Privacy Policy

1. Who we are and when this Policy applies

Simak Financial Services (Private) Limited ("Simak", "we", "us" or "our") operates the Bharosago mobile application and any related website, customer-support channel or Salary Advance service that links to this Privacy Policy (together, the "Services").

This Policy applies to applicants, customers, former customers, visitors, references, proposed guarantors and other individuals whose personal data is processed through the Services in Pakistan. It should be read together with the applicable Key Fact Statement (KFS), terms and conditions, Salary Advance agreement, consent screens and complaint procedures.

A Salary Advance application, approval, release or repayment remains governed by the KFS and Salary Advance agreement. This Policy explains information practices and does not promise approval.

2. Definitions and privacy principles

"Personal Data" means information that identifies, relates to, describes or can reasonably be linked with an individual. It includes identity, contact, financial, device and service information. "Sensitive Personal Data" includes CNIC information, biometric or facial data, financial account information and any other data treated as sensitive under applicable law or regulatory requirements.

We follow these principles: lawfulness and transparency; purpose limitation; data minimization; accuracy; security; limited retention; accountability; and respect for user choice. We will not acquire information that is personal in nature and not directly connected with Salary Advance assessment, identity and fraud controls, service delivery, legal compliance or another purpose disclosed in this Policy.

3. Information we collect

The exact information collected depends on the stage of your application, the product you use and the permissions you grant. We may collect the following categories:

3.1 App permissions and prohibited access

Important: Refusing a non-essential permission will not prevent use of unrelated features. A permission that is genuinely necessary for KYC, account security or a requested Salary Advance service may be required to complete that specific step.

3.2 Reference and guarantor information

If an approved product requires a reference or guarantor, you must enter that person's details manually and confirm that you have informed them. Bharosago will not copy details from your address book. A person will not be treated or contacted as a guarantor unless their consent has also been obtained and recorded at the required stage. References and guarantors may contact us to exercise their privacy rights.

4. Where information comes from

• Directly from you, including forms, documents, consent screens, support contacts and Salary Advance transactions.
• Automatically from Bharosago and your device, limited to the technical, security and usage information described above.
• From identity and KYC providers, including NADRA-linked or other legally authorized verification services, where available and permitted.
• From authorized information providers, financial institutions, banks, e-wallets, payment networks and account-title verification services where permitted.
• From fraud-prevention, sanctions-screening, cybersecurity, analytics and communications providers engaged under contract.
• From regulators, courts, law-enforcement bodies, public records or other sources where collection is authorized or required by law.

5. Why we use information

• Create and protect your account, authenticate logins and bind the account to a trusted device.
• Verify identity, age, CNIC, liveness, bank or e-wallet title, and other KYC information.
• Carry out AML/CFT, sanctions, fraud, duplicate-account and security checks.
• Assess employment, salary history, affordability and eligibility; calculate an available Salary Advance amount; and make or support an approval decision.
• Generate and deliver the KFS, Salary Advance offer, disclosures, agreement, statements, receipts and service notices.
• Release approved amounts, process repayments, reconcile transactions, report account performance and manage overdue amounts.
• Provide support, investigate errors, resolve complaints, monitor service quality and maintain evidence of instructions or consent.
• Operate, secure, test, audit and improve Bharosago, including analytics, performance monitoring, vulnerability management and incident response.
• Comply with applicable SECP requirements, authorized reporting duties, court orders, tax, accounting, audit, AML/CFT and other legal obligations.
• Send marketing only where permitted and where the required consent or opt-in has been obtained.

5.1 Grounds for processing

Depending on the activity and applicable law, we process Personal Data on one or more of the following grounds: your explicit consent; steps requested before entering a Salary Advance agreement; performance and administration of a Salary Advance agreement; compliance with legal or regulatory duties; protection of accounts, users and the public from fraud or security threats; and legitimate operational interests that are compatible with your rights.

Where consent is required, it will be requested in a clear and convenient manner. Optional permissions and marketing consent are not treated as consent for unrelated processing. Withdrawal of consent does not make earlier lawful processing invalid and may prevent us from providing a feature that genuinely depends on that information.

6. Salary Advance assessment and automated processing

Bharosago may use rules, statistical models and automated tools to assess identity confidence, fraud risk, affordability, employment and salary stability, Salary Advance amount, term and pricing eligibility. Relevant inputs may include KYC results, employment and income evidence, current obligations, prior repayment behavior, application consistency, account-title match and limited device-security signals.

We do not use your phonebook, SMS content, call logs, photo gallery, religion, ethnicity, political opinions or other information unrelated to Salary Advance eligibility and fraud controls to make an eligibility decision. A decline or reduced offer may also result from incomplete verification, existing obligations, adverse verified information, suspected fraud, inconsistent documents or the inability to confirm repayment capacity.

