This policy explains what personal and sensitive user data ZAK Holdings collects through its website and mobile application, why we collect it, who we share it with, how long we keep it, and how you can have it deleted. It is written to meet the disclosure requirements of the Google Play User Data policy, the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).
01Who we are
ZAK Holdings (“ZAK Holdings”, “we”, “us”, “our”) is a master planning, development and investment company registered in Pakistan, with its office at Razia Sharif Plaza, 3rd Floor, Islamabad, 44000, Pakistan.
ZAK Holdings is the data controller responsible for the personal information described in this policy. For any privacy matter, contact us at privacy@zakholdingspk.com or +92 300 762 4815.
In this policy, “Services” means the website at zakholdingspk.com and the ZAK Holdings mobile application distributed through Google Play.
02Data we collect
We collect only what the Services need in order to function and to respond to you. The categories below correspond to the data types declared in our Google Play Data safety form.
| Data type | Examples | Collected | Shared |
|---|---|---|---|
| Personal identifiers | Name, organisation, job title | Yes — when you submit them | No |
| Contact details | Email address, telephone number, postal address | Yes — when you submit them | No |
| Messages | Enquiry text, site details, documents you attach | Yes — when you submit them | No |
| App activity | Screens viewed, features used, session length | Yes — in the app, in aggregate | Yes — analytics provider |
| Diagnostics | Crash logs, device model, OS version, app version | Yes — in the app | Yes — crash reporting provider |
| Approximate location | Country or region derived from IP address | Yes | No |
| Precise location | GPS coordinates | No | No |
| Financial information | Card or bank details | No | No |
| Photos, contacts, calendar, SMS, call logs | — | No | No |
| Health, biometric or other sensitive data | — | No | No |
The enquiry form on our website does not store data on this site: it opens your own email client with a pre-filled message that you choose whether to send. We receive that information only if you send it.
We do not sell personal information, and we do not use personal information for advertising, profiling or automated decision-making.
03Why we collect it
- To answer you. Names, contact details and messages are used to respond to enquiries, prepare proposals and manage professional relationships.
- To operate the app. App activity and diagnostics are used to keep the application stable, diagnose crashes and improve usability.
- To keep the Services secure. Technical logs, including IP-derived approximate location, are used to detect abuse and protect against fraud.
- To meet legal obligations. Certain records are retained where accounting, tax or regulatory rules require it.
Our lawful bases under the GDPR are: your consent (where you volunteer information), our legitimate interests in operating and securing the Services, the performance of a contract where one exists, and compliance with legal obligations.
04Permissions requested by the app
The ZAK Holdings mobile application requests the minimum permissions needed for its features. Each is optional in the sense that the app remains usable if you decline, though the related feature will not work.
- Internet / network state — required to load project content and submit enquiries.
- Storage (scoped) — used only to save documents you explicitly choose to download.
- Camera — used only if you choose to attach a site photograph to an enquiry. Images are not accessed in the background.
- Notifications — used only if you opt in, to notify you about a project you follow.
You can withdraw any permission at any time in your device settings.
05How we share information
We do not sell, rent or trade personal information. We share it only in these circumstances:
- Service providers. Hosting, email, analytics and crash-reporting providers that process data on our instructions under written agreements.
- Professional advisers. Lawyers, auditors and insurers, where necessary and confidential.
- Project partners. Where you have asked us to act on a commission, and only the information needed to act.
- Legal requirement. Where required by law, court order or a lawful request from a public authority.
- Business transfer. If our business is restructured or transferred, subject to this policy continuing to apply.
06Third-party services
The Services rely on a small number of third parties, each with its own privacy policy:
- Google Fonts — serves the typeface used on this website; receives your IP address as part of the request.
- Image content delivery network — serves photography on this website; receives your IP address as part of the request.
- Analytics and crash reporting (mobile app only) — receives aggregated app activity and diagnostic data associated with a resettable identifier, not with your name.
- Google Play — distributes the application and processes installation and update data under Google’s own privacy policy.
07How long we keep data
| Enquiries that do not become projects | 24 months from last contact |
|---|---|
| Client and project records | 7 years after completion, for legal and professional purposes |
| App analytics and diagnostics | 14 months, then deleted or fully aggregated |
| Server and security logs | 90 days |
| Marketing consents | Until you withdraw consent |
When a retention period ends, data is deleted or irreversibly anonymised.
08Deleting your data
You may ask us to delete the personal information we hold about you at any time, whether or not you use the mobile application.
- i
Email privacy@zakholdingspk.com with the subject line “Data deletion request”, from the email address associated with your data, or write to our Islamabad office at the address below.
- ii
Tell us which data you want removed — all of it, or a specific enquiry, account or record.
- iii
We will confirm receipt within 5 business days and complete the deletion within 30 days, then confirm in writing.
In the mobile application you can also delete your account and its associated data from Settings → Account → Delete account. Deleting the account removes your profile, saved projects and enquiry history. Backups containing residual copies are overwritten on a rolling 90-day cycle.
We may retain a minimal record where law requires it — for example, transaction records kept for tax purposes. We will tell you if that applies and what is retained.
09Security
All traffic between your device and our Services is encrypted in transit using HTTPS/TLS. Data at rest is stored on access-controlled infrastructure, and access is limited to personnel who need it for their work. We apply the principle of least privilege, review access periodically and require confidentiality undertakings from staff and contractors.
No system is perfectly secure. If a breach affects your personal information and is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority without undue delay, and in any event within 72 hours of becoming aware of it where the law requires.
10International transfers
We are based in Pakistan and use service providers that may process data in the European Union, the United Kingdom, the United States and the Gulf. Where personal data is transferred out of a jurisdiction that restricts transfers, we rely on appropriate safeguards — typically the European Commission’s Standard Contractual Clauses or an equivalent mechanism — and require providers to maintain a level of protection consistent with this policy.
11Your rights
Subject to your jurisdiction, you have the right to:
- Access the personal data we hold about you
- Correct data that is inaccurate or incomplete
- Delete your data (see section 08)
- Restrict or object to processing
- Receive your data in a portable format
- Withdraw consent at any time
- Opt out of the sale or sharing of personal information — we do neither
- Be free from discrimination for exercising these rights
To exercise any right, email privacy@zakholdingspk.com. We respond within 30 days and do not charge a fee for reasonable requests. If you are in the EU or UK and are unsatisfied with our response, you may lodge a complaint with your national data protection authority.
12Children
Our Services are directed at professional and commercial audiences and are not intended for children under 13 (or under 16 where local law sets a higher age). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact privacy@zakholdingspk.com and we will delete it promptly.
13Cookies and local storage
This website does not use advertising, tracking or profiling cookies. Where a strictly necessary cookie or local-storage entry is used — for example to remember a preference — it exists only to make the site work and is not shared. The mobile application stores a resettable identifier and your app preferences on your device; clearing app data removes them.
14Changes to this policy
We update this policy when our practices change. The effective date at the top of this page always reflects the current version. Material changes — for example a new category of data or a new recipient — are announced on this page and, where the change affects app users, through an in-app notice before it takes effect. Continued use of the Services after the effective date constitutes acceptance of the revised policy.
15Contact
Questions, requests and complaints about privacy should be addressed to:
ZAK Holdings
Razia Sharif Plaza, 3rd Floor
Islamabad, 44000
Pakistan
Within 30 days