PRIVACY POLICY
Preamble
Islamic Help Pakistan respects the privacy, dignity, and confidentiality of every person who interacts with us. This includes donors, supporters, volunteers, beneficiaries, children, families, staff, consultants, suppliers, partners, visitors to our website, and members of the wider public.
This Privacy Policy explains how Islamic Help Pakistan collects, uses, stores, protects, shares, and manages personal information through its website, online donation systems, forms, campaigns, communications, field programmes, events, social media platforms, and other digital or physical interactions.
We are committed to handling personal information responsibly, lawfully, fairly, and transparently, in line with the applicable laws of Pakistan, relevant international data-protection principles, recognised humanitarian and child-safeguarding standards, donor requirements, and sound information-security practice.
1. About Us
Islamic Help Pakistan is a humanitarian and development organisation working to support vulnerable and underserved communities through programmes such as emergency response, water, sanitation and hygiene (WASH), education, health, Child protection, orphan support, food security and Nutrition, livelihood, Housing and shelter, community development, climate action and other charitable interventions.
For the purposes of this Policy, “Islamic Help Pakistan”, “IHP”, “we”, “our” or “us” refer to Islamic Help Pakistan and its authorised staff, representatives, volunteers, and implementing partners acting on its behalf. For the personal information described in this Policy, Islamic Help Pakistan acts as the “data controller”.
Contact details
Islamic Help Pakistan
Website: https://islamichelp.org.pk
Email: info@islamichelp.org.pk
Phone: +92 325 786 5555 / +92 42 35290725
2. Legal and Ethical Framework
This Policy is designed to meet both national requirements and recognised international good practice. Because Pakistan does not yet have a single, comprehensive, enacted data-protection statute, we align our practice with the applicable Pakistani laws below and, where they go further, with leading international standards.
2.1 National framework (Pakistan)
- •Constitution of the Islamic Republic of Pakistan - including the right to dignity and the privacy of the home (Article 14).
- •Prevention of Electronic Crimes Act, 2016 (PECA), as amended in 2025- governing unauthorised access to, and misuse of, electronic data and identity information.
- •Sector and related laws- including the Payment Systems and Electronic Fund Transfers Act, 2007; the Banking Companies Ordinance, 1962; the Right of Access to Information Act, 2017; the Electronic Transactions Ordinance, 2002; and the NADRA Ordinance, 2000, as applicable.
- •Forthcoming legislation - we monitor the draft Personal Data Protection Bill and related national data-governance policy, and we will update this Policy once such legislation is enacted.
2.2 International standards and humanitarian principles
- •EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679 - applied as a benchmark of good practice, particularly for international donors and transfers.
- •International Covenant on Civil and Political Rights (ICCPR) – to which Pakistan is a signatory, protecting the right to privacy.
- •ICRC Handbook on Data Protection in Humanitarian Action and the IASC Operational Guidance on Data Responsibility in Humanitarian Action.
- •Core Humanitarian Standard on Quality and Accountability (CHS) and applicable child-safeguarding standards (including the UN Convention on the Rights of the Child)
3. Definitions
In this Policy, the following terms have the meanings set out below:
Personal information / personal data. Any information relating to an identified or identifiable living individual, such as a name, identity number, contact details, location, or online identifier.
Sensitive personal information. Personal data requiring additional protection, including health, disability, biometric or identity data, financial hardship, religious donation preferences, and protection or safeguarding concerns.
Processing. Any operation performed on personal information, including collecting, recording, storing, using, sharing, transferring, archiving, or deleting it.
Data controller. The party that determines the purposes and means of processing personal information, in this Policy, Islamic Help Pakistan.
Data processor. A third party that processes personal information on our behalf and under our instructions.
Data subject. The individual to whom the personal information relates.
Beneficiary. A person or household receiving, or assessed for, assistance through our programmes.
Consent. A clear, informed, and freely given indication that a person agrees to their personal information being processed for a stated purpose.
4. Scope of This Policy
This Policy applies to personal information collected through:
- •Our website and online forms;
- •Online donation, fundraising, sponsorship, and appeal pages;
- •Email, telephone, WhatsApp, SMS, postal correspondence, and social-media communication;
- •Volunteer, internship, job, consultant, and supplier applications;
- •Programme registration, beneficiary assessment, monitoring, evaluation, accountability, and reporting activities;
- •Photographs, videos, case studies, testimonials, and media-consent forms;
- •Events, trainings, field visits, distributions, surveys, and community consultations;
- •Any other interaction where Islamic Help Pakistan collects or processes personal information.
This Policy does not apply to third-party websites or platforms linked from our website. Those third parties are responsible for their own privacy practices.
