INZHA Elevator & Escalator (Pvt.) Ltd.

Personal Data: Any information that identifies, or can reasonably be used to identify, a natural person, such as a name, phone number, email address, CNIC number, address, job title, photograph, or online identifier.

Sensitive Personal Data: Personal data that requires extra care, such as health information, biometric data, religious or political beliefs, criminal records, and financial account information.

Data Subject: The person to whom the personal data relates.

Processing: Any operation performed on personal data, including collecting, recording, storing, using, sharing, transferring, and deleting it.

Recipient Group: A category of individuals or organizations to whom the Company discloses personal data.

Data Inventory: The Company’s record of its processing activities, linking each purpose to the data categories, data subjects, and recipient groups involved.

Periodic Destruction: The recurring deletion, destruction, or anonymization of personal data that is no longer needed. Under this Policy, it takes place in June and December of each year.

Applicable Law: The laws of Pakistan that apply to the Company’s handling of personal data, including Article 14 of the Constitution of Pakistan (dignity and privacy of the person), the Prevention of Electronic Crimes Act, 2016, the Electronic Transactions Ordinance, 2002, and any personal data protection legislation that enters into force in Pakistan, together with sector regulations and contractual obligations that apply to the Company.

Policy: This Personal Data Processing and Protection Policy.

2. Purpose

This Policy sets out the rules and procedures INZHA follows when it processes and protects personal data. INZHA is a professional engineering company that designs, supplies, installs, commissions, and maintains elevators, escalators, and moving walks for residential, commercial, hotel, hospital, and industrial projects across Pakistan, including Islamabad, Lahore, Karachi, Multan, and Faisalabad.

INZHA is committed to processing the personal data of its employees, job applicants, customers, suppliers and service providers, business partners, website visitors, and other third parties in line with Applicable Law, and to making it easy for those individuals to exercise their rights.

All personal data activities at INZHA are carried out in accordance with this Policy.

3. Scope

This Policy applies to:

the departments and employees of INZHA that process personal data;
business partners, suppliers, subcontractors, and service providers who receive or handle personal data on INZHA’s behalf or share it with INZHA;
government bodies, regulators, and other persons authorized by law to receive personal data from INZHA; and
all processing activities, whether automated or manual, and whether electronic or paper-based.

If Applicable Law changes, or if a legal obstacle or a need for improvement arises, INZHA may revise this Policy and its related practices. The updated Policy will be published on inzha.com.

4. Processing of Personal Data

A. Principles

INZHA follows these principles when processing personal data:

Personal data is processed lawfully, fairly, and transparently.
Personal data is kept accurate and, where necessary, up to date.
Personal data is collected for specified, explicit, and legitimate purposes.
Personal data is relevant, limited, and proportionate to the purposes for which it is processed.
Personal data is kept only for as long as the law requires or the purpose demands.

B. Conditions for Processing

INZHA processes personal data only when at least one of the following conditions applies:

Consent. The data subject has given consent that is specific, informed, and freely given. Consent can be withdrawn at any time, without affecting processing already carried out.
Legal requirement. The law expressly requires or permits the processing.
Protecting life. Processing is necessary to protect someone’s life or physical safety, and the person cannot give consent because of a practical impossibility or lack of legal capacity.
Contract. Processing is directly related to forming or performing a contract with the data subject, for example a supply, installation, or maintenance contract.
Legal obligations. Processing is necessary for INZHA to meet its legal obligations, such as tax, safety, and regulatory filings.
Data made public. The data subject has made the data public, in which case it is used only for that purpose.
Legal claims. Processing is necessary to establish, exercise, or defend a legal right.
Legitimate interests. Processing is necessary for INZHA’s legitimate interests, provided it does not harm the fundamental rights and freedoms of the data subject.

C. Conditions for Processing Sensitive Personal Data

INZHA processes sensitive personal data only in line with this Policy and with appropriate administrative and technical safeguards.

