Privacy Policy

IndusBill is operated by EdCo Tech (SMC-Pvt) Ltd, whose registered office is in Rawalpindi, Punjab, Pakistan. This policy explains what personal data we handle when you use the IndusBill website, billing portals, emails and mobile API, why we handle it, who we share it with, and the choices you have.

It applies to visitors of our website, organisations that register with IndusBill and their staff, and people who receive or pay invoices issued through IndusBill (“Payers”).

• For organisation and staff account data (registration, verification, sign-in) we decide how the data is used, so we are the “data controller”.
• For Payer data that an organisation uploads or enters (names, registration numbers, contact details, invoices, payments) the organisation decides why and how it is used; we process it on the organisation’s behalf to provide the service. If you are a Payer and want to exercise rights over that data, please contact the organisation that billed you first; we will help it respond.

• Organisations: name, type, NTN, address, city, landline, website, chosen portal address, logo, billing settings and the name, gender, date of birth, nationality, CNIC or passport number and expiry date, mobile number and email of the main contact person.
• Staff users: name, email, mobile number, gender, date of birth, nationality, CNIC or passport number and expiry date, a copy of the CNIC (front and back) or passport, residential address, city, province, post code and country, optional profile photo, and the permissions granted to them.
• Payers: name, group/class, registration or roll number, mobile and WhatsApp numbers, up to three email addresses, the invoices issued to them, amounts, due dates, payment dates, methods and references, and receipts.
• Payment-channel data: when a payment arrives through 1BILL we receive the 1BILL Invoice ID, amount, bank or company code, transaction authorisation ID, date and time from 1Link.
• Technical and security data: IP address, browser and device information, sign-in and failure events, pages and actions performed (our audit trail), and cookies described below.
• Messages: what you send us through the contact form or by email.

• to create and verify accounts, prevent fraud and meet know-your-customer and anti-money-laundering obligations (legal obligation and contract);
• to provide the service: issue invoices, send emails and reminders, record payments, produce receipts and reports (contract);
• to secure the service, detect abuse, keep an audit trail and resolve disputes (legitimate interests and legal obligation);
• to communicate with you about the service, respond to enquiries and send important notices (contract and legitimate interests);
• to comply with the law, court orders and requests of competent authorities (legal obligation).

We do not sell personal data and do not use it for third-party advertising.

• The organisation that billed you and its authorised staff, according to the permissions it has set.
• Platform administrators at IndusBill who verify organisations and staff and support the service; identity documents are visible only to the organisation’s owner and to our verification team, and each access is logged.
• 1LINK (Pvt) Limited, banks and wallets when a Payer pays or enquires through 1BILL.
• Service providers that run the platform for us under confidentiality and security obligations: Google Cloud (hosting, database, storage and logging in the Doha, Qatar region), Amazon Web Services (Amazon SES for email delivery), and Google reCAPTCHA (bot protection on forms).
• Authorities and advisers where required by law or to protect rights, for example the Federal Board of Revenue, the State Bank of Pakistan, law-enforcement agencies and courts, and our professional advisers.

Our primary systems are hosted in Google Cloud’s Doha (Qatar) region. Emails may be processed by Amazon SES in the region we configure (currently Mumbai, India). Where data is handled outside Pakistan we rely on contractual and technical safeguards and take reasonable steps to ensure a level of protection consistent with this policy.

• each organisation’s data is logically isolated from every other organisation’s;
• access is permission-based, limited by role and by branch, and every significant action is written to an audit trail that cannot be edited or deleted;
• identity numbers are encrypted in the database; identity documents and uploads are kept in private storage and served only to authorised users; data is encrypted in transit and at rest on the cloud platform;
• staff must be verified before they can sign in, platform administrators must use two-step verification, and sign-in attempts are rate-limited and monitored;
• regular backups and point-in-time recovery for the database.

No system is perfectly secure. If a breach affects personal data we will notify the affected organisations without undue delay and cooperate with them and the authorities.

We keep data for as long as the account is active and afterwards for as long as needed to meet legal, tax, audit and dispute-resolution requirements. Invoices, payment records and the audit trail are normally kept for at least six years, or longer where the law requires. Identity documents are kept while the user is active and for the period required by anti-money-laundering and record-keeping rules, and are then deleted or anonymised. Contact-form messages are kept for as long as needed to deal with your request.

Subject to applicable law you may ask us to confirm what personal data we hold about you, to correct inaccurate data, to delete data we no longer need, to object to or restrict particular uses, and to withdraw consent where we rely on it. Some data (for example invoices and verification records) must be retained by law, and we will tell you if we cannot delete it. Staff cannot edit their own verified identity details; contact your organisation’s administrator to correct them.

At the date of this policy, Pakistan has no single, comprehensive data-protection statute in force (a Personal Data Protection Bill has been under consideration). We handle personal data in line with internationally recognised principles and with the laws that currently apply, including the Prevention of Electronic Crimes Act, 2016, the Electronic Transactions Ordinance, 2002 and the Anti-Money Laundering Act, 2010, and we will comply with any data-protection law that comes into force.

To exercise a right or make a complaint, write to us at the address below. If you are not satisfied you may approach the competent authority or court in Pakistan.

We use only cookies that are strictly necessary: a session cookie that keeps you signed in and a security (CSRF) token that protects forms. We do not use advertising or cross-site tracking cookies. Our reCAPTCHA check is provided by Google and may set its own cookies and collect information about your device, subject to Google’s privacy policy.

IndusBill is for organisations and adults. We do not knowingly collect data directly from children. Organisations such as schools may include a child’s name as the subject of an invoice; the organisation is responsible for doing so lawfully and for contacting parents or guardians.

Payers receive invoices, receipts, change notices and reminders from the organisation that billed them through our service. These are service messages sent on the organisation’s instructions. Organisations choose the reminder schedule; a Payer who does not wish to receive them should contact that organisation.

We may update this policy and will post the new version here with its effective date. For material changes we will notify organisations by email or inside the service.

This policy is governed by the laws of the Islamic Republic of Pakistan. Any dispute is subject to the dispute-resolution provisions of our Terms of Service.

EdCo Tech (SMC-Pvt) Ltd, registered office: Rawalpindi, Punjab, Pakistan. Email: hello@indusbill.com.