1.1  This Privacy Policy explains how DASTAVEZ.NET (SMC-PRIVATE) LIMITED (“Dastavez”, “we”, “us”, “our”) collects, uses, shares, transfers, and protects personal data when you use the Dastavez.net website, mobile applications, and related services (the “Services”). It applies to all users worldwide, including Survey Publishers and Respondents.
1.2  This Policy is structured as a universal core (Sections 1–15) supplemented by regional annexes that grant additional rights and disclosures required by local law: Annex A (European Economic Area and United Kingdom), Annex B (United States), and Annex C (Pakistan). Where an annex applies to you, it prevails over the core to the extent of any conflict.
1.3  Capitalised terms not defined here have the meanings given in our Terms of Service. “Personal data” means any information relating to an identified or identifiable natural person; where regional law uses a different term (such as “personal information”), this Policy applies to that concept equally.
2.1 Â Dastavez as controller. We act as the data controller (or equivalent under local law) for: account registration and authentication data; billing and subscription records; platform usage analytics and security logs; Value Coin balances and reward administration; fraud prevention; and our own marketing and communications.
2.2  Dastavez as processor. When a Survey Publisher collects personal data from Respondents through a Survey, the Publisher is the data controller of those Survey responses and Dastavez acts solely as a data processor, processing responses on the Publisher’s documented instructions under our Data Processing Addendum. If you have questions about how a particular Survey uses your responses, the Publisher identified in the Survey is your first point of contact; we will nevertheless assist you in reaching them and will honour rights requests to the extent of our role.
2.3 Â Where the same data serves both roles (for example, a response event used for reward crediting and fraud prevention), we act as controller only for the reward-and-integrity purpose and as processor for the response content itself.
3.1 Â Data you provide directly
3.2 Â Data collected automatically
3.3 Â Data from third parties
3.4 Â Sensitive data. We do not seek to collect special categories of personal data (such as health, religion, political opinions, or biometric data) for our own purposes. Publishers are contractually prohibited from collecting such data through Surveys except where lawful, expressly disclosed, and consented to as required by applicable law, as set out in the Survey Publisher Terms & Conditions.
We process personal data for the purposes below. For users in the EEA/UK (and as good practice everywhere), each purpose rests on the lawful basis shown.
| Purpose of processing | Lawful basis (GDPR/UK GDPR) and rationale |
|---|---|
| Creating and administering accounts; authentication; providing core Platform features | Performance of a contract (Art. 6(1)(b)) — necessary to deliver the Services you signed up for |
| Processing subscriptions, Minting transactions, and billing | Performance of a contract; legal obligation (Art. 6(1)(c)) for tax, accounting, and financial record-keeping |
| Crediting, administering, and enabling redemption of Value Coins | Performance of a contract — rewards are a core Platform feature |
| Fraud prevention, abuse detection, multi-account and circumvention detection, platform security | Legitimate interests (Art. 6(1)(f)) — protecting the Platform, our users, and the integrity of the reward system; balanced against your rights and subject to the safeguards in Section 10 |
| Service communications: transactional emails, security notices, changes to terms | Performance of a contract; legal obligation |
| Product analytics and service improvement (aggregated or pseudonymised where possible) | Legitimate interests — understanding and improving how the Services perform |
| Marketing communications about our own Services | Consent (Art. 6(1)(a)) where required by law; otherwise legitimate interests with an easy opt-out in every message |
| Non-essential cookies, analytics SDKs, and similar technologies | Consent, obtained via our consent banner or device settings, as described in the Cookie & Tracking Technologies Policy |
| Compliance with law, lawful requests, and defence of legal claims | Legal obligation; legitimate interests in establishing, exercising, or defending legal claims |
We do not use personal data for purposes incompatible with those above without informing you and, where required, obtaining your consent.
We use cookies, SDKs, local storage, and similar technologies as described in our Cookie & Tracking Technologies Policy. Essential technologies operate on the basis that they are strictly necessary for the Services; all non-essential technologies (analytics, preference, and any advertising technologies, if introduced) are deployed only with your consent where required by the law applicable to you, and you may withdraw consent at any time through the consent manager or your device settings.
