Privacy policy
Last updated October 7, 2026
1. Who we are
ygkonnect.com is operated by YG Konnect (Private) Limited, a company registered in Pakistan (CUIN 0341984, NTN J303479-8, STRN 3277876395341), with its registered office at Office No 6-D, Multan Industrial Estate, Phase-1, Multan, Pakistan ("YG Konnect", "we", "us").
We sell crop-protection and crop-nutrition products (pesticides, herbicides, fungicides, growth promoters and related agri-inputs) to farmers and dealers in Pakistan through this website and over WhatsApp.
Questions about this policy or about your data: info@ygkonnect.com · WhatsApp / phone +92 301 1199118.
2. What this policy covers
This policy explains what personal information we collect when you use ygkonnect.com or message us on WhatsApp, why we collect it, who we share it with, how long we keep it, and the choices you have. It applies to customers and visitors of the shop. Our staff systems have their own internal rules.
3. Information we collect
We collect only what is needed to take, deliver and support an order. You can browse the catalogue, read the blog and use the cart without giving us any personal information.
3.1 When you place an order (guest or signed in)
| Information | Required? | Why |
|---|---|---|
| Full name | Required | Consignee name on the parcel |
| Mobile number (Pakistani) | Required | Order confirmation, delivery coordination, tracking, and the identity your order history is linked to |
| Email address | Optional | Order notices by email, if you prefer them |
| Delivery address, city and province | Required | Delivery; also used to estimate the delivery depot and transit time |
| Postal code | Optional | Delivery |
| Order notes | Optional | Passed to the courier as a third address line |
| Payment method (Cash on Delivery or bank deposit; online payment through XPay only when it is shown at checkout) | Required | How the order is settled |
We also record the order itself: the products, quantities, the price you were shown, the parcel weight, the order number, when it was placed, and its progress (received, paid, dispatched, delivered, returned, refunded).
Approximate delivery coordinates. From the city and province you give us we derive an approximate latitude and longitude from a fixed table of Pakistani locations. This is used to choose the shipping depot and is passed to the courier. We do not read your device's GPS location.
3.2 When you create an account
Accounts are optional. If you register we collect your name, mobile number, email address and a password. The password is stored only as a one-way hash (BCrypt); we cannot read it. To activate the account we send a six-digit verification code to your mobile number over WhatsApp; the code is also stored only as a hash, expires after ten minutes, and dies after five wrong attempts. Once your number is verified, earlier guest orders placed with the same number are linked to your account so you can see them.
3.3 When you track an order without an account
The track-order page looks up an order by its order number and the mobile number it was placed with. Both must match. We keep no record of the lookup other than ordinary server logs.
3.4 When you message us on WhatsApp
If you write to our customer WhatsApp number we receive, through Meta's WhatsApp Business platform, your WhatsApp number, the profile name you have set in WhatsApp, the content of your messages, and any photos or documents you send (for example a bank-deposit slip or a photo of a damaged parcel). Our staff reply from a shared inbox. Messages are kept with the order they relate to so that a later conversation can be answered.
3.5 When you leave a product review
We collect the name you choose to display, an optional location (for example your city), a star rating and the review text. Reviews are held for moderation and are not published until a member of staff approves them. Once published, the display name, location, rating and text are visible to everyone.
3.6 When you join the newsletter
We record the email address you enter, the language you were using and the page you signed up from.
3.7 Technical information
Our server sees the IP address of every request. We use it to rate-limit checkout, tracking, review and newsletter requests and to lock out repeated failed sign-in attempts. IP addresses appear in our server logs together with the time and the action; they are not stored against your order or account.
3.8 What we deliberately do not collect
- No card numbers, expiry dates, CVV codes or wallet PINs. If online payment is offered and you choose it, these are entered on the secure payment page or payment fields provided by our payment processor, XPay, and go directly to XPay. They never pass through or are stored on our servers (see §3.9). A bank deposit is made by you, from your bank, to ours; we only record that the money arrived.
- No national ID (CNIC), date of birth or any identity document.
- No device location, no contacts, no device identifiers.
