Privacy Policy

Kampay is a Pakistan-based, two-sided home-services marketplace. Customers use the Platform to book KYC-verified professionals for services such as cleaning, cooking, plumbing, electrical work, and more; Professionals use it to find work, receive escrow-protected payments, and access optional insurance. Operating a marketplace of this kind requires us to collect certain information — and this policy applies to both our mobile app and our website.

We are committed to collecting only what we need, being transparent about why we need it, and never selling your personal data. If you are a Professional, please read Section 9 carefully: it explains the special protections that apply to your KYC and verification data. If you have any questions after reading this policy, contact our Privacy Team using the details in Section 13.

We collect the following categories of information, depending on how you use the Platform:

(a) Account & Profile

When you create an account, we collect your name, phone number, and — where provided — your email address, saved home or service addresses, and profile photo. Customers and Professionals both provide this basic profile information so that the other side of a Booking knows who they are dealing with.

(b) KYC & Verification Data (Professionals)

To become a Professional on Kampay, you must complete our six-step KYC process. For that, we collect: images of your CNIC (Computerized National Identity Card), front and back; a live selfie used to match against your CNIC; your police verification certificate; the names and contact details of two emergency references; and your service-area location pin. These documents and checks exist to keep customers and fellow professionals safe.

(c) Location Data

With your permission, we collect precise or approximate location data. For Customers, this helps us show nearby Professionals and match custom jobs. For Professionals, it verifies your service area and supports job tracking and safety. You can withdraw location permission at any time in your device settings, though some features — such as nearby matching — may then be limited.

(d) Payment & Transaction Data

Payments for Bookings are processed through JazzCash, Easypaisa, and debit or credit card processors. We store transaction records — amounts, dates, booking references, escrow status, and wallet balances — but we do not store full card numbers. Payment credentials are handled by the payment processors under their own security and privacy terms.

(e) Communications

We store in-app chat between a Customer and a Professional about a Booking, as well as your communications with us — support tickets, emails, and notes from calls with our helpline — so that we can help you and keep a record of what was agreed.

(f) Device & Usage Data

We collect technical information such as device model, operating system and version, app version, IP address, and interactions with the Platform (for example, pages viewed and features used), together with crash and performance logs. This helps us keep the app stable, secure, and improving.

(g) Reviews & Ratings

Reviews and ratings you write are connected to your account and the relevant completed Booking, and are displayed on the Platform in accordance with our Terms of Service.

We use your information to operate, protect, and improve the Platform:

• to provide and operate the service — accounts, Bookings, start codes, time tracking, in-app chat, and notifications;
• to carry out KYC and safety checks on Professionals, including CNIC and selfie matching, police certificate review, reference checks, and service-area verification;
• to manage Escrow, payments, the 10% commission, wallet balances, and payouts;
• to enroll eligible Professionals in worker insurance and support insurance claims;
• to provide customer support and respond to your questions and reports;
• to prevent, detect, and investigate fraud, misuse, and security incidents, and to handle disputes and chargebacks;
• to understand how the Platform is used, fix bugs, and improve performance and features — usually using aggregated or anonymized data; and
• to send you marketing or promotional messages — but only with your consent, and you can opt out at any time without affecting your account.

We do not use your KYC documents or verification data for marketing, profiling, or any purpose other than verification, safety, insurance, and legal compliance.

Where a legal basis is required for processing your personal data, we rely on the following:

• Consent — for example, for location access where you grant permission, and for marketing messages. You can withdraw consent at any time.
• Performance of a contract — processing needed to provide the Platform to you, such as creating your account, processing Bookings, Escrow, and payouts.
• Legal obligation — processing required by the law of Pakistan, such as retaining transaction records for tax purposes and verifying identity as part of our KYC program.
• Legitimate interests — including the safety and security of the Platform and its users, fraud prevention, dispute resolution, and improving our services, balanced against your rights.

We share personal data only where it is needed, and we never sell it:

• Payment processors — JazzCash, Easypaisa, and card processors receive the data needed to execute your payments and payouts.
• Insurance partner — for Professionals enrolled in an insurance plan, we share the information the insurer needs to administer coverage and claims.
• Government and police verification authorities — as part of the KYC process, identity and police verification information is submitted to the relevant authorities as required.
• Law enforcement — where we are legally compelled or where disclosure is necessary to prevent fraud, illegal activity, or harm to any person.
• Hosting and cloud service providers — service providers who host and run the Platform under confidentiality and security obligations; they may process data outside Pakistan (see Section 11).
• The other party in a Booking — Professionals see the Customer's first name, booking address, and service instructions; Customers see the Professional's first name, profile photo, service category, rating, and verified badge. Only limited, need-to-know details are shared, and your CNIC, selfie, or verification documents are never shown to other users.
• Business restructuring — if Kampay is involved in a merger, acquisition, or sale of assets, your information may be transferred, and we will notify you before it happens.

