Legal

Privacy Policy

Last updated: 30 July 2026

In short. We collect the information you give us (your listing, name, and SMS-verified phone number) plus basic technical data about your device — including your IP address and browser — when you post a listing or send an inquiry. We use it to run the Platform, moderate content, prevent fraud, and meet legal obligations. We do not sell your data. Publicly submitted listing details (title, price, photos, verified contact number) are shown to other users, because that is the purpose of an advertisement.

This Privacy Policy explains how the Bahria Enclave Properties portal (“we”, “us”, “the Platform”) collects, uses, discloses, and protects information when you use the service. (The Enclave Bazaar marketplace is a separate service with its own Terms and Privacy Policy.) It should be read together with our Terms of Use.

We process personal data in accordance with applicable Pakistani law — including the Prevention of Electronic Crimes Act, 2016 (“PECA”) and Pakistan’s data-protection framework (the Personal Data Protection Act/Bill, as and when in force) — and, where it applies to you, the EU General Data Protection Regulation (“GDPR”). You can ask us to delete your account and data at any time: see “Account & data deletion” below, or use the account & data deletion request page.

1. Information we collect

a. Information you provide

Account & identity: your name, email, and mobile number. Your mobile number is verified by a one-time SMS code (via Google Firebase Authentication).
Listing content: the title, description, price, community, sector/area, measurements, property type, photographs, and the verified contact number you choose to publish.
Inquiries & messages: details you submit when you contact an advertiser or the Platform team.
Payment references: for paid promotions, the transaction reference and receipt image you upload. We never collect or ask for your EasyPaisa/bank PIN, OTP, or password.

b. Information we collect automatically (technical & legal metadata)

When you submit a listing or an inquiry, and during normal use, we record technical data for security, moderation, fraud-prevention, and legal record-keeping, including:

your IP address;
your browser and device information (user-agent string, and where available, language and platform);
the referring page and the pages/actions on the Platform;
timestamps of your submission and activity.

This submission metadata is attached to the relevant listing/record so that, if a listing is later alleged to be fraudulent or unlawful, there is an accurate record of where and when it was submitted.

c. Cookies & local storage

We use minimal local storage/cookies to keep you signed in and to remember preferences such as your light/dark theme. We do not use them to build advertising profiles.

2. How we use information

To operate the Platform — publish listings, enable contact between users, and manage accounts.
To verify mobile numbers (reducing anonymous abuse) and to moderate and review content.
To prevent, detect, and investigate fraud, abuse, and security incidents.
To keep records and to comply with legal obligations and lawful requests.
To send transactional notifications (e.g. listing status, payment verification) and respond to your queries.

3. What is shown publicly

A property advertisement is public by design. The listing details you submit — including the title, description, price, community/sector, photographs, and your verified contact number — are displayed to other users and may be indexed by search engines. Do not include information in a listing that you do not want to be public. Your IP address and browser metadata are not shown publicly.

4. How we share information

With other users: the public listing content described above.
With service providers: infrastructure and authentication providers (e.g. Google Firebase for authentication and data storage, and our email/SMS delivery providers) that process data on our behalf to run the Platform.
With authorities: we may disclose information, including IP and browser metadata, to law-enforcement or other lawful authorities in response to a valid legal request, or where we reasonably believe it necessary to investigate fraud, enforce our Terms, or protect the rights and safety of users.
We do not sell your personal information.

5. Legal bases for processing

Where the GDPR or a comparable data-protection law applies, we rely on the following legal bases to process your personal data:

Your consent — e.g. publishing the contact details you choose to include in a listing, and sending you optional notifications. You may withdraw consent at any time.
Performance of a contract — to provide the service you request, such as creating your account, publishing your listing, or processing an order.
Compliance with a legal obligation — including record-keeping and cooperation with lawful authorities under PECA and other applicable Pakistani law.
Our legitimate interests — operating and securing the Platform, verifying numbers, moderating content, and preventing, detecting, and investigating fraud and abuse, balanced against your rights and freedoms.

6. Data retention

We keep account and listing information for as long as your account/listing is active and as needed to provide the service. Submission metadata and moderation records may be retained for a longer period where necessary for fraud-prevention, dispute resolution, or to meet legal obligations (including any retention period required or permitted under PECA and applicable law), after which it is deleted or anonymised. When you ask us to delete your account (see below), we remove or anonymise your personal data except for the limited records we are legally required or permitted to retain.

7. Security

We take reasonable technical and organisational measures — appropriate to the risk and consistent with the security expectations of PECA and the GDPR — to protect information against unauthorised access, loss, or misuse. Mobile numbers are verified via SMS one-time passwords, access is role-restricted, and secrets and service credentials are stored outside the public web root. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal-data breach occurs that is likely to affect your rights, we will act in line with applicable breach-notification requirements.

8. Your rights

Subject to applicable law, and to the extent the GDPR applies to you, you have the right to:

Access — obtain a copy of the personal data we hold about you.
Rectification — have inaccurate or incomplete data corrected. You can update much of your information from your account.
Erasure (“right to be forgotten”) — have your personal data deleted; see “Account & data deletion” below.
Restriction and objection — ask us to restrict processing, or object to processing based on our legitimate interests.
Data portability — receive certain data in a structured, machine-readable format.
Withdraw consent at any time, without affecting processing already carried out.
Complain to a competent data-protection or regulatory authority.

We may need to verify your identity before acting on a request, and we may retain limited records where required or permitted for legal, security, or fraud-prevention purposes. We do not charge for exercising these rights except where the law allows, and we aim to respond within a reasonable time.

9. Account & data deletion

You can request permanent deletion of your account and associated data (your listings, orders, favourites, saved searches, and profile) at any time:

use the account & data deletion request page — no login required, and reachable without installing the app;
in the Bahria Enclave app, open Account → “Delete my account & data”; or
email us at anjum.farrukh@gmail.com.

Your request is actioned by our team. We delete or anonymise your personal data in line with this Policy and our retention period, keeping only the limited records we are legally required or permitted to retain (for example, for fraud-prevention or to comply with PECA and other lawful obligations). If we need to verify that you own the account, we will contact you at the email you provide before deleting anything.

10. International users and transfers

We operate from Pakistan and our service providers (for authentication, storage, and email/SMS delivery) may process data in other countries. Where we transfer personal data internationally, we take steps consistent with applicable law to protect it. If you access the Platform from the European Economic Area or another region with its own data-protection law, the rights described above apply to you to the extent that law requires.

11. Children

The Platform is intended for adults (18+). We do not knowingly collect information from children. If you believe a minor has provided information, contact us and we will remove it.

12. Third-party links

Listings or pages may link to third-party sites (e.g. WhatsApp to contact an advertiser). We are not responsible for the privacy practices of those third parties.

13. Changes to this policy

We may update this Privacy Policy from time to time. Changes take effect when posted here with a new “last updated” date. Your continued use after changes means you accept the updated policy.

14. Contact

Questions or requests about your privacy — including access or deletion — can be sent to anjum.farrukh@gmail.com. This Privacy Policy is provided for transparency and does not constitute legal advice.