Privacy Policy
What personal information this website handles, why, where it is held and how to ask us about it.
Version 1.0 · Effective
Who we are
This policy covers the Pakistan pages of this website, run by Umair Manzoor & Co. Chartered Accountants (“the firm”, “we”, “us”). It also covers the country choice page at umairmanzoor.com, for the technical request information our hosting provider receives when you visit it. The firm is responsible for the personal information described here.
The firm’s Managing Partner, Umair Manzoor, is a Fellow Chartered Accountant and a member of the Institute of Chartered Accountants of Pakistan (ICAP).
- Office: Office 205, Shayan Iconic Tower, Shaheed-e-Millat Rd, Karachi
- Email: hello@umairmanzoor.com
- Phone: +92 21 3712 0735
- WhatsApp: +92 311 3110415
Umair Manzoor PC, UM Tax and Accounting Inc. and Umair Manzoor & Co. Chartered Accountants are separate entities. Each is responsible only for its own work.
This policy describes the firm’s own practices only.
What we collect and why
The site collects very little. This is everything it handles today:
- Technical request information. When you visit, our hosting provider’s servers receive your IP address, the page you asked for, the time and your browser type, and may keep them in operating logs. The site itself keeps no log of your visit; it only counts visits, as the next item describes.
- Visit counts without cookies. We also count visits on our own server, without cookies: the pages read, the site you came from, and your browser, device type, screen size and language. Your IP address is used briefly, to estimate your country and to tell one visit from another, and is not stored. None of this is sent to another company. This happens whatever you choose in the cookie settings, because it uses no cookies and identifies no one.
- What you send us. If you email us, call us or message us on WhatsApp, we receive what you choose to send, such as your name, contact details, your question or a CV for a role. We use it to reply to you and to deal with what you ask.
- Staff sign-in. Authorised staff sign in to the site’s private admin area with a Microsoft account. Visitors never sign in.
- Your country choice. If you choose a country on the country choice page at umairmanzoor.com or with the region switcher in the footer, a cookie remembers it. The cookie policy explains this.
- Enquiries through our form. If you send the enquiry form, we keep what you enter: your name, email address, phone number if given, where you’re based, what you’re interested in, your message, and any other details the form asks for, such as your company, revenue, timeline or how you heard of us. We also keep the page and any campaign link that brought you to the form, your browser type and a scrambled (hashed) form of your IP address, never the address itself. Your email address and phone number are stored encrypted. We use them to reply to you and to keep a record of the enquiry. We email you a confirmation through Microsoft 365. A security check by Cloudflare Turnstile helps stop automated spam. We keep enquiries that don’t lead to an engagement for 24 months after our last contact, and spam for 30 days. If you tick the reminders and updates box, we keep a record of that consent for 3 years after you unsubscribe.
- Deadline reminders and occasional tax updates by email, if you ask for them. If you tick the reminders and updates box on our enquiry or booking form, or sign up on our Tax deadlines page, we keep your email address, the wording you agreed to and when you agreed, and send you an email about once a month listing the tax deadlines due in the next 45 days, and occasional tax updates. Every email has an unsubscribe link, and unsubscribing takes effect at once.
- Calls you book. If you book a call on the site, we keep your name, email address, phone number if given, your notes and your time zone as part of your enquiry, with your email address and phone number encrypted. We set up the call in our Microsoft 365 calendar with a Microsoft Teams link, and email you a confirmation, reminders and a link to reschedule or cancel. If you lose that email, Find my booking sends the link again, only to the address on the booking. A booking is kept with your enquiry, on the same timetable.
- Privacy requests. If you use our privacy request form, we keep the type of request, your email address, your name and details if you give them, and a scrambled (hashed) form of your IP address, never the address itself, with your address, name and details encrypted. We email you a link to confirm the request comes from you. We delete a request you never confirm after 30 days, and keep a request we have answered for 3 years after we close it, as a record of our answer.
The site does not run advertising or social media tags, a chat widget, embedded maps or videos, or an error-monitoring service. It uses Google Analytics as the cookie policy describes, and only as your choices allow. Besides Google Analytics, one thing from another company loads, and only on the pages with our enquiry and booking forms, including Find my booking, and on our Tax deadlines page, which has a sign-up box: Cloudflare Turnstile, a security check that helps stop automated spam. It runs in its own frame, may store what it needs for that check in your browser, and does not see what you type into the form. Everything else, including the fonts and images, is served from this site. Links to other websites, such as WhatsApp or the FBR, load nothing until you click them.
We do not sell personal information and we do not share it for advertising. We pass it to the service providers listed below, to others only with your authority, or where a legal or professional duty requires it. We do not use automated decision-making.
The law in Pakistan
When this policy was last updated, Pakistan had no general data protection law in force. A Personal Data Protection Bill has been drafted but has not been enacted.
The Prevention of Electronic Crimes Act 2016 (as amended in 2025) sets out offences of unauthorised access to information systems and data, and related offences. The measures under “How we protect it” are there to prevent such access to this site.