We do not sell personal data, and we do not share personal data for cross-context behavioural advertising. We share personal data only as follows:
7.1 Â We are a Pakistan-based company and our primary hosting infrastructure is located in Singapore. Your personal data may therefore be transferred to, stored in, and processed in Pakistan, Singapore, and other countries where our service providers operate, which may not provide the same level of data protection as your home jurisdiction.
7.2  Where we transfer personal data originating from the EEA, the United Kingdom, or other jurisdictions with transfer restrictions, we implement appropriate safeguards, including the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), supplemented by technical and organisational measures such as encryption in transit and at rest, access controls, and transfer impact assessments. You may request a copy of the relevant safeguards (redacted for confidentiality) via privacy@dastavez.net.
We apply technical and organisational measures appropriate to the risk, including: encryption of data in transit (TLS/HTTPS) and at rest; hashed credential storage; role-based access controls and the principle of least privilege; logging and monitoring of administrative access; environment segregation; token-based authentication for third-party integrations; and periodic security reviews. No system is perfectly secure; we cannot guarantee absolute security, and you should use a strong, unique password and protect your credentials.
Breach notification. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected users without undue delay and in accordance with applicable law (including, for the EEA/UK, the 72-hour authority-notification standard).
We retain personal data only as long as necessary for the purposes described in this Policy, and specifically:
When retention ends, data is deleted or anonymised such that it can no longer be associated with you.
Regardless of where you live, we extend the following baseline rights to all users, subject to identity verification and lawful exceptions:
To exercise any right, contact the Data Protection Officer at privacy@dastavez.net or use the in-app privacy request form. We respond within 30 days (extendable where permitted for complex requests, with notice). We will not discriminate against you for exercising your rights. Where a request concerns Survey responses controlled by a Publisher, we will forward the request to the Publisher and assist as processor. If you are dissatisfied with our response, the annexes below describe complaint routes available in your region.
Automated decision-making. We use automated systems to detect fraud, abuse, and circumvention (for example, duplicate-account and response-quality signals). Where an automated decision would significantly affect you (such as withholding rewards or suspending an account), you may request human review under the review procedure in our Terms of Service, contest the decision, and express your point of view.
The Services are not directed to children under 16 (or a higher age where local law sets one), and we do not knowingly collect personal data from them. Reward redemption is limited to users aged 18 or over, or with verifiable parental or guardian consent where permitted. If you believe a child has provided us personal data, contact privacy@dastavez.net and we will delete it promptly. Publishers are prohibited from targeting Surveys at minors without legally valid parental or guardian consent.
We may update this Policy to reflect changes in law, technology, or our Services. For material changes we will provide at least 30 days’ advance notice by email or prominent in-app notice and, where required by law, seek renewed consent. The “Last Updated” date above shows the current version.
DASTAVEZ.NET (SMC-PRIVATE) LIMITED
Registered office: 98-H, Gulberg 3, Lahore, Pakistan
Data Protection Officer: privacy@dastavez.net
General support: support@dastavez.net  | Phone: +92 309 8906611
This Annex applies if you are located in the EEA or the UK, or where the GDPR or UK GDPR otherwise applies to our processing of your personal data. It supplements the core Policy.
A.1  Controller and representative. The controller is DASTAVEZ.NET (SMC-PRIVATE) LIMITED, 98-H, Gulberg 3, Lahore, Pakistan. As we are established outside the EEA and UK, we have appointed / will appoint representatives pursuant to Article 27 GDPR and Article 27 UK GDPR: EU Representative: [● to be appointed — name and address]; UK Representative: [● to be appointed — name and address]. Until appointment, all enquiries should be directed to privacy@dastavez.net.
A.2 Â Lawful bases and legitimate interests. The lawful bases for each purpose are set out in Section 4. Where we rely on legitimate interests, we have conducted balancing assessments; you may request summary information about them. You have the right to object at any time to processing based on legitimate interests, and to direct marketing absolutely.
