Privacy Policy

MFTC Procurement (“the App”, “we”, “us”) is an internal enterprise procurement application operated by Meskay & Femtee Trading Company (MFTC). It is used by authorised employees, purchasers, store keepers and approvers to raise requisitions, compare vendor quotations, issue purchase orders, record goods receipts and manage inventory.

The App is not a public consumer service. Accounts are created and assigned by our administrators; users cannot self-register. By using the App you agree to the practices described in this policy.

a. Account and profile information

• Name, username and encrypted password.
• Work email address and contact number.
• Employee role, designation, department, branch or location, and assigned permissions.
• Optional profile photo.

b. Business and transactional data

• Requisitions, quotations, comparisons, purchase orders, goods received notes, gate passes, expenses and petty cash records that you create or approve.
• Vendor and supplier details, item catalogues, prices, stock levels and delivery records.
• Documents, invoices, bills and images you upload or capture as attachments.
• Approval remarks and workflow decisions attributed to your account.

c. Technical and usage information

• Device model, operating system version and app version.
• Login timestamps, session tokens and IP address.
• Activity logs: screens visited inside the App and actions performed (create, edit, approve, delete), kept for audit and accountability.
• Diagnostic and crash information used to fix faults.

We do not collect precise background location, contacts, SMS, call logs or advertising identifiers, and we do not use the App for advertising or profiling.

The App requests the following permissions only when a feature needs them. You may decline any of them; the related feature will simply be unavailable.

• Camera — to scan QR codes and barcodes on items, assets and gate passes, and to photograph invoices or received goods.
• Photos, media and files — to attach existing documents and images to a requisition, purchase order or expense claim, and to save PDF reports you generate.
• Notifications — to alert you about pending approvals and status changes on your documents.
• Internet and network state — required to sync with our servers.

• To authenticate you and enforce role-based access to modules and records.
• To create, route and process procurement documents through their approval workflow.
• To notify you and other approvers, in-app or by email, about actions needing your attention.
• To generate reports, dashboards and analytics for management.
• To maintain audit trails showing who created, changed or approved a record and when.
• To detect misuse, troubleshoot faults and improve the reliability of the App.
• To comply with tax, accounting, audit and other legal obligations.

We never sell your personal information, and we do not use it for advertising or for automated decisions producing legal effects about you.

Where data protection law such as the GDPR applies, we process your information on the basis of: performance of your employment or contractual relationship with us; our legitimate interest in operating, securing and auditing a procurement system; compliance with legal obligations; and, where required, your consent — for example for camera access or notifications.

We share information only as described below.

• Within your organisation — documents you create are visible to colleagues, approvers and administrators whose role grants them access.
• Vendors and suppliers — purchase orders and related correspondence may include the raising or approving officer’s name and business contact details.
• Service providers — hosting, database, file storage, email delivery and push notification providers that process data strictly on our instructions.
• Legal and regulatory bodies — where disclosure is required by law, court order or audit, or to protect our rights, safety and property.
• Business transfer — in a merger, acquisition or reorganisation, subject to this policy.

Data is stored on managed cloud infrastructure and may be processed on servers located outside your country. Where data is transferred internationally, we take reasonable steps to ensure it remains protected under this policy.

Procurement records, approvals and audit logs are company business records and are retained for as long as required by our internal policy and by applicable tax, accounting and corporate law — typically several years after the transaction. Account credentials and session data are deleted or anonymised once an account is closed.

• Passwords are stored only as salted one-way hashes; we cannot read them.
• Traffic between the App and our servers is encrypted in transit (HTTPS/TLS).
• Access is controlled by signed session tokens with automatic expiry and forced logout.
• Granular role and permission checks limit each user to the records they need.
• Administrative and record-level actions are logged for audit.

No system is completely secure. If we become aware of a breach affecting your personal information, we will notify affected users and the relevant authorities as required by law.

Subject to applicable law and to our record-keeping obligations, you may:

• Request access to the personal information we hold about you.
• Request correction of inaccurate or incomplete details.
• Request deletion of your account and personal profile data.
• Object to, or request restriction of, certain processing.
• Withdraw a device permission at any time from your device settings.
• Request a copy of your data in a portable format.

To exercise any of these rights, write to ho.procurement@mftc.com.pk. We respond within 30 days. Completed procurement transactions and audit trails cannot be erased where we are legally required to retain them.

You can request deletion of your account and associated personal data at any time:

• in the App, open the account menu and choose Delete Account; or
• email ho.procurement@mftc.com.pk from your registered address with the subject “Account Deletion Request”.

On deletion we remove your login credentials, profile details, photo and device tokens within 30 days. Procurement documents you created remain in the system as company business records, with your identity retained only where audit or legal requirements demand it.

The App is an internal business tool intended solely for employees and authorised personnel aged 18 or above. We do not knowingly collect information from children. If we learn that we have, we will delete it promptly.

The App relies on established infrastructure providers for cloud hosting, database services, file storage, email delivery and push notifications. These providers process data only to deliver those services to us and are bound by their own privacy and security commitments. The App may also link to vendor or partner websites whose privacy practices we do not control.

We may update this policy to reflect changes in the App, our practices or the law. The revised version will be posted on this page with a new “Last updated” date. Significant changes will additionally be communicated in the App or by email. Continued use of the App after an update means you accept the revised policy.

For any question, request or complaint regarding this policy or your personal data, contact: