Privacy Policy

1. Scope and status of this Policy

1. 1.1This Policy governs the processing of personal data by Perfect Care Foundation (the “Foundation”) in connection with the website pcf.org.pk and every sub-domain, form, application programming interface and electronic facility operated under it (the “Platform”), and in connection with donations, enquiries, subscriptions, volunteering and programme delivery.
2. 1.2Capitalised expressions not defined in this Policy bear the meanings given to them in the Terms and Conditions.
3. 1.3This Policy does not govern the processing of personal data by any third party, including a Payment Service Provider, a social-media platform or any site reached by a link from the Platform. Clause 21 applies to such destinations.
4. 1.4Where a specific Programme, appeal or form is accompanied by its own privacy notice, that notice supplements this Policy and prevails to the extent of any inconsistency in respect of that Programme only.

2. Identity of the controller

1. 2.1The Foundation determines the purposes and means of the processing described in this Policy and is accordingly the controller of that processing. Its registered office is WS-17, Sector 16-B, North Karachi Industrial Area, Karachi, Sindh, Pakistan.
2. 2.2Enquiries concerning this Policy, and any request made under Clause 14, must be addressed to info@pcf.org.pk bearing the subject line “Data Protection Request”. An enquiry submitted through any other channel is not treated as a formal request and time does not begin to run against it.
3. 2.3The Foundation has designated a member of its administrative staff to receive and co-ordinate the handling of privacy enquiries. That person is contactable through the address in Clause 2.2.

3. The legal framework we apply

1. 3.1Our processing is nevertheless constrained by, and this Policy is framed by reference to: Article 14 of the Constitution of the Islamic Republic of Pakistan, which protects the dignity of man and the privacy of the home; the Prevention of Electronic Crimes Act, 2016, which criminalises unauthorised access to, and unauthorised disclosure of, information systems and data; the Electronic Transactions Ordinance, 2002; the obligations of confidence arising at common law and in equity; and the record-keeping, reporting and customer-due-diligence obligations imposed by the Anti-Money Laundering Act, 2010, the Income Tax Ordinance, 2001 and the Companies Act, 2017.
2. 3.2We have elected, as a matter of internal governance rather than statutory compulsion, to apply the substantive principles of purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability, to all processing described in this Policy.
3. 3.3Upon the enactment of any general data protection legislation in Pakistan, this Policy will be revised to reflect the statutory rights and obligations then arising, and the revision will be published under Clause 22.

4. Definitions

“Personal Data” — Any information relating to an identified or identifiable natural person, whether recorded in electronic or physical form, including any identifier by reference to which such a person may reasonably be distinguished.

“Processing” — Any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, transmission, alignment, restriction, erasure and destruction.

“Processor” — A person who processes Personal Data on behalf of, and upon the documented instructions of, the Foundation.

“Sensitive Data” — Personal Data revealing health or medical condition, financial distress or destitution, religious designation of a contribution, biometric identifiers, national identity particulars, or the circumstances of a Beneficiary’s need.

“Technical Data” — Data generated automatically by the interaction between your device and our systems, including internet protocol address, user-agent string, request path, timestamp and referring resource.

5. Categories of data we process

We process the following categories, and only the following categories, in the ordinary course.

1. 5.1Sensitive Data is processed only where it is necessary for the assessment or delivery of assistance, for the discharge of a legal obligation, or with the explicit consent of the person concerned, and is subject to restricted internal access.
2. 5.2Where a field on a form is marked optional, the consequence of not completing it is limited to our reduced ability to acknowledge, receipt or follow up your Contribution. Where a field is mandatory, we cannot complete the Transaction or enquiry without it.

6. Data we expressly do not collect

1. 6.1We do not purchase, rent, licence or otherwise acquire marketing lists or donor data from data brokers.
2. 6.2We do not sell, rent, licence or trade Personal Data. This has no exception. The disclosures permitted by Clause 10 are made for the operational and legal purposes there stated and are not, in any circumstance, made for consideration.
3. 6.3We do not process Personal Data for the purpose of political profiling, credit scoring, insurance underwriting, or behavioural advertising to third parties.

