Privacy Policy

1. Who we are

This Privacy Policy is issued by Bech ("Bech", "we", "us"), the operator of bech.pk and its associated mobile applications (the "Platform"). We are the data controller for the personal information described below.

2. Information we collect

We collect information in the following ways:

a. Information you give us

• Account details: full name, phone number, email address, password (stored hashed, never in plain text).
• Profile details: avatar, city/town/area, notification preferences.
• KYC and verification: CNIC number, front and back CNIC images, and any additional documents you submit to become a verified seller or verified shop.
• Listings: the title, description, price, photos, and category of anything you post.
• Messages and offers: the content of chats you send through the Platform, including voice notes and negotiated offer amounts.
• Payments: proof-of-payment images and bank reference numbers submitted for boosts and dealer subscriptions. We do not store your full card, wallet, or bank credentials.

b. Information we collect automatically

• Device and log data: IP address, device type, operating system, app version, browser type, and pages/features you interact with.
• Location: the city, town, and area you choose. If you use the "use my location" feature, approximate GPS coordinates.
• Cookies and similar technologies: for session management, remembering preferences, and analytics.

c. Information from third parties

• Sign-in providers: if you sign in with Google, we receive your name and email address as authorised by you.
• Payment gateways: confirmation of successful payments (not your card or wallet details).

3. Why we use your information

We process your data for the following purposes:

• Creating and operating your account.
• Displaying your listings to buyers and connecting you with them.
• Verifying your identity (KYC) to prevent fraud and impersonation.
• Sending you transactional notifications (new messages, offers, listing expiry, KYC status) by in-app notification, email, SMS, or WhatsApp — subject to your channel preferences.
• Preventing spam, abuse, harassment, and prohibited listings.
• Responding to your queries and complaints.
• Complying with lawful requests from Pakistani authorities under PECA 2016, the Code of Criminal Procedure 1898, and other applicable law.
• Improving the Platform through anonymised, aggregated analytics.

4. Legal basis for processing

We process your personal data under one or more of the following lawful bases:

• Consent — when you sign up, opt into marketing, or choose to submit KYC documents.
• Contract — to provide the services you asked for (listing your item, delivering messages, processing boosts).
• Legitimate interest — fraud prevention, safety, product improvement.
• Legal obligation — responding to lawful court orders, requests from the Federal Investigation Agency's Cyber Crime Wing, or requirements under PECA 2016.

5. Sharing your information

We do not sell your personal information. We share it only:

• With other users, where you choose to share it. Your name, city, verification badge, avatar, and phone number (if you enable "share phone with buyers" on a listing) are visible to signed-in users who view your listing.
• With service providers who help us operate the Platform — including hosting, email delivery, WhatsApp Business API providers, SMS providers, error monitoring (Sentry), and analytics. These providers act on our instructions and are contractually bound to protect your data.
• With payment gateways processing your dealer subscription or boost payment.
• With courts or law-enforcement authorities when we receive a lawful order, or where disclosure is necessary to prevent imminent harm.
• With a successor entity in the event of a merger, acquisition, or restructuring, subject to equivalent privacy commitments.

6. Data storage and international transfers

Our primary databases are hosted on servers located in Pakistan wherever practical. Certain service providers (for example error monitoring or cloud email) may process limited data outside Pakistan. Where personal data is transferred abroad, we require the recipient to protect it to a standard equivalent to Pakistani law.

7. Cookies

We use first-party cookies to keep you signed in, remember your language / city / notification preferences, and to run privacy-safe analytics. You can disable cookies in your browser, but parts of the Platform may not work correctly if you do.

8. How we protect your data

• All traffic between you and Bech is encrypted in transit using TLS.
• Passwords are hashed with a strong one-way algorithm; we cannot read them.
• CNIC images and other sensitive documents are stored with restricted access.
• We log administrative actions on sensitive data (KYC review, moderation) for auditing.
• We regularly review our systems for vulnerabilities in line with reasonable industry practice.

No system can be guaranteed 100% secure. If you become aware of a possible security incident affecting your data, please write to security@bech.pk immediately.

9. How long we keep your data

• Active accounts: for as long as your account is open.
• Listings: while they are live, plus 90 days after they are sold, deleted, or expired, for dispute-resolution purposes.
• Chats and offers: while your account is open, plus 12 months after account closure or the message being deleted.
• KYC documents: until you are unverified, plus 5 years, in line with anti-fraud and record-keeping expectations.
• Payment records: 5 years, in line with the Income Tax Ordinance, 2001 and related regulations.
• Data required to comply with a lawful order will be kept as long as the order requires.

10. Your rights

Subject to Pakistani law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data (most fields can be edited from your profile).
• Delete your account and associated personal data (subject to legal retention).
• Withdraw consent to marketing communications at any time (via your notification preferences or the "unsubscribe" link).
• Object to processing that relies on our legitimate interest.
• Ask us not to share your phone number publicly on your listings (per-listing toggle).

To exercise these rights, write to privacy@bech.pk from the email registered with your account. We aim to respond within 15 working days.

11. Children's privacy

Bech is not intended for children under 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it.

12. Cyber-crime complaints

If you believe you have been the victim of a cyber crime (fraud, harassment, unauthorised access to your account, non-consensual sharing of your data), you may file a complaint with the Federal Investigation Agency's National Response Centre for Cyber Crime (NR3C) at complaint.fia.gov.pk or by calling 1991. We will cooperate with lawful investigations.

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will change and, for material updates, we will notify you through the Platform or by email. Please review this page periodically.

14. Contact us

For any privacy question, correction request, or complaint, please write to privacy@bech.pk. You may also use the Contact Us form and we will route your query to the right team.