Privacy Policy

1. Introduction

This Privacy Policy governs how Karnival Pvt ("the Platform") collects, uses, maintains, and discloses information from users of the Karnival classifieds app. It is written under Pakistan law, including the Pakistan Electronic Crimes Act (PECA) 2016 and the Contract Act 1872. Karnival Pvt is a company registered with the Securities and Exchange Commission of Pakistan (SECP). This policy does not claim GDPR, UK GDPR, or CCPA compliance; we do not operate those markets as a regulated data controller there.

By using the Platform, you agree to the terms of this policy and consent to the processing of your personal data as outlined here. Failure to comply with the principles outlined herein may result in suspension of services, civil liabilities, or criminal prosecution under the relevant laws of Pakistan.

2. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person, including names, addresses, identification numbers, location data, and other factors specific to a person's identity.

• Data Controller: Karnival Pvt acts as the Data Controller with respect to the collection, use, and management of personal information provided by users.

• Data Processor: Third-party services that process data on behalf of Karnival Pvt (for example cloud hosting, messaging, and analytics providers), as applicable under Pakistan data-protection law.

• Processing: Any operation or set of operations performed on personal data, including collection, recording, organization, storage, alteration, retrieval, and disclosure.

3. Legal Basis for Data Processing

We collect and process personal data under the following legal bases:

• 3.1 Contractual Necessity: When users enter into a contract to buy or sell items, their personal data is processed as part of the contractual obligations under the Contract Act 1872. Failure to provide necessary data may result in the inability to complete transactions.

• 3.2 Legitimate Interests: Karnival Pvt processes certain data to further its legitimate interests in improving user experience, fraud detection, risk management, and marketing activities, as long as these interests are not overridden by users' fundamental rights and freedoms.

• 3.3 Consent: Where legally required, such as for direct marketing or the use of cookies, Karnival Pvt obtains explicit user consent.

4. Data Collection and Usage

4.1 Categories of Data Collected:

• User Profile Data: Name, email address, phone number, and mailing address.

• Listing and chat data: Ad content, in-app messages, and related activity needed to run the marketplace.

• Device Information: IP address, operating system, browser type, and unique device identifiers.

• Usage Data: Information on how users navigate through and interact with the Platform.

4.2 Sensitive data: Government ID (for example CNIC) may be processed for optional verification. Karnival does not collect card numbers for checkout because it does not process payments in the app.

4.3 Data minimization: We only collect data needed to run listings, chat, verification, and support.

4.4 App Permissions and Device Access:

Storage Access: Karnival requests access to your device's storage only when you choose to upload images or videos for your ads. The app accesses only the files you select for upload and does not access other files or content on your device.

Camera Access: Karnival requests access to your camera only when you choose to capture photos or videos for your ads. Media captured through the camera is used to create your listing and is uploaded only when you choose to publish your ad.

Location Access: Karnival requests access to your device's location to enhance your experience by enabling location-based features, including:

• Allowing you to set the location of your ad more accurately.

• Showing nearby and relevant listings based on your current location.

• Improving search results and local recommendations.

Location permission is optional. If you prefer not to share your location, you can continue using Karnival by manually selecting your province and city when browsing or posting ads. You can manage location permissions at any time through your device settings.

5. Purpose of Data Processing

• 5.1 Connecting buyers and sellers: Personal data is used so users can list items, message each other, and arrange their own handover. Karnival does not process card or wallet payments in the app.

• 5.2 Fraud Detection & Prevention: We collect and process user data to authenticate transactions, monitor suspicious activities, and identify fraudulent actors in compliance with ISO 27001 and PECA 2016.

• 5.3 Direct Marketing: Subject to your consent, personal data may be used to send you direct marketing communications. You can opt out at any time.

6. Sharing and Disclosure of Personal Data

• 6.1 Third-party service providers: We work with providers such as cloud hosting, push notifications, and analytics. They must handle data under PECA 2016. Karnival does not use in-app payment processors.

• 6.2 Legal Obligations: We may share personal data in response to a valid legal request from governmental authorities, governed by the Electronic Transactions Ordinance (ETO) 2002 and PECA 2016.

• 6.3 Cross-border data transfers: If personal data is processed outside Pakistan (for example cloud hosting), we choose reputable providers and use contractual and technical safeguards appropriate to the risk.

7. User Rights

• 7.1 Right of Access: You may request a copy of your personal data. We will respond within 30 days of a verified request.

• 7.2 Right to Rectification: You may request corrections to any inaccuracies in your personal data under Section 27 of the PDPB.

• 7.3 Right to Data Portability: You can request your data be transferred to another platform, where technically feasible.

• 7.4 Right to Erasure: You may request deletion of your personal data, subject to retention obligations under tax laws and PECA 2016.

8. Data Retention

We retain personal data for as long as necessary to fulfill the purposes outlined in this policy. User data related to financial transactions will be retained for 7 years to comply with Pakistan's Income Tax Ordinance 2001 and anti-money laundering (AML) obligations.

9. Data Security

• Encryption: All personal data is encrypted using AES-256 standards during transmission and at rest.

• Firewalls & Network Security: We employ firewalls, DDoS protection, and intrusion detection systems.

• Access Controls: Only authorized personnel have access to personal data based on the principle of least privilege.

We use encryption, access controls, and routine security reviews. We do not claim ISO/IEC 27001 certification on this page.

10. Breach Notification

In the event of a data breach, Karnival Pvt will notify affected users as promptly as practicable after discovery, with details of the nature of the breach, data impacted, and steps to mitigate harm, consistent with PECA 2016 and good practice.

11. Where we operate

Karnival is built for users in Pakistan. This policy is governed by the laws of Pakistan. We do not hold ourselves out as GDPR- or CCPA-compliant.

12. Changes to the Privacy Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via email or through notifications on the platform. Your continued use of the Platform following such updates constitutes acceptance of the revised policy.