We keep your information only as long as we need it for the purposes in this policy, or as long as the law requires:

• Account data is retained while your account is active.
• KYC documents are retained for as long as legally required and for insurance purposes, given the verification and compliance role they serve.
• Transaction records are retained in accordance with tax and other regulatory requirements.
• On account closure, we delete or de-identify your personal data, except where retention is required by law or needed to resolve disputes — in which case we retain only what is necessary, for as long as necessary.

Backups may persist for a limited additional period under our standard deletion cycles, and aggregated, anonymized statistics — which can no longer identify you — may be kept indefinitely.

We use encryption in transit, access controls, and secure infrastructure to protect your information. Access to personal data — and in particular to KYC documents — is granted on a strict need-to-know basis to trained personnel, and our systems are monitored for suspicious activity.

No system or method of transmission is 100% secure, and we cannot guarantee absolute security. If you believe your data has been compromised, or you discover a security vulnerability in our Platform, please report it immediately to support@kampay.com.pk. We investigate all reports and will notify affected users where required by law.

You have the following rights over your personal data:

• access the personal data we hold about you;
• correct or update inaccurate or incomplete data;
• delete your data, subject to legal retention requirements;
• withdraw consent for processing based on consent, such as marketing;
• object to processing based on legitimate interests; and
• export your data in a portable format.

You can exercise many of these rights directly in your in-app settings, or by writing to us at privacy@kampay.com.pk. We respond within a reasonable period and may need to verify your identity first. Please note that Professionals' KYC data may need to be retained for legal compliance even after an account is closed, as described in Section 6.

In Pakistan, the collection, use, and disclosure of information in electronic form is governed by the Prevention of Electronic Crimes Act, 2016 (PECA) and related regulations, which we comply with. For users located in the European Economic Area (EEA) or the United Kingdom, we honor GDPR-style rights — including the rights listed above — where applicable.

We recognize that CNIC images, live selfies, police verification certificates, references, and service-area pins are among the most sensitive information entrusted to us. This data is used solely for verification, safety, insurance, and legal compliance — never for marketing, and never shown to other users.

Access to KYC data is restricted to a strict need-to-know basis: trained staff involved in verification, safety, and insurance administration, plus the government and police verification authorities involved in the KYC process as described in Sections 2 and 5. Your two references are contacted only for verification purposes and are told only what is needed to complete the check.

If your verification data changes — for example, a renewed CNIC — you can update it in-app, and we will re-verify with the same protections described here.

The Platform is intended for users aged eighteen (18) and over, and our services are not directed at children. We do not knowingly collect personal data from children. If we learn that we have collected personal data from a person under eighteen, we will delete it and deactivate the account.

If you are a parent or guardian and believe your child has provided us personal data, please contact us at support@kampay.com.pk so we can take action. Babysitting and other services booked through Kampay are for the care of children by verified adults — children themselves may not register or book.

Kampay operates from Lahore, Pakistan, but some of our hosting, cloud, and infrastructure providers may process data on servers located outside Pakistan. Where that happens, your data is safeguarded through contractual confidentiality and security obligations, encryption, and by limiting what is transferred to the minimum needed to perform the service.

We select providers carefully and review these arrangements regularly. If you have questions about where and how a specific category of your data is processed, contact us at privacy@kampay.com.pk.

Like most apps and websites, we use cookies and similar technologies — including device identifiers — for the following purposes:

• Strictly necessary — to keep you signed in, remember your session and security settings, and protect the Platform against abuse. These cannot be disabled, because the app and website cannot function without them.
• Analytics — to understand, in aggregate, how features are used and where the app can be improved.
• Device identifiers for push notifications and anti-fraud — to deliver booking updates and alerts you have asked for, and to recognize devices associated with fraudulent activity.

You can control cookies through your browser settings and control device permissions — such as location and notifications — through your device settings. Blocking or deleting cookies may affect some features. Essential cookies and identifiers, however, cannot be disabled, as they are required for the Platform to work securely.

We may update this Privacy Policy from time to time to reflect changes in our practices, the law, or the Platform. Where a change is material, we will notify you in-app and/or by email before it takes effect, and update the date at the top of this page.

Your continued use of the Platform after the effective date of an updated policy means you accept the changes. We encourage you to review this page periodically. Prior versions are available on request at privacy@kampay.com.pk.

The Kampay Privacy Team is here to help with any question, request, or concern about this policy or your data. Reach us at support@kampay.com.pk (for privacy-related matters you may also write to privacy@kampay.com.pk), or call our helpline at 0328-1369034 (Mon – Sat, 8:00 AM – 8:00 PM). Kampay, Lahore, Pakistan.