Privacy Policy

M U BAGS (“M·U Bags,” “we,” “our,” or “us”) operates the website at mubagpk.com and the M·U Bags mobile application (collectively, the “Service”). This Privacy Policy explains what information we collect from you, how we use it, who we share it with, the choices you have, and how we protect it.

This policy is written to comply with the Google Play User Data Policy and Google Play’s Data Safety requirements, the Pakistan Electronic Crimes Act 2016 (PECA), the Personal Data Protection Bill of Pakistan, and (where applicable to overseas customers) the EU General Data Protection Regulation (GDPR).

1. Who We Are & How To Contact Us

M U BAGS is a private retail and manufacturing entity registered in Lahore, Pakistan. We are the data controller of personal information processed via the Service.

• Registered address: Aslam Plaza, Flat 40, Lahore, 54000, Pakistan
• Telephone: +92 321 748 2965
• Privacy queries: Call us between 12:00 and 18:00 PKT, Monday–Saturday

2. Information We Collect

(a) Information you provide to us

• Account & identity data: name, email address, telephone number, delivery and billing addresses, password (stored only in salted, hashed form).
• Order data: products purchased, sizes, customisation requests, order history, returns and exchange records.
• Payment data: processed by third-party payment processors (e.g. Stripe, JazzCash, EasyPaisa, HBL Card Gateway). We never store full card numbers, CVV codes, or banking PINs on our own servers.
• Communications: messages you send us by phone, email, or in-app messaging, including your atelier appointment requests.

(b) Information collected automatically

• Device & technical data: device model, operating system version, mobile network information, app version, language settings, time zone, anonymised IP address.
• Usage data: pages or screens viewed, products favourited, time spent, navigation patterns, crash logs, performance metrics.
• Approximate location: derived from IP address only — used for delivery zone estimation and currency display. We do not collect precise GPS location through our app.
• Cookies & similar technologies: session cookies, preference cookies, and limited analytics cookies. You may disable non-essential cookies via your browser or device settings.

(c) Information from third parties

• Payment processors confirm whether a transaction was authorised.
• Logistics partners (TCS, Leopards Courier, DHL Express) share delivery status updates.
• Analytics providers (Google Analytics, Firebase Crashlytics) provide aggregated usage and crash data.

3. How We Use Your Information

We use the information we collect for the following limited purposes:

• To process, fulfil, and ship your orders, and to handle returns or exchanges.
• To create and maintain your customer account.
• To respond to your inquiries, atelier appointment requests, and customer-care messages.
• To send transactional communications (order confirmations, dispatch notices, delivery updates).
• To send marketing communications about new collections — only with your prior, explicit opt-in consent. You can withdraw consent at any time by contacting us.
• To prevent fraud, secure our systems, and comply with legal or tax obligations in Pakistan.
• To improve our Service through aggregated, anonymised analytics.

4. Legal Bases for Processing

Where the GDPR applies, we process your personal data under the following legal bases:

• Contract: to fulfil orders you place with us.
• Consent: for marketing communications and non-essential cookies.
• Legal obligation: for tax records, anti-fraud screening, and regulatory compliance.
• Legitimate interests: to maintain the security and functionality of our Service, balanced against your privacy rights.

5. Sharing & Disclosure

We do not sell your personal information. We share it only with the following categories of recipients, and only as needed:

• Service providers who process data on our behalf under written confidentiality and data-processing agreements (hosting, payment processing, courier, analytics, customer-care platforms).
• Logistics carriers with the minimum data required to deliver your order.
• Government, courts, and regulators where compelled by law or where necessary to protect the rights, property, or safety of M·U Bags, our customers, or the public.
• A successor entity in the event of a merger, acquisition, restructuring, or sale of assets — under equivalent privacy protections.

6. Data Retention

We retain personal information only as long as necessary for the purposes set out above:

• Account data: until you ask us to delete your account.
• Order & tax records: seven (7) years, as required by Pakistani tax law.
• Marketing preferences: until you withdraw consent.
• Analytics & crash data: 26 months in aggregated form, after which it is anonymised or deleted.

7. Data Security

We protect your information through industry-standard safeguards: TLS 1.3 in transit, AES-256 encryption at rest, role-based access controls, audit logging, and regular penetration testing of our app and website. Payment data is handled exclusively by PCI-DSS compliant processors. Despite these measures, no system is perfectly secure; if we ever discover a breach affecting your personal information, we will notify you and the relevant authorities without undue delay.

8. Children’s Privacy

Our Service is intended for users aged 16 and above. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, please contact us and we will promptly delete it. The M·U Bags app on Google Play is rated for a general audience and does not target children.

9. Your Rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information (subject to our legal record-keeping duties).
• Restrict or object to certain processing activities.
• Port your data to another service in a structured, machine-readable format.
• Withdraw consent at any time for any processing based on consent.
• Lodge a complaint with a relevant data-protection authority.

To exercise any of these rights, please contact us at the telephone number and address listed above. We will respond within thirty (30) days.

10. Account & Data Deletion (Google Play Requirement)

You may request deletion of your M·U Bags account and the personal data associated with it at any time by:

• Calling us at +92 321 748 2965 during business hours, or
• Writing to us at Aslam Plaza, Flat 40, Lahore, 54000, Pakistan, or
• Using the in-app Settings → Account → Delete My Account option, where available.

Upon verified request we will delete your account, your order preferences, your saved addresses, and your communications history within thirty (30) days. We will retain only the minimum information required by law (e.g. invoices for tax purposes) in restricted, access-controlled archives.

11. Permissions Used by Our Mobile App

The M·U Bags Android application requests the following device permissions, each used only for a stated purpose:

• Internet & network state: to load product images and complete purchases.
• Camera (optional): only when you choose to upload an image for a custom-bag enquiry; never accessed in the background.
• Photos / Media (optional): only when you choose to attach an image to a customer-care conversation.
• Notifications (optional): for order updates and dispatch alerts; you may disable these at any time in your device settings.

We do not request or use SMS, contacts, microphone, precise location, accessibility services, or device-administrator permissions.

12. International Data Transfers

Our primary servers are located in Pakistan and Singapore. Where data is transferred outside your country, we rely on contractual safeguards (including the EU Standard Contractual Clauses where applicable) to ensure equivalent protection.

13. Third-Party Links

Our Service may contain links to third-party sites or payment gateways that we do not operate. This Privacy Policy does not apply to those services; please review their own privacy policies before providing personal information to them.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Effective date” at the top of this page and, for material changes, notify you through the Service or by direct communication before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

15. Contact

If you have any questions, requests, or complaints about this Privacy Policy or our handling of your personal information, please contact us:

• M U BAGS — Aslam Plaza, Flat 40, Lahore, 54000, Pakistan
• Telephone: +92 321 748 2965