PRIVACY POLICY

Version: 1.0 (Comprehensive Pre-Publication Review)
Effective Date: 22 September 2026
Last Updated: September 2026
Document Status: Ready for Legal Review & Website / Meta Lead Ads Publication

Important Notice Before Publication

Every item bracketed with placeholder indicators represents an operational or administrative detail that must be verified by the management of Flag Square Builders prior to public hosting. Meta requires a live, functional Privacy Policy URL before Lead Ad campaigns can activate. Once published, this document constitutes a binding representation of the company’s data practices.

1. Who We Are & Data Controller

This Privacy Policy explains how Flag Square Builders (“Flag Square Builders”, “we”, “us”, “our”) collects, uses, processes, discloses, and protects personal data when you interact with us across our digital advertising, social media channels, messaging platforms (including WhatsApp), websites, sales offices, on-site project offices, or promotional events.
For the purposes of applicable data protection standards, the entity responsible as the Data Controller for your personal information is:
  • Trading Name: Flag Square Builders
  • Registered Legal Name: Flag Square Builders
  • Corporate Office: C-79 Commercial, Etihad Town Phase 1, Raiwind Road, Lahore, Punjab, Pakistan
  • Project / Site Office: Union Town, Main Boulevard, Pine Avenue, Lahore, Punjab, Pakistan
  • Telephone (UAN): 0310-1533333
  • Privacy Contact Email: info@flagsquarebuilders.com
  • Official Websites: www.flagsquarebuilders.com | www.flagsquarebuilders.com
Flag Square Builders is a construction and real estate firm based in Lahore, Pakistan. Our portfolio includes delivered developments as well as active projects including Pine Residencia (located on Pine Avenue, Union Town, Lahore) and Flag Square Business Center (Etihad Town Phase 1, Raiwind Road, Lahore).

2. Scope of This Policy

This Policy applies to all personal information collected through any of the following touchpoints:
  • Paid Digital Advertising: Lead generation campaigns across Meta platforms (Facebook and Instagram), Google (Search, Display, YouTube), TikTok, and LinkedIn—including on-platform native instant lead forms.
  • Direct Messaging: WhatsApp conversations, SMS communications, and direct inquiries initiated by you or by our sales representatives in response to your interest.
  • Websites & Digital Properties: Our main websites, landing pages, interactive calculators (e.g., payment plan calculators), and brochure download forms.
  • Telephonic Communications: Inbound and outbound calls via our UAN and designated sales lines.
  • Social Media & Online Presence: Inquiries, direct messages, comments, and reviews across our organic social media pages and Google Business Profile.
  • Physical Visits: Walk-in visits, appointments, and consultations at our corporate offices, project site offices, and display centers.
  • Corporate Events & Ballots: In-person and virtual promotional events, pre-launch sessions, and allotment balloting.
  • Sales Administration & Customer Service: Documentation processing, identity verification, instalment billing, account statements, and eventual property handover.
Third-Party Platform Scope: This Policy does not apply to the independent processing conducted by third-party platforms (such as Meta, Google, TikTok, or ByteDance) under their own privacy policies. Where we configure and use interactive features (such as Meta Instant Lead Ads or advertising tracking pixels), Flag Square Builders and the respective platform act as joint controllers for the collection and transmission stage, after which our handling is governed by this Policy.

3. Legal Framework & Standards Applied

While comprehensive data protection legislation (such as the proposed Personal Data Protection Bill) remains pending enactment by the Parliament of Pakistan, personal data privacy in Pakistan is safeguarded under Article 14 of the Constitution of the Islamic Republic of Pakistan (Fundamental Right to Privacy), the Prevention of Electronic Crimes Act 2016 (PECA), and the Pakistan Telecommunication Authority’s (PTA) Protection from Spam, Unsolicited, Fraudulent and Obnoxious Communication Regulations 2009.
Flag Square Builders adheres to international data governance best practices, aligning our standards with the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. Where you engage with us from the United Kingdom, European Union, or overseas jurisdictions, those statutory rights are fully respected. For domestic clients within Pakistan, we extend equivalent transparency, security, and access rights as a matter of institutional policy.

4. Personal Data We Collect

4.1 Data Provided Directly by You

When you enquire regarding our residential or commercial projects, we typically collect:
  • Full name and contact details (mobile number, WhatsApp number, email address).
  • City and country of residence (including Overseas Pakistani resident status).
  • Project preferences (e.g., interest in Pine Residencia Townhouses, specific blocks such as Block A or Block E, floor preferences, and unit typology).
  • Budgetary scope, preferred instalment structure, and purchase horizon.
  • Intended use (end-user residential living vs. long-term capital investment).
  • Communication preferences (preferred language, call times, or messaging channels).
  • Any bespoke requirements or notes shared via web form inputs or direct discussions.