Sensitive data other than health data is processed only with the explicit consent of the data subject, unless the law expressly provides otherwise.
Health data is processed with explicit consent, or without consent only where the law permits it, for example for workplace health and safety, mandatory medical checks, and the provision of medical care by persons bound by a duty of confidentiality.
Access to sensitive personal data is limited to authorized employees who are bound by confidentiality obligations.

D. Informing Data Subjects

INZHA informs data subjects at or before the time their data is collected. The notice explains:

who the data controller is and how to contact INZHA;
the purposes for which data is processed and the legal basis;
who the data is shared with and why;
how the data is collected; and
the rights available to the data subject.

Where the retention period cannot be stated precisely, INZHA explains the criteria used to determine it. Where giving personal data is mandatory, INZHA explains the consequences of not providing it.

Where INZHA uses CCTV for physical security, notices are posted at the entrances of monitored areas.

E. Categories of Data Subjects

This Policy covers personal data of the following groups:

Job applicants. Individuals who are being considered for employment or an internship at INZHA but do not yet have an employment contract.
Employees. Current and former employees, who are also subject to INZHA’s internal HR and employee data notices.
Customers. Individuals and the representatives, owners, and staff of organizations that buy or use INZHA products and services, including building owners, developers, contractors, consultants, hotels, and hospitals.
Business partners and suppliers. Individual officers, shareholders, and employees of the organizations with which INZHA has a commercial relationship.
Visitors. Individuals who visit INZHA’s offices, factories, warehouses, or project sites, or who use inzha.com.
Other individuals. Any other natural person whose data INZHA processes and who is not covered by the groups above.

F. Purposes of Processing

INZHA processes personal data for the following purposes:

1. Planning and carrying out commercial strategy

Strategic planning activities.
Managing relationships with business partners, customers, and suppliers.

2. Designing and running human resources activities

Recruiting employees.
Planning and running internship and student placement programs.
Planning HR processes.
Meeting obligations arising from employment contracts and labor and social security laws.
Monitoring and supervising work activities, including site safety.
Planning and administering employee benefits.
Handling employee exits.
Planning and tracking performance reviews.
Planning and delivering in-house training, including technical and safety training.
Managing payroll and compensation.
Planning orientation and company events.
Meeting information and document obligations in legal and administrative proceedings.

3. Carrying out business activities in line with law and company policy

Quotations, tendering, orders, supply, installation, testing, commissioning, handover, and after-sales service and maintenance.
Warranty, AMC (annual maintenance contract), and breakdown call management.
Finance and accounting, including invoicing, tax compliance, and collections.
Investor relations.
Corporate communications and sustainability activities.
Efficiency and performance analysis of business operations.
Event management.
Building and managing information technology infrastructure.
Planning, auditing, and carrying out information security processes.
Quality assurance and quality control, technical documentation, and inspection and compliance records.

4. Other purposes

Ensuring the commercial, technical, and legal security of people with whom INZHA has a business relationship, and keeping in touch with them.
Protecting INZHA’s commercial reputation and the trust placed in it.
Complying with the retention, reporting, and disclosure obligations that public authorities impose under the law.
Reviewing, evaluating, and responding to requests from public authorities and individuals.
Securing and monitoring INZHA’s premises through CCTV and similar systems.
Preserving evidence for possible future legal disputes.
Any other purpose that falls within the conditions and purposes described in Section 4.B above.

G. Retention Periods

INZHA keeps personal data for the periods below, or longer where the law requires. After the retention period ends, the data is destroyed at the next Periodic Destruction (June or December).

Process	Retention period
Conduct of commercial business	10 years
Preparation and performance of contracts	10 years after the contract stops having any effect on business and transactions
Communications with the Company	10 years after the activity ends
Human resources processes	10 years after the employment contract and any related legal process end
Log and monitoring systems	2 years
Access to hardware and software	2 years
Visitor records	2 years
CCTV recordings	2 months
Job application forms and CVs	Immediately if the position is withdrawn, otherwise 2 years
Requests submitted to the Company by data subjects	10 years after the request, and any related regulator or court process, ends
Corporate memory and historical records	99 years

INZHA to confirm these periods against its tax, labor, and contract-limitation obligations in Pakistan before publication.