5. Data-Protection Principles We Follow
We apply the following principles to all personal information we handle:
- •Lawfulness, fairness, and transparency - We process information lawfully and explain clearly how and why we use it.
- •Purpose limitation - We collect information for specified, legitimate purposes and do not use it in incompatible ways.
- •Data minimisation - We collect only what is necessary and proportionate for the purpose.
- •Accuracy – We take reasonable steps to keep information accurate and up to date.
- •Storage limitation - We keep information only for as long as necessary.
- •Integrity and confidentiality - We protect information with appropriate security measures.
- •Accountability - We take responsibility for our processing and can demonstrate our compliance.
- •Privacy and safeguarding by design - We build privacy and protection considerations into our programmes and systems from the outset.
6. Personal Information We May Collect
Depending on how you interact with us, we may collect the following categories of information.
6.1 Identification and contact information
Name; father’s, husband’s, or guardian’s name where required; CNIC or identity details where legally or programmatically necessary; date of birth, age, gender; address, district, province; phone number, email address; and emergency-contact details.
6.2 Donation and financial information
Donation amount and type; Zakat, Sadaqah, Lillah, Fitrana, Fidya, Kaffara, Qurbani, or other giving preference; transaction reference; payment method; bank-transfer details; donor-receipt and tax-related information where applicable; and communication preferences.
Islamic Help Pakistan does not intentionally store full debit or credit-card details on its own systems. Online payments may be processed through authorised banks, payment gateways, or financial-service providers subject to their own security standards.
6.3 Supporter and communication information
Your preferences for receiving updates, newsletters, appeals, campaign information, event invitations, volunteer opportunities, donor reports, receipts, acknowledgements, and impact updates.
6.4 Beneficiary and programme information
Information required to assess eligibility, vulnerability, and needs, including assistance received, household composition, socio-economic status, disability status, health-related needs, education and livelihood status, WASH and shelter needs, protection concerns, and other programme-relevant data. We collect such information only where necessary for humanitarian, development, accountability, safeguarding, audit, donor-reporting, or legal purposes.
6.5 Children’s information
Where our programmes involve children, including orphans, students, child beneficiaries, or children in vulnerable households, we may collect limited information necessary for programme delivery, safeguarding, sponsorship, education, welfare monitoring, and reporting. Children’s information is treated as highly sensitive. We seek appropriate consent from parents, guardians, or authorised caregivers wherever required, and we apply additional safeguards when using children’s photographs, stories, or personal details.
6.6 Photographs, videos, stories, and case studies
With appropriate consent, we may collect photographs, videos, audio recordings, quotes, testimonials, life stories, case studies, and impact stories for reporting, fundraising, advocacy, communication, transparency, and accountability. We avoid publishing sensitive details that may expose any person, child, family, or community to harm, stigma, discrimination, exploitation, or security risk.
6.7 Website and technical information
When you visit our website, we may collect limited technical information such as IP address, browser and device type, operating system, pages visited, date and time of visit, approximate location, referral source, cookies, and similar analytics data.
6.8 Employment, volunteer, consultant, and supplier information
If you apply for a job, consultancy, internship, volunteer role, vendor registration, or partnership, we may collect CVs, qualifications, work history, references, identity documents, tax information, bank details, conflict-of-interest and safeguarding declarations, due-diligence information, and other information relevant to recruitment, procurement, contracting, or compliance.
6.9 Sensitive personal information
In limited cases, we may process sensitive information, including health status, disability, vulnerability status, biometric or identity details, financial hardship, religious donation preferences, and protection or safeguarding concerns. Such information is collected only where necessary, proportionate, lawful, and subject to appropriate safeguards.
7. How We Collect Information
We may collect information directly from you when you:
- •Make a donation or create an online account;
- •Subscribe to our newsletter;
- •Contact us by phone, email, website form, WhatsApp, SMS, or social media;
- •Register for an event, training, campaign, or volunteer opportunity;
- •Apply for a job, internship, consultancy, supplier registration, or partnership;
- •Participate in surveys, assessments, interviews, feedback mechanisms, or complaints processes;
- •Receive assistance through our programmes;
- •Provide consent for photographs, videos, stories, or case studies.
We may also collect information from authorised third parties, including implementing partners, community committees, referral organisations, government departments, schools, hospitals, financial institutions, payment gateways, donors, auditors, regulatory bodies, or publicly available sources, where lawful and necessary.
8. Why We Use Personal Information
8.1 Donations and supporter services
To process donations, issue receipts, maintain donor records, manage Zakat and restricted donations, respond to enquiries, provide updates, and ensure funds are used according to donor intent and organisational policy.