- No advertising or analytics trackers. The shop runs no Google Analytics, Meta Pixel or similar tool.
3.9 If you pay online
Online payment is not offered at the moment. This section applies only when an online payment option is shown at checkout.
Online payments (debit and credit cards, and the mobile wallets or other methods shown at checkout) are processed by XPay by PostEx, a payment gateway certified to PCI DSS and regulated under the State Bank of Pakistan. When you choose to pay online:
- We send XPay your order number, the amount in PKR, and your name, mobile number and email address so that the payment can be matched to your order and the receipt and any one-time passcode can reach you.
- You enter your card or wallet details on XPay's secure payment page or in payment fields served by XPay. Your bank or wallet provider may ask you to confirm the payment with a one-time passcode (3-D Secure). We do not see, receive or store your card number, expiry date, CVV or wallet credentials.
- XPay returns to us the result of the payment, a transaction reference, the payment method type, the card brand and the last four digits of the card (where applicable). We keep these with your order as the record of payment and to process any refund to the same card or wallet.
- XPay processes your payment data under its own privacy policy, published by PostEx.
4. How we use your information
| Purpose | What we use | Legal basis / why it is justified |
|---|---|---|
| Taking and fulfilling your order | Name, phone, address, email, order details | Performing the contract you asked for |
| Taking and refunding online payments (when offered) | Name, phone, email, amount, order number, payment result and transaction reference | Performing the contract; preventing fraud and handling disputes |
| Telling you about your order | Phone (WhatsApp), email | Performing the contract. These are service notices (order received, awaiting payment, payment received, dispatched with tracking number, out for delivery, delivered, delayed, cancelled, return received, refund issued). They are not marketing |
| Answering you on WhatsApp | Your messages and media, your order | Performing the contract and responding to your request |
| Running your account | Name, phone, email, password hash, verification codes | Providing the account you asked for |
| Showing moderated reviews | Display name, location, rating, text | Your submission; you choose what name to show |
| Aggregate figures on the site | A count of distinct customer phone numbers with non-cancelled orders; review counts and averages | Legitimate interest in showing honest, derived figures. No individual is identifiable |
| Preventing abuse | IP address | Legitimate interest in keeping the shop available |
| Accounting, tax and dispute records | Order and payment records | Legal obligation to keep business records |
We do not use your information for profiling, automated decisions, abandoned-cart messages or promotional campaigns. See §6 on marketing.
5. Who we share your information with
We do not sell personal information and we do not share it with advertising networks or marketing agencies. We share it only with the parties needed to deliver and support your order:
| Recipient | What they receive | Why |
|---|---|---|
| TCS (courier) | Consignee name, address lines, city, postal code, mobile number, email (if given), approximate coordinates, the product names, quantities and prices, the parcel weight, and the Cash-on-Delivery amount where applicable | To carry the parcel, collect COD and provide proof of delivery. TCS returns delivery status and the name of the person who received the parcel |
| XPay by PostEx, payment processor (only when online payment is offered) | Order number, amount, your name, mobile number and email; you give your card or wallet details to XPay directly | To authorise, capture and refund online payments, screen for fraud and respond to chargebacks. XPay may share the transaction with your card scheme, issuing bank or wallet provider as needed to process it |
| Meta Platforms (WhatsApp Business / Cloud API) | Your WhatsApp number and the content of messages sent to and received from you | WhatsApp messages can only be delivered through Meta. Meta's own privacy terms apply to its handling of WhatsApp traffic |
| Our email provider | Your email address and the notice content | To deliver order emails and password-reset codes you ask for by email |
| Our ERP / accounting system (Oracle AIMS via ORDS) | Order number, product codes, quantities, the depot and the internal dealer/company and pricing codes | To raise the invoice and stock movement. No name, phone or address is sent to it |
| Our depot and accounts staff | The customer invoice (name, address, products, amounts) | To pack and account for the parcel. The invoice travels inside the parcel |
| Railway (hosting provider) | Everything held in our database and our server logs. Our website, API and database run on Railway's servers in Singapore | Railway rents us the servers and stores the data on our instructions; it does not use it for its own purposes |
| Cloudflare (R2 file storage) | Photos and files received over WhatsApp, generated invoices and slips, product images, and nightly backups of our database | File storage and backups. Cloudflare stores the files on our instructions and may hold them outside Pakistan |
| Authorities, courts or professional advisers | What is lawfully demanded or needed to establish or defend a legal claim | Legal obligation |
Our website, API and database run on servers rented from Railway in Singapore, and our files and database backups are stored with Cloudflare. Both act only on our instructions. The database holding your information is used by us alone and is not shared with any other business. If we change hosting provider we will update this section.
