Privacy Policy

1. Who controls your information

Zamisha is the controller responsible for the personal information described in this policy.

Privacy enquiries and requests may be sent to privacy@zamisha.pk. Controller address: Pakistan.

2. Information we collect

• Identity and contact information, including name, email address and mobile number.
• Order, delivery and recipient information, including shipping address, selected products, membership details, returns and customer-service history.
• Account information and authentication records. Passwords are stored only as secure hashes.
• Payment-related references and payment status supplied by a payment provider. Zamisha does not need to store complete card details for hosted payment processing.
• Newsletter choices and communications you request from us.
• Technical and security information such as IP address, browser/device information, request logs and fraud-prevention signals.
• Cookie and similar-technology choices. Consent evidence stores hashed network and browser identifiers rather than the raw values.

3. Why we use information

We use personal information to provide the storefront, maintain accounts and shopping bags, process and deliver orders, handle returns, provide customer support, secure the service, prevent fraud, maintain business and tax records, improve operations, and send communications you request.

Depending on the activity and applicable law, processing is based on performing a contract or taking requested pre-contract steps, complying with legal obligations, Zamisha’s legitimate interests in operating and securing the service, or your consent. Consent may be withdrawn at any time without affecting earlier lawful processing.

4. Who receives information

We disclose only what is reasonably necessary to service providers supporting hosting, security, communications, delivery, payment processing, customer support and professional advice. Delivery details may be shared with couriers; transaction details may be shared with payment providers and financial institutions.

The storefront currently obtains font files from Google Fonts. That request can disclose basic connection information, such as an IP address and browser details, to Google. We treat presentation of the storefront as a necessary operational purpose and do not use that request for advertising.

We may also disclose information when required by law, to protect customers or the service, or in connection with a genuine business reorganisation. We do not sell personal information.

5. International processing

Some technology or service providers may process information outside Pakistan. Where applicable, we use contractual, organisational or other recognised safeguards and limit the information transferred to what the service requires.

6. How long information is kept

We keep information only for as long as required for the purpose collected, applicable legal and accounting obligations, dispute resolution and security. Order and payment records are retained for the applicable commercial and tax record period. Account information is retained while the account is active and for a reasonable period afterward. Newsletter information is retained until unsubscribe or suppression is required. Consent records are scheduled for deletion after their evidence-retention period.

Backup copies and security logs may remain for a limited additional period before secure deletion or anonymisation.

7. Your choices and rights

Subject to applicable law, you may ask to access, correct, update or delete personal information; object to or restrict certain processing; withdraw consent; and request a portable copy where relevant. We may need to verify your identity and may retain information where law or legitimate legal claims require it.

You can change optional browser-storage choices at any time through Cookie settings. You may unsubscribe from marketing messages using the option in the message or by contacting us.

8. Security

We use access controls, authentication, encrypted transport, password hashing, audit trails, data minimisation and operational controls intended to protect information. No internet service can guarantee absolute security, so customers should also protect account credentials and devices.

9. Children

The storefront is intended for adults able to enter a purchase contract. We do not knowingly seek personal information from children for behavioural advertising or profiling. A parent or guardian who believes a child provided information should contact us.

10. Policy changes and contact

We may update this policy when services, providers or legal requirements change. The effective date and version above identify the current notice. A material change to consent-based technologies will require a fresh choice.

Questions or privacy requests: privacy@zamisha.pk.