5. Transfer of Personal Data

A. Principles for Transfers

INZHA may share personal data with third parties, using due care and appropriate security measures, where one or more of the following applies:

the law expressly requires or permits it;
it is directly related and necessary for forming or performing a contract;
it is necessary for INZHA to meet its legal obligations;
the data subject has made the data public, in which case it is shared only for that purpose;
it is necessary to establish, exercise, or defend the legal rights of INZHA, the data subject, or third parties;
it is necessary for INZHA’s legitimate interests and does not harm the data subject’s fundamental rights and freedoms;
it is necessary to protect someone’s life or physical safety and consent cannot be obtained; or
the data subject has given consent.

B. Recipient Groups and Purposes

Transfers within Pakistan. INZHA transfers personal data to other parties in Pakistan only under the conditions above.

Transfers outside Pakistan. INZHA may transfer personal data outside Pakistan, for example to equipment manufacturers, overseas technical support teams, and cloud, email, or software providers. These transfers happen only where:

one of the conditions in Section 5.A applies;
the transfer complies with Applicable Law, including any cross-border transfer rules, data localization requirements, or regulatory approval that apply; and
the recipient is bound by written commitments to protect the data to a standard at least equivalent to this Policy, or the data subject has given explicit consent.

Groups to whom INZHA may transfer personal data:

Business partners, limited to establishing and maintaining the business partnership.
Suppliers, manufacturers, and subcontractors, limited to what is needed to supply products and services and carry out INZHA’s commercial activities.
Public authorities and private persons authorized by law, such as tax authorities, labor and social security institutions, municipal and development authorities, elevator inspection and licensing bodies, and courts, limited to the purpose of their lawful request.
Professional advisers and service providers, such as lawyers, auditors, accountants, banks, insurers, and IT providers, limited to the services they provide to INZHA.
Other third parties, in accordance with the conditions for transfer set out in this Policy.

INZHA does not sell personal data.

6. Rights of Data Subjects

A. Your Rights

Subject to Applicable Law, you have the right to:

find out whether INZHA processes your personal data;
request information about the processing if it has taken place;
learn the purposes of the processing and whether the data is used in line with those purposes;
know the third parties, in Pakistan or abroad, to whom your data is transferred;
request correction of incomplete or inaccurate data, and ask that the correction be communicated to the third parties who received the data;
request deletion or destruction of your data when the reasons for processing no longer apply, and ask that this be communicated to the third parties who received the data;
object to an outcome that is unfavorable to you and results solely from automated analysis of your data;
request compensation if you suffer harm from unlawful processing of your data;
request that processing be restricted; and
withdraw any consent you have given.

If your request is refused, the answer is inadequate, or INZHA does not respond in time, you may take the matter to the competent authority or court under Applicable Law.

B. How to Exercise Your Rights

Send a written request, with enough information to identify you and describe your request, by any of the following methods:

Method	Where to send it	What to write on the request
In person (bring identification)	INZHA registered office address	“Personal Data Request”
Courier or registered post	INZHA registered office address	“Personal Data Request”
Email from the address already registered with INZHA	privacy@inzha.com	Subject line: “Personal Data Request”

Requests made through the email address that INZHA already holds for you are treated as verified. For other methods, INZHA may ask for proof of identity to protect your data from unauthorized disclosure.

C. How INZHA Responds

INZHA takes the administrative and technical steps needed to handle requests properly. INZHA will respond to a properly submitted request as soon as possible and in any case within 30 days. The response is free of charge, but INZHA may charge a reasonable fee where the request involves an additional cost and the law allows it.

