Privacy Policy

Marinsh Technologies (Private) Limited is a technology company incorporated under the Companies Act 2017 of Pakistan, operating a real estate discovery platform at marinsh.com. We are the Data Controller for personal information collected through the Platform.

Our registered office is in Islamabad, Pakistan. For privacy inquiries, contact our Data Protection Officer at privacy@marinsh.com.

We collect the following categories of personal data:

We do not collect sensitive personal data (religion, ethnicity, health, biometrics) except where legally required for identity verification purposes, and only with your explicit consent.

We use your personal data for the following purposes:

• Providing the Platform: Account management, listing display, search results, agent connections.
• Agent verification: Confirming identity to maintain Platform integrity and user trust.
• Personalisation: Showing listings relevant to your search history and saved preferences.
• Communications: Responding to enquiries, sending transactional emails (password resets, listing alerts), and important Platform notices.
• Marketing (with consent): Sending promotional emails and listing recommendations. You may opt out at any time.
• Safety & fraud prevention: Detecting and preventing fraudulent listings, fake accounts, and misuse of the Platform.
• Legal compliance: Meeting our obligations under Pakistani law, including responding to lawful requests from courts or law enforcement agencies.
• Analytics & improvement: Understanding how users interact with the Platform to improve features and fix issues.

We do not sell your personal data to any third party for their own marketing purposes.

Under the Personal Data Protection Act 2025 (Pakistan), we rely on the following legal bases:

• Contract performance: Processing necessary to provide the Platform services you have requested (e.g. displaying your listing, enabling agent enquiries).
• Consent: Marketing emails, optional location sharing, and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legitimate interests: Fraud prevention, Platform security, analytics, and improving user experience — where our interests are not overridden by your rights.
• Legal obligation: Compliance with court orders, regulatory requests, anti-money laundering obligations, and PECA 2016 requirements.

We may share your data with the following categories of recipients:

• Other users: When you post a listing or register as an agent, your display name, contact details (if provided), and listing information are visible to other Platform users. This is the core purpose of the Platform.
• Service providers: Cloud hosting (AWS/GCP), email delivery, image storage (Cloudinary), mapping services (Mapbox), and analytics tools — bound by contractual data processing agreements.
• Payment processors: If you purchase a subscription, your payment is processed by a PCI-DSS-compliant payment provider. We do not store card details.
• Law enforcement / courts: Where required by Pakistani law, a valid court order, or to protect the rights and safety of users or the public.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of our assets, your data may be transferred to the acquiring entity, subject to the same privacy commitments.

We do not share your CNIC number or other sensitive verification data with any party other than our authorised verification service provider.

We use cookies and similar tracking technologies to operate and improve the Platform.

You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Platform.

We retain your personal data for as long as necessary to fulfil the purposes set out in this policy, or as required by Pakistani law:

• Account data: Retained for as long as your account is active, plus 3 years after closure for legal and dispute purposes.
• Listing data: Active listings retained while posted; expired listings retained for 2 years for fraud detection purposes.
• CNIC verification data (agents): Retained for 5 years as required by Anti-Money Laundering Act 2010.
• Communication records: Retained for 3 years.
• Usage & technical logs: Retained for 12 months, then aggregated or deleted.
• Financial records: Retained for 6 years as required by the Income Tax Ordinance 2001.

After the applicable retention period, data is securely deleted or anonymised.

Under the Personal Data Protection Act 2025 and applicable Pakistani law, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data, subject to our legal retention obligations.
• Right to restriction: Request that we limit processing of your data in certain circumstances.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: Withdraw consent at any time for processing based on consent (e.g. marketing emails).

To exercise any of these rights, email privacy@marinsh.com with your request. We will respond within 30 days. We may need to verify your identity before processing the request.

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at privacy@marinsh.com and we will delete it promptly.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure, including:

• TLS/HTTPS encryption for all data in transit.
• Encryption of sensitive data at rest.
• Role-based access controls limiting employee access to personal data.
• Regular security assessments and penetration testing.
• Secure third-party cloud infrastructure with ISO 27001-certified providers.

Despite these measures, no internet transmission is 100% secure. In the event of a personal data breach that poses a risk to your rights, we will notify you and the relevant Pakistani authority within 72 hours of becoming aware of the breach, as required by the Personal Data Protection Act 2025.

Our primary operations and data storage are based in Pakistan. Some of our service providers (e.g. cloud hosting, analytics, image storage) may process data outside Pakistan. Where we transfer data internationally, we ensure equivalent data protection safeguards are in place through contractual obligations with those providers.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify registered users of material changes by email or by a prominent notice on the Platform at least 14 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated policy.

For any privacy-related queries, access requests, or complaints, contact our Data Protection Officer:

If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Authority of Pakistan, once established under the Personal Data Protection Act 2025. Until then, complaints may be directed to the National Telecommunication & Information Technology Security Board (NITB) or the relevant court of jurisdiction.