4.2 Booking, Statutory & KYC Documentation

If you proceed from an initial enquiry to booking and unit allotment, we collect required legal and regulatory data:
  • CNIC / NICOP number and clear photographic copies; Passport copies for overseas buyers.
  • Father's or Husband's name, date of birth, marital status, and permanent/current postal addresses.
  • Next of kin and designated nominee details.
  • Passport-sized photographs affixed to official booking forms.
  • Banking details, cheque / pay order / electronic transfer proofs, and payment receipt records.
  • Source-of-funds verification details required in compliance with anti-money laundering (AML) guidelines and statutory real estate regulations.
  • Ongoing instalment records, ledger statements, and possession clearance records.
Note on Third-Party Data: If you supply personal details on behalf of a co-applicant, spouse, nominee, or referee, you confirm that you have obtained their explicit prior consent to do so.

4.3 Data Collected Automatically (Web & Digital Channels)

When you visit our digital web pages:
  • Technical identifiers: IP address, device model, operating system, browser version, and approximate location.
  • Browsing behavior: Pages visited, session duration, scroll depth, form submission milestones, and exit pages.
  • Marketing attribution: Campaign source tags (UTM parameters), indicating which ad, creative, or network directed you.
  • Cookies and tracking pixels: Advertising identifiers generated by Meta, Google, and analytics systems. (Note: Native lead forms completed within Facebook or Instagram are hosted directly on Meta infrastructure; lead details are delivered securely via Meta Leads Center or API).

4.4 Data Received from Third Parties

  • Authorized real estate brokers, channel partners, and Al-Haram Estate & Builders who refer prospective buyers with prior consent.
  • Digital real estate portals (e.g., Zameen.com) where you express direct interest in Flag Square Builders listings.
  • Aggregated analytics and reporting data from advertising networks.

4.5 Site Security & CCTV

For physical safety and asset protection, closed-circuit television (CCTV) cameras operate continuously at our corporate headquarters, site offices, and project access gates. Prominent signage alerts visitors upon entry. Visitors may also be requested to log their entry in physical gate registers.

4.6 Call & Communication Recordings

When you contact our UAN (0310-1533333) or sales representatives, or interact via our official WhatsApp channels, communications may be monitored, logged, or recorded for customer support quality, sales verification, and dispute resolution. Where automated call recording is active, verbal notification is provided at the start of the call.

4.7 Excluded Sensitive Categories & Minors

We do not solicit, require, or process sensitive special-category data (such as religious beliefs, biometric health records, ethnicity, or political affiliations). Our services are directed exclusively at individuals aged 18 and older. We do not knowingly collect personal data from minors.

5. Why We Use Your Data & Legal Grounds

Purpose / Activity

Business & Practical Objective

Legal Basis (GDPR / UK Standards)

Responding to Inquiries

Contacting you via phone, WhatsApp, or email with project brochures; arranging viewings.

Pre-contractual steps; Legitimate interest.

Lead Qualification & Routing

Directing your enquiry to dedicated sales executives or partner desks.

Legitimate business interest.

Contractual Execution

Processing booking applications, maintaining ledgers, and completing possession.

Performance of a contract.

Legal & Regulatory Compliance

Verifying identity details and fulfilling anti-money laundering obligations.

Compliance with statutory legal obligations.

Direct Project Marketing

Sending notifications regarding new launches and construction progress.

Consent; Legitimate interest for existing prospects.

Campaign Optimization

Tracking ad performance and booking attribution to avoid wasted spend.

Legitimate interest; Consent for cookies.

Custom & Lookalike Audiences

Re-engaging past visitors and modeling demographic profiles for relevance.

Consent / Legitimate interest.

Site Safety & Security

CCTV monitoring and site office visitor registries.

Legitimate interest in safety of staff/assets.

Dispute Resolution

Managing legal queries, defending claims, and enforcing contractual terms.

Legitimate interest; Legal obligation.

6. Marketing Communications, WhatsApp Protocols & Opt-Out

Unsolicited spam is contrary to our operational standards. We adhere strictly to the following principles:
  • Opt-In Basis: We initiate direct outreach only when you have submitted an inquiry form, called our numbers, messaged us directly, or authorized an official partner introduction.
  • No Data Selling: Flag Square Builders will never sell, rent, lease, or trade your contact details to third-party marketing firms, commercial lists, or external developers.
  • Zero-Hassle Opt-Out: You may withdraw consent or stop promotional outreach at any time:
    • Reply STOP to any promotional WhatsApp or SMS message.
    • Click Unsubscribe in any marketing email.
    • Request exclusion verbally during any telephone conversation with our sales staff.
    • Email your opt-out request directly to info@flagsquarebuilders.com.
  • Processing Timeline: Marketing suppression is processed within seven (7) business days.
  • Service vs. Marketing Messages: Opting out of promotional messages does not cancel critical administrative communications (such as due instalment notices or legal documentation) if you have booked a unit.

7. Cookies, Pixels & Advertising Technologies

On our web properties, we utilize distinct tiers of digital tools:
  • Strictly Necessary Cookies: Essential for website navigation, form stability, and security protocols.
  • Analytics Cookies (e.g., GA4): Measures aggregated visitor volumes and navigation paths to enhance experience.
  • Advertising Pixels & Conversion APIs: Evaluates ad effectiveness and attributes lead generation.
  • Functional Cookies: Remembers preferences such as language and facilitates embedded tools like payment calculators.

