Privacy Policy

This Privacy Policy applies to the Zanzibar mobile application (the “App”) and to the related web admin console, operated by NAKALEEM INDUSTRIES (PRIVATE) LIMITED, a company incorporated in Pakistan that operates the restaurant Zanzibar (“we”, “us”, “our”).

Registered address: Zanzibar, 64-A Abdali Road, Altaf Town, Multan, Pakistan
Contact: info@zanzibarpk.com
Telephone (company): +92 61 478 0114

The App is an internal management tool. It is not offered to the general public or to restaurant customers. Accounts are created only by us, for a small number of company executives (“Executives”), restaurant managers (“Managers”) and administrators. There is no self-registration. Only accounts created by an administrator can sign in. The App is available in English only.

A web admin console (admin.zanzibarpk.com) is used by Executives and administrators on a computer to manage users and devices, and uses the same accounts and the same data described in this Policy.

The App is intended for adults using it for business purposes. It is not directed to children, and we do not knowingly collect personal data from children.

We collect only the data needed to operate the App securely.

The App does not use your location, contacts, camera, microphone, photos, or advertising identifier. We do not use analytics SDKs, advertising SDKs, or tracking technologies. The App does not save business data in a database on your phone; it is held in memory while the App is open.

Face ID

You can choose to sign in with Face ID on supported iPhones. Your biometric data is handled by iOS and never leaves your device: the App only receives a pass or fail result, and we never receive or store your Face ID data. When you turn Face ID on, the App saves your phone number and PIN on your device, in the iOS Keychain, protected by Face ID. Our servers still never store your PIN itself, only a salted hash. The saved PIN is removed from your device when you turn Face ID off in the App’s Settings. Signing out does not remove it, so that you can sign back in with Face ID.

Push notifications

If you allow notifications, the App registers an Apple Push Notification service (APNs) device token with our server, linked to your account, so that we can deliver notices to your phone. APNs is operated by Apple, and notifications pass through Apple’s service. A notification may show the title of a ToDo or the text of a notice, and the name of a colleague who completed a ToDo. Notices about money, such as large credit sales, show only a generic message on the lock screen and do not include amounts. You can turn notifications off at any time in the App’s Settings or in iOS Settings. We remove your token from our server when you sign out or turn notifications off in the App.

Depending on your role, the App displays business data of the restaurant, such as sales, item-level sales counts and, for Executives only, expenses, profit, cash position, and receivables (which may include business counterparty names). This is company business data and not personal data of App users. The App does not process personal data of restaurant customers.

• To create and manage your account and let you sign in (name, phone number, PIN hash, device identifier).
• To protect the security of the App and company data, including detecting unauthorized access and investigating incidents (audit log, network logs, device identifier).
• To restrict what each user can see according to their role (Executive or Manager).
• To deliver notices and ToDo alerts to your phone, if you allow notifications (push notification token).
• To maintain and troubleshoot the service.

We do not use your data for advertising, marketing, profiling, or sale.

We process this data because it is necessary for the legitimate operation and security of our business and for the working relationship between you and us. Where your agreement is needed, we rely on the consent you give when your account is set up. For optional features such as Face ID and push notifications, we rely on your choice to turn them on, which you can withdraw at any time in the App.

We do not sell your personal data and we do not share it with third parties for their own purposes. We do not use advertising or analytics providers.

We use Amazon Web Services (AWS) as our cloud infrastructure provider. AWS processes data on our behalf, under our instructions, to host the App’s servers and database. If you allow notifications, Apple delivers them through APNs. We may also disclose data if required by law, a court order, or a competent authority, or to protect our rights and the security of our systems.

Server-side data is stored in AWS in the Asia Pacific (Mumbai) region, India (ap-south-1). We are based in Pakistan. By using the App you understand that your data is processed in India and accessed from Pakistan. We apply the safeguards described in Section 10.

• Account data (name, phone number, PIN hash, registered devices): kept while your account is active. When an account is deactivated, access stops immediately, but we do not delete the data automatically. We keep it so that the account can be restored and our business records stay complete, and we delete or irreversibly anonymize it only on a deletion request that we have verified (see Section 11) or when we decide to do so.
• Audit log and network logs: kept for at least 12 months so that we can investigate incidents and meet legal obligations. We do not delete them automatically at the end of that period, and we may keep them longer where needed for security, accounting or legal reasons.
• Push notification tokens: removed from our server when you sign out or turn notifications off. A token that Apple reports as no longer valid is no longer used.
• On your device: signing out ends your session. The device identifier and device token stay on the phone so that it remains an approved device. A saved Face ID credential stays until you turn Face ID off.

• Data is transmitted over encrypted connections (TLS).
• PINs are never stored in original form on our servers. Only salted-secret hashes are stored.
• Sign-in tokens are kept in the iOS Keychain. If you turn on Face ID, the saved PIN is kept in the Keychain behind Face ID.
• Access is controlled by role. Executives and Managers see different data.
• Significant actions are written to an audit log.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify affected users and the relevant authorities as required by applicable law.

You may contact us at info@zanzibarpk.com to:

• ask what personal data we hold about you;
• ask us to correct inaccurate data (for example your name or phone number);
• ask us to delete your data or close your account;
• ask questions or raise a concern about how your data is handled.

We will respond within 30 days. We may need to verify your identity first. Some data (such as audit logs) may be retained where needed for security or legal reasons, as described in Section 9.

You can also turn Face ID and push notifications on or off yourself in the App’s Settings.

Because accounts are created by us and not by users, deletion is handled by an administrator.

How to request deletion:

1. Ask your company administrator, or send an email to info@zanzibarpk.com from your registered contact, with the subject “Zanzibar App account deletion” and your registered phone number.
2. We will verify your identity and deactivate your account, and delete or anonymize your personal data within 30 days, except for data we must keep as described in Section 9.
3. We will confirm by email or message once it is done.

Signing out ends your session on the device. To remove the Face ID credential from your phone, turn Face ID off in the App’s Settings before you uninstall the App. These steps do not delete server-side data. Please use the request process above for that.

This section is our public account deletion request page: https://zanzibarpk.com/privacy#account-deletion

The App is for adult business users only. We do not knowingly collect data from anyone under 18. If you believe a child’s data has been provided, contact us and we will delete it.

We may update this Policy. We will post the new version at https://zanzibarpk.com/privacy with a new “Last updated” date, and tell active users through the App or directly when changes are material.

This Policy is governed by the laws of Pakistan.

Questions or requests: info@zanzibarpk.com or +92 61 478 0114
NAKALEEM INDUSTRIES (PRIVATE) LIMITED, Zanzibar, 64-A Abdali Road, Altaf Town, Multan, Pakistan