This Data Policy sets out, in more technical detail than our Privacy Policy, what data ZurvaPay collects and stores while operating the platform, how long we keep it, and how it is shared.
1. Categories of Data We Hold
- KYC & identity data — CNIC details and images, next-of-kin information, business/NTN documents, shop/business photographs.
- Financial data — bank account and mobile-wallet details used for settlement, transaction amounts and status.
- Platform/API data — API keys, webhook/callback URLs, domain and IP allow-lists configured for your integration.
- Activity logs — login history, admin actions on your account, and API request/response logs used for support and fraud investigation.
2. Where Data Is Stored
Data is stored on servers used to operate ZurvaPay, with access restricted to authorised personnel who need it to provide support, process payments, or carry out compliance checks. Sensitive fields (such as API secret keys) are masked wherever shown in the dashboard or logs.
3. Retention Periods
Transaction and KYC records are retained for the lifetime of your account and for the period required afterward by Pakistani financial record-keeping regulations. Technical logs used for fraud detection and debugging are retained for a shorter, operationally necessary period.
4. Sharing With Payment Partners
To process a payment, the minimum data needed (amount, order reference, payer's mobile number where applicable) is shared with the relevant rail — JazzCash, Easypaisa, Raast QR/DQRC, or a settlement bank. These partners have their own privacy and data-handling obligations as licensed financial institutions.
5. Sharing With Government and Law-Enforcement Authorities
As a licensed payment service provider, ZurvaPay has a legal responsibility to assist government authorities, regulators, and law-enforcement agencies when they make a valid, lawful request for data — for example, a court order, subpoena, or a directive from the State Bank of Pakistan or the Federal Investigation Agency. This is particularly important where a user or merchant is suspected of defrauding others on our platform — including through fake invoices or fraudulent payment requests used to scam genuine customers. We will not hand over data to an authority without a valid legal basis for the request, but where that basis exists, we will cooperate so that fraud can be properly investigated and the people affected by it are protected.
6. Data Breach Notification
In the unlikely event of a data breach affecting your personal or account information, we will take reasonable steps to contain it and notify affected users and, where legally required, the relevant regulator, without undue delay.
7. Your Rights and Requests
You may request details of the data we hold about you, or ask us to correct it, subject to our legal and regulatory record-keeping obligations. Reach us through our Contact page with your request.