Privacy policy

What we collect

Only what the site needs to work. There is no tracking pixel network here and we do not buy or sell data about you.

From everybody with an account

• Mobile number. Compulsory. It is the account — one account per mobile number — and it is how a buyer reaches you.
• Name. Compulsory. Shown on your ads as the seller name. A dealer’s business name is shown instead of a personal name.
• Email address. Optional. If you give one we use it for ad status notifications and nothing else.
• City. Compulsory. It decides which listings you see first.
• Password. Stored as a one-way hash. Nobody at GaariBazar, including the administrator, can read it or recover it.

From people who post ads

• Everything you type into the ad form — the car’s specification, your description and your photographs. All of it is intended to be public, and all of it is public once the ad is approved.
• The history of that ad: when it was submitted, when it was approved or rejected and why, when it expired, when it was renewed.

From bidders only

• CNIC number, photographs of both sides of the CNIC, and your postal address. Collected once, before your first bid ever, and never from anyone who is not bidding. This is the most sensitive thing on the site and it has its own section below.

Automatically

• Standard web-server records: IP address, browser, the pages requested and when. Kept for 30 days and used to keep the site up and to spot abuse.
• Anonymous traffic statistics — see cookies and analytics below.

Why we collect it

• To run your account. One account per mobile number is what stops the same car being posted five times by the same person from five accounts.
• To publish your ads and let buyers reach you. Your number is released to a signed-in buyer when he presses “Show phone number”, and not before.
• To check ads before they go public. A person reads every ad, which means a person reads what you wrote in it.
• To make auctions safe for sellers. That is the whole purpose of CNIC verification.
• To answer you when you contact us.

We do not use your data to build an advertising profile, we do not sell it, and we do not pass it to other companies except the two service providers named below.

Who can see it

• The public, including search engines: your name or dealer name, your city, and everything in your ad. That is the point of an ad.
• A signed-in member who presses the button: your mobile number, on the ad he is looking at.
• The administrator: everything in your account except your password, which nobody can read.
• The verification team: CNIC data, and only CNIC data, and only for bidders.
• Other bidders: nothing. On an auction page a bidder is shown as Bidder A*** — first letter and nothing else.
• Our hosting provider and our SMS provider: as a technical necessity, under contract. [ Client to confirm both providers before launch. ]

We will hand data to the police or a court if we are legally required to, and only then.

CNIC data — in full

If you never bid in an auction, none of this applies to you: we never ask a buyer or a seller for a CNIC. It is collected from bidders only, once, and here is exactly what happens to it.

What is collected

• Your 13-digit CNIC number.
• A photograph of the front of the card and a photograph of the back.
• The postal address on the card.

Who sees it

The verification team, and nobody else. It is held in its own database table with its own access control, separate from your account record. It is not visible on any public page, not visible to sellers, not visible to other bidders, and not visible to ordinary administrator accounts that do not have the verification permission.

How it is held

All of it is encrypted at rest — the number, the address and both photographs. The photographs are also stored outside the public web root and are served only through an authenticated request, so there is no URL that shows a CNIC image to somebody who is not on the verification team, and the files themselves are unreadable to anyone who reaches the disk.

Every look is logged

Every time a member of the verification team opens a CNIC record, the system writes down who opened it, whose record it was and when. That log is kept for two years and is reviewed. If your CNIC data is ever looked at, there is a record of who did it.

When it is deleted

90 days after the auction closes, the CNIC number, both images and the address are deleted. Not archived, not moved to cold storage — deleted. What remains is a single flag on your account saying that you were verified and on what date, so that you do not have to send it again for the next auction.

The 90 days exist because that is roughly how long a dispute over a car sale takes to surface. If there is an open dispute or an active legal request on a specific auction, the data for that auction is held until it is resolved and deleted immediately afterwards.

What we will never do with it

• Show it to a seller, however insistent.
• Use it for credit checks, marketing or anything other than confirming who is bidding.
• Pass it to another company.

Bank documents on a car sold on lease

Bank documents a dealer uploads with a car it is selling on instalments are seen only by this site’s staff, to check the ad, and are deleted 90 days after the ad ends. They are held encrypted, outside the public web root, with no address that serves them; only a moderator or the owner of the site can open one, every opening is written down with who did it and when, and the verification team — who handle CNIC data — cannot open one at all.

Buyers never see them. A car page says whether documents are attached and nothing else: not a file name, not a count, not a link. If you are the dealer who uploaded them you can see their names while you are editing your ad, and remove or replace them.

Cookies and analytics

Two kinds of cookie, and no third kind.

• Necessary. A session cookie that keeps you signed in and an anti-forgery token that stops somebody submitting a form as you. Both are deleted when you sign out. Without them the site cannot work, so there is no option to refuse them.
• Analytics. Anonymous page-view statistics so we know which cities and which makes people are searching for, with IP addresses truncated before they are stored. No advertising cookies, no remarketing tags, no social-network trackers, no cross-site profile. [ Client to confirm the analytics provider before launch. ]

You can refuse the analytics cookie and the site works exactly the same.

Seeing, correcting and deleting your data

You can edit your name, city and email yourself from your account at any time. For anything else:

• A copy of what we hold on you. Ask through the contact page or the privacy address below. We reply within one working day and send it within seven.
• Correcting something wrong. Same route, usually the same day.
• Deleting your account. Ask, and we delete your account, your ads and your contact details within seven days.

Two honest limits. Your mobile number is kept in a suppression list after deletion, because “one account per mobile number” cannot be enforced against a number we have forgotten. And where an ad or an auction is part of an unresolved dispute, that record is kept until the dispute ends.

Contacting us about privacy

Anything on this page — a request, a correction, a complaint, or a concern that somebody has seen something they should not have:

Email

[email protected]

Post

[ not set — admin, Settings, Contact ]

A privacy request is answered within one working day. If you think your CNIC data has been seen by somebody who should not have seen it, say so in the first line of the message and it goes straight to the top of the queue — we can check the access log and tell you exactly who opened your record and when.

Changes to this policy

If we change what we collect or who can see it, the change is posted on this page with a new date at the top, and anybody with an email address on file is told. We will not quietly widen what we do with your data.

Draft — not yet dated. The live version carries the date it took effect.