The firm keeps client information confidential, as the ICAP Code of Ethics requires, and does not disclose it without the client’s authority unless a legal or professional duty requires it.
Although no data protection law requires it, the site follows these principles:
- Purpose: information is used only for the reason it was given.
- Minimum: the site collects only what it needs to work and to reply to you.
- Consent: nothing optional is collected or stored without telling you first.
If a data protection law is enacted in Pakistan, we will update this policy to follow it.
Consent and your choices
The “Cookie settings” link at the foot of every page opens a panel where you can switch analytics on or off at any time. Where the law of the place you are visiting from requires your consent first, it stays off until you agree. If we add advertising, we will update this policy and the cookie policy before it is switched on.
The same applies to any other new feature: this policy will be updated before it goes live.
Where your information is held
The site and its database are hosted outside Pakistan, in the United States. These are the service providers that handle information for us:
| Provider | Purpose | Information | Location |
|---|---|---|---|
| Render Services, Inc. | Hosting the site and its database | Technical request information in operating logs; everything the site stores | United States (Ohio) |
| Microsoft Corporation (Microsoft Entra ID) | Staff sign-in to the private admin area | Staff sign-in identities only; no visitor information | Microsoft’s cloud. Ask us for the region. |
| Microsoft Corporation (Microsoft 365) | Our business email: receiving the email you send us, sending the confirmation, reminder and update emails, and our own notice of your enquiry; our calendar, where a call you book is set up with a Microsoft Teams link | Your name, email address and what you send us | Set by Microsoft for the firm’s account |
| Cloudflare, Inc. (network and security) | Delivers and protects every page of the site; tells the site the country a visit comes from | The technical request information: IP address, the page asked for, browser and device | United States and Cloudflare’s worldwide network |
| Cloudflare, Inc. (Turnstile) | A security check on the pages with our enquiry and booking forms, including Find my booking | Technical signals from your browser during the check, not what you type | United States |
| Google LLC (Google Analytics) | Counting visits and pages read, only as your cookie choices allow | An identifier stored in your browser, the pages you visit, your browser and approximate location | Global |
Every visit to umairmanzoor.com passes through the network of Cloudflare, Inc., which delivers and protects the site for the firm and for our hosting provider, Render. Cloudflare handles the technical request information (your IP address, the page you asked for, your browser and device). It also tells the site which country you are visiting from. We use that only to decide whether analytics runs before you make a choice, as our cookie policy explains. It is kept with the record of your cookie choice, never with your IP address. Apart from this, the Turnstile security check described above, and the site’s images, which are stored with Cloudflare R2, the site itself sends no information to Cloudflare.
If you choose to contact us on WhatsApp, your messages are handled by WhatsApp (Meta) under its own terms and privacy policy.
How we protect it
- The site is served over an encrypted connection (HTTPS) by our hosting provider.
- Only authorised staff can reach the admin area, by signing in with a Microsoft account. A staff session ends after 30 minutes without activity, and after 12 hours in any case.
- Where the site records an IP address, for staff sign-in or with a form you send, it stores only a scrambled (hashed) form, never the address itself.
- The enquiry and booking forms refuse tax identification, card and bank account numbers, and store your email address and phone number encrypted.
How long we keep it
| Information | Kept for |
|---|---|
| Emails you send us | As long as we need them to deal with your enquiry and any work that follows, and as long as the law or our professional rules require |
| A CV or application you send us | As long as we need it to consider you for a role. You can ask us to delete it at any time. |
| Hosting operating logs | For the period our hosting provider, Render, sets |
| Visit counts made without cookies (no IP address, nothing that identifies you) | 14 months, then deleted |
| The region_pref cookie | 12 months, in your browser, unless you delete it sooner |
| A record of your cookie choice (consent ID, the choice, the policy version, the date, your browser type, whether your browser sent a Global Privacy Control signal and, where known, the country and province you visited from, never your IP address) | 3 years after it expires or you withdraw it |
| Enquiries sent through the form that do not lead to an engagement | 24 months after our last contact with you |
| Enquiries that lead to an engagement | 90 days after the engagement starts, then kept only in our client records |
| Form submissions marked as spam | 30 days |
| A record of your consent to deadline reminders and occasional tax updates | 3 years after you unsubscribe |
| A call you book through the site | With your enquiry, on the same timetable |
| A privacy request you never confirmed | 30 days |
| A privacy request we have answered | 3 years after we close it |
Asking about your information
You can ask us what personal information we hold about you, ask us to correct it or ask us to delete it. Use our privacy request form, or email hello@umairmanzoor.com, with your request.
We may ask you to confirm your identity before we act, and we will tell you what we have done.
Children
The site and our services are not directed at children, and we do not knowingly collect personal information from children.
Changes to this policy
When the site changes what it collects or how, we update this policy before the change goes live and change the date at the top of the page.
Version history
- Version 1.0, effective . First published version.