Privacy Policy

SahulatKar ("SahulatKar", "we", "us", or "our") operates a Shariah compliant Buy Now, Pay Later platform in Pakistan and is the data controller responsible for the personal data described in this policy. We are in the process of completing NADRA integration and Non Banking Finance Company (NBFC) licensing, either directly or through a licensed partner. This policy describes how we handle your data both during our current pre launch phase and once financing services are fully live.

If you have any question about this policy or about how your data is handled that is not answered here, section 16 explains how to reach us.

To keep this policy readable, a small number of terms are used throughout with a specific meaning, set out below. Any term capitalised in this policy that is not defined here carries the meaning given to it in our Terms of Service.

• "Personal data" means any information that identifies you or could reasonably be used to identify you, directly or indirectly.
• "Processing" means anything done with personal data, including collecting, storing, using, sharing, and deleting it.
• "KYC" means Know Your Customer, the identity verification process required before we can offer you financing.
• "Merchant" means the third party website or seller whose product page you link to when requesting financing.
• "Platform" means our website, mobile experience, and any related services operated by SahulatKar.

While SahulatKar is in pre launch, joining our waitlist, registering interest, or making a pre booking means we collect only your name, phone number and/or email address, and city. We use this information solely to notify you when we launch and, only if you have agreed to receive them, to send you product updates beforehand. We do not run credit checks and we do not collect CNIC data at this stage, because no financing decision is being made yet.

Once financing services are live and you apply to finance a purchase, we collect a wider set of personal data, described in the categories below. We only collect what is needed for the purpose stated against each category.

Identity details

Your full legal name, father's name, CNIC number and expiry date, date of birth, and residential address, collected during KYC and used to confirm you are eligible to use our services and to meet our regulatory obligations.

Verification media

Photographs of your CNIC, front and back, together with a short liveness verification video or selfie, cross checked against NADRA's records to confirm the identity document belongs to the person applying.

Device and contact data

Your phone number, a device fingerprint, and your IP address, used to secure your account and to detect and prevent fraud, including attempts to open more than one account.

Enhanced due diligence, for larger orders

For larger orders, or where our risk assessment calls for closer review, proof of income, details of a connected bank or mobile wallet account, and details of any existing loans or financing you choose to disclose to us.

References

The name, CNIC number, phone number, and address of at least two personal references, required for the Borrower Fact Sheet that applicable NBFC regulation obliges us to keep on file. We do not contact your references unless we are unable to reach you directly about your own account, and even then only for that limited purpose.

Transaction data

The products and orders you finance, your payment history, and your communications with our Support team, used to manage your financing plan and to help us if you ever raise an issue with an order.

We use the personal data described above to:

• Verify your identity and confirm you meet our eligibility requirements.
• Assess your creditworthiness and set or adjust your credit limit.
• Detect and prevent fraud, including duplicate account attempts.
• Purchase items on your behalf in our capacity as your Wakeel, or purchasing agent, under your Wakalah agreement.
• Generate, manage, and enforce your Wakalah and Murabaha contracts.
• Collect payments and send you payment reminders and account notifications.
• Comply with our regulatory obligations, including those of the SECP and, once applicable, the State Bank of Pakistan.
• Respond to your questions and support requests.
• Send you marketing communications, but only where you have given your consent to receive them.

We only process your personal data where we have a proper basis to do so. In most cases that basis is one of the following: processing is necessary to enter into or perform a contract with you, such as your Wakalah or Murabaha agreement; processing is necessary to comply with a legal or regulatory obligation we are subject to, such as recordkeeping rules set by the SECP; processing is necessary for our legitimate interests, such as preventing fraud, provided those interests are not overridden by your own rights; or you have given your clear consent, which applies specifically to marketing communications and can be withdrawn at any time as described in section 11.

Sensitive fields, including your CNIC number, bank or IBAN details, and payment card data, are individually encrypted using AES 256 encryption at the database level, rather than relying on general access controls alone, with encryption keys managed through a dedicated key management service. Data in transit between your device and our servers is encrypted using TLS. Card numbers are never shown in full in any internal log or report, and access to sensitive fields is limited to staff and systems that genuinely need it to perform their function.

We share identity and transaction data only with the parties needed to deliver our service, and never sell your personal data to third parties for their own marketing purposes.

• NADRA, for identity verification against your CNIC record.
• Our KYC and liveness verification vendor, to confirm your identity documents and selfie match.
• Payment processors, which may include Safepay, JazzCash, Easypaisa, Raast connected institutions, and our card issuing partner, to process your payments and issue the secure single use card used for your purchase.
• Delivery and tracking providers, so we and you can see the status of your order.
• Regulators, including the SECP and, once we are licensed, the State Bank of Pakistan, where we are legally required to share information with them.

Our primary infrastructure and the vendors listed in section 8 are chosen with a preference for data being stored and processed within Pakistan wherever practical. Where a service provider processes data outside Pakistan, we require them to provide a comparable standard of protection to the one described in this policy before we share any personal data with them.

We retain NADRA verification records for 7 years, consistent with SECP recordkeeping requirements. KYC images are retained for 1 year in active storage and are then moved to long term archival storage rather than deleted outright, reflecting that same regulatory basis. Contract and payment records are retained for the life of your financing plan, plus a post completion period required for audit and dispute purposes.

Pakistan does not yet have a fully enacted general data protection law. As of this policy's effective date, the Personal Data Protection Bill remains in draft form. We apply the retention and security practices described in this policy voluntarily, ahead of that law taking effect, and we will update this policy if and when that changes our obligations.

You can review your identity information from your account profile once your KYC is complete, and you can opt in or out of marketing communications from your notification preferences at any time. You may also request a copy of the personal data we hold about you, or ask us to correct or delete it, by contacting us using the details in section 16.

Some records, particularly NADRA and KYC data, may need to be retained for the periods described in section 10 even after a deletion request, because we remain subject to the regulatory obligations that require us to keep them. Where that applies, we will tell you which records cannot yet be deleted and why.

Part of assessing your eligibility for financing, and setting or adjusting your credit limit, is carried out by an automated system that evaluates the information described in section 4 against our risk policies. If an automated decision results in your application being declined or your credit limit being set lower than you expected, you may contact Support using the details in section 16 to ask for that decision to be reviewed.

Our website uses essential cookies to keep you signed in and to remember your session, and basic analytics cookies to understand how the site is used and where it can be improved. We do not use cookies for third party advertising, and we do not sell information collected through cookies to advertisers.

SahulatKar's services are not directed at, and may not be used by, anyone under the age of 18. If we become aware that we have collected personal data from someone under 18, we will take steps to delete that data as soon as reasonably possible.

We may update this policy as our services and regulatory obligations evolve. When we do, we will post the updated version on this page with a new effective date, and where a change is material we will also notify you through the app or by SMS or email before it takes effect.

If you have a question about this policy, or you would like to exercise any of the rights described in section 11, get in touch using the details below.

You can reach us by email at chat.sahulatkar@gmail.com, by WhatsApp at +92 307 9556246, or by writing to our office at A.K. Brohi Road, Sector H11/4, FAST NUCES, Islamabad, Pakistan.