Privacy policy

2.1Whose data

Clients and prospective clients (business contacts), visitors to site33.pk / getsite33.com, and people who contact us. For data collected through our clients' websites, the client is responsible and our Data Processing Addendum applies.

2.2Data we collect

Contact details (name, phone/WhatsApp, email, business name, address); business information you give in the Intake Form; billing records (invoices, payment confirmations; we do not store full card numbers); communications (WhatsApp, email, call notes); website usage data (IP address, device, pages viewed, cookies: see Cookie Policy); identity check details only when required (last 4 digits of CNIC/ID, never the full number unless a registry legally requires it).

To provide and bill the services (contract); to respond to enquiries (steps before a contract); to keep accounting and tax records (legal obligation); to improve our services and keep them secure (legitimate interests); to send marketing messages (consent, which you can withdraw at any time); to measure which of our ads bring enquiries (consent through marketing cookies).

4.1The legal basis for each use is shown in brackets under 'Why we use it'. Where we rely on your consent, you can withdraw it at any time.

4.2WhatsApp and marketing

We send service messages to the WhatsApp number you register. We send promotional messages only if you opt in, and you can stop them anytime by replying STOP.

4.3Laws we follow

Pakistan: Prevention of Electronic Crimes Act 2016 and general law (Pakistan has no general data protection act in force as of [DATE]; we will update this policy when one is enacted). UAE: Federal Decree-Law No. 45 of 2021 (PDPL). EU/UK visitors and clients: GDPR / UK GDPR principles.

5.1Service providers that help us run Site33 (hosting/CDN, email, Google Workspace, accounting software, WhatsApp/Meta, payment providers), domain registries (registrant details are required to register your domain), professional advisers, and authorities when required by law. We do not sell personal data.

5.2Analytics

Website usage data goes to our analytics providers (Google Analytics and Microsoft Clarity) only if you accept analytics cookies. See the Cookie Policy.

5.3Advertising

If you accept marketing cookies, Google Ads, the Meta Pixel (Facebook and Instagram) and the TikTok Pixel measure our ads on this website. When you send a form, they record the enquiry with its reference number and, for Meta and TikTok, form details such as type of business and city, but never your name, number or email. See the Cookie Policy.

5.4Hashed contact details shared with Meta

If you have accepted marketing cookies when you send a form, our server also sends the enquiry to Meta (Meta Conversions API), so Meta can match it to an ad and count it only once: your WhatsApp number (and email, if you gave one) in hashed form (turned into a one-way code, never in plain text), the reference number, the page address, your IP address, browser details and Meta's cookie IDs (_fbp, _fbc). Meta uses this to measure and deliver our ads under Meta's Business Tools Terms. If you reject marketing cookies, nothing is sent, and you can change your choice at any time in 'Cookie settings'.

Client records: for the contract and then as long as tax and accounting laws require (typically 6 to 7 years). Leads who do not become clients: 12 months. Website analytics: up to 14 months.

You may ask to access, correct or delete your data, object to or restrict processing, withdraw consent, or receive a copy. Contact [PRIVACY EMAIL]; we reply within 30 days. International users may also complain to their data protection authority (e.g. the UAE Data Office or an EU/UK supervisory authority).

SSL encryption, access control, two-factor authentication, backups and staff confidentiality.

Our services are not for anyone under 18 and we do not knowingly collect children's data.

Our providers may store data outside Pakistan or the UAE (e.g. in the EU, US or Singapore). Where the law requires, we use contractual safeguards for these transfers.

For data collected through our clients' websites (visitor enquiries, bookings, orders, customer accounts), the client is responsible and our Data Processing Addendum applies. When we handle a client's customer data, we act only on that client's instructions; international clients (and any client who requests it) sign the Data Processing Addendum.

We will post updates here with a new date and notify clients of material changes.

[SITE33 LEGAL ENTITY NAME], trading as Site33, [REGISTERED ADDRESS]. Questions about this policy or your data: [PRIVACY EMAIL]. We reply within 30 days.