A.3 Â Your GDPR rights. In addition to the baseline rights in Section 10, you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), the right not to be subject to solely automated decisions with legal or similarly significant effects (Art. 22, subject to its exceptions and the human-review safeguard in Section 10), and the right to withdraw consent (Art. 7(3)). We respond within one month, extendable by two further months for complex requests with notice.
A.4  Complaints. You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, or — in the UK — with the Information Commissioner’s Office (ico.org.uk). We would appreciate the opportunity to address your concern first via privacy@dastavez.net.
A.5  International transfers. Transfers of your personal data to Pakistan, Singapore, and other third countries are made under the European Commission’s Standard Contractual Clauses (Module as applicable) and, for UK data, the ICO’s International Data Transfer Addendum, supported by supplementary measures and transfer impact assessments. Copies (redacted) are available on request.
A.6 Â Cookies. Non-essential cookies and similar technologies are set only with your prior consent obtained through our consent banner, which allows granular acceptance, refusal with the same ease, and withdrawal at any time, in line with the ePrivacy rules of your Member State and the UK PECR.
This Annex applies if you are a resident of a US state with a comprehensive consumer privacy law (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others as enacted). It supplements the core Policy.
B.1 Â Categories of personal information. In the preceding 12 months we have collected the categories of personal information described in Section 3, which map to statutory categories as follows: identifiers (name, email, IP address, account and device identifiers); commercial information (subscriptions, Minting transactions, reward and redemption records); internet or other electronic network activity (usage data, interaction logs); approximate geolocation (city-level, derived from IP); audio/visual information (profile photo, if provided); and inferences used solely for fraud prevention and service integrity. Sources, purposes, and recipients are as described in Sections 3, 4, and 6.
B.2  No sale or sharing. We do not sell personal information, and we do not share personal information for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act as amended by the CPRA and comparable state laws. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. Because we do not sell or share, no “Do Not Sell or Share” opt-out is required; if our practices ever change, we will update this Policy and provide the required opt-out mechanisms, including recognition of the Global Privacy Control signal.
B.3 Â Sensitive personal information. We do not use or disclose sensitive personal information for purposes other than those permitted by applicable state law (such as providing the Services and preventing fraud), and we do not use it to infer characteristics about you.
B.4 Â Your rights.
Submit requests via privacy@dastavez.net or the in-app privacy request form. We will verify your identity using account information and respond within 45 days (extendable by 45 days with notice). You may designate an authorised agent to act on your behalf, subject to verification. If we decline a request, you may appeal by replying to our decision; we will respond to appeals within the period required by your state’s law, and you may also contact your state Attorney General.
B.5  California “Shine the Light” and notices. We do not disclose personal information to third parties for their own direct-marketing purposes. California residents may request information about such disclosures (Civil Code §1798.83) via privacy@dastavez.net.
This Annex applies if you are located in Pakistan. It supplements the core Policy.
C.1  Legal framework. We process personal data in accordance with applicable Pakistani law, including the Prevention of Electronic Crimes Act 2016 (PECA) and, upon its enactment and entry into force, the Personal Data Protection legislation of Pakistan. This Policy has been drafted to align with the principles of that framework — lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, security, and accountability — so that your rights under it are honoured from day one.
C.2 Â Your rights. You may exercise all of the baseline rights in Section 10. Upon the personal data protection framework taking effect, you will additionally benefit from any further rights it grants (including complaint to the designated data protection authority), and we will update this Annex accordingly.
C.3 Â Cross-border storage. Your personal data is primarily stored in Singapore, as described in Section 7. Should Pakistani law introduce data-localisation or cross-border transfer conditions applicable to our Services, we will comply, including by obtaining required approvals or relocating relevant data categories.
C.4 Â Disclosure to authorities. We may be required to disclose data to Pakistani authorities under PECA and other applicable laws. We disclose only what is legally required, assess the validity of each request, and maintain records of disclosures.