5.1 Third-party content on the site
- Payment page. If online payment is offered and you choose it, the payment step is served by XPay. XPay may set its own cookies or use device and browser information to detect fraud; this is governed by XPay's privacy policy.
- Weather widget. The home page shows weather from Open-Meteo (api.open-meteo.com) for a fixed city, not your location. Your browser makes that request directly, so Open-Meteo sees your IP address.
- Videos. Articles may embed YouTube (privacy-enhanced "nocookie" mode) or Vimeo players, which load only when you press play and are governed by those services' policies.
- WhatsApp links. "Chat on WhatsApp" buttons open wa.me links; nothing is sent until you send a message.
6. Marketing and the newsletter
We do not send marketing messages. Every WhatsApp or email you get from us is about an order you placed, or a code you requested.
If you subscribe to the newsletter, we store your email address so that we can send you seasonal crop advisories and product safety or availability alerts. These are sent, if at all, from a separate mailing tool operated by our staff, never automatically from the shop. You may unsubscribe at any time using the newsletter card in the site footer (choose "Unsubscribe instead" and enter your address), or by emailing info@ygkonnect.com or messaging +92 301 1199118; your address is marked unsubscribed at once and is left out of every list we export.
To stop WhatsApp messages from us entirely, reply STOP to any message from our number. You will then receive nothing further from us on WhatsApp, including order notices; reply START to resume.
To stop order emails, use the "Stop order emails to this address" link at the foot of any order email from us. We will then send no further order emails to that address; order updates continue on WhatsApp. The link is specific to your address and can be used from any email we have sent you.
7. How we protect your information
- The site and our API are served over HTTPS with HSTS.
- We take no card or wallet details ourselves. If online payment is offered, card and wallet payments are handled entirely by XPay, which is PCI DSS certified, so our servers hold no card data.
- Passwords and one-time codes are stored only as BCrypt hashes.
- Checkout, tracking, sign-in, review and newsletter endpoints are rate-limited by IP, and sign-in locks after repeated failures.
- Staff access to customer data is role-based (Admin, Operator, Head of Business) and staff sign-ins expire after eight hours.
- Prices are computed on the server; the browser cannot alter what you are charged.
- Customer photos and documents received over WhatsApp are deleted from storage after 90 days (see §8).
No system is perfectly secure. If we become aware of a breach that affects your information we will inform you and any authority that the law requires.
8. How long we keep your information
| Information | Kept for | Why |
|---|---|---|
| Orders, invoices, payments, refunds and their history | For as long as accounting and tax law require us to keep business records, and until any dispute about the order is closed. We do not currently delete order records on a fixed schedule | Accounting, tax and dispute records |
| Online payment records (transaction reference, method, card brand, last four digits) | With the order, for the same period | Refunds, chargeback evidence (card schemes allow disputes for up to 180 days) and accounting |
| Customer account (name, phone, email, password hash) | While the account is active, and until you delete it from the account page (§9). Deletion removes the name, phone, email, WhatsApp id and password from the account immediately | Providing the account |
| One-time verification and reset codes | Expire after 10 minutes; the record of a code having been issued is kept with the account | Support and fraud investigation |
| WhatsApp conversation text | With the related order, for the same period as the order | Answering follow-up questions about the order |
| Raw message data received from WhatsApp (the technical delivery record) | 30 days after the message has been processed, then the raw data is removed; the record that a delivery arrived, and the message itself in the conversation, remain | Troubleshooting message delivery |
| Photos and files received over WhatsApp | 90 days, then the file is deleted; the record that a file was received remains | Storage limits |
| Generated print documents (invoices, slips) | 14 days on the print server; the record lives on with the order | Operational |
| Product reviews | Published reviews until you ask for removal; rejected reviews are retained unpublished for moderation records | Moderation history |
| Newsletter address | Until you unsubscribe; thereafter marked unsubscribed and not used | Honouring your choice |
| Nightly database backups | Six years, then deleted automatically by the storage lifecycle. A backup is used only to restore the service after a failure; information deleted at your request may remain in an older backup until that backup expires | Disaster recovery |
| Server logs (including IP addresses) | 30 days, kept by our hosting provider | Security and troubleshooting |
9. Your choices and rights
You may, at any time, ask us to:
- Access the information we hold about you. Signed-in customers can see their profile and order history on the account page; anyone can ask us for a copy by email.
