Privacy Policy

Effective date: 20 October 2026 · Last updated: 20 October 2026

This Policy explains how XELVON (Private) Limited (“XELVON”, “we”, “us”) collects, uses, shares and protects personal data when you visit xelvon.com.pk, contact us, or use our products and services. It is designed to align with applicable laws of Pakistan (including electronic and cybercrime laws such as PECA 2016, and any applicable personal data protection requirements as they apply to us) and with widely recognised international standards (including principles consistent with the EU GDPR and similar frameworks). It is not legal advice.

1. Data controller and contact

Controller: XELVON (Private) Limited
Address: 1304 Al Hafeez Executive, C3, Gulberg 3, Lahore, Pakistan
Privacy and data requests: info@xelvon.com.pk
Phone: +92 42 3789 7420 · WhatsApp: +92 333 433 3611

2. Whose data we process

• Website visitors and users of online forms or chat/contact channels
• Prospective and current clients (including company contacts)
• Consumers or end users of products or portals we operate or support where personal data is involved
• Suppliers, partners and job or internship applicants (if you contact us for that purpose)

3. Personal data we collect

3.1 Data you provide

• Identity and contact details (name, company, role, email, phone, WhatsApp number, address)
• Enquiry, proposal and project information you send us
• Billing and payment-related details needed for invoicing (as applicable)
• Credentials or access details you choose to share for delivery (handled under confidentiality and security controls)
• Support tickets, attachments and correspondence

3.2 Data collected automatically

• IP address, device and browser type, approximate location derived from IP, referring URL, pages viewed, time on page
• Cookie identifiers, pixel/tag IDs, advertising identifiers and similar technologies
• Diagnostic and security logs for site integrity

3.3 Data from third parties

• Analytics and advertising platforms (for example Google Analytics and marketing pixels/tags)
• Public business directories or referrals where lawful
• Payment or hosting providers involved in delivering a service (where applicable)

4. Purposes and legal bases

We process personal data for:

• Providing the website and responding to enquiries (legitimate interests / steps prior to contract / consent where required)
• Performing contracts for software, cloud, cyber, AI and related services
• Billing, accounting and tax compliance (legal obligation / contract)
• Security, fraud prevention and abuse detection (legitimate interests / legal obligation)
• Analytics to understand site performance and improve content (consent and/or legitimate interests where permitted)
• Marketing and advertising, including remarketing and measurement via pixels and similar tools (consent where required; opt-out available)
• Legal claims and regulatory requests (legitimate interests / legal obligation)

Where consent is required (including non-essential cookies and marketing pixels), you may withdraw it at any time without affecting prior lawful processing.

5. Cookies, analytics and marketing pixels

We use cookies and similar technologies, including analytics and marketing / advertising pixels, to measure traffic, understand campaigns and (where enabled) show or measure relevant ads on our site or third-party platforms.

• Essential cookies — required for security, load balancing and basic site functions.
• Analytics cookies / tags — e.g. Google Analytics or similar tools to see how visitors use the site.
• Marketing pixels / tags — e.g. advertising platform pixels that may set or read identifiers for campaign attribution, remarketing and conversion measurement.

Third-party providers may process data in other countries under their own privacy policies. You can control cookies through your browser settings and, where we deploy a consent banner or preference centre, through those controls. Industry opt-outs (such as platform ad settings) may also apply. Blocking some cookies may affect site features or measurement accuracy.

6. How we share data

We do not sell personal data. We may share data with:

• Service providers (hosting, email, analytics, advertising, payment, cloud and collaboration tools) under appropriate agreements
• Professional advisers (legal, accounting) under confidentiality
• Authorities when required by law or to protect rights, safety and security
• Business successors in a merger, acquisition or restructuring, with notice where required
• Your organisation’s authorised contacts when you engage us as a business client

7. International transfers

Our primary operations are in Pakistan. Tools we use (hosting, analytics, marketing platforms) may process data in other countries. Where we transfer personal data internationally, we take steps consistent with applicable law and international good practice (for example contractual safeguards and provider assessments) so that an appropriate level of protection is maintained.

8. Retention

We keep personal data only as long as needed for the purposes above, including legal, tax, accounting and dispute periods. Enquiry data is typically kept for a limited business period; contract and billing records are kept for the periods required by Pakistani law and our retention schedules. Analytics and advertising identifiers follow provider retention settings and our configuration.

9. Security

We apply organisational and technical measures appropriate to the risk, such as access controls, encrypted transport where available, least-privilege access for staff and suppliers, and secure handling practices for cyber and recovery engagements. No method of transmission or storage is completely secure; please use strong unique passwords and notify us of suspected incidents involving our systems.

10. Your rights

Subject to applicable Pakistani law and, where relevant, international frameworks that apply to your situation, you may have the right to:

• Access personal data we hold about you
• Request correction of inaccurate data
• Request deletion or restriction in certain cases
• Object to processing based on legitimate interests, and to direct marketing
• Withdraw consent where processing is consent-based
• Request data portability where technically feasible and legally applicable
• Lodge a complaint with a competent authority or pursue remedies in the courts of Lahore, Pakistan, as applicable

To exercise rights, email info@xelvon.com.pk with enough detail to verify your identity and locate the data. We will respond within a reasonable period consistent with applicable law.

11. Children

Our website and services are directed at adults and businesses. We do not knowingly collect personal data from children under 13 (or the higher age required in your jurisdiction). If you believe a child has provided data, contact us and we will take appropriate steps to delete it.

12. Client data we process as a service provider

When we process personal data on a client’s instructions (for example hosting, application support, AI automation, or incident response involving customer databases), the client is typically the controller and we act as a processor/service provider. In that case:

• We process data only on documented instructions and for the engagement
• We apply agreed confidentiality and security measures
• Sub-processors (cloud providers, etc.) may be used as needed for delivery, with appropriate safeguards
• Details should be set out in the SOW, MSA or data processing addendum

13. Cyber security and sensitive engagements

DFIR, ransomware recovery, database reconstruction and similar work may involve highly sensitive data. We limit access to authorised personnel, follow need-to-know principles, and handle evidence and recovered data according to the engagement terms. You must ensure you are authorised to instruct us regarding the systems and data involved.

14. Automated decision-making

We do not use solely automated decision-making that produces legal or similarly significant effects about you without human involvement, unless we clearly inform you and meet applicable legal requirements.

15. Changes to this Policy

We may update this Policy by posting a revised version on this page with a new “Last updated” date. Material changes will be highlighted where practicable. Continued use of the site or services after the effective date means you acknowledge the updated Policy.

16. Governing law

This Policy is governed by the laws of the Islamic Republic of Pakistan. Disputes relating to this Policy are subject to the exclusive jurisdiction of the courts at Lahore, without prejudice to mandatory rights you may have under other applicable laws.

17. Contact

Privacy questions and requests: info@xelvon.com.pk
See also our Terms and Conditions.