8.2 Programme delivery
To identify needs, assess eligibility, register beneficiaries, deliver assistance, monitor quality, prevent duplication, support vulnerable communities, and remain accountable to affected populations.
8.3 Safeguarding and protection
To protect children, vulnerable adults, communities, staff, volunteers, and partners from harm, abuse, exploitation, neglect, fraud, misconduct, or safeguarding risks.
8.4 Communication and fundraising
To send newsletters, appeals, campaign updates, impact reports, event invitations, and volunteering opportunities where you have agreed or where otherwise permitted by applicable law.
8.5 Accountability, monitoring, evaluation, and learning
To assess impact, improve services, conduct surveys, prepare reports, respond to feedback, manage complaints, and meet donor, audit, and regulatory requirements.
8.6 Legal, regulatory, and compliance purposes
To comply with applicable laws, court orders, financial-recordkeeping and tax obligations, audit requirements, anti-fraud controls, anti-money-laundering and counter-terrorism-financing obligations, and donor due-diligence requirements.
8.7 Website improvement and security
To operate, maintain, secure, and improve our website, prevent misuse, detect technical problems, analyse usage, and enhance user experience.
8.8 Recruitment, procurement, and administration
To process applications, manage contracts, conduct due diligence, evaluate suppliers, maintain HR records, process payments, and manage operations.
9. Lawful and Ethical Basis for Processing
We process personal information only where there is a lawful, legitimate, and ethical basis to do so. Depending on the context, one or more of the following bases will apply:
| Basis | When we rely on it |
|---|---|
| Consent | When you subscribe to communications, agree to photography or story collection, or otherwise give clear permission. |
| Contract or request | To process a donation, sponsorship, service, application, or a request you have made to us. |
| Legal or regulatory obligation | To meet tax, audit, anti-money-laundering, counter-terrorism-financing, court, and donor due-diligence requirements. |
| Vital interests | To protect life or safety in an emergency or life-saving situation. |
| Legitimate humanitarian and charitable interests | To deliver assistance, prevent duplication, safeguard people, and remain accountable to affected communities and donors. |
| Public interest and humanitarian mandate | To carry out humanitarian response and community welfare activities. |
Sensitive personal information is processed only with explicit consent or another appropriate safeguard, for example, where processing is necessary to protect life, to safeguard a child or vulnerable adult, or to meet a legal or donor obligation.
Where consent is the basis for processing, you may withdraw it at any time, subject to legal, contractual, safeguarding, audit, or programme-related obligations that may require us to retain certain information.
10. Children’s Privacy and Safeguarding
Islamic Help Pakistan is committed to protecting the privacy, dignity, safety, and best interests of children. When collecting or using children’s information, we will:
- •Collect only information that is necessary and proportionate;
- •Seek consent from a parent, guardian, caregiver, or authorised representative where required;
- •Obtain the child’s assent where appropriate, taking into account age, maturity, and understanding;
- •Avoid publishing full names, exact locations, school details, or other identifying information where this may create risk;
- •Use photographs, videos, and stories respectfully and only with appropriate consent;
- •Avoid images or stories that may be degrading, exploitative, misleading, or harmful;
- •Restrict access to children’s information to authorised personnel only;
- •Apply safeguarding procedures where concerns arise.
Islamic Help Pakistan does not knowingly use children’s personal information for commercial marketing.
11. Photographs, Videos, Stories, and Media Consent
We may use photographs, videos, testimonials, and case studies to demonstrate impact, raise awareness, report to donors, support fundraising, advocate for vulnerable communities, and promote transparency.
We will seek informed consent wherever required and appropriate. Individuals have the right to refuse photography, filming, or story collection without affecting their eligibility for assistance, unless documentation is strictly required for verification, audit, or compliance. We will not knowingly publish images or stories that compromise a person’s dignity, safety, privacy, or security.
12. Cookies and Similar Technologies
Our website may use cookies and similar technologies to improve functionality, remember preferences, analyse traffic, support donation processes, and improve user experience. Cookies may include:
- •Essential cookies required for website functionality;
- •Analytics cookies to understand website use;
- •Preference cookies to remember user choices;
- •Security cookies to protect the website and users;
- •Security cookies to protect the website and users;
Where required, we will request your consent before using non-essential cookies. You may also control or disable cookies through your browser settings, though disabling certain cookies may affect website functionality.
