Privacy policy

Last updated: August 23, 2026

Khushbu.pk ("Khushbu.pk," "we," "us," or "our") operates this website and online store, including all related content, features and services (the "Services"), to provide you with a curated fragrance shopping experience. Our Services are built on the Shopify platform.

This Privacy Policy explains how we collect, use, share, and protect your personal information when you visit khushbu.pk, place an order, contact us, or otherwise interact with us, and explains the choices available to you. By using the Services, you acknowledge that you have read and understood this Privacy Policy.

1. The Legal Framework This Policy Is Based On

Pakistan does not yet have a single, comprehensive data protection statute — the Personal Data Protection Bill remains in draft form before Parliament. In the absence of that law, this Policy is built around the legal obligations that do currently apply to a business like ours, namely:

  • The Prevention of Electronic Crimes Act, 2016, as amended by the Prevention of Electronic Crimes (Amendment) Act, 2025 ("PECA") — Pakistan's primary cybercrime and electronic data law, which criminalizes unauthorized access to, use of, or disclosure of personal/identity information (PECA, s.16) and unsolicited bulk commercial messaging ("spamming," PECA, s.25).
  • The Electronic Transactions Ordinance, 2002, which governs the legal recognition of electronic records and transactions.
  • The Punjab Consumer Protection Act, 2005, which applies to our business as a Lahore-based seller.
  • The Payment Systems and Electronic Fund Transfers Act, 2007, and applicable State Bank of Pakistan (SBP) regulations, which govern how payment processors and banks in Pakistan must safeguard financial transaction data.
  • Article 14 of the Constitution of Pakistan, which protects the dignity and privacy of every citizen.

Where this Policy refers to "rights" or "choices," please note that — unlike in the EU (GDPR) or US states (CCPA) — these are not yet codified statutory entitlements in Pakistan. We are extending them to you voluntarily, as a matter of good practice and customer trust, and will update this Policy once the Personal Data Protection Bill is enacted.

2. Information We Collect

Depending on how you use the Services, we may collect:

  • Contact details: name, phone number, email address, billing and shipping address.
  • Order and transaction information: items purchased, order history, returns/exchanges, cart and wishlist activity.
  • Payment information: for card or digital wallet payments, transaction confirmation and limited payment metadata (we do not store your full card number — see Section 3). For Cash on Delivery orders, we record the order value and delivery confirmation.
  • Account information: username, password (encrypted), preferences.
  • Communications: messages you send us via email, phone, WhatsApp, or social media.
  • Device and usage information: IP address, browser type, device identifiers, and how you interact with our website, collected automatically.

We do not knowingly collect your CNIC number, biometric data, or other sensitive identity documents. If a courier partner requests ID verification at the point of delivery, that is collected and handled by the courier company directly, not by us.

3. Cash on Delivery (COD) and Courier Data Sharing

Because most orders on khushbu.pk are fulfilled via Cash on Delivery, please note specifically:

  • When you place a COD order, we share your name, phone number, and delivery address with our courier partner(s) (e.g., TCS, Leopards, PostEx, M&P, or similar) solely to deliver your order and collect payment.
  • We or our courier partner may call or message you to confirm a COD order before dispatch, as a fraud-prevention measure.
  • For card or digital wallet payments, your payment details are transmitted directly to a PCI-DSS compliant payment gateway or bank (e.g., Shopify Payments, JazzCash, Easypaisa, or your issuing bank) and are processed under SBP regulatory oversight. We do not see or store your full card number, CVV, or wallet PIN.

4. How We Use Your Information

We use your information to:

  • Process and fulfil orders, payments, returns, and exchanges.
  • Create and manage your account.
  • Communicate with you about your order, account, or support requests.
  • Send you marketing communications, where you have opted in (see Section 8).
  • Detect and prevent fraud, abuse, and unauthorized transactions.
  • Improve our website, products, and customer experience.
  • Comply with applicable Pakistani tax, accounting, and legal record-keeping obligations.

