Master Privacy Policy

This Privacy Policy establishes the foundational principles for the collection, processing, storage, transfer, and protection of Personal Data by ONVIRA. It applies to all digital assets, websites, customer portals, software applications, APIs, and administrative services operated by ONVIRA.

This document is structured to provide our legal and administrative teams with a clear operational standard while ensuring full compliance with Pakistani statutory regulations and international best practices for data privacy.

ONVIRA as a Data Controller

ONVIRA acts as a Data Controller when determining the purpose and means of processing personal data for:

• Account creation, billing details, and corporate client profiles.
• Direct customer support inquiries and business development records.
• Website analytics, server security logs, and employment applications.

ONVIRA as a Data Processor

ONVIRA acts as a Data Processor when processing data strictly on behalf of corporate clients using our platforms:

• Client-uploaded contact lists, databases, and customer records.
• Transmitted message payloads, chat histories, and campaign records.
• System integration tokens and third-party API configurations.

ONVIRA adheres strictly to the principle of Data Minimization - collecting only data that is directly necessary for providing, securing, and improving our services.

Account & Identity Information

• Data Points: Full Name, Business Email Address, Mobile Phone Number, Business Name, National Tax Number (NTN) or corporate identification numbers, and Billing Address.
• Purpose: Verification, service delivery, contractual performance, tax compliance, and billing.

Technical & Telemetry Data

• Data Points: IP Address, Device Type, Browser Version, System Access Timestamps, and Error Diagnostics.
• Purpose: System security, fraud detection, server load balancing, and compliance with PECA 2016 security standards.

Explicitly Prohibited Practices

To maintain commercial integrity and prevent regulatory liability:

• ONVIRA does not collect continuous background GPS coordinates, Bluetooth environment scans, or local network/WiFi access point mapping.
• ONVIRA does not engage in invasive behavioral tracking such as mouse trajectory recording or background audio/video scraping.

ONVIRA respects electronic communication standards and mandates total compliance with PTA guidelines regarding commercial dispatches:

• Opt-In Mandate: Commercial communications (SMS, WhatsApp, Email) are transmitted only after obtaining prior verifiable consent.
• DND Registry Integrity: ONVIRA honors all subscriber registrations on PTA's Do Not Call / Do Not Disturb (DND) lists. Account creation with ONVIRA does not forfeit a user's legal protection under telecom anti-spam regulations.
• Unconditioned Opt-Out: Every automated marketing dispatch contains a direct, single-click opt-out mechanism (e.g., Unsubscribe link or STOP reply keyword), which immediately suppresses the recipient's record permanently from marketing lists.

Server Architecture and External Processing

Where ONVIRA utilizes cloud infrastructure or third-party service nodes located outside of Pakistan:

• Contractual Guarantees: Standard Contractual Clauses (SCCs) and data protection addenda are executed with all cloud infrastructure providers.
• Data Residency Alignment: Client records containing sensitive corporate or personal details are subject to risk assessments in compliance with local data localization guidelines.
• Encryption Standards: All data in transit is protected via TLS 1.3 encryption, and data at rest is secured using AES-256 cryptographic standards.

Retention Schedule

• Active Accounts: Data is retained for the duration of the active contractual relationship.
• Financial & Tax Records: Retained for a mandatory statutory period (up to 6 years) to satisfy corporate and tax filing requirements.
• Processor Payload Data: Deleted or anonymized within 30 days of subscription termination or upon explicit written client request.

Cyber Incident & Breach Management (PECA Alignment)

In the event of a confirmed security incident impacting personal data:

• Containment: Technical teams isolate affected nodes within 2 hours of detection.
• Internal Escalation: Legal and compliance officers assess the scope of disclosure.
• Notification: Affected Data Controllers/Users and relevant statutory bodies (such as the NCCIA or PTA where mandated) will be notified without undue delay, providing actionable remediation guidance.

ONVIRA acknowledges and enforces the statutory rights of individual Data Subjects:

• Right to Access: Obtain confirmation and copies of personal data held by ONVIRA.
• Right to Rectification: Request immediate correction of inaccurate or incomplete records.
• Right to Erasure (Right to be Forgotten): Request deletion of data where processing is no longer required by law or contract.
• Right to Restriction & Object: Limit or object to direct processing or marketing activities.
• Right to Data Portability: Receive personal data in a structured, standard format.

This document serves as the operational baseline for ONVIRA's legal, technical, and administrative operations.

• Internal Review Cycle: Annual / Semi-Annual upon issuance of new PTA/NCCIA directives or enactment of the Personal Data Protection Bill.

Operational Contact

Legal & Compliance Team - ONVIRA

Email

legal@onvira.com / privacy@onvira.com