7. Sources of data

1. 7.1Directly from you, when you complete a form, make a Contribution, correspond with us, register an account, or apply to volunteer or for assistance.
2. 7.2Automatically, through server logs, security logs and cookies, when you interact with the Platform.
3. 7.3From Payment Service Providers, who return transaction outcomes, settlement records and limited payment metadata to us.
4. 7.4From third parties acting on your instruction, where a Contribution is made on your behalf by an employer, a family member or a fundraising platform.
5. 7.5From community referrals, field staff and partner institutions, in the case of Beneficiary data, and from publicly available sources where due diligence requires it.

8. Purposes and lawful bases

1. 8.1Where we rely on a legitimate interest, we have assessed that interest against your interests, rights and reasonable expectations, and have concluded that the processing is proportionate and not unduly intrusive. You may require a summary of that assessment under Clause 14.
2. 8.2We will not use Personal Data for a materially different purpose without first notifying you and, where the basis is consent, obtaining it afresh.

9. Consent and its withdrawal

1. 9.1Where processing rests upon your consent, that consent is sought by a clear affirmative act, is recorded together with its date, and is never inferred from silence, inactivity or a pre-ticked box.
2. 9.2You may withdraw consent at any time by writing to info@pcf.org.pk or by using the unsubscribe facility in any marketing communication. Withdrawal takes effect prospectively and does not affect the lawfulness of processing carried out before it.
3. 9.3Withdrawal of consent does not oblige us to erase data that we are required by law to retain, or that we hold on a basis other than consent. Clause 12 governs retention in that event.

10. Disclosure and recipients

We disclose Personal Data only to the following classes of recipient, and only to the extent necessary for the stated purpose.

1. 10.1Payment Service Providers and banks, for the initiation, authorisation, settlement, reconciliation, refund and dispute handling of Transactions.
2. 10.2Hosting and infrastructure providers, who store the Platform’s files and database under contract and upon our instructions.
3. 10.3Software and service providers engaged as Processors, including the donation-management, email-delivery, analytics and backup services we use to operate the Platform.
4. 10.4Professional advisers, being our auditors, accountants, bankers and legal advisers, each of whom is subject to a duty of confidence.
5. 10.5Programme partners and implementing institutions, where the delivery of assistance to a Beneficiary requires it, and subject to written confidentiality undertakings.
6. 10.6Regulatory, tax, law-enforcement and judicial authorities, where disclosure is required by Applicable Law, by court order, or in response to a lawful demand. We satisfy ourselves as to the lawfulness of any such demand and disclose no more than it requires.
7. 10.7A successor entity, upon any amalgamation, reconstitution or transfer of the Foundation’s undertaking to a body with substantially similar charitable objects, subject to that body assuming the obligations in this Policy.
8. 10.8Every Processor is bound by contract to process Personal Data only upon our documented instructions, to apply appropriate security measures, to impose equivalent obligations upon any sub-processor, and to return or destroy the data upon termination of its engagement.
9. 10.9We publish aggregated and anonymised statistics concerning donations and programme outcomes. Such statistics are not Personal Data and are not subject to this Policy, provided no individual is reasonably identifiable from them.

11. Cross-border transfer

1. 11.1Certain Processors on which the Platform relies, including hosting, email-delivery, font and content-delivery and analytics services, operate infrastructure situated outside Pakistan. Personal Data may accordingly be transferred to, stored in, and accessed from jurisdictions whose legal protections differ from those available in Pakistan.
2. 11.2Before engaging such a Processor we satisfy ourselves as to its security posture and contractual undertakings, and we require that it processes data only upon our instructions and applies protections no less protective than those described in this Policy.
3. 11.3By using the Platform you acknowledge that transfers of this nature are inherent in the operation of an internet-facing service and consent to them for the purposes described.

12. Retention schedule

We retain Personal Data for no longer than is necessary for the purpose for which it was collected, subject to the minimum periods that law imposes upon us.