7. Security of Personal Data

A. Technical Measures

INZHA takes the following technical measures:

Regular testing to identify risks, threats, and vulnerabilities in INZHA’s IT systems, followed by corrective action.
Continuous monitoring of threats that could affect IT system continuity.
Access to systems and user authorization controlled by an access and authority matrix and by security policies on a central directory.
Physical protection of IT equipment, software, and data.
Hardware protections such as CCTV, alarm systems, and locks, and software protections such as firewalls, intrusion prevention, network access control, and anti-malware.
Identification of risks of unlawful processing, with suitable technical measures and regular technical checks.
Access procedures, with reporting and analysis of access to personal data.
Logging of access to storage areas that hold personal data, to detect inappropriate access or attempts.
Measures to make deleted data inaccessible and unrecoverable for users.
A process to notify affected individuals and the relevant authorities if personal data is obtained by others unlawfully, in line with Applicable Law.
Tracking of security vulnerabilities, installation of security patches, and up-to-date information systems.
Strong passwords on electronic systems that hold personal data.
Secure logging in electronic systems that hold personal data.
Data backup programs to store personal data safely.
Access to stored personal data, electronic or otherwise, limited by access principles.

Additional measures for sensitive personal data:

A separate policy for the security of sensitive personal data.

Training and confidentiality agreements for employees who handle sensitive personal data, and defined access authorization for users.
Use of cryptographic methods for electronic environments in which sensitive personal data is processed, stored, or accessed, with keys kept in secure environments, continuous monitoring of security updates, regular security testing, and recorded test results.
Adequate security for physical environments, with unauthorized entry and exit prevented.
When sensitive data must be sent by email, it is encrypted and sent from a corporate email address. Data sent on portable media such as USB drives, CDs, or DVDs is encrypted, with the key kept separately. Data moved between servers in different physical locations is transferred through secure channels such as sFTP or a VPN. Paper documents are sent in a way that protects against theft, loss, or unauthorized viewing, and are marked “confidential.”

B. Administrative Measures

INZHA takes the following administrative measures:

Training for employees on preventing unlawful processing of and access to personal data, protecting personal data, communication techniques, technical skills, and the law.
Confidentiality agreements for employees.
A disciplinary procedure for employees who do not comply with security policies and procedures.
Contracts with third parties who store or handle personal data on INZHA’s behalf that require them to take appropriate security measures. As a general principle, INZHA prefers recipients that hold relevant certifications and have compliance processes in place.
Security and restricted access for locations where personal data is stored physically.
A Data Inventory.
Periodic and random internal audits.
Equipment for physical destruction of records on INZHA’s premises.
Notices for CCTV in areas where it operates.

8. Destruction of Personal Data

A. Reasons for Destruction

INZHA deletes, destroys, or anonymizes personal data, on its own initiative or at the data subject’s request, in the following cases:

the legal provisions that required the processing have changed or been repealed;
the purpose for processing or storing the data no longer exists;
the processing is or becomes unlawful or unfair;
INZHA accepts the data subject’s request for deletion, destruction, or anonymization;
a competent authority or court orders it;
the maximum retention period has expired and no condition justifies keeping the data longer;
the contract between the parties was never formed, is invalid, has ended automatically, or has been terminated or withdrawn; or
processing was based only on consent and the data subject has withdrawn that consent.

B. Methods of Destruction

Deletion. Making personal data completely inaccessible and unusable for the users concerned.

Destruction. Making personal data inaccessible, unrecoverable, and unusable by anyone. This applies mainly to data held in physical records, such as shredding paper documents.

Anonymization. Making personal data impossible to link to an identified or identifiable person, even when it is combined with other data. INZHA may use methods such as one-way functions and encryption, together with the necessary technical and administrative measures.

Periodic destruction takes place in June and December each year.

9. Publication, Storage, Effective Date, and Updates

This Policy is kept in two forms: a signed paper copy and an electronic copy. The electronic version is published on inzha.com. The signed paper copy is kept in the Company’s files.
This Policy takes effect once it is published on INZHA’s website.
If this Policy is withdrawn, the old signed copies are cancelled and signed by the Company’s authorized signatories (by stamping or writing “cancelled”) and are kept for at least 5 years.
INZHA may update this Policy when the law changes or when it is otherwise necessary. The latest version is always available on inzha.com.

10. Contact

INZHA Elevator & Escalator (Pvt.) Ltd., Address: D3 First Floor, Darvaish Plaza, opposite DHA-II Gate 1, GT Road, Rawalpindi, Islamabad Pakistan.

Questions about this policy: info@inzha.com or +92 318 6900075.

Privacy Policy