Skip to content

Privacy Policy

Last updated: June 23, 2026

Nizami Herbal ("we," "us," or "our") operates the website at nizamiherbal.com(the "Site") and sells herbal wellness products across Pakistan. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you browse our Site, create an account, place an order, or contact us.

By using our Site, you agree to the practices described in this policy. If you do not agree, please do not use the Site.

1. Information We Collect

We collect information that you provide directly and information collected automatically when you use the Site.

1.1 Information you provide

  • Account details: full name, email address, WhatsApp/mobile number, and password (stored in hashed form only).
  • Order & delivery details: shipping address (including city and province), order items, order notes, payment method selection, and order history.
  • Phone verification: mobile number and one-time verification codes when you register or verify your account via SMS or WhatsApp OTP.
  • Customer support: messages you send us via WhatsApp, email, or our contact form (name, phone number, and message content).
  • Product reviews: display name, rating, and review text you submit on product pages.
  • Social sign-in (optional): if you choose to sign in with Google or Facebook, we receive basic profile information permitted by that provider (such as your name and email address).

1.2 Information collected automatically

  • Device & usage data: browser type, device type, pages visited, referring URL, and general usage patterns.
  • Cookies & local storage: shopping cart contents, session tokens, theme preferences, and cookie consent choices. See our Cookie Policy for details.
  • Location data (approximate): when you use address autocomplete during checkout, Google Maps may process address-related queries. We do not track your precise GPS location.

1.3 Payment information

For Cash on Delivery (COD), we do not collect card or wallet credentials on our servers. For online payments through PayFast, payment processing is handled by the payment provider. We receive confirmation of payment status and a transaction reference—not your full payment credentials.

2. How We Use Your Information

We use personal information for the following purposes:

  • Processing, fulfilling, and delivering your orders
  • Creating and managing your customer account
  • Verifying your identity via phone OTP during registration or login
  • Sending order confirmations, delivery updates, and support messages via WhatsApp, SMS, or email
  • Coordinating COD collection and courier bookings
  • Applying coupons, calculating taxes, and generating invoices
  • Responding to inquiries, complaints, and return requests
  • Improving our Site, products, and customer experience
  • Preventing fraud, abuse, and unauthorized access
  • Complying with applicable laws and lawful requests

We do not sell your personal information to third parties for their marketing purposes.

3. Legal Basis for Processing

Depending on the activity, we process your data because:

  • It is necessary to perform our contract with you (e.g., fulfilling an order)
  • You have given consent (e.g., optional marketing messages or social login)
  • It is in our legitimate business interests (e.g., fraud prevention, Site security)
  • It is required by law (e.g., tax or regulatory obligations)

4. How We Share Your Information

We share personal information only when necessary to operate our business:

  • Courier partners (e.g., TCS): recipient name, phone number, and delivery address to ship your order and provide tracking.
  • Payment providers: PayFast receives the data required to process your payment when you choose online checkout.
  • WhatsApp / Meta: phone number and message content when we send order updates or OTP verification messages through the WhatsApp Business API.
  • Authentication services: Google and Facebook when you use social login; Firebase when you verify your phone number.
  • Cloud & infrastructure providers: hosting, database, image storage (e.g., Cloudinary), and email delivery services that process data on our behalf under contractual safeguards.
  • Google Maps: address search queries when you use checkout address autocomplete.
  • Legal & safety: authorities or parties when required by law, court order, or to protect our rights, customers, or the public.

All service providers are permitted to use your data only to perform services for us and must protect it appropriately.

5. Cookies & Similar Technologies

We use essential cookies for cart and checkout functionality, preference cookies for theme settings, and may use analytics tools to understand how visitors use the Site. You can manage cookies through your browser settings and our cookie consent banner. Some features may not work if essential cookies are disabled. Read our full Cookie Policy.

6. Data Retention

We retain personal information only as long as needed for the purposes described above:

  • Account data: retained while your account is active and for a reasonable period after deletion for backup, dispute resolution, and legal compliance.
  • Order records: retained for accounting, tax, and customer support purposes, typically for several years as required by applicable law.
  • OTP & verification records: deleted or expired automatically after verification or when the code expires.
  • Support messages: retained as long as needed to resolve your inquiry.

7. Data Security

We implement reasonable technical and organizational measures to protect your information, including encrypted connections (HTTPS), hashed passwords, access controls on admin systems, and secure cloud infrastructure. No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we work to reduce risk and respond to incidents promptly.

8. Your Rights & Choices

Subject to applicable law, you may have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate or incomplete information via your account profile
  • Request deletion of your account and associated personal data
  • Withdraw consent where processing is based on consent
  • Object to or restrict certain processing activities
  • Opt out of non-essential cookies via browser settings or our consent banner

To exercise these rights, contact us using the details in Section 12. We may need to verify your identity before fulfilling a request.

8.1 Account deletion

Registered customers can delete their account from Account Settings → Delete Account. Deletion removes your profile and linked address book. Order records required for legal, tax, or fraud-prevention purposes may be retained in anonymized or minimized form after account deletion.

9. Children's Privacy

Our Site and products are intended for adults. We do not knowingly collect personal information from anyone under 18 years of age. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. International Data Transfers

We are based in Pakistan. Some of our service providers (such as cloud hosting, Firebase, WhatsApp/Meta, and Google) may process data on servers located outside Pakistan. Where data is transferred internationally, we take steps to ensure it receives an adequate level of protection consistent with this policy.

11. Third-Party Links

Our Site may contain links to third-party websites (such as social media or payment portals). We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect the latest revision. Material changes will be posted on this page. Continued use of the Site after changes constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related questions, requests, or complaints, contact Nizami Herbal:

We aim to respond to privacy requests within 30 days. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.

Related policies: Terms & Conditions · Cookie Policy · Returns Policy