Meta Conversions API (CAPI) Privacy Safeguards: To evaluate campaign performance without exposing raw personal records, customer identifiers (such as phone numbers or email addresses) are cryptographically hashed (SHA-256) before transmission. We never transmit sensitive financial details or CNIC numbers through ad tracking pixels.

8. Sharing & Disclosure of Personal Data

We disclose personal information solely on a confidential, need-to-know basis to the following entities:
  • Authorized Internal Personnel: Sales, recovery, accounting, and site operations teams.
  • Official Sales & Channel Partners: Authorized representation partners—specifically Al-Haram Estate & Builders.
  • Technology & CRM Providers: Secure cloud hosting and CRM providers like Person operating under strict confidentiality.
  • Digital Ad Networks: Meta, Google, TikTok, and LinkedIn for secure conversion verification.
  • Financial Institutions: Commercial banks for processing payments and escrow reconciliation.
  • Professional Advisors: External legal counsel, chartered accountants, and auditors.
  • Statutory Authorities: Competent courts, FIA, PHATA, LDA, and the FBR when required by legal process.

9. Cross-Border Data Transfers

Flag Square Builders operates in Pakistan, where primary physical files are maintained. However, our digital systems utilize infrastructure located in the United States, European Union, and other global regions. Where personal data of UK or EEA residents is processed outside those jurisdictions, we ensure appropriate safeguards are enacted, incorporating Standard Contractual Clauses (SCCs) and technical encryption measures.

10. Data Retention Schedules

Personal data is retained only for the duration required to satisfy the underlying business or statutory purpose:
  • Unconverted Inquiries: Retained for twenty-four (24) months from the date of last contact.
  • Marketing Suppression Lists: Contact details are retained on an internal registry indefinitely to honor opt-out requests.
  • Booked Clients & Homeowners: Full transaction files are maintained for at least ten (10) years following possession handover to comply with audit and warranty statutes.
  • Web Analytics: Retained for up to fourteen (14) months in Google Analytics.
  • CCTV Surveillance Footage: Overwritten on a cyclical basis every 30 to 60 days.

11. Your Rights

Regardless of your geographic location, Flag Square Builders provides you with control over your data:
  • Right of Access: Request confirmation of whether we hold your data and receive a copy.
  • Right to Rectification: Request immediate correction of inaccurate personal records.
  • Right to Erasure: Request deletion of records where processing is no longer required (subject to legal mandates).
  • Right to Restrict Processing: Request a temporary halt on processing during dispute investigations.
  • Right to Object: Object at any time to direct marketing or processing under legitimate interests.
  • Right to Withdraw Consent: Revoke any previously granted marketing or tracking consent.

Exercising Your Rights: Submit your request via email to info@flagsquarebuilders.com. Identity verification may be required. Requests are processed within thirty (30) days without charge.

12. Data Security & Incident Response

We implement robust administrative, physical, and digital safeguards:
  • Role-based access controls for internal staff.
  • Encrypted digital storage (SSL/TLS in transit; AES-256 for sensitive files).
  • Secured physical file archives for original purchase applications.
  • Immediate account deactivation upon employee offboarding.
Security Incident Management: In the event of a material security breach, Flag Square Builders will notify affected individuals and relevant regulatory authorities without undue delay. The nominated internal Data Protection Officer is Person.

13. Third-Party Websites & External Hyperlinks

Our web pages may contain links to third-party platforms (e.g., Google Maps). Flag Square Builders exercises no control over external platforms and assumes no responsibility for their privacy practices.

14. Protection of Minors

Our projects are strictly targeted at adults. We do not knowingly collect data from children under 18. If a minor has provided information to us, please notify us at info@flagsquarebuilders.com for prompt erasure.

15. Updates to This Policy

We reserve the right to revise this Privacy Policy to reflect modifications in our workflow or statutory legislation. Material alterations will be highlighted via notice on our website or direct communication.

16. Contact Details & Regulatory Recourse

For all inquiries, please reach out to:
  • Attention: Privacy & Data Governance Desk
  • Entity: Flag Square Builders
  • Corporate Address: C-79 Commercial, Etihad Town Phase 1, Raiwind Road, Lahore, Punjab, Pakistan
  • Telephone (UAN): 0310-1533333
  • Direct Email: info@flagsquarebuilders.com

Regulatory Oversight:

  • In Pakistan, concerns may be reported to the PTA or the NCCIA / FIA.
  • In the United Kingdom, complaints may be lodged with the Information Commissioner’s Office (ICO) at ico.org.uk.
  • In the EEA, individuals may petition their local Data Protection Authority (DPA).

Legal Disclaimer: This privacy policy draft has been vetted for structural completeness. Final formal sign-off by qualified legal counsel in Pakistan is recommended prior to commercial launch.