Privacy Policy

1. Who We Are and Scope of This Policy

EBIT Management Consultant (SMC-Pvt.) Ltd. is a single-member private limited company incorporated in Pakistan under the Companies Act 2017, with its office at 13-14, First Floor, B-71-72, Linear Commercial, Phase 8, Bahria Town, Rawalpindi, Pakistan, 46220. For the purposes of this policy, EBIT decides why and how your personal information is processed and is responsible for it (the "data controller").

This policy applies to:

• visitors to this website and its sub-pages;
• people who submit an enquiry, proposal request, contact form, career application, newsletter sign-up or referral;
• registered users of our client, student, worker, consultant and partner portals;
• clients, candidates, students, applicants, sponsors and family members whose information is provided to us in the course of an engagement;
• suppliers, consultants, referral partners, employers, institutions and other business contacts.

This policy does not cover websites, platforms or services operated by others, even where we link to them (for example a university, embassy, visa application centre, payment provider or map service). Those organisations have their own privacy policies.

2. Laws We Follow

Our handling of personal information is guided by the following Pakistani laws and regulations, as amended from time to time:

• Constitution of the Islamic Republic of Pakistan, 1973 — Article 14, which protects the dignity of the person and the privacy of the home;
• Prevention of Electronic Crimes Act 2016 (PECA), as amended in 2025, which prohibits unauthorised access to information systems and data, interference with data, electronic fraud and forgery, and unauthorised use of identity information;
• Electronic Transactions Ordinance 2002, which recognises electronic documents, records, communications and signatures;
• Emigration Ordinance 1979 and Emigration Rules 1979, which govern overseas employment, the records kept for intending emigrants and the information shared with the Bureau of Emigration & Overseas Employment and Protectors of Emigrants;
• Companies Act 2017, Income Tax Ordinance 2001 and the applicable sales-tax-on-services laws, which require us to keep business, accounting and tax records;
• Anti-Money Laundering Act 2010 and related regulations, where customer due diligence applies to a transaction we are involved in;
• Pakistan Telecommunication (Re-organization) Act 1996 and the PTA Protection from Spam, Unsolicited, Fraudulent and Obnoxious Communication Regulations 2009, which govern SMS and telephone marketing;
• Payment Systems and Electronic Fund Transfers Act 2007 and State Bank of Pakistan requirements, as applied by the banks and payment providers we use.

When the Personal Data Protection Bill (or any successor data-protection law) is enacted, we will update this policy and our practices to meet it, including any requirements of the National Commission for Personal Data Protection.

Where we handle the information of people located outside Pakistan, or work with overseas employers, universities and authorities, we also respect the data-protection laws that apply to them (for example the UK GDPR, the EU GDPR, or data-protection laws in the GCC), so far as they apply to our role.

3. Our Data-Protection Principles

Whatever the service, we handle personal information according to these principles:

• Lawful and fair: we only process information where we have a lawful basis and we tell you what we do with it.
• Purpose limitation: we use information for the purposes we collected it for, or compatible purposes.
• Data minimisation: we ask only for what the service, the destination country, the employer or the institution actually requires.
• Accuracy: we take reasonable steps to keep information correct and up to date, and you can correct it at any time.
• Storage limitation: we keep information only as long as needed or as the law requires (see Section 12).
• Security: we protect information with technical and organisational safeguards appropriate to its sensitivity.
• Accountability: we train our staff, restrict access on a need-to-know basis and keep records of how we handle data.