5. How We Share Your Information

We share personal information only as needed, with:

  • Shopify, our e-commerce platform provider, which hosts and processes data on our behalf.
  • Payment processors and banks (e.g., Shopify Payments, JazzCash, Easypaisa, or partner banks), to complete your transaction.
  • Courier and logistics partners, to deliver your order (see Section 3).
  • Service providers who support functions like customer support tools, analytics, or marketing — under contractual confidentiality obligations.
  • Government or law enforcement authorities, where required by Pakistani law, court order, or a lawful request (e.g., under PECA or by the National Cyber Crime Investigation Agency).
  • A successor entity, if Khushbu.pk is involved in a merger, acquisition, or sale of assets.

We do not sell your personal information to third parties for their own marketing purposes.

6. Where Your Data Is Stored

Our website infrastructure is provided by Shopify, which operates data centers outside Pakistan. As a result, your personal information may be stored and processed outside Pakistan, including in jurisdictions such as the United States or Canada, in order to operate our store. We take reasonable steps to ensure that any third party processing your data outside Pakistan maintains a standard of protection consistent with this Policy.

7. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to:

  • Keep you logged in and remember your cart.
  • Understand how visitors use our site (analytics).
  • Show you relevant ads on our site and on third-party platforms (e.g., Meta/Facebook, Google), where applicable.

You can control or disable cookies through your browser settings. Disabling cookies may affect parts of the Services, such as your ability to check out.

8. Marketing Communications

We may send you promotional emails, SMS, or WhatsApp messages about new products, offers, or restocks only with your consent, consistent with PECA's restriction on unsolicited commercial messaging (s.25). You can withdraw consent and opt out at any time by clicking "unsubscribe" in any marketing email, or messaging us directly to be removed from SMS/WhatsApp marketing. You will continue to receive non-promotional messages related to your orders or account even after opting out of marketing.

9. Data Security

We use reasonable technical and organizational measures (such as encrypted checkout via Shopify and restricted internal access) to protect your information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. Please avoid sending sensitive information (e.g., full card numbers) to us via unencrypted channels like email or WhatsApp.

10. Data Retention

We retain personal information for as long as necessary to:

  • Fulfil the purpose it was collected for (e.g., processing your order);
  • Maintain your account, for as long as it remains active;
  • Meet our recordkeeping obligations under Pakistani tax and commercial law (order and transaction records are generally retained for a minimum of six years, consistent with FBR recordkeeping requirements); and
  • Resolve disputes or enforce our agreements.

When information is no longer needed, we take reasonable steps to delete or anonymize it.

11. Children's / Minors' Privacy

Our Services are intended for use by individuals 18 years of age or older (the age of majority in Pakistan under the Majority Act, 1875). We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will take steps to delete it.

12. Your Choices

You may, at any time, ask us to:

  • Access the personal information we hold about you;
  • Correct inaccurate information;
  • Delete your account and associated personal information, subject to our legal recordkeeping obligations; and
  • Opt out of marketing communications.

To exercise any of these choices, contact us using the details below. We will respond within a reasonable time and may need to verify your identity before processing certain requests.

Note: Pakistan does not yet have a dedicated, operational data protection authority. This section will be updated once the National Commission for Personal Data Protection becomes operational under the Personal Data Protection Bill.

13. Third-Party Links

Our Services may link to third-party websites or social media pages we do not control (e.g., Facebook, Instagram, TikTok). We are not responsible for the privacy practices of these third parties.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable Pakistani law — including once the Personal Data Protection Bill is enacted. The "Last updated" date at the top of this page reflects the most recent revision.

15. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of the Islamic Republic of Pakistan. Any disputes arising from or relating to this Policy shall be subject to the exclusive jurisdiction of the courts of Lahore, Punjab.

Contact Us

Khushbu.pk

Phone / WhatsApp: +92 33 33 123 004

Email: info@khushbu.pk

Address: 38-B Zam Zam Heights, Sabzazar, Lahore