IMPORTANT NOTICE ON REGULATORY DATA PROCESSING & PRIVACY

This Privacy Policy ("Policy") describes the policies and practices of CLOUD ERP 360 (PRIVATE) LIMITED ("Company", "Licensor", "we", "us", or "our") regarding the collection, processing, storage, transmission, and protection of corporate, personal, and transactional compliance data obtained through the DI-FBR platform, including: (a) The Flutter Windows Desktop Client (64-bit native executable); (b) The Flutter Android Mobile and Tablet POS application; (c) The Flutter iOS Mobile and iPad application; (d) The Flutter Web Application and Progressive Web App (PWA); and (e) The Laravel Enterprise Web Management Portal, RESTful APIs, and Cloud Database synchronization services. By accessing, configuring, or using DI-FBR, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy.

STATUTORY ROLES: DATA CONTROLLER VS. DATA PROCESSOR

1.1 Clarification of Legal Roles: Under national data privacy standards and applicable tax statutes: (a) The Subscriber Business Entity ("Licensee", "Business", "you") acts as the Data Controller with respect to all customer records, buyer tax identifiers (NTN/CNIC/STRN), item master catalogs, sales transactions, purchase invoices, and ledger entries entered into the software. (b) CLOUD ERP 360 (PRIVATE) LIMITED acts solely as a technological Data Processor and transmission conduit for formatting, validating, and submitting tax data to authorized government revenue bodies. 1.2 Taxpayer Legal Responsibility: You are legally responsible for obtaining all necessary consents and authorizations from your commercial counterparties, buyers, and employees prior to inputting their personal or fiscal data into the system.

CATEGORIES OF INFORMATION WE COLLECT

2.1 Business Registration & Tax Identification Data: - Business legal name, trade name, commercial address, and business phone number. - Official National Tax Number (NTN), Sales Tax Registration Number (STRN), and Computerized National Identity Card (CNIC) of business owners, partners, or corporate directors. - Government fiscal credentials: FBR PRAL POS ID, Bearer Tokens, API keys, digital encryption keys, and provincial revenue authority credentials (PRA, SRB, KPRA, BRA). 2.2 User Profile & Role-Based Access Credentials: - User names, login email addresses, mobile numbers, system roles (e.g., Administrator, Cashier, Accountant, Operator), and encrypted authentication passwords. 2.3 Transactional & Invoicing Compliance Data: - Complete invoice details: Invoice Number, Fiscal Invoice Reference Number (IRN / FBR Invoice Number), date, time, buyer information (Name, NTN/CNIC/STRN, Address, Province). - Itemized line entries: HS Codes (Harmonized System), Unit of Measure (UOM), product descriptions, quantity, unit value, sales tax rate, further tax, extra tax, withholding tax, and total value. 2.4 System Telemetry, Hardware & Audit Logs: - Network IP addresses, MAC addresses, device identifiers, operating system versions, browser types, session timestamps, and diagnostic event logs. - Real-time cryptographic transmission logs of all submissions made to FBR PRAL and provincial fiscal gateways.

PURPOSE & LEGAL BASIS FOR PROCESSING

3.1 Mandatory Regulatory Compliance: Processing is conducted to fulfill statutory legal obligations imposed by: - Sales Tax Act, 1990 (specifically Section 50A and Chapter XIV-AA Digital Invoicing Rules); - Income Tax Ordinance, 2001 (Sections 236G and 236H); - Provincial Sales Tax on Services Acts (PRA, SRB, KPRA, BRA); - Prevention of Electronic Crimes Act, 2016 (PECA). 3.2 Operational Execution: - Processing real-time electronic invoices and generating verified QR codes with statutory FBR IRN numbers. - Synchronizing transaction pipelines with offline local storage engines to ensure business continuity during network outages. - Auditing and monitoring platform integrity to prevent fraudulent tax manipulation or flying invoices. - Providing customer support, debugging hardware peripheral connectivity (ESC/POS thermal printers, barcode scanners), and delivering critical security updates.

DATA TRANSMISSION TO STATUTORY AUTHORITIES

4.1 Automatic Transmission to Revenue Gateways: When an invoice is finalized or submitted in DI-FBR, the application automatically formats the payload and transmits it directly to the designated official server of the Federal Board of Revenue (PRAL) or relevant provincial revenue board. 4.2 Government Audit Invariant: Once an invoice is registered with FBR PRAL, it receives a statutory cryptographic Fiscal Invoice Number (IRN). Neither the Company nor the Subscriber can unilaterally delete or purge registered fiscal records from government repositories. Any post-submission adjustments must strictly be executed through statutory Credit Notes or Debit Notes under Sales Tax Rules.

DATA SECURITY, CRYPTOGRAPHY & TENANT ISOLATION

5.1 Encryption Standards: - Data in transit is secured using modern TLS 1.3 / SSL 256-bit encryption protocols. - Sensitive fiscal integration credentials (API tokens, private keys) are encrypted at rest using AES-256 envelope encryption. 5.2 Multi-Tenant Logical Isolation: - Each business subscriber operates within an isolated tenant partition, preventing cross-tenant access, unauthorized querying, or inadvertent exposure of corporate financial records. 5.3 Local POS Storage Protection: - For desktop and mobile POS terminals, offline caching is stored in local encrypted databases (SQLite/Hive). The Licensee is responsible for implementing workstation physical security, operating system passcodes, and restricting terminal access to authorized personnel.

STATUTORY SEVEN (7) YEAR DATA RETENTION MANDATE

6.1 Mandatory Statutory Retention: In strict accordance with Section 22 of the Sales Tax Act, 1990 and related corporate laws of Pakistan, all sales tax records, digital invoices, credit/debit notes, and transmission audit logs must be maintained for a mandatory minimum period of seven (7) years. 6.2 Post-Subscription Invariant: In the event of subscription lapse, account deactivation, or termination, the historical fiscal transmission records remain archived in cold storage for the statutory 7-year audit requirement to satisfy official FBR or provincial regulatory inquiries.

USER RIGHTS & LIMITATIONS UNDER TAX LAW

7.1 Access and Rectification: Subscribers have the right to review their profile details, view historical invoice registers, and export standard ledger reports. 7.2 Limitations on Right to Erasure: Because tax law mandates permanent retention of fiscal invoices and audit logs, the right to erasure does not apply to transactional records, tax invoices, buyer NTN logs, or FBR transmission payloads that have been submitted to government authorities.

THIRD-PARTY DISCLOSURES & RESTRICTIONS

8.1 Zero Commercial Sale of Data: We strictly never sell, rent, monetize, or trade your corporate, personal, or transactional data to advertisers or commercial third parties. 8.2 Essential Infrastructure Providers: We engage only trusted enterprise infrastructure providers (such as ISO-certified cloud data centers and SMS notification gateways) bound by non-disclosure and security agreements. 8.3 Law Enforcement Compliance: We may disclose data when strictly required by a court order, statutory subpoena, or authorized notice from the Directorate General of Intelligence & Investigation (I&I-IR) or Federal Investigation Agency (FIA).

POLICY UPDATES & AMENDMENTS

9.1 Continuous Regulatory Alignment: We may update this Privacy Policy from time to time to maintain strict parity with emerging FBR statutory amendments, SRO notifications, or provincial tax directives. 9.2 Notification: Any material updates will be published on the platform, reflected with an updated "Last Modified" date, and accompanied by in-app notices where appropriate.

DATA PROTECTION OFFICER & PRIVACY CONTACT

For questions, regulatory inquiries, or data protection concerns, contact our designated privacy department: CLOUD ERP 360 (PRIVATE) LIMITED Legal, Regulatory & Data Protection Compliance Cell Email: privacy@difbr.pk Support: support@difbr.pk Phone: +92 305 9633360 Official Website: https://difbr.pk/privacy

Privacy Inquiries & Data Protection Officer

If you have any questions about this Privacy Policy, FBR PRAL data processor status, or wish to exercise your data rights, please contact our Legal & Privacy team.

Email: privacy@difbr.pk Tel: 0305-9633360

DI-FBR ENTERPRISE PRIVACY POLICY & STATUTORY DATA PROTECTION STATEMENT