You may request a review of a decision by contacting the Compliance and Privacy Officer. We may ask for updated documents or identity verification before conducting the review.

7. When and with whom we share information

We share only the data reasonably necessary for the stated purpose and, where required, obtain your specific written, electronic or recorded consent. Recipient categories may include:

• Identity, liveness, biometric, KYC, AML/CFT, sanctions and fraud-verification providers.
• Authorized information providers and financial institutions for lawful inquiry, reporting and risk management.
• Banks, branchless-banking providers, mobile wallets, payment gateways, account-title verification services and settlement networks for Salary Advance release and repayment.
• Pakistan-hosted cloud, data-center, cybersecurity, software, communications, customer-support, document-generation and analytics service providers acting under our instructions.
• Authorized call-center or payment-support providers, legal counsel and agents who require limited information to service an outstanding Salary Advance and who are bound by confidentiality and conduct controls.
• Insurers, auditors, accountants, professional advisers and independent assessors where relevant to risk, assurance, legal claims or regulatory compliance.
• SECP, State Bank of Pakistan where applicable, NADRA or other authorized government bodies, courts, law-enforcement agencies and regulators where disclosure is required or lawfully requested.
• A prospective buyer, investor, successor or restructuring party in a merger, acquisition, insolvency, restructuring or sale of business, subject to confidentiality, due diligence and continued protection of Personal Data.

We do not sell, rent or trade Personal Data. Aggregated or anonymized statistics that do not reasonably identify you may be used for portfolio analysis, service improvement, research and lawful reporting.

8. Service providers and third-party SDKs

Bharosago may use carefully selected software development kits (SDKs) and service providers for functions such as crash reporting, security, attribution, communications or analytics. We conduct privacy and security due diligence, restrict the data made available, require contractual confidentiality and purpose limits, and review material changes before release.

An SDK or provider must not use Bharosago data for its own unrelated advertising, profiling or sale. If a future SDK materially changes the categories of data collected or the purposes of use, we will update this Policy and obtain any new consent required before the change takes effect.

9. Data residency and cross-border access

Personal Data collected through Bharosago, including production databases, KYC documents, Salary Advance records, logs, backups and disaster-recovery copies containing customer information, is stored on cloud infrastructure or data centers within Pakistan.

Service providers must preserve this Pakistan data-residency requirement for regulated customer data. We do not permit a provider to relocate or store such data outside Pakistan unless the transfer is expressly permitted by applicable law and regulatory requirements, appropriate safeguards are in place, and any required notice or consent has been provided. Controlled remote support access, if used, is limited, logged and does not change the approved storage location.

10. How long we keep information

We keep Personal Data only for as long as necessary for the purpose collected and for periods required by applicable Salary Advance, AML/CFT, KYC, tax, accounting, audit, limitation, dispute, cybersecurity and SECP requirements. Retention is governed by a documented schedule and legal holds may temporarily suspend deletion.

• Active Salary Advance accounts: for the relationship, servicing, repayment, complaint and mandatory recordkeeping periods.
• Incomplete or declined applications: for the limited period needed for audit, fraud prevention, duplicate detection, complaint handling and legal compliance, after which the data is deleted or anonymized unless a longer period is required.
• CNIC, selfie and biometric information: only for identity verification, fraud prevention, contract evidence and legally required retention; never for advertising or unrelated facial recognition.
• Call recordings and communications: for the quality, complaint, payment follow-up, evidence and regulatory period applicable to the interaction.
• Security logs and backups: for the documented security or backup cycle, after which they are securely overwritten, deleted or anonymized.

Closing your account or deleting the App does not automatically erase records that must be kept for an outstanding Salary Advance, a complaint, fraud investigation, legal claim or mandatory retention period. When retention ends, we securely delete or irreversibly anonymize the information.

11. Your privacy rights and choices

Subject to applicable law, identity verification and legitimate exceptions, you may request to:

• Access Personal Data we hold about you and obtain a copy in a reasonably usable format.
• Correct or update inaccurate or incomplete Personal Data.
• Withdraw optional consent or disable a device permission through Bharosago or device settings.
• Opt out of direct marketing while continuing to receive essential account, security, repayment and legal notices.
• Object to or request restriction of non-essential processing where recognized by applicable law.
• Delete Personal Data or close your account, subject to outstanding obligations, fraud controls and mandatory retention.
• Request a review of an automated eligibility decision and submit relevant additional information.
• Complain about our use of Personal Data or the conduct of a service provider or payment-support agent.

