Privacy Policy
Operated by: Mehrab Ali Khan, trading as Pak Legal Desk, a sole proprietorship in Pakistan
Registered office: A-31, Salman Tower, Opposite NADRA, Near Malir Court, Main National Highway, District Malir, Bin Qasim Town, Karachi, Sindh, Pakistan
Trading address: BKT-555, Block A, A-6, Khowaja Fareed Road, Block 9, Bakhtawar Goth, Gulistan-e-Jauhar, Karachi 75300, Pakistan
Effective date: 7 October 2026
Last updated: 7 October 2026
1. Who We Are
Pak Legal Desk operates the website at https://paklegaldesk.com and provides software tools, document templates, contract generation, case management features, AI-assisted legal information, legal research, and a directory of independent advocates.
2. Legal Framework
This Privacy Policy is governed by the Prevention of Electronic Crimes Act, 2016 (PECA) of Pakistan, the primary legislation governing data protection in Pakistan. We operate in alignment with the principles of the draft Personal Data Protection Bill, 2023. Nothing in this Policy limits any right under Article 14 of the Constitution of Pakistan.
3. Data We Collect
- Account data: name, email, username, hashed password, role.
- Contact data: country, phone; for advocates, Bar Council number.
- Payment data: transaction ID, method, receipt, status. We do not store card numbers or CVV.
- Content data: documents, contracts, research notes, questions submitted.
- Usage data: pages visited, features used, IP address, browser type.
- Communications data: messages sent to support.
4. Purpose of Processing
To manage accounts, process payments, prevent fraud, provide Services, respond to support, comply with legal obligations, and improve the Platform.
5. Legal Basis
Consent (optional features); contract (performance of Services); legal obligation (tax and regulatory); legitimate interests (security and fraud prevention).
6. Sensitive Personal Data
For financial data, CNIC numbers, and biometric identifiers, we obtain your explicit, opt-in consent. You may withdraw this consent at any time.
7. Data Retention
- Account data: while active plus 3 years.
- Payment records: 7 years (Pakistani tax law).
- Traffic data: 1 year (Section 29 of PECA).
- Research and AI query data: 2 years.
8. Data Sharing
Only with payment providers, hosting providers, communication providers, analytics providers, professional advisers, and government authorities where required by law. We do not sell personal data.
9. Data Security
Reasonable technical and organisational measures including encryption in transit, hashed password storage, access controls, and secure payment handling.
10. Data Breach Notification
We notify you and the relevant authority within 14 days of becoming aware of a breach affecting your rights.
11. Your Rights
Access, correct, delete, or object to processing; withdraw consent. Contact [email protected].
12. Cookies
Used for login, preferences, and analytics. You can control cookies through your browser.
13. International Transfers
Some third-party providers may process data outside Pakistan. We take reasonable steps to ensure adequate protection.
14. Children
The Platform is not intended for persons under 18.
15. Changes
The “Last updated” date reflects the current version.
17. Your Rights Under GDPR (EU / EEA)
If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (EU) 2016/679:
- Right of access — obtain confirmation of whether we process your data and a copy of it.
- Right to rectification — have inaccurate or incomplete data corrected.
- Right to erasure (“right to be forgotten”) — have your data deleted where there is no overriding legal reason for retention.
- Right to restrict processing — limit how we use your data while a dispute is resolved.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests or for direct marketing.
- Right not to be subject to automated decision-making — including profiling that produces legal or similarly significant effects.
- Right to lodge a complaint with a supervisory authority in your country of residence.
Lawful bases for processing: We rely on (a) consent for optional features and marketing; (b) performance of a contract for delivering the Services; (c) legal obligation for tax, accounting, and AML compliance; and (d) legitimate interests for security, fraud prevention, and platform improvement.
International transfers: Where we transfer EU personal data to Pakistan or other countries outside the EEA, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses.
Data Protection Officer: Mehrab Ali Khan — [email protected]
18. Your Rights Under CCPA / CPRA (California)
If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:
- Right to know the categories and specific pieces of personal information we have collected about you.
- Right to delete personal information we have collected from you, subject to legal exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of the sale or sharing of personal information. Pak Legal Desk does not sell personal information.
- Right to limit use of sensitive personal information.
- Right to non-discrimination for exercising your privacy rights.
To exercise these rights, email [email protected] with the subject line “California Privacy Request”. We will verify your identity before responding.
19. UAE Personal Data Protection Law (PDPL)
If you are a resident of the United Arab Emirates, we process your personal data in accordance with Federal Decree-Law No. 45 of 2021. We obtain your informed, unambiguous consent before processing. Sensitive personal data is processed only with your explicit consent. You have the right to object to automated processing and to request access, correction, or erasure of your data. Data is transferred outside the UAE only with appropriate safeguards. Complaints may be made to the UAE Data Office.
20. Australian Privacy Principles (APP)
If you are an Australian resident, we comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth). We handle your personal information in accordance with APP 1 (open and transparent management), APP 5 (notification of collection), APP 6 (use and disclosure), and APP 11 (security).
Automated decision-making disclosure (effective 10 December 2026): We use automated systems, including AI-assisted tools, to generate legal information and document drafts. These systems do not make decisions that produce legal or similarly significant effects about you without human review. Full details of the kinds of personal information used and the decisions made will be published in this policy before that date.
Complaints may be made to [email protected] or, if unresolved, to the Office of the Australian Information Commissioner (OAIC).
21. Data Protection Officer
Our Data Protection Officer is Mehrab Ali Khan.
Contact: [email protected]