4. Information We Collect

4.1 Information you give us

Depending on how you deal with us, this may include:

• Identity and contact details: name, father's or husband's name, date of birth, gender, nationality, CNIC/NICOP or passport number, postal address, email address, telephone and WhatsApp numbers, and photographs.
• Enquiry and proposal details: company name, designation, the services you are interested in, budget, timelines and any message or files you send.
• Business client information: company registration, NTN/STRN, ownership and management details, financial statements, contracts, operational data and other information needed for consulting, M&A, real-estate, brand-management or digital engagements.
• Job-seeker and worker information: CV, employment history, references, educational and trade certificates, trade-test results, skills videos, licences, medical-fitness results, police character certificate, next-of-kin details, emigration and protector documents, visa and work-permit details, and placement and deployment records.
• Student and education information: academic transcripts and certificates, English-test scores, statement of purpose, references, programme choices, offer letters, sponsor details, bank statements and funding evidence, and student-visa documents.
• Immigration and travel information: family composition, marital status, travel and visa history, previous refusals, employment and financial evidence, and other details required by a destination country's visa form.
• Consultant, partner and supplier information: professional profile, qualifications, bank-account details for payments, NTN and tax status, referral activity and agreements.
• Account information: username, password (stored only in hashed form), two-factor authentication settings and portal preferences.
• Payment information: invoices, payment receipts and transaction references. Card payments are processed by our payment provider; we do not store your full card number or CVV.
• Communications: emails, letters, call notes, messages through our portals, WhatsApp or SMS, survey responses, feedback, testimonials and meeting notes.

4.2 Information collected automatically

• technical data such as IP address, browser and device type, operating system, language and approximate location derived from the IP address;
• usage data such as pages viewed, links clicked, date and time of access and referring page;
• security and audit logs, including sign-in attempts, two-factor verifications and changes made inside portals;
• information stored by cookies and similar technologies (see Section 10).

4.3 Information from other sources

• overseas employers, their agents and trade-testing or medical centres, about selection, test results, fitness and deployment;
• universities, colleges and testing bodies, about applications, offers and results;
• embassies, consulates and visa application centres, about the progress or outcome of applications;
• referees, sponsors, family members and referral partners, where you have asked them to provide information or where they refer you to us;
• public sources such as SECP company records, professional networking profiles, company websites and published directories, for business contacts and due diligence;
• government verification channels, where verification of identity documents or certificates is required for a service and permitted by law.

If you give us information about another person (for example a family member, sponsor, employee or referee), please make sure they know you are doing so and have seen this policy.

5. Sensitive Personal Information

Some services require information that deserves extra protection, such as national identity and passport numbers, financial and bank information, health and medical-fitness information, criminal-record certificates, information about children, and, where a destination country's form requires it, religion or ethnicity.

For sensitive information we:

• collect it only where it is genuinely required by the service, the employer, the institution or the authority concerned;
• obtain your explicit consent, usually in your engagement or registration form, unless the law requires or permits the processing without consent;
• restrict access to the staff handling your file;
• store documents in access-controlled storage, encrypted where the storage service supports it;
• share it only with the recipients needed for the service you asked for.

We do not collect biometric data ourselves. Visa application centres, NADRA, medical centres or foreign authorities may collect biometrics from you directly under their own policies.

6. How We Use Your Information and Why

We use personal information only where we have a lawful reason. The table below explains our main purposes and the basis we rely on.

We will not use your information for a purpose that is unrelated to the one we collected it for unless we tell you first and, where required, ask for your consent.

7. Automated Tools and Artificial Intelligence

Our platform uses software tools, including artificial-intelligence services, to help our team work efficiently. For example, they may help read and classify uploaded documents (optical character recognition), summarise long documents, draft correspondence, suggest matching services or roles, and prioritise enquiries.

• Where practicable, we remove or mask personal identifiers before content is sent to an external AI service.
• We use AI services under business terms and, where the provider offers it, settings that prevent our data being used to train their public models.
• We do not make decisions that have legal or similarly significant effects on you — for example rejecting a job application, admission or visa file — solely by automated means. A member of our team reviews such decisions.
• You may ask us to explain how an automated tool was used on your file and ask for a human review.