11.1 How to submit a request

1. Email compliance.officer@simak.pk with the subject line "Bharosago Privacy Request" or write to the office address in Section 18.
2. Include your full name, registered mobile number, the right you wish to exercise and enough detail to locate the relevant record. Do not send your password, PIN or OTP.
3. We may request proportionate identity or authority evidence to protect your account and the privacy of others.
4. We will acknowledge, assess and respond within the period required by applicable law or regulatory standards. If we cannot fully comply, we will explain the reason where legally permitted.

12. Security and incident response

We maintain administrative, technical and physical safeguards designed to protect the confidentiality, integrity and availability of Personal Data. These include multi-factor or OTP authentication, configurable access controls, least-privilege administration, encryption in transit and at rest, network and application security, logging and monitoring, secure development, vulnerability assessment and penetration testing, patch management, backups, incident response, vendor reviews and staff confidentiality obligations.

Access by employees, call centers, payment-support staff and vendors is limited to what they need for their role and is monitored. Critical data is separated where appropriate, and logs are protected against unauthorized modification.

No system is completely secure. If a security incident occurs, we will investigate, contain and remediate it; preserve required evidence; and notify affected individuals, regulators or authorities where required by law or where notice is appropriate to reduce a material risk of harm.

13. Communications and marketing

We may contact you through in-app messages, notifications, SMS, email, WhatsApp where permitted, telephone or post for identity verification, application status, security alerts, KFS and agreement delivery, Salary Advance release, repayment reminders, statements, receipts, complaints, overdue amounts and other service-related purposes. Some operational communications cannot be opted out of while an account or Salary Advance remains active.

Marketing is separate from essential servicing. We will send direct marketing only where permitted and after obtaining any required opt-in or consent. You may opt out through the message instructions, Bharosago settings or compliance.officer@simak.pk. Opting out of marketing will not affect an existing Salary Advance or essential notices.

Calls may be recorded for quality, evidence, training, complaint and regulatory purposes after appropriate notice. Staff and agents will never ask you to reveal a password, PIN or OTP.

14. Responsible servicing and payment follow-up

Simak and its approved agents must use designated contact channels, identify themselves, communicate professionally and respect lawful contact hours. Before seeking payment, they should provide relevant information about the outstanding amount and available complaint channels.

• No threats, abusive or obscene language, deception, discrimination, public shaming or disclosure of an outstanding balance to unrelated persons.
• No access to or use of a customer's phonebook, contacts list, SMS log, call log or photo gallery for payment follow-up.
• No transfer, copying or personal use of customer information by call-center or payment-support staff.
• A manually supplied reference or consenting guarantor may be contacted only within the documented authorization, lawful purpose and confidentiality limits.
• Complaints must be logged, given a reference number where available, investigated and escalated through the grievance process.

15. Children and eligibility

Bharosago is intended only for persons aged 18 years or older who are legally eligible to apply for Salary Advance in Pakistan. We do not knowingly offer Salary Advance to or create customer profiles for children. If we learn that a child has submitted Personal Data, we will close the application and delete the data unless retention is required to investigate misuse or comply with law.

16. Cookies, links and external services

Our website may use necessary cookies and similar technologies for sessions, security, preferences, performance and analytics. Browser settings can block or delete cookies, although some features may not work correctly. Optional analytics or advertising technologies will be used only as disclosed and where the required choice is provided.

Bharosago may link to a bank, wallet, app store, payment provider or other external service. Their privacy practices are governed by their own policies. Use only official Bharosago distribution links and verify the publisher before installing an App or making a payment.

17. Changes to this Policy

We may update this Policy to reflect changes in law, regulation, products, permissions, vendors or security practices. The current version will be posted in Bharosago and, where available, on our official website with a revised date. We will provide prominent notice of material changes and obtain fresh consent before a change that materially expands consent-based collection or use takes effect.

18. Questions, privacy requests and complaints

Please contact the Compliance and Privacy Officer if you have a question, request, concern or complaint about this Policy, a Bharosago permission, an eligibility-decision review, a service provider or a payment-support interaction.

We will handle complaints through the applicable grievance-redressal process. Where Simak and the relevant service are subject to SECP supervision, you may also approach SECP through its current official complaint channels after first giving us a reasonable opportunity to resolve the matter.

19. Applicable framework

This Policy is governed by the laws of Pakistan and the regulatory requirements applicable to Simak and Bharosago. These may include, where applicable and as amended, the Companies Act, 2017; Electronic Transactions Ordinance, 2002; Prevention of Electronic Crimes Act, 2016; applicable AML/CFT laws and regulations; consumer-protection requirements; the applicable financial-services framework; and SECP circulars and guidelines for Salary Advance services, cybersecurity, customer protection, complaints and App whitelisting.

END OF PRIVACY POLICY