Privacy Policy

Panzex Solutions (Pvt.) Ltd. is a custom software development company based in Kharian, Punjab, Pakistan. We build SaaS platforms, web and mobile applications, and do the technical SEO and growth work around them.

For anything in this policy, the contact is build@panzex.com.

We collect personal data in the four situations below, and there is no passive collection of anything not listed here.

When you submit a project brief

The quote form asks for your name, company, role, email address, phone number and country, alongside your answers about the project itself. Every one of those fields is used to answer you and to understand what you are asking for.

The form asks you to enter your email and phone number twice to check for errors. Only one copy is stored, and the confirmation entries are discarded once compared.

When you send a message

The contact form asks for your name, email address, a topic and your message. Nothing else.

When you vote on an FAQ answer

The “was this helpful?” control on knowledge base answers records which answer was voted on and whether the vote was yes or no. It does not record who voted, and it is not tied to any other record.

When you sign in

Signing in is optional and is only needed for the member area and some of the free tools. It happens through Google, and Google tells us your email address, the name on your Google account and your profile picture. We never see your password, and there is no password on this site to see.

Alongside that we record the IP address you signed in from, the address of your most recent visit, and the date and time of each. That record exists so an account can be stopped when it is used to attack the site or to spam other members, and it is visible only to the people who run it. It is described again under how long we keep things.

What we do not collect

• No advertising trackers. There is no Google Analytics, no Meta pixel, no session recorder, no heatmap tool. We count visits and page speed with Vercel Web Analytics and Speed Insights, which set no cookies and do not identify you — we see totals, not people.
• No account is needed to read the site. Every public page works signed out, and nothing asks you to register to read it.
• No profiling and no automated decision-making. Every enquiry is reviewed by a member of our team.

Both forms use anti-spam measures, described below.

• How long the form took to fill in. The page records when it loaded and compares this with when the form was submitted, to identify automated submissions. Only the elapsed time is kept, not the timestamps.
• Your IP address, for rate limiting. We allow three submissions per hour per connection. For the forms, the address is held in memory on the server for at most one hour, is never attached to your submission, and is never used to identify or locate you. If you have an account, the address you last connected from is stored against it — see the sign-in section above, which is the only place on this site where an address is written down.

The forms also include a hidden field that people cannot see. Automated submissions tend to fill it in, which allows them to be identified. Nothing you type is entered into it.

Where UK/EU data protection law applies, our lawful bases are these, and nothing else:

• Your consent, given by the checkbox on each form, for using your contact details to reply to your enquiry. You can withdraw it at any time — see your rights.
• Legitimate interests, for keeping the site available and free of automated abuse. This covers the rate limit and the timing check above. We have weighed this against your interests and concluded that an hour-long, in-memory, non-identifying counter is proportionate to the problem it solves.
• Contract, once we are actually working together, for the records any engagement requires.

We do not rely on legitimate interests for marketing. If we ever want to send you something you did not ask for, we will ask first.

When you submit a form, the data is handled in one of two ways.

1. Email to our own inbox. The submission is formatted into a message and sent to build@panzex.com through a transactional email provider, which processes it solely to deliver it.
2. A local record on the server. A copy is written to a file on the application server so that a mail outage cannot lose your enquiry. This copy contains the same fields as the email.

If neither succeeds, the page informs you and provides our email address instead.

We do not sell your data, and we do not share it for anyone else’s marketing. The only third parties involved are the infrastructure providers that host the site and carry the mail. They act on our instructions and for no other purpose.

Booking a call. If you book a slot on Book a call, the booking calendar is Google’s. It loads only when you press “Show available times”, and what you enter there (name, email, phone and what the call is about) goes to Google Calendar, which creates the event and the Meet link under Google’s own privacy policy. We see it as an event on our calendar.

We are in Pakistan, and our hosting and email providers operate globally. Your data will therefore be processed outside the country you are in, including potentially outside the UK and EEA.

Where that involves a transfer out of the UK or EEA, we rely on the standard contractual clauses our providers offer, together with the technical measures described in this policy. For procurement or data processing agreements, contact us for full details.

• Enquiries that do not become work: up to 24 months, then deleted. This allows us to refer to your original brief if you return to the project.
• Enquiries that become work: for the duration of the engagement and for six years afterwards, which is what accounting and contractual records require.
• Rate-limit counters: one hour, in memory only.
• FAQ votes: indefinitely, because they contain nothing personal.
• Your account: for as long as you have one. That includes the sign-in record described above — your email address, the name and picture from your Google account, the addresses you connected from and the dates you did so. Deleting your account deletes all of it. Ask us and we will.
• Addresses we have blocked: until we unblock them. An address is added to that list only after it has been used to attack the site or to spam other members, and the list holds the address and the reason, with no other record of the person attached.

Ask us to delete something sooner and we will, unless we are legally required to keep it — in which case we will tell you which record and why.

The quote form saves your progress as you go, so that a reload or a click away to another page does not cost you the answers you have already given.

That draft is held in your browser’s session storage. It never leaves your device, we cannot access it, and it is erased when you close the tab or submit the form. Your consent selection is never saved, so you will be asked to confirm it again on a restored draft.

The site also remembers your theme choice. See the Cookie Policy for the full list. None of it is used for tracking.

Depending on where you live you may have the right to access your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent you previously gave.

To use any of them, email build@panzex.com. We will need to be reasonably satisfied that you are the person the data relates to. We respond within 30 days.

If we get it wrong, you can complain to your local data protection authority. In the UK that is the Information Commissioner’s Office. We encourage you to contact us first so we can resolve the issue.

The site is served over HTTPS only, with HSTS. It sets a Content Security Policy that prevents the page loading code or sending data to origins we have not allowed, along with protections against clickjacking and content-type sniffing.

Access to submitted enquiries is restricted to the people responsible for answering them, and that access is reviewed.

No system is perfectly secure. If you believe you have found a vulnerability, please write to build@panzex.com rather than disclosing it publicly, and we will work with you on it.

This site is aimed at businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has sent us their details, tell us and we will delete them.

When this policy changes we update the date at the top. If a change materially affects how we handle data you have already given us, we will contact you about it directly rather than relying on you to re-read the page.