1. Introduction & Data Controller Info

At GECA ("we", "our", "us"), we take data privacy seriously. This Privacy Policy explains how we collect, use, and protect the personal and business information of our Merchants and their end Customers when they use the GECA platform (geca.pro) and related online store services. We act as a Data Controller for Merchant data, and a Data Processor for the Customer data flowing through our Merchants' storefronts.

2. What Data We Collect

We collect various types of information to provide and improve our instant business website services:

Account Data: Name, email address, business name, phone number, and physical address.
Store Data: Product listings, categories, descriptions, images, historical customer orders, and payment records.
Usage Data: Storefront page views, Merchant dashboard activity logs, feature usage statistics.
Technical Data: IP addresses, browser information, device type, and operating system.
Customer Data: When a Customer places an order on a Merchant's store, we process their name, email, phone number, and delivery address on behalf of the Merchant.

3. How We Use Data

The data we collect is utilized for the following core purposes:

Platform Operation: To manage accounts, provision tenant databases, and maintain functionality of the website builder.
Order Processing: To facilitate cart checkout, fulfillment pipelines, and delivery workflows for Merchants.
Analytics: To provide dashboard analytics (visitors, revenue, top products) to Merchants and monitor overall platform performance.
Security: To detect and prevent fraudulent activities, unauthorized access, and spam.
Communications: To send important account updates, system alerts, and occasional promotional information (with opt-out options).

4. Data Storage & Security

Security is a priority. We store our data on secure, industry-leading cloud infrastructure. Our PostgreSQL databases implement strict row-level security (RLS) to ensure absolute tenant isolation—meaning one Merchant can never access another Merchant's data. All data is encrypted at rest and in transit via TLS. We conduct regular internal security reviews to protect our systems.

5. Data Sharing

We strictly do not sell your personal or business data to third parties. We only share data in the following specific circumstances:

Service Providers: We use trusted third parties to support our platform, including cloud infrastructure providers, transactional email services, and payment processors. These partners are bound by strict confidentiality agreements.
Legal Compliance: We may disclose information if required by law, subpoena, or legally binding request from law enforcement authorities in Pakistan or applicable jurisdictions.

6. Cookies

We use cookies and similar tracking technologies to ensure our platform functions correctly, including session authentication and basic performance monitoring. For full details on the exact cookies we use and how you can manage them, please review our Cookie Policy.

7. Your Rights

We align our practices with modern data protection principles (such as GDPR). As a Merchant, you have the right to:

Access the personal data we hold about you.
Request corrections to inaccurate or incomplete data.
Request deletion of your account and associated data.
Export your store data (data portability) via standard CSV/JSON formats upon request.

8. Data Retention

We retain your Account and Store Data for as long as your GECA account remains active. If you delete your account, we will purge your data from our active databases within 30 days, though residual backups may be retained for up to 90 days for disaster recovery purposes.

9. Children's Privacy

GECA's services are built for businesses and individuals aged 18 and older. We do not knowingly collect personal data from anyone under the age of 13. If we become aware that we have inadvertently collected data from a child, we will take immediate steps to delete it.

10. International Transfers

While GECA operates primarily out of Pakistan, our cloud servers and third-party service providers may be located internationally. By using our platform, you consent to the transfer and processing of your data in these global data centers under secure conditions.

11. Changes to Policy

We may periodically update this Privacy Policy to reflect changes in our legal obligations or operational practices. We will notify Merchants of any material changes via email or an alert in the dashboard.

12. Contact

If you have any questions, concerns, or data requests, please reach out to our privacy team:

Email: [email protected]
WhatsApp: +92 335 1228674