13. Marketing and Communication Preferences
We may contact you with updates, newsletters, appeals, campaigns, event information, volunteer opportunities, and impact reports where you have opted in, donated to us, requested information, or where communication is otherwise permitted by applicable law. You may opt out of marketing communications at any time by:
- •Clicking the unsubscribe link in our emails, where available;
- •Contacting us by email;
- •Sending a request through our website;
- •Informing our staff by phone, WhatsApp, or in writing.
We will not sell, rent, or trade your personal information to third parties for their own marketing purposes.
14. Sharing of Personal Information
We share personal information only where necessary, lawful, proportionate, and subject to appropriate safeguards. We may share information with:
- •Banks, payment gateways, and financial-service providers;
- •Donation platforms and fundraising service providers;
- •IT, website hosting, email, cloud, SMS, WhatsApp, CRM, and database service providers;
- •Auditors, accountants, legal advisers, and professional consultants;
- •Donors, institutional partners, and grant-making organisations;
- •Implementing partners, community-based organisations, and service providers;
- •Government departments, regulators, tax authorities, law-enforcement agencies, or courts where required by law;
- •Hospitals, schools, referral services, emergency responders, or protection actors where necessary for programme delivery or safeguarding;
- •Logistics providers, suppliers, contractors, and field teams involved in delivering assistance;
- •International affiliates or partners where necessary for donor reporting, programme management, compliance, or humanitarian response.
We require third parties handling personal information on our behalf to use it only for authorised purposes and to apply appropriate confidentiality and security measures under a written arrangement.
15. International Data Transfers
As a humanitarian and development organisation, we may work with international donors, partners, affiliates, service providers, and platforms. This may require personal information to be transferred, accessed, or stored outside Pakistan. Where such transfers are necessary, we take reasonable steps to ensure appropriate safeguards are in place, such as:
- •Sharing only the minimum necessary information;
- •Using secure transfer methods;
- •Entering into confidentiality, data-protection, or contractual arrangements (including recognised standard contractual safeguards where appropriate);
- •Limiting access to authorised personnel;
- •Applying donor and safeguarding requirements;
- •Ensuring sensitive information is protected from misuse, unauthorised access, or unnecessary disclosure.
16. Data Security
We take reasonable technical, organisational, and physical measures to protect personal information against unauthorised access, loss, misuse, alteration, disclosure, or destruction. These measures may include:
- •Access controls and password protection;
- •Role-based access to systems and files;
- •Staff confidentiality obligations;
- •Secure storage of physical and digital records;
- •Antivirus, firewall, backup, and system-security measures;
- •Secure payment processing through authorised providers;
- •Staff training on privacy, safeguarding, and information security;
- •Restricted access to sensitive beneficiary, child, donor, HR, and financial data;
- •Incident-response procedures for suspected data breaches.
No website, email, or digital system can be guaranteed to be completely secure. However, we take reasonable steps to protect the information entrusted to us.
17. Data Retention
We retain personal information only for as long as necessary for the purpose for which it was collected, including legal, audit, tax, donor, safeguarding, contractual, programme, or operational requirements. The following indicative periods apply and may be adjusted to meet specific donor or statutory obligations:
| Category of records | Indicative retention period | Primary basis |
|---|---|---|
| Donation and financial records | Minimum 6 years after the financial year | Tax, audit, donor and statutory recordkeeping |
| Beneficiary and programme records | Duration of the programme plus 5–7 years | Donor reporting, audit and accountability |
| Safeguarding and protection records | Retained long-term in line with safeguarding policy | Child protection and duty of care |
| HR, consultant, volunteer and supplier records | Duration of engagement plus up to 7 years | Legal, tax and contractual obligations |
| Consent forms, photographs, videos, case studies | For the period consent remains valid or until withdrawn | Consent and communications governance |
| Complaints, feedback and accountability records | Typically 3–7 years | Accountability and quality assurance |
| Website and analytics data | Typically up to 24 months | Website operation and security |
When personal information is no longer required, we will securely delete, anonymise, archive, or dispose of it in accordance with applicable requirements and organisational procedures.
18. Your Privacy Rights
Subject to applicable law, donor requirements, safeguarding obligations, and legitimate organisational needs, you may have the right to:
- •Request access to the personal information we hold about you;
- •Request correction of inaccurate or incomplete information;
- •Withdraw consent where processing is based on consent;
- •Object to certain uses of your information;
- •Request deletion of your information where it is no longer required;
- •Request restriction of certain processing activities;
- •Request information about how your data has been used or shared;
- •Opt out of marketing communications;
- •Raise a complaint or concern about how your information is handled.
18.1 How to exercise your rights
To make a request, contact us using the details in Section 1 or Section 25. We will acknowledge your request and aim to respond within 30 days. There is normally no charge, although we may apply a reasonable fee for manifestly unfounded, repetitive, or excessive requests. We may need to verify your identity before responding.
