Privacy policy

MISA Bazaar (Private) Limited operates MISA Bazaar, a multi-vendor marketplace in Pakistan. We are the data controller for the personal data described here. You can reach us at misabazaar@gmail.com.

You give us:

• Your name and mobile number, to create an account and to deliver orders.
• Your delivery address and city.
• An email address, if you choose to add one.
• Bank or wallet details, if you sell on the platform and need to be paid.
• KYC documents, if you sell on the platform — CNIC and business registration.

We collect automatically:

• Order and browsing history on the platform.
• Device and browser information, and approximate location from your IP address.
• Cookies needed to keep you signed in and to remember your cart.

We never see or store your card or bank account details. Where online payment is offered, it is processed entirely by PayFast, our licensed and PCI-DSS (Payment Card Industry Data Security Standard) compliant third-party payment gateway. Your card number, expiry date and CVV are entered directly on PayFast's secure payment page and are never transmitted to, processed by, or stored on MISA Bazaar (Private) Limited's servers or databases. We receive only a payment confirmation and a transaction reference number from PayFast — never your card details.

• To take, deliver and support your orders — the core reason for almost all of it.
• To verify sellers and prevent fraud, counterfeit listings and abuse.
• To send order updates by SMS and WhatsApp. These are service messages, not marketing.
• To improve the platform — which products to stock, which cities to serve next.
• To meet legal, tax and regulatory obligations in Pakistan.

A seller needs enough information to pack and ship your order, and no more. When you buy from a shop, that seller receives:

• Your name and the delivery address for that order.
• A MASKED mobile number — for example 0300****567.
• The items, quantities and amount to collect for their parcel only.

Sellers never see your full mobile number, your email address, your other orders, or anything you bought from a different shop. The courier receives your full number, because the rider has to call you at the door.

• Courier partners, to deliver your parcel.
• PayFast, our PCI-DSS compliant payment gateway, to process online payment and settle sellers — see section 2 for exactly what this involves.
• SMS and WhatsApp providers, to send order updates.
• Professional advisers and authorities, where the law requires it.

We do not sell your personal data.

Order records are kept for as long as tax and accounting law requires, currently six years. Account details are kept while your account is open. KYC documents are kept for the life of the seller relationship and for the retention period required afterwards.

• Ask for a copy of the personal data we hold about you.
• Ask us to correct anything inaccurate.
• Ask us to delete your account and data, where no legal obligation requires us to keep it.
• Opt out of marketing at any time. Order updates continue, because they are part of the service.

Write to misabazaar@gmail.com to exercise any of these. We respond within 30 days.

Data is encrypted in transit and at rest. Access is restricted by role, staff accounts with access to money or identity require two-factor authentication, and every administrative action against an account is logged.

No system is perfectly secure. If a breach affects you, we will tell you and the relevant authority without undue delay.

MISA Bazaar is not intended for children under 18. We do not knowingly collect their data, and will delete it if we discover we have.

We will post any change here and update the date at the top. Questions go to misabazaar@gmail.com, or through support.