8. Who We Share Information With

We do not sell, rent or trade your personal information. We share it only as needed for the purposes in this policy, with:

• EBIT's own divisions and staff, where more than one division is involved in your matter (for example Education & Placement working with Immigration & Global Mobility on a student visa);
• overseas employers and their authorised agents, for recruitment, selection, trade testing, visas and deployment;
• universities, colleges and testing bodies, for admissions and enrolment;
• embassies, consulates, visa application centres and immigration authorities, for visa and immigration applications you ask us to prepare;
• Government of Pakistan bodies, such as the Bureau of Emigration & Overseas Employment, Protectors of Emigrants, NADRA, the Ministry of Foreign Affairs or Higher Education Commission (for attestation), the Federal Board of Revenue and SECP, where the service or the law requires it;
• trade-testing, medical and training centres involved in your placement;
• counterparties to a transaction, such as mall management, property owners, brands, buyers, sellers or investors, under confidentiality obligations, where this is part of an engagement you have authorised;
• service providers who process data for us, such as cloud hosting and storage, email and SMS delivery, payment processing, electronic signature, document conversion, backup, communication and IT-support providers, under contracts that require them to protect it;
• professional advisers such as lawyers, auditors, tax advisers and insurers;
• law-enforcement agencies, courts and regulators, when we are legally required to disclose information, for example under a court order, a lawful request under PECA, or tax law, or where necessary to prevent fraud or protect someone's safety;
• a successor business, if EBIT or part of its business is reorganised, merged or sold, in which case the recipient must continue to protect your information under this policy.

9. Transfers Outside Pakistan

Many of our services are international by nature. Your information may be sent outside Pakistan, for example:

• to an employer, university, embassy or authority in the country you are applying to;
• to cloud servers and service providers located outside Pakistan that host our platform, email and backups.

When we transfer information abroad we send only what is necessary, use encrypted connections, work with reputable providers bound by confidentiality and security obligations, and, where the destination is chosen by you (such as an employer or university abroad), rely on your instruction and consent given when you engage us. We will apply any additional transfer rules that Pakistani law introduces in future.

10. Cookies and Similar Technologies

Cookies are small files placed on your device by a website. We use them as follows:

We do not currently use advertising or cross-site tracking cookies. If we introduce analytics or marketing cookies in future, we will update this section and, where required, ask for your consent first. You can block or delete cookies in your browser settings, but parts of the website may then stop working.

11. Marketing Communications

• We send newsletters, insights and event invitations by email only if you have subscribed or have an existing business relationship with us, and every email includes an unsubscribe link.
• We send promotional SMS or WhatsApp messages only in line with PTA regulations and only to people who have agreed to receive them. Service messages about your own application, appointment or invoice are not marketing.
• You can opt out at any time by using the unsubscribe link, replying STOP to an SMS, updating your portal preferences or writing to info@ebitmnc.com. Opting out of marketing does not affect service messages.

12. How Long We Keep Information

We keep personal information only as long as it is needed for the purpose it was collected for, or longer where the law requires it. Typical periods are:

When information is no longer needed, we securely delete it or anonymise it so it can no longer identify you. Information may be kept longer if it is subject to a legal hold, dispute, investigation or regulatory request.

13. How We Protect Information

• encrypted connections (HTTPS/TLS) for the website and portals;
• access-controlled storage for uploaded documents and backups, encrypted where the storage service supports it;
• passwords stored only as secure hashes, with optional two-factor authentication on accounts;
• role-based access controls so staff see only the files they work on, with audit logs of access and changes;
• confidentiality obligations in staff, consultant and supplier agreements, and data-protection training;
• regular backups, software updates and monitoring for suspicious activity;
• redaction of personal identifiers where full details are not needed.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You can help by choosing a strong password, enabling two-factor authentication, not sharing your login and signing out on shared devices.

14. Data Breaches

If we become aware of a security incident affecting personal information, we will act promptly to contain it, assess the risk and fix the cause. Where the incident is likely to put you at risk, we will tell you without undue delay — aiming to do so within 72 hours of becoming aware of it — explaining what happened, the likely consequences, the steps we have taken and what you can do to protect yourself.

