This Privacy Policy explains how AssanPay may collect, use, retain, disclose and otherwise process personal and business data in connection with the AssanPay platform and services.

AssanPay is committed to handling your information transparently and only for legitimate purposes, in accordance with applicable Pakistani law and the data privacy and transparency requirements applicable to applications distributed through the Google Play Store and the Apple App Store.

Effective Date: June 2026

1. Purpose and scope

This Privacy Policy applies to personal and business data processed in connection with AssanPay accounts, merchant onboarding and KYC/AML, use of the AssanPay platform and services (the mobile application, Merchant Dashboard, web application, hosted checkout pages, payment links, and API), support interactions, complaint and dispute handling, compliance reviews, and security controls. It explains what information may be collected, where it may come from, why it may be used, how it may be shared, and what choices may be available to you.

2. Contact details

For general questions about this Privacy Policy or the handling of personal data, you may contact AssanPay through the details below.

Contact point	Details
Legal entity	DEVTECTS (Private) Limited
Brand	AssanPay
Support e-mail	support@assanpay.com
Privacy e-mail	privacy@assanpay.com
Legal & regulatory e-mail	legal@assanpay.com
Address	4th Floor, 32-C, 13th Lane, Bukhari Commercial, Phase 6, DHA, Karachi, Pakistan

 

3. Information that may be collected

Depending on how you use AssanPay, the information processed may include:

• account and profile information, such as your name, username, contact details, registration date, and account activity history;
• merchant onboarding and KYC/AML information, including business name and registration details, tax identification numbers, beneficial ownership declarations, operating licences, and identity documents of principals;
• transaction information, including amounts, currencies, dates, transaction references, payment method details (such as masked card numbers or wallet identifiers), and refund and chargeback records;
• settlement and financial information, including bank account details and settlement account information provided for the purpose of settlement through Payment Partners;
• device and technical information, including device model, operating system, IP address, browser type, session identifiers, and access timestamps;
• cookies and similar technologies used for session authentication, fraud detection, analytics, and platform optimisation;
• customer information provided in connection with a transaction, including identifiers and order or payment details relevant to that transaction;
• communications with AssanPay, including support requests, complaints, and dispute submissions; and
• information received from third parties, such as Payment Partners, identity verification providers, and other service providers.

4. Children’s data / minors

The Platform is not directed at individuals under the age of eighteen (18) years. AssanPay does not knowingly collect personal information from minors. If AssanPay becomes aware that personal information has been collected from a person under eighteen years of age, AssanPay will take steps to delete or anonymise that information promptly, subject to applicable legal, regulatory, and record-retention obligations. If you believe a minor has submitted personal information through the Platform, please contact privacy@assanpay.com.

5. How information may be obtained

AssanPay may obtain information directly from you, automatically through your use of the Platform, from your device or browser settings, from Payment Partners and other service providers, from merchants or customers involved in a transaction, and from third-party sources permitted by law, such as government databases or verification providers used during onboarding.

6. Why AssanPay may use personal data

AssanPay may use personal and business data for purposes including: merchant onboarding, identity verification, and KYC/AML compliance; account administration, authentication, access management, and security; routing, processing, and transmitting transaction instructions to Payment Partners; providing transaction reporting, reconciliation tools and related operational information; fraud detection, fraud prevention, risk management, and platform security monitoring; chargeback management, dispute resolution, and refund processing; provision of customer and merchant support; compliance with applicable legal, regulatory, and contractual obligations; communications regarding operational matters and platform updates; analytics, platform improvement, and technology development; and enforcement of this Suite and protection of AssanPay’s rights.

