Privacy Policy

1. Who We Are & Our Privacy Covenant

Magic Hair Oil is operated under the executive direction of Babar Dogar, headquartered at Ghous Garden Phase 3, Lahore, Pakistan.

We operate under an absolute zero-spam and zero-data-brokering covenant. We will never sell, lease, monetize, rent, or share your telephone number, delivery address, or personal identifiers with marketing brokers, data aggregators, or third-party telemarketers.

2. Categories of Information We Collect

We only collect data strictly necessary to coordinate courier delivery, provide customer care, and prevent malicious checkout activities:

• Domestic Delivery Coordinates: Full recipient name, street address, nearby landmark, city in Pakistan, and postal code required to print Leopards Courier Service (LCS) consignment labels.
• Contact Telemetry: WhatsApp mobile phone number and email address used to transmit order receipts, LCS tracking updates, and delivery arrival calls.
• Account Credentials: Passwords stored via one-way cryptographic bcrypt hashing algorithms, or ephemeral single-use 6-digit verification codes.
• VIP Birthday Data (Optional): Date of birth voluntarily registered to receive exclusive annual birthday gifts and celebratory concessions.
• Payment Verification Receipts: Transaction IDs (TID) or payment screenshots voluntarily submitted by clients to confirm direct bank or mobile wallet remittances.

3. Zero Banking Credential & Zero Card Storage

Our web servers, application files, and MariaDB databases never record, process, intercept, or store sensitive credit card numbers, debit card CVVs, bank account login passwords, or mobile wallet MPINs.

All pre-payment remittances are executed entirely within your own banking app (Meezan Bank, EasyPaisa, JazzCash, SadaPay, NayaPay, or Raast). The only payment records retained by our system are client-uploaded transfer receipts and transaction reference strings required for accounting reconciliation.

4. Functional Cookies & Local Storage

We utilize lightweight, secure HTTP-only cookies and local browser storage strictly for functional commerce operations:

• Session & Bag Persistence: Keeping your shopping bag contents and active session intact as you navigate between pages.
• Security Tokens: Generating cryptographically random CSRF tokens to safeguard forms against cross-site request forgery attacks.
• Zero Cross-Site Tracking: We do not deploy intrusive third-party behavioral surveillance cookies or ad-retargeting beacons.

5. Disclosure to Authorized Logistics Providers

To complete doorstep delivery across Pakistan, your shipping details (Name, Delivery Address, Landmark, City, and Contact Telephone) are securely shared with our primary logistics partner: Leopards Courier Service (LCS). LCS is legally contracted to utilize this data exclusively for parcel delivery and is strictly prohibited from marketing to our consignees.

6. Data Security & Encryption Standards

All traffic between your browser and our platform is encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS) with high-grade 256-bit encryption. Passwords and authentication passcodes are secured using industry-standard bcrypt salt-and-hash routines. Internal administrative console access is restricted exclusively to authorized directors under multi-factor verification.

7. Statutory Compliance with Pakistan PECA 2016

We comply fully with the statutory mandates of the Pakistan Prevention of Electronic Crimes Act (PECA 2016) and established consumer data protection principles:

• Unauthorized Access Protection: Strict database firewalls and security rules block unauthorized external intrusion.
• Lawful Interception: We will only disclose personal data to law enforcement agencies if presented with a valid, official court order issued by a competent judicial authority in Pakistan.

8. Data Retention Policy

We retain order and customer telemetry only for as long as legally necessary to fulfill logistics obligations, manage tax audit records, and resolve customer support tickets. Transaction records are retained in compliance with Pakistani commercial tax regulations, after which non-essential logs are securely purged.

9. Your Legal Rights: Access, Correction & Erasure

You maintain complete ownership of your personal data:

• Right of Access: You can review all your registered orders, profile details, and support inquiries directly within your Client Portal at any time.
• Right of Rectification: You can update your telephone number, delivery address, or password directly in your account settings.
• Right of Erasure (Right to Be Forgotten): You have the absolute legal right to request the permanent deletion of your profile and registered contact telemetry from our database.

10. Children's Privacy Protection

Our storefront is designed for adults capable of entering into binding commercial contracts under Pakistani law. We do not knowingly solicit or collect personal information from individuals under the age of 18 without parental consent.

11. Data Protection Desk & Inquiries

To submit an account erasure request, exercise your privacy rights, or discuss data protection matters, contact our data privacy officer: