PTCL's
General Privacy Notice

PTCL VPN Service Privacy Notice

This Privacy Notice (the “Notice”) explains how Pakistan Telecommunication Company Limited (“PTCL”, “we”, “us” or “our”) collects, uses, processes, stores, protects and shares your information in connection with PTCL VPN application and related sub-services (“PTCL VPN”). PTCL VPN is a security and digital safety solution that provides secure and reliable connectivity and helps enhance your privacy and protection online. This Notice also explains the choices and rights available to you in relation to your personal information.

2. Sensitive Personal Information

2.1. For the purposes of this Notice, we treat the following categories as sensitive personal data:

• (i) Passwords
• (ii) Financial data (bank account, credit card, debit card, or other payment instruments)
• (iii) Precise physical location

2.2. PTCL VPN service is not designed or intended to collect such sensitive personal information. If any sensitive personal information is possessed, appropriate safeguards will be applied in accordance with the applicable legal and regulatory requirements.

3. Activity Data and Operational Data

3.1. User Activity Data – for example browsing history or the content of your internet traffic.

3.2. Operational and Device Data – technical information needed to operate, secure and improve the service.

3.3. PTCL VPN is not designed to monitor or store User Activity Data (browsing history or traffic content).

3.4. In order to provide a reliable service, PTCL VPN may process limited Operational and Device Data. This may include, but is not limited to:

• 3.4.1. Connectivity sessions (timestamps and data volume);
• 3.4.2. Internet Protocol (IP) address assigned by the VPN and the source IP address;
• 3.4.3. Operating system (OS);
• 3.4.4. Web Browsers;
• 3.4.5. Aggregate technical logs; and
• 3.4.6. Limited analytics and diagnostics data.

3.5. This data is processed only as necessary for functionality, security, performance optimisation and troubleshooting. We do not use it to track your online behaviour. For further information, please refer to section 6.

4. Customer Consent

4.1. By registering for or subscribing to PTCL VPN, you acknowledge that your information will be processed as described in this Policy. Where consent is required for a specific processing activity, PTCL will obtain such consent through an appropriate mechanism within the application before commencing that processing activity.

4.2. Moreover, PTCL VPN is not intended for use by individuals below the minimum age permitted under applicable law without the involvement or authorization of a parent or legal guardian. PTCL does not knowingly collect personal information from children in circumstances where parental or guardian authorization is legally required.

5. Collection and Storage of Information

5.1. To provide you with the best possible services, PTCL and its authorized affiliates may collect and store the following, limited to what is necessary for service delivery, security and improvement:

• 5.1.1. Account registration information;
• 5.1.2. Device and application information;
• 5.1.3. Transaction and subscription details;
• 5.1.4. Diagnostic and operational information; and
• 5.1.5. Information needed for security, customer support and abuse prevention as detailed in Sections 1.1 and 3.4.

5.2. Your information relating to PTCL VPN will primarily be stored in electronic form. We implement appropriate organisational and technical measures to protect your information and privacy.

6. Use of Information

6.1. PTCL uses the information described above only for the following purposes:

• 6.1.1. Providing and maintaining PTCL VPN service;
• 6.1.2. Managing accounts and subscriptions;
• 6.1.3. Service performance, diagnosis, and optimizations;
• 6.1.4. Customer support and troubleshooting;
• 6.1.5. Protecting the security and integrity of the service;
• 6.1.6. Detecting and preventing fraud, cyber abuse, including violations of our terms & conditions; and
• 6.1.7. Complying with applicable legal and regulatory requirements.

6.2. We use this information to support the service and not to actively track your online behaviour.

7. Disclosure and Sharing of Information

7.1. PTCL does not sell or rent information obtained through PTCL VPN Service. Trusted third-party service providers and infrastructure sub-processors (such as certified cloud hosting facilities, server infrastructure providers, and secure payment processing gateways, etc.) may be given access to your information solely to operate and support PTCL VPN. Such access is limited to operational purposes and is subject to appropriate contractual and security safeguards.

7.2. All such service providers act strictly as data processors under binding contractual agreements requiring strict confidentiality and security compliance in accordance with applicable data protection standards. Such service providers may process information only on PTCL’s documented instructions and solely to provide the relevant services to PTCL. They have no independent right to use PTCL VPN user information for advertising, profiling, marketing or any other unrelated commercial purpose.

7.3. PTCL ensures the implementation of adequate organizational and technical measures to protect your information and privacy; however, your information may be shared, used or otherwise processed as described in this Notice e.g., in the following circumstances:

• 7.3.1. PTCL may disclose limited information where required by applicable law, a valid court order or a lawful request from a competent authority. Any such disclosure will be limited to the information or operational data that PTCL is legally required to provide and will be handled in accordance with applicable legal and regulatory requirements.
• 7.3.2. PTCL may use anonymised or aggregated data (which cannot reasonably identify you) to understand how to improve connectivity, design better products and services, measure network performance, and develop innovative features.

8. Security, Access, and Retention

8.1. PTCL maintains robust organizational, technical, physical, and infrastructure security controls in accordance with recognized industry standards and applicable telecommunications security frameworks to safeguard user data against unauthorized access, destruction, loss, or intrusion.

8.2. If a personal-data incident occurs, PTCL will assess and manage the incident in accordance with its security-response procedures and will notify affected users and relevant authorities where required under applicable law.

8.3. Access to information processed in connection with the services of PTCL VPN is restricted to personnel who require such access for legitimate service purposes, subject to appropriate confidentiality, security, and role-based access controls.

8.4. PTCL retains data strictly in accordance with data minimization principles and established retention schedules:

• 8.4.1. Operational & Connection Telemetry: Temporary diagnostic session logs (such as timestamps, data volume, and performance metrics) are retained on a rolling cycle, in line with regulatory requirements, for a maximum period of 3 years, after which they are automatically purged or aggregated into non-identifiable statistical metrics.
• 8.4.2. Account & Profile Information: Your name, email address, telephone number, and subscription status are maintained for the active duration of your PTCL VPN account to deliver the service.
• 8.4.3. Post-Termination & Statutory Retention: Following account termination or an erasure request, personal account data is purged from active operational databases within 30 days or aggregated into non-identifiable statistical data.
• 8.4.4. Some records, such as specific billing records, transaction records, and tax documentation are retained solely for the mandatory statutory period prescribed by applicable telecommunications and financial laws.

9. Your Rights

The following are your rights regarding your information in connection with the PTCL VPN service:

9.1. You have the right to withdraw your consent. You may withdraw your consent for any processing activity that relies on consent. Withdrawal will not affect processing already undertaken before the consent was withdrawn. Where the relevant information is necessary to provide PTCL VPN, withdrawal may affect your ability to continue using some or all of the service.

9.2. You have the right to access your information. If you are a Customer/Subscriber of the PTCL VPN app, you can request a copy of your personal data through PTCL’s relevant App, or by visiting a PTCL designated customer care center.

9.3. You have the right to correct your information. PTCL takes adequate measures to ensure that the information we hold about you is accurately recorded as provided by you. You are responsible for the integrity of the information you provide, and you may request us to correct and/or update your information, if it is inaccurate. You can request correction or updating of the information held by PTCL by contacting us in writing.

9.4. You have the right to opt out of marketing messages. Where permitted and subject to any required consent, PTCL VPN may send service-related updates and promotional communications using the contact details associated with your account. You may opt out of promotional communications through the relevant application settings or the unsubscribe mechanism provided in the communication. Service-related and security notifications may continue where necessary to operate or protect your account.

9.5. You have the right to request erasure. You may request deletion of personal information associated with your PTCL VPN account. Following account deletion, personal information will be removed in accordance with the retention periods described in this Policy, except where specific information must be retained to comply with applicable legal, regulatory, billing, tax, audit or dispute-resolution requirements.

• 9.5.1. You may note that exercising your above-mentioned rights such as erasure of certain information or withdrawal of consent may lead to cancellation of your subscription or registration with us or affect quality and access to our services.

9.6. To exercise any of the rights described above, or if you have a question or complaint about this Privacy Notice or the handling of your information, please contact us through the PTCL VPN application.

9.7. Please provide sufficient information to allow us to verify your identity and to identify the information your request relates to. We will respond within a reasonable time and in accordance with applicable law.

10. Changes to this Notice

10.1. PTCL may update this notice from time to time to reflect changes to PTCL VPN service, its information processing practices, or applicable legal and regulatory requirements. Where appropriate, material changes may be communicated through the PTCL VPN application, website, email, or any other substitutable channel.

10.2. The latest version of this Policy will remain available through the PTCL VPN application and the designated PTCL VPN website. Where a change materially affects how personal information is collected, used or shared, PTCL will provide an appropriate Policy through the application, website, email or another suitable communication channel.

11. Contact Information

11.1. If you have a question, concern or complaint about this Privacy Notice or the handling of your information or how we are processing your data, you can visit pvpn.ptcl.com.pk for contact information or contact us at ictbssi@ptclgroup.com.