Where an incident involves a criminal offence under PECA, we will report it to the National Cyber Crime Investigation Agency or other competent authority, and we will notify any regulator or data-protection authority as Pakistani law requires.

15. Your Rights

Subject to the law and to records we must keep, you have the right to:

• Access — ask what information we hold about you and receive a copy;
• Correction — ask us to correct inaccurate or incomplete information;
• Deletion — ask us to delete information we no longer need or have no lawful reason to keep;
• Withdraw consent — where we rely on your consent, withdraw it at any time, without affecting processing already carried out;
• Object — object to processing based on our legitimate interests, and to direct marketing at any time;
• Restriction — ask us to pause the use of your information while a concern is being resolved;
• Portability — receive information you gave us in a commonly used electronic format; registered users can download a copy from the privacy section of their portal;
• Human review — ask for a person to review any decision made with the help of automated tools;
• Complain — raise a concern with us and, if you are not satisfied, with the competent authority or court.

To exercise any right, email info@ebitmnc.com or use the privacy section of your portal. We may need to verify your identity before acting, for example by asking you to confirm details from your file. We will respond within 30 days. If a request is complex we may extend this, and we will tell you why. We do not charge for requests unless they are clearly unfounded or excessive.

Please note that withdrawing consent or deleting certain information may mean we can no longer continue an application or service, for example if an employer, institution or embassy requires that information. We will explain this before acting.

16. Children's Information

Our education services often involve students under 18. We collect and use a minor's information only with the consent and involvement of a parent or legal guardian, and only for the education or immigration service requested. We do not knowingly collect information directly from children under 18 through this website without that consent, and we do not use children's information for profiling or targeted advertising.

We do not register anyone under 18 for overseas employment. If you believe a child has provided information to us without consent, please contact info@ebitmnc.com and we will delete it.

17. Recruitment Fraud and Impersonation

Criminals sometimes impersonate recruitment and immigration firms to collect money or documents. To protect yourself:

• EBIT never asks for payment into a personal bank account, a mobile wallet in an individual's name or in cash without an official receipt;
• overseas-employment fees can only be charged as permitted under the Emigration Ordinance and Rules, and every payment is receipted;
• our official communications come from our listed phone numbers and email domain;
• you can verify any overseas employment promoter on the Bureau of Emigration & Overseas Employment website.

If you receive a suspicious message using EBIT's name, do not pay or send documents. Contact us at +92 51 570 9707 or info@ebitmnc.com, and report it to the National Cyber Crime Investigation Agency.

18. Third-Party Websites

Our website may link to or embed content from other websites, such as universities, embassies, government portals, social-media platforms and map services. We are not responsible for their privacy practices, and we encourage you to read their privacy policies before giving them information.

19. Changes to This Policy

We may update this policy to reflect changes in the law — including the enactment of Pakistan's personal data-protection law — or in our services and practices. The date at the top shows when it was last updated. If the changes are significant, we will notify registered users by email or through their portal before they take effect.

20. Contact Us and Complaints

For any question, request or complaint about privacy, please contact our data-protection contact:

• Email: info@ebitmnc.com
• Telephone: +92 51 570 9707
• Post: Data Protection Contact, EBIT Management Consultant (SMC-Pvt.) Ltd., 13-14, First Floor, B-71-72, Linear Commercial, Phase 8, Bahria Town, Rawalpindi, Pakistan, 46220

We will acknowledge complaints within 5 working days and aim to resolve them within 30 days. If you are not satisfied with our response, you may approach the competent authority — including the National Commission for Personal Data Protection once it is established, the National Cyber Crime Investigation Agency for cyber offences, or the Bureau of Emigration & Overseas Employment for matters relating to overseas employment — or the courts of competent jurisdiction in Pakistan.