What we hold, why we hold it, and what we never show.

What we collect

Merchant data: business and contact details, CNIC, phone, email, pickup address and bank account details.

Consignee data: name, phone, delivery address and, where resolved, the coordinates of that address.

Operational data: scans, locations and timestamps recorded by riders, proof-of-delivery photographs and signatures.

Technical data: IP address and user agent on sign-in and on form submission, kept for security and audit.

Why we collect it

To collect, carry and deliver parcels, to collect and remit cash on delivery, to notify merchants and consignees about a shipment, to investigate disputes, and to meet our accounting and audit obligations.

What we never expose

Public tracking shows a partial consignee name, the delivery area rather than the full address, and no phone number. It shows no merchant financial information. Personal data is never written to application logs or API request logs.

How long we keep it

Notification message bodies containing personal data are retained 180 days, after which the body is purged and only delivery metadata is kept for audit.

API request logs are retained 30 days.

Order, ledger and audit records are retained for as long as accounting and tax obligations require.

How we protect it

Passwords are hashed with Argon2id and are never reversible.

Bank and credential material is encrypted at rest; API secrets are hashed with a server-side pepper and shown once.

Access to merchant and consignee personal data inside the back-office is permission-controlled and logged.

The site is served over TLS, and the database is not exposed publicly.

Sharing

Consignee details are shared with the assigned rider for the purpose of delivery, and with the merchant who shipped the parcel. We do not sell personal data and we do not use the WhatsApp channel for marketing.

Your choices

Merchants control their own notification preferences in the portal. Transactional status updates to a consignee are part of the delivery service, but a recipient who asks to be excluded is added to an opt-out list and honoured.

Contact

Privacy enquiries: info@qcs.com.pk