We are committed to protecting your privacy. This policy explains what data we collect, why we collect it, and how you can control it. We never sell your personal data to third parties.
1. Who We Are
Nizam ("we", "our", or "us") is a Community Management Platform — a product of Nizam Technologies (Private) Limited ("Nizam Technologies"), a company incorporated in Pakistan and registered with the Securities and Exchange Commission of Pakistan (CUIN 0362149). Our platform is accessible via www.nizamco.com and the Nizam mobile application.
For any privacy-related questions, please contact us at [email protected].
2. Data We Collect
2.1 Information You Provide Directly
- Account registration: name, email address, phone number, and password (stored as a salted hash).
- Resident profile: unit number, move-in date, and any additional profile information entered by you or a complex administrator.
- Payment details: bill amounts, payment status, and transaction references. We do not store credit or debit card numbers on our servers.
- National ID (optional): a national ID number, only if you or a complex administrator choose to enter one on a resident or ownership transfer record. Service provider records may also include an ID or business registration number. You do not need to provide a national ID to use Nizam.
- Communications: messages and voice notes you send in the app, and messages you send through the contact form on our website.
- Photos and documents: images and PDF files you attach or take in the app (see section 2.3).
- Visitor details (optional): a visitor's name, phone number and photo, only if a resident or gate staff member chooses to enter them. Each visit record also includes the purpose of the visit and its time.
- Staff records: attendance, leave and payroll details.
- Staff bank details (optional): bank name, account number and IBAN, only if entered for salary payments.
- SOS alerts: the type of emergency, your name and your unit. SOS alerts do not use your device location.
2.2 Information Collected Automatically
- Device information: device type, operating system version, and app version. On Android, Firebase Analytics may also read your device's advertising ID to measure app installs. We do not use it to show you ads.
- Usage data: pages viewed, features used, and actions performed within the application (anonymised where possible).
- Log data: IP address, browser type, referring URL, and timestamps of server requests.
- Push notification tokens: device tokens used solely to deliver in-app notifications and SOS alerts.
- Crash and error data: technical details about an app crash or error, such as your device model, operating system, app version and the time it happened. This comes from our server error logs and, if you have agreed to share crash reports with them, from Apple and Google. We use it only to find and fix problems.
2.3 Device Permissions
The Nizam app asks for these permissions only when you use a feature that needs them. You can turn any of them off at any time in your device settings. The rest of the app keeps working, but that feature will not.
- Precise location (staff attendance): when a staff member checks in or out, the app reads the device's precise location and saves it with that attendance record, which the complex's management can access. It is used to confirm the staff member is at the complex. An administrator setting up the attendance area can also use their current location to mark the complex's position. We read location only at those moments. We do not track location in the background, and we do not collect location from residents. Staff who turn location off cannot check in from the app, but management can record their attendance.
- Camera, photos and files: used to take or attach photos and PDF files, such as expense bills, invoices, payment receipts, visitor photos, complaint and work order pictures, chat attachments, marketplace listings and profile pictures. The camera also scans asset QR labels. We receive only the photos and files you choose to attach. The app can also save receipts and documents to your photo library when you ask it to.
- Contacts: lets you pick a phone number from your contacts instead of typing it when adding someone, such as a resident, family member, visitor, staff member, committee member or service provider. Your contact list is read on your device only and is never uploaded. We receive only the name and number of the contact you pick, and only when you save the form.
- Microphone: used to record voice notes in chat, visitor requests and similar features, such as complaints, work orders and announcements. The app records only after you tap record, and the voice note is sent only when you choose to send or save it.
2.4 Information From Third Parties
- Firebase (Google): we use Firebase Cloud Messaging to send push notifications and Google Analytics for Firebase to understand how the app is used. Google handles this data under its own privacy policy.
3. How We Use Your Data
We use the data we collect to:
- Provide, maintain, and improve the Nizam platform.
- Authenticate you and keep your account secure.
- Generate and send maintenance bills and payment receipts.
- Deliver push notifications and in-app alerts, including SOS emergency notifications.
- Enable complex administrators to manage residents, units, and committee roles.
- Verify staff attendance using location at check-in and check-out.
- Store and share the photos, documents and voice notes you add, with the people meant to receive them.
- Find and fix crashes and errors.
- Respond to support requests and enquiries.
- Analyse aggregated usage trends to improve the product (no individual profiling).
- Comply with applicable laws and regulations.
We do not use your data for advertising, selling to third-party marketers, or automated profiling that produces legal or similarly significant effects.
4. Data Sharing
We share personal data only in the following circumstances:
- Within your complex: complex administrators can view resident profiles, unit details, and payment history for units they manage. Residents see their own bills and payment records. Content you share, such as chat messages, voice notes, attachments, marketplace listings and community complaints, is visible to the people you share it with. Visitor requests, including any voice note, are shared with gate staff and management.
- Service providers: we share data with trusted providers (cloud hosting and file storage, push notifications and analytics through Google Firebase, email delivery through Brevo, and SMS and WhatsApp delivery of login codes, including through Meta) who process data on our behalf under data-processing agreements.
- Legal requirements: if required by law, court order, or governmental authority, we may disclose data.
- Business transfers: in the event of a merger or acquisition, user data may be transferred — you will be notified in advance.
We never sell your personal data to third parties.
5. Data Storage & Security
Your data is stored on servers hosted in secure data centres. We implement industry-standard security measures including:
- TLS/HTTPS encryption for all data in transit.
- Bcrypt password hashing — we never store plaintext passwords.
- Role-based access controls so employees and administrators can only access data they need.
- Internal security reviews every quarter.
We retain your data for as long as your account is active or as needed to provide services. This includes attachments, voice notes and attendance location records. If you delete your account, we will delete or anonymise your personal data within 30 days, unless we are required to retain it by law.
6. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: request a copy of the personal data we hold about you.
- Correction: request that we correct inaccurate or incomplete data.
- Deletion: request deletion of your personal data ("right to be forgotten").
- Portability: receive your data in a structured, machine-readable format.
- Objection: object to certain processing activities.
- Withdraw consent: where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
7. Cookies & Tracking
Our marketing website (nizamco.com) uses minimal cookies:
- Strictly necessary cookies: required for the website to function (e.g., session management). No consent required.
- Analytics cookies: we may use anonymous analytics tools to understand how visitors interact with our site. These do not identify individual users.
The Nizam web and mobile application uses local storage and session tokens to keep you logged in. These are not used for advertising.
8. Children's Privacy
Our platform is intended for use by adults (18 years and older) who are residents or administrators of residential complexes. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us immediately at [email protected].
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via email or an in-app notification at least 14 days before the changes take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy. The "Last updated" date at the top of this page will always reflect the most recent version.
10. Contact Us
If you have any questions about this Privacy Policy or how we handle your data, please contact us:
- Email: [email protected]
- Website: www.nizamco.com/#contact