Privacy Policy for DOBUY Applications

Effective Date: August 4, 2026 | Entity: DOBUY (Private) Limited (Registered in Pakistan)

DOBUY (Private) Limited ("DOBUY", "we", "us", or "our") operates the DOBUY Customer App, DOBUY Vendor App, DOBUY Rider App, and associated web portals at store.dobuy.pk, vendor.dobuy.pk, rider.dobuy.pk, admin.dobuy.pk, and www.dobuy.pk. This Privacy Policy details how we collect, store, process, share, and safeguard your personal information when you use our multi-role B2B commerce and logistics platform.

1. Information We Collect

We collect information to provide, personalize, and improve our multi-industry commerce, RFQ negotiation, payment settlement, and delivery dispatch services:

• Personal & Identity Information: Account registration data including full name, business entity name, phone number, email address, physical store location, and national tax/registration credentials.
• Background Location Data (Rider App): Our DOBUY Rider App collects precise location data (latitude/longitude) in the background when a driver turns on "Active Duty" status. This data is collected to enable real-time GPS tracking for buyers, calculate estimated arrival times, and automatically route delivery tasks. Location collection stops immediately when the rider toggles off duty.
• Financial & Payment Information: Payment card tokens, digital wallet authorization codes, and bank account settlement details processed through certified third-party gateway adapters (Moyasar and HyperPay). DOBUY does not store raw credit card numbers or security CVV codes on our servers.
• Device, Media & Camera Access: Photo library and camera access for uploading proof of delivery images, digital customer signatures, product catalog images, and business verification documents.
• Technical & System Logs: Device model, operating system version, unique device identifier (IDFV/Android ID), Firebase notification tokens, IP address, and app usage diagnostics.

2. Purpose & Legal Basis for Data Processing

Your data is processed strictly under the following legitimate business purposes:

• To facilitate Request for Quotation (RFQ) negotiations between buyers and wholesale suppliers.
• To dispatch, route, and track delivery shipments across platform riders, vendor fleets, and third-party logistics partners.
• To calculate commissions, process Cash-on-Delivery (COD) auditing, and disburse vendor payouts and rider earnings.
• To send real-time push notifications regarding order state transitions, incoming RFQ quotes, and chat messages via Firebase Messaging.
• To comply with regulatory tax laws, combat fraudulent activities, and enforce Role-Based Access Control (RBAC) security.

3. Data Sharing & Third-Party Service Providers

We do not sell or rent your personal data to third parties or marketing advertisers. Data is shared strictly with authorized infrastructure service providers necessary to operate the platform:

• Google Maps & Location Services API: For mapping delivery routes, geocoding buyer addresses, and visualizing live rider locations.
• Firebase Messaging (Google): For broadcasting real-time mobile push notifications.
• Moyasar & HyperPay Gateway Adapters: For secure payment authorization, tokenization, and payout settlements.
• Socket.IO Real-Time Engine: For synchronized buyer-supplier chat rooms and live order status broadcasts.

4. Data Security & Storage Retention

We implement enterprise-grade security protocols including TLS 1.3 encryption for data in transit, AES-256 encryption for sensitive data at rest, role-based access restrictions across 7 internal staff levels, and MongoDB persistent security models. Personal data is retained only as long as your account remains active or as required by commercial tax and audit laws.

5. User Data Rights & Account Deletion

In compliance with Google Play Console Developer Policies and global data protection standards, all registered users have the right to inspect, correct, export, or request permanent deletion of their account and personal data. You can initiate self-service account deletion at any time via our Data Deletion Portal.

6. Children's Privacy

DOBUY services are strictly designed for commercial trade and adult users (aged 18 and older). We do not knowingly collect or solicit personal data from children under 18 years of age.

7. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect technological upgrades or legal requirements. Updated policies will be posted on this page with a revised effective date.

8. Contact & Data Protection Officer

If you have questions, feedback, or concerns regarding this Privacy Policy or data privacy practices, please contact us at:

DOBUY (Private) Limited
Attn: Data Privacy Officer
Email: privacy@dobuy.pk | Support: support@dobuy.pk
Website: A Product of FRESME (www.fresme.com)