Privacy & Data Protection Policy

1.1 Corporate Entity, Scope & Applicability

Flux Pay (Private) Limited ("Flux Pay", "Flux", "we", "us", or "our") is a private limited company incorporated under the laws of the Islamic Republic of Pakistan. We are dedicated to safeguarding the privacy and financial information of registered merchants, authorized merchant representatives, integration developers, and consumers interacting with Flux hosted checkouts.

1.2 Legal Compliance Framework

Our data processing practices are governed by the Prevention of Electronic Crimes Act, 2016 (PECA), the Payment Systems and Electronic Fund Transfers Act, 2007, and internationally recognized information security benchmarks.

2.1 Merchant Identity & Corporate Verification Data

During merchant registration and KYC submission, we collect:

• Representative Identification: Full legal name, Computerized National Identity Card (CNIC) or NICOP number, photograph, biometric/NADRA verification proofs, registered mobile contact numbers, and corporate email addresses.
• Corporate & Tax Credentials: Business name, trade registration or partnership deed, FBR National Tax Number (NTN) certificate, and registered commercial address.
• Settlement Banking Information: Bank name, Branch code, Account title, and International Bank Account Number (IBAN).

2.2 Transaction Telemetry & Customer Checkout Data

When a buyer initiates a checkout through Flux hosted checkout or API:

• Payer telephone number and wallet identity (JazzCash, Easypaisa, or Raast Alias);
• Transaction metadata: amount, currency (PKR), order reference number, and merchant identifier;
• Device telemetry: IP address, user-agent string, device fingerprint, and checkout session timestamps.

3.1 Telemetry Routing & Data Security

In technical partnership with Volzix Technologies (volzix.io), real-time transaction event routing, multi-rail gateway aggregation, and webhook dispatch are executed across hardened cloud nodes.

3.2 Data Segregation & Protection

Volzix Technologies operates strictly under a Data Processing Agreement adhering to strict confidentiality. Telemetry transmitted through Volzix routing layers is encrypted via AES-256-GCM and TLS 1.3. Volzix Technologies has zero rights to sell, monetize, or disclose merchant records to any external entity.

5.1 Encryption at Rest and in Transit

Sensitive merchant secrets, including upstream payment gateway signing certificates, webhook HMAC keys, and payout API tokens, are stored utilizing AES-256-GCM authenticated encryption with separate cryptographic key rotation schedules. All data transmitted between browsers, merchant webservers, Flux Pay, and Volzix.io relays is strictly enforced via Transport Layer Security (TLS 1.3).

5.2 Role-Based Access Controls (RBAC)

Internal access to merchant KYC documents and raw banking records is restricted to compliance officers with verified multi-factor authentication (MFA) and is continuously recorded in immutable audit logs.

6.1 Upstream Payment Switches

To process checkouts, payment requests are routed directly to licensed upstream operators: JazzCash (Mobilink Microfinance Bank Limited), Easypaisa (Telenor Microfinance Bank Limited), and 1Link (Raast interbank switches). These institutions process payment requests under their respective SBP banking licenses.

6.2 Legal & Regulatory Authorities

Flux Pay may disclose merchant or transaction data when formally compelled by a lawful order of a Pakistani court of competent jurisdiction, the State Bank of Pakistan, the Federal Investigation Agency (FIA under PECA 2016), or the National Accountability Bureau (NAB).