Privacy Policy
Contents
1. Who is responsible
DocCraft, Islamabad, Pakistan, is the controller of personal data processed for the website and for DocCraft's services. You can contact us at info@doccraft.cc or on WhatsApp at +92 343 051 7326.
2. Scope
This policy applies to personal data we process through the website, email, WhatsApp, Telegram, and our order and admin systems. It does not apply to third-party websites or services we link to, which have their own privacy policies.
3. Data we collect
| Category | Examples |
|---|---|
| Identity and contact data | Name, phone number, email address, postal address, WhatsApp number, company name, job title. |
| Order data | Services ordered, quantities, prices, order notes, delivery instructions, order reference, status. |
| Documents and content | Documents you upload or send for translation, filing, drafting, business documentation, or academic support, which may include identity documents, financial records, academic records, and other sensitive information. |
| KYC/AML data | Identity documents, beneficial-ownership information, source-of-funds evidence, sanctions-screening results, and records of our checks. |
| Payment data | Payment method, transaction reference, bank or wallet details, and amounts. We do not store full card numbers; payments are made by bank transfer, Easypaisa, or Wise. |
| Communications | Emails, WhatsApp and Telegram messages, call notes, complaints, and feedback. |
| Technical data | IP address, browser and device information, pages visited, referring URL, and timestamps. Our hosting provider may log this data. |
| Consent data | The version of the Terms you accepted, the time of acceptance, and technical evidence of acceptance (such as IP address). |
4. How we collect it
- directly from you when you fill in the checkout or contact form, send us a document, or message us;
- from third parties such as payment providers, identity-verification providers, translators, couriers, and government portals;
- from public registers and sanctions lists; and
- automatically through our website and hosting provider.
5. Why we use it and our legal bases
| Purpose | Legal basis (where GDPR/UK GDPR applies) |
|---|---|
| To provide the Services, process orders, deliver documents, and communicate with you | Performance of a contract; steps prior to entering a contract |
| To verify identity, comply with AML/KYC, sanctions, tax, and record-keeping laws | Legal obligation |
| To prevent fraud, misuse, and security incidents | Legitimate interests; legal obligation |
| To manage complaints, disputes, and legal claims | Legitimate interests; legal obligation |
| To improve the website and Services | Legitimate interests |
| To send marketing communications, where permitted | Consent, or legitimate interests with an opt-out |
| To comply with court orders and requests from regulators | Legal obligation |
Where we rely on legitimate interests, we balance our interests against your rights and freedoms. You may object at any time (see section 10).
6. Who we share it with
We share personal data only as needed for the purposes above, with:
- Service providers and processors: Cloudflare (hosting, Pages, D1 database), Telegram (order notifications to our team), WhatsApp/Meta (communications), Google Fonts (font delivery), unpkg (JavaScript library delivery), picsum.photos (placeholder images), and the CDN at z-cdn-media.chatglm.cn (website media). These providers may receive your IP address and technical data when you use the site.
- Professional and delivery providers: translators, couriers, notaries, banks, and government or regulatory portals, where needed to perform the Services.
- Professional advisers: lawyers, accountants, insurers, and auditors, subject to confidentiality.
- Authorities and law enforcement, where required by law, court order, or to prevent fraud or harm, and for AML/CFT reporting.
- Successors, in connection with a merger, acquisition, or sale of assets, subject to appropriate confidentiality.
We do not sell personal data. We do not share personal data for third-party advertising.
7. International transfers
We are based in Pakistan, and our providers may process data in other countries, including the United States, the European Union, the United Kingdom, and countries where our translators, agents, or authorities are located. Where we transfer personal data from the EU/UK to a country without an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. You can ask us for a copy of the relevant safeguards.
8. How long we keep it
| Data | Retention period |
|---|---|
| AML/KYC, identity-verification, and transaction records | At least 5 years after the end of the relationship or transaction, or longer if required by law |
| Order records, invoices, and consent records | 5 years after the order or the end of the relationship |
| Legal documentation files | 5 years after delivery, or longer if required by law |
| Marketing preferences and communications | 2 years after the last interaction, or until you opt out |
| Website technical logs | As configured by our hosting provider, typically a short period |
| Complaints and dispute records | Until the matter is closed and any limitation period has expired |
We may keep data longer where required by law, a court order, a regulator, or a legal hold. When data is no longer needed, we delete or anonymise it.
9. Security
We use reasonable technical and organisational measures, including encryption in transit, access controls, restricted admin access, and retention limits. No method of transmission or storage is completely secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights, we will notify you and the relevant authority as required by law.
10. Your rights
Depending on your location, you may have the right to:
- access a copy of your personal data;
- correct inaccurate or incomplete data;
- delete data, subject to legal retention obligations;
- restrict or object to processing;
- receive your data in a portable format;
- withdraw consent at any time, without affecting prior processing; and
- complain to a supervisory authority.
To exercise a right, email info@doccraft.cc. We may ask you to verify your identity. We will respond within the period required by applicable law (generally one month under GDPR/UK GDPR, extendable where permitted). We may refuse a request where the law requires us to keep the data, or where a legal privilege or exemption applies.
If you are in the UK, you can complain to the Information Commissioner's Office (ICO). If you are in the EU, you can complain to your local data-protection authority. In Pakistan, you can complain to the relevant authority once a comprehensive data-protection law is in force.
11. Cookies and local storage
We do not use advertising or tracking cookies. We use browser local storage to keep your cart between visits (the key is doccraft_cart) and session storage for the admin login. These are strictly necessary for the website to work.
Our hosting provider, Cloudflare, may set security cookies (such as __cf_bm) to protect the site against bots and abuse. Third-party resources may set their own cookies or receive technical data when your browser loads them: Google Fonts, unpkg, picsum.photos, and z-cdn-media.chatglm.cn. We do not control those providers. If we add analytics or advertising tools, we will update this policy and, where required, ask for consent first.
12. Children
Our Services are intended for adults aged 18 or over. We do not knowingly collect personal data from children. Academic support for a student under 18 must be arranged by a parent or guardian, who must consent to this policy. If you believe a child has provided personal data, contact us and we will delete it.
13. Marketing
We may send service updates and offers where permitted by law. You can opt out at any time by replying STOP, using an unsubscribe link, or emailing us. We do not sell or rent your data to third-party marketers.
14. Automated decisions
We do not make decisions with legal or similarly significant effects about you solely by automated means. We may use automated checks for fraud, sanctions, or security, but a human reviews adverse results before we take action.
15. Changes
We may update this policy from time to time. The version and effective date are shown at the top. We will post the updated policy and, for material changes, give reasonable notice by email or WhatsApp where appropriate.
16. Contact and complaints
For privacy questions or requests, contact info@doccraft.cc or WhatsApp +92 343 051 7326. Our address is Islamabad, Pakistan.