- Correct a name, phone number, email or address. Note that an address on an order already handed to the courier may not be changeable; contact us as early as possible.
- Delete your account yourself, from the account page ("Delete my account", after confirming your password). Your name, phone number, email, WhatsApp id and password are removed from the account at once, the account is closed and every sign-in is ended. Order and payment records needed for accounting are retained for the period in §8 and keep the name, phone number and address that were on the order, because the invoice must carry them. To have other personal information deleted or anonymised, ask us; we will delete what we are not legally required to keep.
- Stop messages: reply STOP on WhatsApp; use the footer newsletter card to leave the newsletter; use the link at the foot of any order email to stop order emails (§6).
- Object to any use of your information you believe is unjustified, or complain to us about how we have handled it. If you are not satisfied you may complain to the relevant authority in Pakistan.
Send requests to info@ygkonnect.com or +92 301 1199118 from the phone number or email on the account or order, so that we can confirm it is you. We will respond within 30 days.
10. Cookies and browser storage
We set one cookie, yg.locale, which remembers whether you read the site in English or Urdu. It lasts one year and carries nothing else.
The shop also uses your browser's local storage, which stays on your device and is not sent to us except as part of the actions you take:
| Key | What it holds |
|---|---|
yg:cart, yg:wishlist | The products you have put in your cart or wishlist |
yg:city, yg:city-prompt-seen | The delivery city you picked for the delivery estimate, and that we asked |
yg:language-prompt-seen | That we have shown the language prompt |
yg:discount | A discount code you entered |
yg:session | Your sign-in token and name/phone/email while signed in. Sign out, or clear site data, to remove it. The token is valid for 7 days, and signing out also cancels it on our server, for every device |
yg:login-email | The phone or email you asked us to remember on the sign-in page |
yg.order.<number> (session storage) | Your just-placed order, so the thank-you page can show it; cleared when the tab closes |
Clearing your browser's site data removes all of these. There are no advertising or analytics cookies, so there is no consent banner. If online payment is offered, the XPay payment step may set cookies of its own for security and fraud prevention (see §5.1).
11. Children
Our products are regulated agricultural chemicals. The shop is intended for adults aged 18 and over. We do not knowingly collect information from children; if you believe a child has given us information, contact us and we will delete it.
12. Where your information is processed
Our website, API and database run on servers rented from Railway in Singapore, so your information is stored outside Pakistan. Files and database backups are stored with Cloudflare, which may hold them outside Pakistan. If online payment is offered, payments are processed by XPay in Pakistan, with card transactions routed to your card scheme and issuing bank. WhatsApp traffic is processed by Meta Platforms, and email by our email provider, each of which may process data outside Pakistan under its own terms. Courier data stays with TCS in Pakistan.
13. Changes to this policy
We will post any changes on this page with a new "last updated" date. Material changes to what we collect or share will also be shown on the site for at least 30 days.
14. Contact
YG Konnect (Private) Limited · CUIN 0341984 · NTN J303479-8 · STRN 3277876395341 Office No 6-D, Multan Industrial Estate, Phase-1, Multan, Pakistan Email: info@ygkonnect.com · WhatsApp / phone: +92 301 1199118