What we hold, and why we hold it.

Who we are

Vilayaty is a personal buying service that purchases goods in the United Kingdom on behalf of clients in Pakistan. For the purposes of data protection law we are the data controller for the information described on this page.

Legal entity: Vilayaty
Address: Islamabad Pakistan
Contact for privacy matters: requests@vilayaty.com

Because we operate from the United Kingdom, we handle personal data in line with the UK General Data Protection Regulation and the Data Protection Act 2018, and we apply the same standard to clients in Pakistan.

What we collect

When you send a request

• Your name.
• Your WhatsApp number.
• The city you want delivery to.
• What you are looking for — the description, any link you paste, the category, your budget range, and any notes you add about size, shade or timing.
• A reference number we generate for the request.

When you book a live video call

• The same contact details, plus your preferred date and time window.
• The shops or brands you would like to visit on the call.

When you join the dispatches list

• Your email address, and nothing else.

Collected automatically

• The browser user-agent string attached to a submission, kept only to identify automated spam.
• Standard server logs held briefly by our hosting providers, which may include IP addresses.

We never ask for and never store payment card details. Payment is by bank transfer arranged directly with you, so no card or account credentials pass through this website.

Why we use it

Every use below is tied to a lawful basis. We do not use your information for automated decision-making or profiling.

• To quote and fulfil your request — contacting you, sourcing the item, arranging shipping and delivery. Basis: performance of a contract, or steps taken at your request before entering into one.
• To keep a record of what we bought for whom — so we can answer questions about a past order, resolve a delivery problem, and meet accounting obligations. Basis: legal obligation and our legitimate interest in running the business properly.
• To prevent spam and abuse of the forms. Basis: our legitimate interest in keeping the service working.
• To send dispatches, if you have asked for them. Basis: your consent, which you can withdraw at any time.

WhatsApp and messaging

Our service runs on WhatsApp. When you submit a request, the site prepares a message containing the details you gave us and opens WhatsApp so you can send it. Nothing is sent on your behalf — you press send.

Once the conversation is with us on WhatsApp, its contents are also handled by WhatsApp under Meta’s own terms and privacy policy, which we do not control. If you would rather not use WhatsApp, write to requests@vilayaty.com and we will work by email instead.

Who we share it with

We do not sell your data, and we do not share it for anyone else’s marketing.

• Supabase — hosts the database that stores requests and bookings.
• Our website host — serves the site and keeps short-lived server logs.
• Shipping and courier partners — receive the name, delivery address and phone number needed to deliver your consignment.
• Customs authorities — receive the declaration information required by law to clear a consignment into Pakistan.
• WhatsApp / Meta — as described above, where the conversation takes place.
• Professional advisers or authorities — only where we are required to disclose something by law.

Sending data abroad

This service exists to move goods between two countries, so your information necessarily moves between them too. Details are handled by us in the United Kingdom and by delivery partners and customs authorities in Pakistan, and our technical providers may store data in other countries.

Where personal data leaves the UK, we rely on the safeguards recognised under UK data protection law — an adequacy decision where one exists, or the International Data Transfer Agreement or equivalent contractual protections where it does not.

How long we keep it

• Requests that never became an order — up to 12 months, then deleted.
• Completed orders — up to 6 years, because transaction records are needed for tax and accounting.
• Dispatches list — until you unsubscribe.
• Server logs — a short period set by our hosting providers, typically no more than 30 days.

You can ask us to delete anything earlier, subject to those legal obligations.

Cookies and tracking

This site sets no advertising cookies and no tracking cookies. We do not run Google Analytics, advertising pixels, session recording, or any third-party analytics script. There is no cookie banner because there is nothing to consent to.

Our host may set strictly necessary technical cookies required to serve the site securely. These do not identify you or follow you elsewhere.

Security

Submissions are sent over an encrypted connection and stored in a database with row-level security enabled, reachable only by our server using a secret key that is never exposed to browsers. Access is limited to the people who need it to fulfil orders.

No system is perfect. If a breach ever affects your data and presents a risk to you, we will tell you and the relevant regulator without undue delay.

Your rights

You can ask us at any time to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete what we hold, where we are not required to keep it;
• restrict or object to how we use it;
• provide it in a portable format;
• withdraw consent for dispatches, which you can also do from any dispatch we send.

Write to requests@vilayaty.com. We will respond within one month. There is no charge. If you are unhappy with our response you can complain to the UK Information Commissioner’s Office at ico.org.uk.

Children

This service is intended for adults. We do not knowingly collect information from anyone under 18. If you believe a child has sent us their details, write to us and we will delete them.

Changes

If we change this policy we will update the date at the top of the page. Where a change materially affects how we use information you have already given us, we will tell you directly rather than relying on you to notice.