7. Sharing and disclosure

AssanPay may share personal and business data on a confidential and need-to-know basis with: Payment Partners, to the extent reasonably necessary to facilitate transaction-related communications, reporting, reconciliation and related operational functions and to fulfil their regulatory obligations; technology service providers, including cloud infrastructure, hosting, analytics, and fraud or risk management providers, who process information on AssanPay’s behalf under confidentiality obligations; legal and regulatory authorities, where required by applicable Pakistani law, court order, or regulatory direction; and, in connection with a merger, acquisition, restructuring, or business transfer, subject to the recipient being bound by equivalent privacy commitments. AssanPay does not sell, rent, or licence personal information to third parties for their independent marketing purposes.

8. Mobile app permissions, device identifiers and analytics

The AssanPay mobile application may request device permissions including: internet access, required for all Platform communications and transaction routing; camera access, used optionally for QR code scanning and document capture during onboarding; storage or file access, used optionally to save reports and upload onboarding documents; biometric authentication, used optionally for fingerprint or face-recognition login; and push notifications, used to deliver transaction and security alerts. Device identifiers, SDKs, and in-app analytics tools may be used for fraud prevention, security monitoring, session management, and platform improvement, and are not used to serve third-party advertising. You may manage application permissions through your device settings, though disabling certain permissions may limit functionality.

9. Service messages and communications

By using AssanPay, you consent to receive communications electronically, including by email, push notification, SMS, in-application message, or Dashboard notification. These communications include account, transaction, security, compliance, and other operational messages necessary for use of the Platform, and constitute written communications for all legal purposes. AssanPay’s communications to your registered email address are deemed received on the date of transmission.

10. Retention of records

AssanPay retains personal and business information for as long as necessary to fulfil the purposes for which it was collected, to maintain the merchant relationship, and to comply with applicable legal, regulatory, and contractual obligations. Transaction records, KYC documentation, and compliance records may be retained for the minimum periods required by applicable Pakistani law, including anti-money laundering regulations. When information is no longer required, AssanPay takes reasonable steps to securely delete, anonymise, or de-identify it.

11. Your choices and requests

Subject to applicable law, you may submit requests to access, correct, or request deletion of personal information, or to withdraw consent where processing is based on consent, by writing to privacy@assanpay.com. AssanPay will acknowledge requests promptly and respond within the timeframe required by applicable law. Identity verification may be required before a request is processed, and AssanPay may decline a request, in whole or in part, where retention is required by law, regulation, court order, or for legitimate purposes including fraud prevention, chargeback management, or dispute resolution.

12. Security measures

AssanPay implements technical and organisational security measures designed to protect information against unauthorised access, disclosure, alteration, loss, and destruction. These include encryption of data in transit using industry-standard TLS protocols, encryption of sensitive data at rest, role-based access controls, multi-factor authentication capabilities, audit logging and security monitoring, and regular security assessments. No method of electronic transmission or digital storage provides absolute security, and you remain responsible for the security of your own access credentials and devices.

13. Account deletion and information after closure

You may request deletion of your account by writing to support@assanpay.com or privacy@assanpay.com. Account deletion will be processed only after resolution of outstanding transactions, pending chargebacks, active disputes, unpaid fees, and applicable reserve periods. AssanPay may retain certain information associated with a deleted account for the periods required by applicable law, including KYC/AML and tax record retention requirements, and the periods necessary for chargeback and dispute resolution. Following account deletion, AssanPay will remove or anonymise personal information from active systems within a reasonable period, subject to these legal retention requirements.

14. Changes to this Privacy Policy

AssanPay may update this Privacy Policy from time to time to reflect changes in its practices, operational requirements, technology, or applicable law. Material changes will be communicated through the Platform, by push notification on the mobile application, or by email to your registered email address. Continued use of the Platform following the effective date of an update constitutes acceptance of the updated Privacy Policy.

15. International data transfers

Information collected through AssanPay may be transferred to, stored in, or processed in jurisdictions other than Pakistan where AssanPay’s service providers, technical infrastructure, or Payment Partners operate. Where such transfers occur, AssanPay takes reasonable contractual and technical measures to ensure the information is afforded a level of protection consistent with applicable Pakistani law.