We may refuse or limit a request where disclosure would affect the rights, safety, privacy, or security of another person, or where retention is required for legal, audit, safeguarding, donor, or humanitarian-accountability purposes. Where we cannot fulfil a request, we will explain the reason.
19. Beneficiary Rights and Accountability
We recognise that beneficiaries and affected communities have the right to dignity, privacy, informed participation, and safe access to assistance. We will make reasonable efforts to ensure that beneficiaries understand:
- •Why their information is being collected;
- •How their information will be used;
- •Whether information may be shared with donors, partners, or authorities;
- •Whether photographs, videos, or stories are optional;
- •How to ask questions, provide feedback, or raise complaints.
Refusal to provide optional media consent will not affect eligibility for assistance. However, certain minimum information may be required to verify eligibility, prevent duplication, ensure accountability, or comply with donor and audit requirements.
20. Data Breach and Incident Response
If we become aware of a data-security incident that may affect personal information, we will act without undue delay to:
- •Contain and investigate the incident;
- •Assess the type and sensitivity of the affected information;
- •Identify affected individuals or systems;
- •Take corrective action;
- •Inform relevant authorities, donors, partners, or affected individuals where required or appropriate;
- •Review and strengthen internal controls to reduce future risk.
Where a breach is likely to pose a significant risk to affected individuals, we aim to notify them and any relevant parties promptly, as a matter of good practice, ordinarily within 72 hours of becoming aware of the breach.
21. Third-Party Links and Platforms
Our website may contain links to third-party websites, payment gateways, social-media platforms, video platforms, donor portals, or partner websites. Islamic Help Pakistan is not responsible for the privacy practices, security, or content of third-party websites or platforms. Users are encouraged to read the privacy policies of those third parties before submitting personal information.
22. Social Media
When you interact with Islamic Help Pakistan through social-media platforms such as Facebook, Instagram, YouTube, LinkedIn, WhatsApp, or others, your information may also be processed by those platforms according to their own privacy policies.
Please do not publicly share sensitive personal, financial, medical, child-related, or beneficiary information on social media. If you need to share sensitive information with us, please use official and secure communication channels.
23. Automated Decision-Making and Profiling
We do not use personal information for automated decisions that produce legal or similarly significant effects without human review. We may use limited segmentation or analysis to understand donor interests, improve communications, prevent fraud, evaluate programme needs, or improve services. Such activities are carried out responsibly and proportionately.
24. Our Commitment to Confidentiality and Ethical Use
We are committed to ensuring that personal information is used ethically and respectfully. We will not knowingly use personal information in ways that:
- •• Exploit vulnerable people;
- •• Misrepresent beneficiaries or communities;
- •• Create stigma, discrimination, harm, or security risk;
- •• Breach confidentiality without lawful or ethical justification;
- •• Use children’s images or stories in a harmful or inappropriate manner;
- •• Sell personal information for commercial gain.
25. Complaints and Concerns
If you have any concern about how Islamic Help Pakistan has collected, used, stored, or shared your personal information, please contact us using the details below. We will review privacy concerns fairly, confidentially, and without retaliation.
Privacy contact
Islamic Help Pakistan
Email: info@islamichelp.org.pk
Phone: +92 325 786 5555 / +92 42 3529 0725
Postal address: Head Office: House Number: 366 - Block G3, Johar Town, Lahore, Punjab Pakistan.
Please include your name, contact details, the nature of your concern, and any relevant information that may help us respond appropriately. If you are not satisfied with our response, you may escalate the matter to the relevant regulatory or oversight body as provided under applicable Pakistani law.
26. Governing Law and Interpretation
This Policy is governed by, and interpreted in accordance with, the laws of the Islamic Republic of Pakistan, without prejudice to the international standards and donor requirements referred to in Section 2. Where a specific donor agreement or applicable law imposes a stricter standard, that stricter standard will apply to the relevant processing.
27. Updates to This Policy
We may update this Policy from time to time to reflect changes in our operations, website, legal or donor requirements, technology, or privacy practices. The latest version will be published on our website with the updated effective date. Where material changes are made, we may take additional steps to notify users where appropriate.
28. Acknowledgement
By using our website, making a donation, communicating with us, participating in our programmes, or otherwise providing personal information to Islamic Help Pakistan, you acknowledge that your information will be handled in accordance with this Privacy Policy.
Islamic Help Pakistan remains committed to protecting personal information with dignity, transparency, accountability, and care, in line with its humanitarian mission and ethical responsibilities.
