Privacy policy

MAP Foundation ("MAP Foundation", "we", "us") is a non-profit welfare organisation based in Karachi, Pakistan. This policy explains what personal information we collect when you visit our website, make a donation or contact us, why we collect it, how long we keep it, who we share it with, and the rights you have. It applies to donors and visitors in Pakistan and overseas.

1. Who we are

MAP Foundation, Suite 212, 4th Floor, Amber Medical Center, M. A. Jinnah Road, Karachi, Pakistan. We decide how and why your personal information is used. For any privacy question, email info@mapfoundation.org.

MAP Foundation and MAP Pay are separate legal entities. We do not share a database or donor information with MAP Pay.

2. Information we collect

• Donation details: your name, mobile number, email address (optional), the amount and currency, the donation type (Zakat, Sadqa or general), the programme or campaign you chose, one-time or monthly, the payment method and your language.
• Payment references: the transaction number and whether the payment succeeded, sent to us by the payment provider. We never receive or store your full card number, card security code (CVV), PIN or mobile-wallet MPIN. These are entered only on the payment provider's or your bank's own secure pages.
• Bank transfers: the reference number and the transfer details our bank shows us, so we can match your gift and send your receipt.
• CNIC: we do not currently ask for your CNIC. If you ask for a receipt for tax purposes, we may ask for it; giving it is optional.
• Contact form: your name, email address, mobile number (optional), topic and message.
• Technical information: your IP address and browser type. We use the IP address briefly to choose the website language for your country (with an offline database on our own server) and to protect our forms against abuse. It is not stored with your donation. Our hosting provider keeps short-term server logs for security.

3. Why we use it

• To process your donation and send your receipt, because you asked us to.
• To keep accurate financial records, keep Zakat in a separate fund, and meet audit, tax and legal requirements.
• To answer your messages and, if you give monthly, to remind you about your donation.
• To keep our website and donors safe from fraud and misuse.
• We do not sell or rent your information, we do not use it for advertising, and we do not build marketing profiles. We will only send newsletters if you ask to receive them.

4. Who we share it with

We share only what is needed, only with:

• The payment provider you choose (JazzCash, Easypaisa, Stripe for international cards) and our bank, to process your payment.
• Our email service, to send your receipt and answer your messages.
• Our website hosting provider and our database provider (Neon, a managed PostgreSQL service), which store the website and its data for us.
• Our auditors and professional advisers, under a duty of confidentiality.
• Government or regulatory authorities, only when the law requires it.

5. Storage outside Pakistan

Some of our service providers (such as our database provider and international card payments) may store or process data on servers outside Pakistan. We choose reputable providers that protect data with strong security measures.

6. How long we keep it

• Donation records and receipts: for as long as Pakistani tax and financial record-keeping laws require, then deleted or made anonymous.
• Contact form messages: up to two years after we have answered, unless they are part of a donation record.
• Security information used against abuse (IP addresses in our forms' rate limits) is kept only in the server's memory and cleared within an hour.

7. Cookies

We use only the cookies the website needs. We do not use advertising or tracking cookies, and we do not use analytics.

• lang: remembers the language you chose (English, Urdu or Arabic), for one year.
• mapf_admin: only for our staff when they log in to the admin area; it expires after 8 hours.
• Payment providers may set their own cookies on their payment pages, under their own privacy policies.
• Our contact page shows a Google Maps map. When it loads, Google may set cookies and receive technical data under Google's privacy policy. The share buttons on campaign pages are plain links and send nothing until you click them.
• If we switch on Cloudflare Turnstile (an anti-spam check) on our forms, Cloudflare processes technical data to tell people from bots.

8. Your rights

You can ask us to give you a copy of the personal information we hold about you, to correct it, or to delete it (unless the law requires us to keep it, such as donation records). You can also ask us to stop contacting you, and withdraw any consent you gave. Email info@mapfoundation.org. We reply within 30 days and may need to confirm your identity first.

9. Pakistan's data protection principles

We follow the principles of Pakistan's proposed personal data protection law and the Prevention of Electronic Crimes Act, 2016: we collect only what we need, use it only for the purpose we told you, keep it accurate and secure, keep it no longer than necessary, and respect your rights.

10. Donors outside Pakistan

If you live in the European Union, the United Kingdom or another country with similar laws, you also have the right to restrict or object to how we use your information, to receive your information in a portable format, and to complain to your local data protection authority. We rely on these legal grounds: carrying out your donation (contract), keeping financial records (legal obligation) and protecting our website (legitimate interests). We do not claim any certification under these laws.

11. How we protect your information

• The whole website uses an encrypted connection (HTTPS).
• Card and mobile-wallet details are entered only with the payment provider, never on our website.
• The admin area is protected by a password stored only as a secure hash, limited login attempts, sessions that expire, and a log of admin actions.
• The connection to our database is encrypted, and only authorised staff can see donor information.
• No system is perfectly secure. If a data breach is likely to harm you, we will tell you and the relevant authorities as the law requires.

12. Children

Our website is not aimed at children under 18, and donations should be made by adults. If you believe a child has sent us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this policy. The latest version is always on this page, with the date it was last changed.

14. Contact us

Privacy questions and requests: info@mapfoundation.org. Questions about a donation or receipt: donate@mapfoundation.org. By post: MAP Foundation, Suite 212, 4th Floor, Amber Medical Center, M. A. Jinnah Road, Karachi, Pakistan.

15. Language and credits

This policy is also available in Urdu and Arabic. If the translations differ from the English version, the English version applies.

The country lookup uses GeoLite2 data created by MaxMind, available from https://www.maxmind.com.