoring and performance diagnostics.
• Cloudflare / R2 — CDN, security, and product image storage.

We do not sell, rent, or trade your personal data to third-party telemarketers or data brokers.

5. Payments & Card Data Security

Your card data never touches Waw servers. All card and wallet payments are completed on Safepay's hosted checkout page, which is fully compliant with PCI-DSS (Payment Card Industry Data Security Standard). Waw never sees, receives, or stores your 16-digit card number, CVV, or expiry date. We store only the payment status and the gateway transaction reference needed to match your order and process refunds. For wallet and Raast QR payments, we receive only the transaction ID and settlement status.

6. Data Retention

We keep your data only as long as needed for the purposes above:

• Orders & financial records: 7 years, as required by Pakistani tax law.
• Seller KYC documents: for the duration of the store's activity plus 3 years.
• Analytics data: 14 months maximum.
• Session data: 30 days.

7. Your Rights & How to Exercise Them

You have the following rights over your personal data: access, correction, deletion, portability, and withdrawal of consent. To exercise any of them:

1. Email care@waw.com.pk from your registered phone number's linked email or the address on your account.
2. Use the subject line “Data Request” or “Privacy Complaint” and describe the right you want to exercise.
3. We respond within 30 days. Deletion requests are honored except where we must retain records under the retention schedule in Section 6.

Residents of Pakistan have rights of access and correction regarding their personal data under the Prevention of Electronic Crimes Act (PECA) 2016 and related applicable law. If you are visiting from the European Union, we honor GDPR Articles 15–22 (access, rectification, erasure, restriction, portability, and objection) where applicable. Pakistan's Personal Data Protection Bill, once enacted, will apply to the extent it governs our processing.

8. Cookies & Consent

We use a consent banner that distinguishes essential, analytics, and marketing categories before any non-essential cookie loads:

• Essential (7 days): waw_session, waw_csrf, and cart token — required for sign-in, security, and keeping your cart. These cannot be disabled.
• Analytics (12-month consent): waw_consent plus Google Analytics 4 cookies — loaded only after you opt in. You can change or withdraw your choice at any time via Cookie Settings in the footer.
• Marketing: only set if you consent; switching them off stops marketing measurement without affecting your account.

9. How We Protect Your Data

• Row-Level Security (RLS): database access is restricted so a user can only ever read their own records.
• Encryption: all traffic to and from Waw is encrypted in transit (TLS/HTTPS).
• Access controls: strict internal role-based access; KYC and financial data are visible only to authorized staff.

10. International Transfers

Waw is operated from Pakistan, but some processors listed in Section 4 process data in cloud regions outside Pakistan (for example, Supabase's hosted cloud region). Where your data is processed abroad, we rely on processor agreements, encryption in transit, and the safeguards described in Section 9, and we only transfer the minimum data necessary for the processor to perform its function.

11. Children's Privacy

Waw is intended for users aged 18 or older. We do not intentionally collect data from children. If you believe a child has provided us personal data, contact care@waw.com.pk and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our services or the law. The current version is always published on this page with its effective date. Material changes will be announced on the site and, where required, re-consent will be requested.

13. Effective Date

This Privacy Policy is effective as of 15 September 2026 and replaces all earlier versions. Questions? Email care@waw.com.pk or message our 24/7 WhatsApp helpline.