Privacy Policy

This Privacy Policy explains how PostEx PayLater, operated by Headless Ecommerce Technology (Pvt.) Ltd. ("PostEx", "we", "us", or "our"), collects, uses, stores, and protects personal information in connection with the Split Payments service. This Policy applies to all Users of the Service aged 18 years and above. The Service is not available to persons under the age of 18, and PostEx does not knowingly collect personal data from minors.

PostEx processes personal data on the following legal bases:

• Performance of Contract: Processing necessary to execute the Murabaha transaction, manage instalments, and provide the Service.
• Consent: For marketing communications, credit bureau reporting, and any processing not strictly necessary for the Service. Consent may be withdrawn at any time.
• Legitimate Interest: For fraud prevention, security monitoring, product improvement, and analytics, where such interests are not overridden by the User's data protection rights.
• Legal Obligation: For AML/KYC compliance, regulatory reporting, and record-keeping as required by applicable Pakistani law.

(A) Personal Information

• Full name
• CNIC number and CNIC image (classified as high-sensitivity data; handled in accordance with NADRA data protection requirements and applicable Pakistani law)
• Mobile number (registered)
• Date of birth
• Email address

(B) Transactional Information

• Order details and purchase history
• Payment history and instalment records
• Instalment plans and outstanding balances

(C) Behavioural & Technical Data

• Device information (model, OS, identifiers)
• Session activity (for analytics and fraud prevention)
• IP address and location data (where permitted)

We may collect relevant information from:

• Information provided directly by the User during registration and at checkout
• PostEx logistics systems
• Courier/logistics partners
• Merchants associated with the User's order
• Credit reference agencies (eCIB, DataCheck, Tasdeeq) for risk assessment

Your data is used to:

• Process and manage Split Payments transactions (Murabaha resale)
• Conduct eligibility and risk assessment
• Enable instalment payments and tracking
• Verify identity and conduct AML/KYC checks as required by law
• Report to credit bureaus (eCIB / DataCheck / Tasdeeq) as per your consent given in the Terms
• Improve user experience and product performance
• Detect and prevent fraud and financial crime
• Comply with legal and regulatory obligations

We implement multi-layered security controls. Your personal data is protected against unauthorised access, misuse, or disclosure. Our cloud infrastructure is hosted with appropriate safeguards; where processors are located outside Pakistan, transfers are handled as described in Cross-Border Data Transfers.

• Secure cloud infrastructure
• End-to-end data encryption (in transit and at rest)
• Access controls, authentication, and monitoring

Payment processing is designed to meet global card security standards:

• All payments are processed via XPay, a PCI DSS-compliant payment gateway.
• PostEx does not store full card details on its systems.
• This ensures secure card processing and compliance with global payment security standards.

If PostEx's cloud infrastructure or any third-party service provider stores or processes personal data outside Pakistan, PostEx will ensure that appropriate safeguards are in place (including contractual protections equivalent to those required under Pakistani data protection law) before transferring any personal data internationally. Where such transfers occur, PostEx will disclose the destination countries and applicable safeguards on request.

We may share limited data with the following categories of recipients. We do not sell your personal data to third parties.

• Payment processors (for transaction completion)
• Logistics partners (for delivery execution)
• Merchants (only for order fulfilment and dispute handling)
• Credit reference agencies (eCIB, DataCheck, Tasdeeq) — with the User's express consent
• Regulatory authorities and law enforcement agencies (where required by law)
• AML screening and sanctions-checking service providers

PostEx retains personal data for a minimum of seven (7) years from the date of the last transaction with the User, in accordance with AML record-keeping requirements under applicable Pakistani law. Shorter retention periods may apply to certain categories of data (e.g., session logs) as set out in our internal data retention schedule.

After the applicable retention period, data is securely deleted or anonymised.

Users have the following rights in respect of their personal data. To exercise any of these rights, contact us at [email protected].

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your data, subject to legal retention obligations and ongoing contractual obligations.
• Portability: Request a portable copy of your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdrawal of Consent: Withdraw consent for any processing based on consent, without affecting the lawfulness of processing before withdrawal.

We use analytics tools to understand user behaviour, improve product experience, and detect issues. This may include session tracking, interaction analysis, and the use of cookies or similar technologies. By using the Service, you consent to such use. You may adjust your device or browser settings to manage or disable cookies, but this may affect the functionality of the Service.

This Privacy Policy may be updated periodically. Material changes will be notified to Users via registered email or SMS at least 14 days before they take effect. Continued use of the Service after the effective date of a change constitutes acceptance of the updated Policy.

For any questions, concerns, or to exercise your data rights, please contact:

• PostEx Data Protection Officer
• Email: [email protected]
• Address: PostEx registered office (as published for legal correspondence)