This Privacy Policy explains how ABT Dev Services (Pvt.) Ltd. (“ABT”, “we”, “us”) collects, uses, shares and protects personal information when you visit abtdevservices.com, contact us, apply for a job, use the client portal, or become a client. It also explains how we handle information inside our software products, Qalamora, DishRoute and MandiKhata. Effective date: 27 October 2026.
1. Who is responsible for your information
ABT Dev Services (Pvt.) Ltd. is a private limited company in Pakistan with its office at 1st Floor TMS, Badami Bagh, Lahore, Pakistan. For website visitors, prospective clients, job applicants and our own business contacts, ABT decides why and how information is used and is the controller. When a school, restaurant or business uses one of our products or asks us to build or operate a system, that customer controls the records of its own students, guests, staff and customers, and ABT processes those records on the customer’s instructions (see section 9).
Privacy questions and requests: contact@abtdevservices.com. Job applications: careers@abtdevservices.com. Client support: support@abtdevservices.com.
2. Information we collect
Information you give us.
-
Contact and project forms: name, email, company, budget range, timeline, services of interest, project brief, consultation time and time zone, company size, compliance needs, partnership type, website, subject and message.
-
Newsletter requests: your email address.
-
Job applications: name, email, the role and your message; anything else you choose to send to our careers inbox, such as a CV or portfolio.
-
Client portal and engagements: account name, email, phone, company details, billing contacts, invoices, payments, contracts, proposals, support tickets and files you upload.
-
Calls, email, WhatsApp and meetings: the details you choose to share and the ordinary metadata needed to reply.
Information collected automatically. Our hosting environment receives your IP address, requested URL, date and time, browser and device information, referrer, and security or error data needed to deliver and protect the website. Your browser stores a few preferences described in our Cookie Policy. We do not currently run third-party analytics, advertising pixels or tracking cookies on this website.
Information from others. Colleagues may introduce you, partners may refer a project to us, and we may look at public business information (such as a company website or LinkedIn page) to prepare for a conversation.
Please do not send passwords, payment card numbers, health records, student records or confidential datasets through general forms or email. If a project needs such data, we agree a secure method first.
3. How and why we use information
-
To answer enquiries, arrange consultations, assess fit, prepare proposals and estimates.
-
To deliver, support and invoice the services and products you buy, and to keep accurate business and tax records.
-
To operate the client portal: sign-in, projects, invoices, contracts, tickets and notifications.
-
To recruit: review applications, contact candidates and keep a record of the process.
-
To send updates you asked for, and, where the law allows, occasional news about our services to existing clients. You can opt out at any time.
-
To secure the website, products and portal, prevent fraud and abuse, troubleshoot and improve performance.
-
To meet legal obligations, respond to lawful requests and establish or defend legal claims.
We do not sell personal information, and we do not make decisions with legal or similarly significant effects about you solely by automated means.
4. Legal bases
Where a data protection law requires a legal basis (for example the EU or UK GDPR), we rely on: taking steps at your request before a contract and performing a contract; our legitimate interests in running and protecting our business, answering enquiries and improving our services, balanced against your rights; compliance with legal obligations, such as tax and accounting rules; and your consent, for optional communications or where the law requires it. You may withdraw consent at any time without affecting earlier processing.
5. Sharing
We share personal information only as needed, with:
-
Our team in Pakistan, on a need-to-know basis and under confidentiality obligations.
-
Service providers that host our website, CRM, client portal and products, deliver email, SMS and WhatsApp messages, store backups, or process payments. They act on our instructions and are bound to protect the data.
-
Delivery partners or subcontractors working on your project, where you have agreed to their involvement.
-
Professional advisers such as lawyers, auditors and accountants.
-
Authorities, courts or regulators where the law requires it, including under the Prevention of Electronic Crimes Act, 2016, or to protect our rights, users or the public.
-
A buyer or successor if our business is reorganised, merged or sold, subject to this policy.
6. International transfers
We are based in Pakistan and work with clients worldwide. Your information may be stored or accessed in Pakistan and in the countries where our hosting and service providers operate. Where a law restricts international transfers, we use the safeguards it recognises, such as contractual clauses, and we tell you if a specific transfer mechanism applies to your engagement.
7. Retention
-
Enquiries that do not become projects: up to 24 months after the last contact, then deleted or anonymised.
-
Client, contract, invoice and payment records: for the engagement and at least 6 years afterwards to meet tax, accounting and limitation requirements.
-
Job applications: up to 12 months after the role is filled, unless you agree to a longer period for future roles.
-
Client portal sessions: one strictly necessary session cookie that ends on sign-out or within 12 hours.
-
Server and security logs: kept for the provider’s rolling retention period, normally no more than 90 days, unless needed to investigate an incident.
-
Product customer data: as described in our Software Products & Subscription Terms.
When information is no longer needed we delete it, anonymise it, or keep it securely isolated until deletion is possible.
8. Security
We use encrypted connections (HTTPS/TLS), security headers, server-side validation, role-based access, two-factor sign-in for administrative systems, encrypted storage of sensitive fields in our products, backups and access logging. Our Security page describes these measures in more detail. No system is completely secure; if a breach affects your personal information, we will notify you and the relevant authorities where the law or our contract requires it.
9. Data inside our products and client systems
Schools, restaurants and businesses that use Qalamora, DishRoute or MandiKhata, and clients whose systems we build or host, own the records they put into those systems. ABT processes that data only to provide, secure, support and back up the service, under the customer’s instructions and our Software Products & Subscription Terms or the client contract. Our support staff access a customer’s data only when needed to resolve an issue and, where the product supports it, only after the customer grants access; that access is logged. If you are a parent, student, guest or employee of one of our customers, please send requests about your records to that organisation; we will assist them in responding.
10. Your rights
Depending on the law that applies to you, you may have the right to access your information, correct it, delete it, restrict or object to certain processing, receive a portable copy, and withdraw consent. Residents of the EU, UK and similar jurisdictions may also complain to their data protection authority. To use these rights, email us from the address we hold or explain how we can verify your identity. We respond within 30 days, or tell you if we need more time or if an exemption applies, for example records we must keep by law. Pakistan’s personal data protection legislation has not yet come into force; when it does, we will update this policy and apply its requirements.
11. Children
This website is intended for adults and people acting for an organisation. We do not knowingly collect children’s information through it. Our school product Qalamora holds student records on behalf of schools, which are responsible for obtaining any parental consent required by law.
12. Links and third-party services
Links to social networks, product websites, payment gateways or partner sites take you to services with their own privacy policies. We are not responsible for their practices.
13. Changes
We update this policy when our practices, services or the law change. The date at the top of the page shows the current version. If a change materially affects how we use information we already hold, we will tell affected clients directly.