Privacy Notice

1. What Personal Data We Collect

“Personal data” means any information that identifies you as an individual or relates to an identifiable individual. We may collect the following categories of personal data:

• Contact Information: Name, email address, postal address, phone number, and similar information.
• Account Credentials: Username, password, and other authentication information when you create an account with us.
• Payment Information: Credit/debit card details, billing address, and transaction history when you purchase our products or services.
• Demographic Information: Age, gender, location, language preferences, and interests.
• Technical Information: IP address, browser type, device identifiers, operating system, and browsing activity on our websites.
• Communication Data: Records of your correspondence with us, including emails, chat messages, and call recordings.
• Usage Data: Information about how you use our websites, applications, and services, including pages visited, time spent, and features used.
• Marketing and Preferences: Your preferences for receiving marketing communications and details of your engagement with our marketing materials.
• Special Categories of Data: In limited cases with your explicit consent, we may collect data such as health information (e.g., allergies for product recommendations) or biometric data (e.g., for AI-powered experiences).

2. How We Collect Your Personal Data

We collect personal data through the following methods:

• Direct interactions: When you fill out forms, create an account, make a purchase, subscribe to our newsletter, participate in surveys or promotions, or contact customer support.
• Automated technologies: We use cookies, web beacons, and similar tracking technologies to automatically collect technical and usage data when you visit our websites. For more details, see our Cookie Notice below.
• Third-party sources: We may receive personal data about you from business partners, data enrichment providers, social media platforms (with your consent), and publicly available sources.

3. How We Use Your Personal Data

We use your personal data for the following purposes:

• To provide, operate, and improve our products and services.
• To process your transactions and manage your account.
• To communicate with you, including responding to inquiries and sending service-related notices.
• To personalize your experience and deliver relevant content, recommendations, and advertisements.
• To conduct research, analytics, and market analysis to improve our offerings.
• To prevent fraud, protect security, and comply with legal obligations.
• To send you marketing communications, where permitted by law or with your consent.
• To administer contests, sweepstakes, or promotions you participate in.
• To create aggregate, anonymized data for business insights.

4. Legal Basis for Processing

We process your personal data based on one or more of the following legal grounds:

• Consent: Where you have given explicit consent for specific processing activities (e.g., marketing emails, cookies, special category data).
• Contractual Necessity: Where processing is necessary to perform a contract with you (e.g., delivering products you purchased).
• Legal Obligation: Where we are required to comply with applicable laws, regulations, or court orders.
• Legitimate Interests: Where processing serves our legitimate business interests (e.g., fraud prevention, network security, direct marketing, analytics) and does not override your fundamental rights and freedoms.

Legal Framework in Pakistan: As of the effective date of this Notice, Pakistan has not enacted a comprehensive data protection law. However, the Personal Data Protection Bill 2023 (PDPB) has been drafted and is under parliamentary consideration[reference:0]. Once enacted, the PDPB will establish a National Commission for Personal Data Protection (NCPDP), impose obligations on data controllers, and require data breach notifications within 72 hours[reference:1][reference:2]. It may also introduce data localization requirements for critical personal data[reference:3]. We are committed to complying with all applicable laws, including the PDPB once it becomes effective, and will update this Notice accordingly. In the meantime, we adhere to internationally recognized privacy principles, including the protection of your rights under Article 14 of the Constitution of Pakistan, which recognizes privacy as a fundamental right[reference:4].

5. Sharing Your Personal Data

We may share your personal data with the following categories of recipients:

• Within the Brackly Group: Companies within the Brackly Group may access your personal data for internal business and operational purposes.
• Service Providers: Third-party vendors who perform services on our behalf, such as payment processing, data hosting, analytics, customer support, and marketing. They are contractually bound to protect your data and may only use it for specified purposes.
• Business Partners: We may share your data with trusted partners to offer co-branded products, services, or promotions.
• Advertising and Analytics Partners: We work with third parties to deliver relevant advertisements and measure campaign effectiveness. These partners may collect data about your online activities over time.
• Legal and Regulatory Authorities: We may disclose your personal data when required by law, legal process, or to protect our rights, property, or safety or that of others.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred as part of the transaction, subject to the promises in this Notice.

6. International Data Transfers

As a global group, we may transfer your personal data to countries other than your own. These countries may have data protection laws different from those in Pakistan. When we transfer data internationally, we take appropriate safeguards to protect your data, including:

• Implementing standard contractual clauses approved by relevant authorities.
• Ensuring the receiving party provides an adequate level of data protection.
• Obtaining your explicit consent where required.

If the PDPB is enacted, cross-border data transfers will be subject to its requirements, including restrictions on transferring data to unauthorized persons or systems and localization of critical personal data within Pakistan[reference:5][reference:6]. We will adapt our practices accordingly.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against accidental loss, unauthorized access, alteration, or disclosure. These measures include:

• Encryption of data in transit and at rest.
• Access controls and authentication mechanisms.
• Regular security assessments and employee training.
• Incident response procedures for data breaches.

While we strive to protect your data, no security system is impenetrable. We encourage you to take steps to protect your own information, such as using strong passwords and safeguarding your login credentials.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Notice, unless a longer retention period is required or permitted by law. The retention period depends on factors such as:

• The nature and sensitivity of the data.
• The purposes for which we process the data (e.g., ongoing business relationship, legal obligations).
• Applicable legal, regulatory, or contractual requirements.

When no longer needed, we securely delete or anonymize your personal data.

9. Your Rights

Depending on your location and applicable laws, you may have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Correct inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data under certain circumstances.
• Right to Restrict Processing: Limit how we use your data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Withdraw previously given consent at any time.
• Right to Lodge a Complaint: File a complaint with a supervisory authority (once established in Pakistan under the PDPB).

To exercise these rights, please contact us at [email protected]. We will respond within a reasonable timeframe as required by law.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience, analyze website traffic, and personalize content. Cookies are small text files placed on your device. You can control cookies through your browser settings; however, disabling cookies may affect functionality. By using our websites, you consent to our use of cookies unless you have set your browser to refuse them. For detailed information on the types of cookies we use and how to manage them, please see our Cookie Notice.

11. Children's Privacy

Our websites and services are generally intended for adults. We do not knowingly collect personal data from children under the age of 13 (or the applicable age of consent in your jurisdiction) without parental consent. If we discover we have inadvertently collected such data, we will delete it promptly. Parents or guardians who believe we may have collected information from a child should contact us.

12. Third-Party Links

Our websites may contain links to third-party websites, plug-ins, or applications. Clicking those links may allow third parties to collect or share data about you. We do not control these third-party sites and are not responsible for their privacy practices. We encourage you to read their privacy notices before interacting with them.

13. Changes to This Privacy Notice

We may update this Notice from time to time to reflect changes in our practices, legal requirements, or other factors. The “Effective Date” at the top of this Notice indicates when it was last revised. We will notify you of material changes by posting the updated Notice on our website or through other appropriate channels. Your continued use of our services after the changes become effective constitutes acceptance of the revised Notice.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Notice or our data practices, please contact us at:

We aim to respond to all legitimate requests within 30 days. If your request is complex or numerous, we may take longer, but we will notify you of any delay.