Privacy Policy

What we collect

When you use the Contact form, we collect what you type in: your name and phone number, plus, if you give them, your email, business or organization name, business type, number of branches, and your message. We also record which product and request type you're asking about and which page of this site you came from. We don't ask for anything beyond that on this site.

Why we collect it, and on what basis

We use it to respond to your enquiry and tell you about Aboha's products, and — only if you say yes — to follow up with updates about Aboha and FBR (Federal Board of Revenue) compliance. Our lawful basis is your consent: submitting the form is an opt-in action, and any follow-up communication carries a clear way to opt out.

Who we share it with

We use a small number of service providers ("processors") to run this website and get back to you. We never sell or rent your information to anyone else.

Cloudflare

Website hosting, spam protection (Turnstile), and privacy-friendly Web Analytics.

Neon

The Postgres database that stores your lead or contact submission.

Resend

Sends the email notification that tells our team you've been in touch.

Google Analytics

Only loaded if you accept analytics cookies. Off by default, and never required to use this site.

How long we keep it

We keep contact and lead submissions for up to 24 months from your last contact with us, then delete or anonymize them — unless the law requires us to keep them for longer or you ask us to delete them sooner.

Your rights

You can ask what information we hold about you, ask us to correct it, or ask us to delete it, at any time. Reach us through the Contact page below or on WhatsApp, and we'll act on your request without unreasonable delay.

Electronic communications (PECA)

Any marketing message we send follows Pakistan's Prevention of Electronic Crimes Act 2016 (PECA): we only send it if you've opted in, and every message carries a clear way to unsubscribe.

Looking ahead

Pakistan's Personal Data Protection framework is still progressing toward law. We're already designing to that standard — a clear lawful basis, purpose limitation, a defined retention window, and a deletion path — and we follow GDPR principles (access, correction, deletion) for visitors in the EU.

Keeping it safe

Everything you send us travels over HTTPS. Your data sits with processors chosen for their own security commitments, and only the smallest team necessary can access it.

Changes to this policy

If we materially change how we handle your data, we'll update this page and move the "Last reviewed" date above.