The rules every person at Vizzora Abroad — staff, partners and contractors — follows when handling personal data. Version 1.0 · effective 26 September 2026 · reviewed at least once a year. For a shorter, customer-facing summary, read our Privacy Policy.
1. Purpose & scope
This policy protects the people who trust us with their information: students, travellers, job-seekers, their families and sponsors, learners in our classroom, community members, job applicants and our own staff. It applies to personal data in every form — in the CRM, the document vault, email, WhatsApp, phone notes and paper — and to everyone who handles it on Vizzora's behalf.
2. Legal framework
Constitution of Pakistan, Article 14 — the privacy of the home and the dignity of the person are inviolable.
Prevention of Electronic Crimes Act 2016 (PECA) — unauthorised access to, copying of or interference with information systems and data are criminal offences.
Personal Data Protection Bill (draft) — not yet in force. Until Pakistan enacts a comprehensive law, we follow its principles and internationally recognised standards voluntarily, and we will update this policy when a law comes into force.
Destination-country rules — when we submit an application abroad, the receiving authority's own data rules also apply.
Record-keeping duties — tax and accounting law set minimum periods for financial records.
3. Our seven principles
Lawful, fair and open — we tell people what we collect and why, before we collect it.
Purpose-limited — data collected for one case is not reused for something unrelated without consent.
Minimal — only what the route's official checklist needs.
Accurate — corrected as soon as we learn something is wrong.
Kept no longer than needed — see the retention schedule (section 10).
Secure — protected against loss, theft and misuse (sections 8 and 9).
Accountable — we can show what we did with every document: who uploaded it, who opened it, when.
4. Who is responsible
Management (the Owner and the Co-Founder) is accountable for this policy, approves every erasure request and every data-breach decision, and handles complaints about staff or about personal data.
The Data Protection Lead, appointed by management, keeps the request and breach registers, answers data requests and runs the annual review. Reach them at info@vizzorabroad.com (subject “Data protection”).
Every team member follows this policy and reports any suspected breach immediately.
5. Data we hold
Ordinary personal data: names, phone numbers, emails, cities, enquiry details, notes, class progress, community posts, payment records.
Sensitive data — extra care: identity documents (passport, CNIC); financial records (bank statements, sponsor documents); health information (medical and TB reports, data for medical-treatment travel); criminal-record information (police character certificates); family and marital records; data about children. Sensitive data is only ever held in the document vault, never in chat groups, and never sent anywhere without the client's instruction.
6. Consent
When someone sends an enquiry, we record the date, the page and what they asked for — proof that they asked to be contacted.
Before any document leaves Vizzora for a university, embassy, visa centre or partner, the client must have instructed us to proceed with that application. The case record shows who submitted what, and when.
Marketing and broadcast messages go only to people who have agreed to receive them. STOP from anyone ends them at once, and is recorded.
For anyone under 18, a parent or guardian gives consent and is involved in the file.
7. Collecting only what is needed
We ask only for what the destination's official checklist requires, when it is required. We work from copies; if an original must be handed over, it is receipted and returned. We never ask for bank passwords, PINs or one-time codes.
8. Who can see what
Role
Access
Owner, Co-Founder
All records, company-wide financial figures, complaints about staff and about personal data, full data export.
Visa Consultants
Leads and visa cases (a shared team workspace), including case documents; fee values only for their own leads. No access to complaints about staff or about personal data.
Front Desk
Enquiries, document intake and visa cases, so documents can be received and filed.
Partners
Only the documents needed for the specific step they perform, shared case by case.
Every person signs in with their own access code; codes are never shared. Access ends the day someone leaves.
9. Security measures
Documents and databases are stored outside the public web folder; no web address leads to them.
Each document's opening is logged (who, when) before it is shown. Documents cannot be deleted inside their retention period — the server refuses.
Only safe file types are accepted, checked by content, not by file name.
HTTPS everywhere; passwords and access codes stored only as one-way hashes; sign-in attempts rate-limited and logged.
Security fixes are deployed promptly, and every release is checked before it goes live.
10. Retention schedule
Record
Kept for
Then
Enquiries and leads
Until the person asks us to delete them
Deleted
Client documents (visa, study, immigration, tour files) and CVs
10 years from the date the file closes (from upload if it never closes)
Deleted from the vault; the log of the deletion is kept
Case records (steps, dates, notes)
10 years from the date the file closes
Deleted or anonymised
Payment and accounting records
As long as tax and accounting law requires
Deleted
Complaints
At least 3 years after closure
Deleted or anonymised
Document access logs
As long as the document itself
Deleted with the document record
Security and sign-in logs
Normally up to 12 months
Deleted
Community posts
Until the member deletes them or asks us to
Removed
Classroom progress
On the learner's own device
—
A client may ask for their documents to be erased before the end of the period. Management decides each request; the erasure is recorded with who asked, who approved it and why. We tell the person what, if anything, we must keep and why.
11. Sharing with others
Only for the client's case, only what that step needs, and only through the official channel (the authority's portal, the visa centre, the university's system).
Partners must be properly licensed for what they do (for example, a BEOE licence for overseas employment) and must protect the data at least as well as we do.
Service providers (hosting, email, payments, messaging) may use the data only to provide their service to us.
Requests from authorities are answered only when they are lawful, and are recorded.
We never sell or rent personal data, and never share it with advertisers.
12. Transfers abroad
Applications are submitted to foreign authorities and institutions by their nature, and our hosting and email providers may store data outside Pakistan. We send only what is needed, through official or secured channels, and choose providers with strong security.
Verify — we confirm identity using the phone number or email on the file before sharing or changing anything.
Acknowledge within 1 working day.
Complete within 30 days: a copy of the data, a correction, a deletion, or a clear written reason why something must be kept.
Free of charge. The person can escalate to management if unhappy with the answer.
14. Data breaches
Report — anyone who suspects a breach (a lost phone, a document sent to the wrong person, a hacked account) tells management immediately, and no later than 24 hours.
Contain — stop the leak: revoke access, change codes, ask the wrong recipient to delete, secure the device.
Assess — what data, how many people, how serious the risk.
Notify — people at risk are told without undue delay (target: within 72 hours of confirming the breach), with what happened and what they should do. Authorities are informed where the law requires.
Learn — every breach is recorded, and the cause is fixed in writing.
15. WhatsApp, phones & paper
Client work happens on the Vizzora business number, not on personal numbers.
Documents received on WhatsApp are uploaded to the client's case in the vault and then deleted from the phone within 7 days.
No client documents in personal chat groups, personal email or personal cloud storage. Phones used for work have a screen lock.
Paper copies are kept in a locked cabinet and shredded when no longer needed.
16. Training & review
Every new team member reads this policy and is trained on it in their first week. The policy is reviewed at least once a year, and whenever the law, our systems or a breach show it needs to change.