Privacy Policy

1Who We Are

DropMandi ("we", "us", "our") is Pakistan's AI-powered dropshipping marketplace, operated at dropmandi.com. We connect buyers, sellers and dropshippers across Pakistan.

2Information We Collect

2.1 Information You Provide

• Registration Data: Full name, email address, phone number, city, province, password
• KYC Documents: CNIC number, CNIC front/back photos, selfie, business registration (for businesses)
• Bank Details: Bank name, account title, IBAN for payout processing
• Business Information: Business name, NTN number, SECP registration, GST number
• Product Listings: Product names, descriptions, images, videos, prices
• Order Information: Shipping address, phone, delivery instructions
• Communications: Complaints, tickets, chat messages with Dua AI

2.2 Information We Collect Automatically

• Location Data: City/province detected via browser geolocation (with your permission)
• Device Information: Browser type, operating system, device type
• Usage Data: Pages visited, products viewed, search queries, time spent
• IP Address: For security, fraud prevention and location detection
• Login Activity: Login times, login counts, last active date

Geolocation: We request your location during registration to auto-fill your city. This is optional and you can skip it. We never track your location continuously.

2.3 Information from Third Parties

• Payment processors (JazzCash, EasyPaisa) — transaction status only
• Courier companies (TCS, Leopard) — tracking information
• FBR — tax filer status verification
• Facebook/Meta — Public Profile (name, profile picture) and email address when you use Facebook Login See Section 12

3How We Use Your Information

4Information Sharing

We do NOT sell your personal data. We share data only in these circumstances:

• Between Buyers & Sellers: Shipping address and phone shared with seller for order fulfillment
• Dropshippers: See product info and order details — NOT buyer's personal contact details
• Payment Partners: Name, amount and transaction ID to JazzCash/EasyPaisa/bank
• Courier Partners: Name, phone and address to TCS/Leopard for delivery
• FBR (Federal Board of Revenue): Transaction data for tax compliance as legally required
• Law Enforcement: When required by Pakistani law, court order or FIA
• Fraud Prevention: With banks and financial institutions when fraud is suspected

We Never Share: Your CNIC details, bank account numbers, passwords, or Facebook/Meta personal data with any third party except as legally required by FBR or court order.

5Data Security

• Passwords: Encrypted using bcrypt hashing — never stored in plain text
• SSL/TLS: All data transmitted over HTTPS encrypted connection
• Database: Access restricted to authorized personnel only
• KYC Documents: Stored in secured server folders, not publicly accessible
• OTP Verification: All sensitive actions require OTP verification
• Session Security: Secure session management with automatic timeout
• Upload Security: PHP execution disabled in upload folders

Data Breach Notification: In case of a data breach affecting your personal data, we will notify you via email within 72 hours of becoming aware of the breach, as required by Pakistan's cyber crime laws. If the breach involves Facebook Login data, we will also notify Meta Platforms as required by their Data Processing Terms.

6KYC & Identity Verification

KYC (Know Your Customer) is mandatory for sellers and dropshippers who wish to receive payouts above Rs 5,000.

We Collect for KYC:

• CNIC number and expiry date
• CNIC front and back photos
• Live selfie for liveness verification
• Business registration documents (for businesses)
• NTN certificate (for sole proprietors and companies)
• For GCC-based dropshippers: Passport or Resident ID (Iqama)

KYC Data Usage:

• Identity verification only — not used for marketing
• Shared with FBR when required for tax compliance
• Retained for 7 years as required by financial regulations
• Deleted upon account closure (except where legally required to retain)

CNIC Security: Your CNIC details are encrypted and stored securely. DropMandi staff can only view the last 4 digits of your CNIC for verification purposes.

7Cookies & Tracking

We Use:

• Session Cookies: To keep you logged in during your visit (deleted when you close browser)
• Preference Cookies: To remember your language and display preferences
• Security Cookies: To protect against CSRF attacks and fraudulent logins

We Do NOT Use:

• Third-party advertising or tracking cookies from external platforms
• Cross-site tracking
• Fingerprinting or device tracking

You can disable cookies in your browser settings, but this may affect login functionality.

7.1 Automated Decision Making

DropMandi uses automated systems for:

• Tier upgrades: Automatically calculated based on your performance metrics
• Product recommendations: Based on browsing and purchase history
• Risk assessment: Automated fraud detection on transactions
• KYC screening: Initial automated review before human verification

You have the right to request human review of any automated decision that significantly affects you. Contact customercare@dropmandi.com.

8Your Rights

Under Pakistan's data protection principles and E-Commerce Policy 2019, you have the right to:

Data Requests: Send all data-related requests to customercare@dropmandi.com with your DM ID and registered email address for verification.

9Children's Privacy

DropMandi is strictly for users aged 18 years and above. We do not knowingly collect personal data from minors.

• Age verification is performed during KYC (CNIC shows date of birth)
• If we discover a user is under 18, their account will be immediately suspended
• Parents/guardians who believe their child has registered should contact us immediately at customercare@dropmandi.com

10FBR & Tax Compliance

As a marketplace operating in Pakistan, DropMandi complies with Federal Board of Revenue (FBR) requirements:

• Withholding Tax (WHT): Deducted from seller payouts as per applicable rates
• Tax Filer Status: We verify filer/non-filer status through FBR IRIS system
• Transaction Reporting: Marketplace transactions reported to FBR as legally required
• NTN Requirement: Corporate and sole proprietor sellers must provide NTN
• Tax Invoices: Generated for each transaction for record keeping

Tax Records: We maintain transaction records for a minimum of 6 years as required by FBR regulations. These records may be shared with FBR upon request.

11Data Retention