1. Who we are
This policy applies to Golden One and this website. We are a rice milling and trading business based in Karachi, Pakistan. When this policy says "we", "us" or "our", it means Golden One. When it says "you", it means anyone visiting this site, placing an order or contacting us.
We are the data controller for the information described below. Questions about this policy, or about the data we hold on you, go to info@goldenonepvtltd.com.
2. Information we collect
We collect only what we need to sell you rice and answer your questions.
You give us directly
- Account details - your name, email address and a bcrypt hash of your password.
- Contact details - phone number, delivery address, city, province and postal code.
- Order details - the products, quantities and amounts on each order, plus any note you add.
- Messages - anything you write in the contact form, and our replies to it.
- Newsletter - your email address, if you subscribe.
Collected automatically
- Session cookie - a single cookie that keeps you signed in and remembers your cart. See our cookie policy.
- Server logs - IP address, browser user agent, requested page and timestamp, written by the web server.
What we never collect
We do not take card numbers. Payment is by cash on delivery or bank transfer, so no card data ever reaches this site. We do not collect national identity numbers, date of birth, or any special-category data such as health or religious information.
3. How we use your information
| Purpose | Data used | Basis |
|---|---|---|
| Fulfilling and delivering your order | Name, phone, address, order lines | Performance of a contract |
| Confirming an order by phone | Name, phone | Performance of a contract |
| Answering your message | Name, email, phone, message | Legitimate interest |
| Keeping you signed in | Session cookie | Strictly necessary |
| Newsletter | Email address | Your consent |
| Fraud prevention and security | Server logs | Legitimate interest |
| Accounting and tax records | Order and invoice data | Legal obligation |
We do not use your data for automated decision-making or profiling, and we do not build advertising audiences from it.
4. Who we share it with
We do not sell your personal data. Not to anyone, for any price.
We share the minimum necessary with:
- Courier partners - your name, address and phone number, so they can deliver the parcel. Nothing else.
- Our hosting provider - which stores the database and server logs on our behalf under contract.
- Our bank - for bank-transfer orders, the payment reference you quote.
- Authorities - only where we are legally required to, and only what is required.
Courier partners act as independent controllers for the delivery itself and have their own privacy terms. Everyone else acts as our processor.
5. How long we keep it
- Account data - until you ask us to delete the account.
- Order records - seven years from the order date, because tax law requires it. This applies even after an account is deleted; the order is detached from the account but the transaction record remains.
- Contact messages - two years from the last reply.
- Newsletter subscription - until you unsubscribe.
- Server logs - 90 days.
- Session cookie - deleted when you close the browser.
6. How we protect it
- Passwords are stored as bcrypt hashes. Nobody at Golden One can read your password, including us.
- All database access goes through parameterised queries, so submitted text cannot be executed as a command.
- Forms that change data are protected against cross-site request forgery.
- Session cookies are HTTP-only and same-site, and are marked secure over HTTPS.
- Admin access is limited to named accounts with individual credentials and a login rate limit.
No system is perfectly secure. If a breach ever affects your data, we will tell you and the relevant authority promptly, with what happened and what to do about it.
7. Your rights
You can ask us at any time to:
- Access - get a copy of the data we hold on you.
- Correct - fix anything inaccurate. Most of it you can edit yourself under My Account.
- Delete - remove your account and personal data, subject to the seven-year record-keeping requirement on completed orders.
- Restrict or object - stop us using your data for a particular purpose.
- Withdraw consent - unsubscribe from the newsletter, with no effect on your ability to order.
- Port - receive your data in a structured, machine-readable format.
Email info@goldenonepvtltd.com from the address on your account. We respond within 30 days and never charge for a request.
8. Children
This site is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has given us personal information, tell us and we will delete it.
9. International transfers
Our servers are located in Pakistan. If we ever move hosting to a provider outside Pakistan, we will update this policy first and ensure the transfer is covered by appropriate contractual safeguards.
10. Changes to this policy
When we change this policy we update the review date at the top of the page. If a change materially affects how we use data you have already given us, we will place a notice on the site and, where we hold your email address and the change is significant, email you before it takes effect.
Questions about this policy
Write to info@goldenonepvtltd.com or call +92 311 3578558. Postal address: 32JP+34M, Karachi Northern Bypass, Gadap Town, Karachi, Pakistan.