Data Retention Policy
This policy is a draft. It will be reviewed by a Pakistani lawyer before Rizq Rasan launches, and the English text is the binding version.
This policy sets out how long Rizq Rasan keeps the information it holds, and what happens when you ask us to delete it. It covers this website today and the platform that verified businesses and NGOs will use from launch. Read it with our Privacy Policy, which explains what we collect and why.
1. Our approach
- Only as long as needed. We keep each kind of information only for as long as we need it for the reason we collected it, or for as long as the law requires.
- Tax law sets the longest period. Section 174 of the Income Tax Ordinance 2001 requires business records to be kept for 6 years after the end of the tax year they relate to, and longer while tax proceedings are pending.
- We follow the draft data law. As of October 2026, Pakistan has no data protection law in force, and the Personal Data Protection Bill (May 2023 draft) has not passed Parliament. We follow the draft’s standard anyway, so nothing needs to change when a law is passed.
- Some periods are still to be set. Where the table below says “set before launch”, that period will be decided after legal review and published here before the platform opens.
We never receive or store card numbers, or bank or wallet login details. NGOs pay on our payment gateway’s own page or in their bank’s app.
2. What we keep and for how long
This website
| Information | Why we keep it | How long |
|---|---|---|
| Messages from the contact, partner and “register your interest” forms | To reply, and to contact you about your request, including joining Rizq Rasan | While we deal with your request. If your organisation applies to join, your messages become part of its application. A fixed period will be set before launch, and you can ask us to delete them at any time |
This website sets no cookies and keeps no visitor records of its own. See our Cookie Policy.
The platform, from launch
| Information | Why we keep it | How long |
|---|---|---|
| Account details: names, email addresses, phone numbers and language of the people who use an account, and the names and mobile numbers of collectors and nominated payers | Running the account and sending order, payment and safety messages | While the account is open |
| Organisation details and pickup or site addresses | Verification, listings and working out distance | While the account is open |
| Your device’s live location | Showing food near you | Not stored |
| Verification documents, such as registration certificates, licences, signatories’ CNIC copies and bank certificates | Checking who you are and that you may use the platform | The account’s life plus 6 years |
| Documents from applications we turn down | Handling an appeal or a new application | Deleted after a short period, set before launch |
| Sanctions and proscribed-list screening results | Checking organisations and signatories against those lists | Set before launch, after legal review |
| Orders, payments, receipts, refunds, payouts and tax withheld, with the bank details each payout went to | Settling money, refunds, our accounts and tax | The account’s life plus 6 years, and longer while tax proceedings are pending |
| Records of which policy versions were accepted, with the time, language and IP address | Evidence of what was agreed | While the account is open. The period after it closes will be set before launch |
| Pickup confirmations, no-show records, strikes and reliability history | Reliability scores and appeals | The account’s life plus 2 years |
| Support requests, complaints, disputes and appeals, with the messages and photos in them | Handling the case and any follow-up | 3 years |
| Listings and food photos | Showing food to NGOs and deciding disputes | Set before launch. Listing details that form part of an order are kept with the order |
| A record of the emails, WhatsApp and in-app messages we send, with delivery status | Checking whether a message reached you | Set before launch |
| Security and access logs, including IP addresses | Protecting accounts and finding fraud | 12 months |
| The audit log of admin actions and money movements | Showing who changed what, and when | Set before launch. Until then, nobody can edit or delete it |
| Error reports, and product analytics if you turned them on | Fixing problems and improving screens | Set before launch |
| Database backups | Recovering from a failure | Daily backups for 7 days, plus a nightly encrypted copy kept off-site for a period set before launch |
The 12-month period for logs also matches the one-year traffic data rule in section 32 of the Prevention of Electronic Crimes Act 2016, if that rule applies to us. That point is subject to legal review.
A strike stops counting after 60 days, as our Reliability and No-show Policy explains, but the record of it is kept for the period above.
3. When an account closes
You can close your organisation’s account at any time once it has no open orders. When it closes, we delete the information we no longer need, and keep only what the table above says we must keep. That kept information is restricted, as section 5 explains, and deleted when its period ends.
Records of what people did for an organisation, such as claims they placed or handovers they confirmed, belong to that organisation’s order records and follow the periods above.
4. Asking us to delete your data
Email hello@rizqrasan.pk with “Privacy request” in the subject line, from the address on your account if you have one, and tell us what you would like deleted. Requests about an organisation’s data must come from its owner or a signatory. From launch, you can also delete your personal account in your account settings. You can ask before launch too, for anything you sent through this website’s forms.
- We check it’s you. We may ask you to confirm who you are before we act, so nobody else can delete your information.
- We reply within 30 days. We tell you what we deleted, what we kept, and why.
- We tell our service providers. Where a service provider such as our email or analytics provider holds your data for us, we ask it to delete that data too.
- Backups catch up. Deleted information stays in our daily backups for up to 7 days, and in off-site copies until they are replaced. If we ever restore a backup, we delete again anything you had asked us to delete.
You can also ask to see or correct your information, as our Privacy Policy explains.
5. What we must keep anyway
We cannot delete some records when you ask, because the law or a fair process needs them:
- records that tax law requires us to keep, such as orders, payments, receipts, payouts and the verification documents behind them, for the account’s life plus 6 years;
- records needed for an open order, refund, dispute, complaint or appeal, until it is settled;
- records needed to deal with a legal claim, or with a lawful request from an authority such as the Islamabad Food Authority after a food incident, a court or the tax authorities;
- entries in our audit log, which nobody can edit or delete.
We restrict these records instead of deleting them. They are locked away from everyday use, seen only by the people who need them for that legal reason, and deleted when their period ends.
If you are unhappy with how we handled your request, you can complain under our Complaints and Disputes policy. We acknowledge complaints within 1 working day and aim to resolve them within 5 working days.
6. Changes to this policy
Every period marked “set before launch” will be decided and published here before the platform opens. When we change this policy, we show the new version number and effective date at the top. We tell account holders about material changes by email at least 14 days before they take effect, as our Terms of Service explain.
Questions about this policy? Email hello@rizqrasan.pk or read our Complaints and Disputes policy.