1. 12.1Where a record is subject to an unresolved dispute, investigation or legal proceeding, retention is extended until the matter is concluded and any appeal period has expired.
2. 12.2On expiry of the applicable period, records are securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for statistical and historical purposes.

13. Security measures

1. 13.1We apply technical and organisational measures proportionate to the risk, including transport-layer encryption of all traffic to and from the Platform, cryptographic hashing of stored credentials, restriction of administrative access paths, role-based access control, logging of privileged and security-relevant events, timely application of security updates, and periodic backup with restoration testing.
2. 13.2Access to Personal Data within the Foundation is restricted to those personnel whose functions require it, each of whom is subject to a contractual duty of confidence that survives the end of their engagement.
3. 13.3The exclusion of card data described in Clause 6 is itself a security control: data never received cannot be compromised in our custody.
4. 13.4No system connected to a public network can be guaranteed impenetrable. While we take the measures described, we cannot and do not warrant absolute security, and transmission of data to us over the internet is at your own risk. You are responsible for maintaining the confidentiality of your own credentials and the security of your own device.

14. Your rights

1. 14.1Access. To be told whether we process Personal Data concerning you and, if so, to receive a copy of it together with the information set out in this Policy.
2. 14.2Rectification. To have inaccurate Personal Data corrected and incomplete data completed.
3. 14.3Erasure. To have Personal Data deleted where it is no longer necessary for the purpose for which it was collected, where consent has been withdrawn and no other basis applies, or where it has been processed unlawfully — subject always to the retention obligations in Clause 12.
4. 14.4Restriction. To require that processing be suspended while the accuracy of data, or the validity of our basis for processing it, is being verified.
5. 14.5Objection. To object to processing founded upon legitimate interest, and to object at any time and without qualification to processing for direct marketing.
6. 14.6Portability. To receive the Personal Data you supplied to us in a structured, commonly used and machine-readable format.
7. 14.7Withdrawal of consent. As described in Clause 9.
8. 14.8Exercising a right. A request must be made to info@pcf.org.pk and must contain sufficient information to identify you and to identify the data or processing concerned. We will verify your identity before acting, because acting on an unverified request would itself be a breach of the rights of the person whose data is held.
9. 14.9Timeline. We acknowledge a request within seven (7) Business Days and respond substantively within thirty (30) Business Days. Where a request is complex or numerous we may extend that period by a further thirty (30) Business Days, informing you of the extension and the reason for it.
10. 14.10Charge. No charge is made for a request. Where a request is manifestly unfounded, excessive or repetitive we may charge a reasonable administrative fee or decline to act, giving written reasons in either case.

15. Children and vulnerable persons

1. 15.1The Platform is not directed at children and we do not knowingly collect Personal Data from a child in the capacity of a Donor or account holder.
2. 15.2Where we become aware that we hold such data otherwise than in the capacity described in Clause 15.3, we delete it without undue delay. A parent or guardian who believes a child has supplied data to us should write to info@pcf.org.pk.
3. 15.3Children are necessarily the subjects of Beneficiary data in our educational, nutritional and medical Programmes. Such data is collected from a parent, guardian or responsible institution, is restricted to what the assistance requires, is subject to heightened access restriction, and is never used for fundraising imagery except in accordance with Clause 16.

16. Beneficiary and photographic data

1. 16.1The dignity of a Beneficiary is not a tradeable asset of the Foundation. Beneficiary data is collected for assessment and delivery, not for solicitation, and is disclosed to donors only in aggregated or anonymised form unless the Beneficiary has given specific, informed and freely given consent to identified disclosure.
2. 16.2A photograph or recording in which a Beneficiary is identifiable is used in published material only where consent has been obtained from that person, or from a parent or guardian in the case of a child, and where the use does not portray the subject in a degrading or exploitative manner.
3. 16.3Consent to photographic use may be withdrawn, whereupon we cease further publication and remove the image from material within our control. We cannot recall material already distributed to third parties or printed.
4. 16.4Where the Platform uses a representative or stock image rather than a photograph of an actual Beneficiary, the Legal Disclaimer records that fact.

17. Personal data breach

1. 17.1We maintain an incident-response procedure covering detection, containment, assessment, notification and remediation.
2. 17.2Where a breach occurs that is likely to result in significant risk to affected persons, we will notify those persons without undue delay, describing the nature of the breach, the categories of data affected, the likely consequences, the measures taken, and the steps we recommend they take.
3. 17.3We will notify competent authorities where Applicable Law requires it, and will co-operate with any resulting investigation.
4. 17.4A suspected breach, vulnerability or unauthorised disclosure may be reported to info@pcf.org.pk. We do not pursue legal action against a person who reports a vulnerability in good faith, who does not exploit it beyond the minimum necessary to demonstrate it, who does not access or exfiltrate the data of others, and who affords us a reasonable opportunity to remediate before disclosure.

18. Automated processing and profiling

1. 18.1We do not take decisions producing legal or similarly significant effects concerning you on the basis of automated processing alone.
2. 18.2Automated screening is applied to Transactions for the purposes of fraud detection, sanctions screening and anti-money-laundering compliance. A determination adverse to you arising from such screening is reviewed by a person before it is acted upon, save where immediate action is required by law.
3. 18.3We may segment donors by contribution history and stated preference in order to direct relevant communications. Such segmentation does not produce a legal effect and may be objected to under Clause 14.5.

19. Cookies and tracking

1. 19.1The Platform uses cookies and comparable technologies. The categories deployed, their purposes, their duration and the means of controlling them are set out in the Cookie Policy, which forms part of this Policy.
2. 19.2Strictly necessary cookies are set without consent because the Platform cannot function without them. Every other category is set only upon your consent.

20. Marketing communications

1. 20.1We send newsletters, appeals and programme updates only to persons who have asked to receive them.
2. 20.2Every such communication carries a functioning unsubscribe facility. Unsubscription is actioned promptly and in any event within ten (10) Business Days.
3. 20.3Transactional messages — receipts, acknowledgements, mandate notices, grievance responses and security notifications — are not marketing, are necessary to the administration of your Contribution, and continue to be sent notwithstanding unsubscription from marketing.
4. 20.4We retain a suppression record of unsubscribed addresses for the sole purpose of ensuring that they are not contacted again.

21. Third-party destinations

1. 21.1Where you follow a link from the Platform to a third-party resource, or complete a payment on a page operated by a Payment Service Provider, the processing of your data at that destination is governed by that party’s own privacy policy, which you should read.
2. 21.2We are not responsible for, and do not control, the privacy practices of any such destination, and the inclusion of a link is not an endorsement of them.

22. Amendment of this Policy

1. 22.1We may amend this Policy at any time by publishing a revised version bearing a new version number and effective date.
2. 22.2Where an amendment materially alters the purposes of processing, the categories disclosed, or your rights, we will take reasonable steps to bring it to the attention of persons whose contact details we hold before it takes effect.
3. 22.3Superseded versions are archived and may be requested under Clause 24.

23. Complaints and escalation

1. 23.1A complaint concerning our processing of Personal Data should be sent to info@pcf.org.pk with the subject line “Privacy Complaint”, setting out the facts, the data concerned and the outcome sought.
2. 23.2We acknowledge within seven (7) Business Days and issue a reasoned determination within thirty (30) Business Days.
3. 23.3If you remain dissatisfied you may request internal review by the Foundation’s governing body, and you retain the right to pursue any remedy available to you before a competent authority or court, including proceedings under the Prevention of Electronic Crimes Act, 2016, where the circumstances warrant it.

24. How to contact us

Perfect Care Foundation — Data Protection Enquiries
WS-17, Sector 16-B, North Karachi Industrial Area, Karachi, Sindh, Pakistan

Email: info@pcf.org.pk (subject line: “Data Protection Request”)
Telephone: 021-36924455

Corporate Universal Identification Number: to be confirmed