Data Processing Agreement

1. Purpose

This Data Processing Agreement (DPA) forms part of the contractual relationship between you (the “Customer”) and Smart Energy Marketplace (“Smart Energy”, “we”, or “us”) for use of smartenergy.pk and related platform features. It describes how personal data is processed when we provide marketplace hosting, account, listing, enquiry routing, and related services.

This DPA should be read together with our Privacy Policy and Terms of Service.

2. Roles of the parties

• Independent controller. For account registration, platform security, analytics, and our own marketing (where opted in), Smart Energy generally acts as an independent controller.
• Processor for seller tools. When a seller uses platform tools to receive buyer enquiries, manage leads, or store customer contact details provided through the marketplace, Smart Energy processes that personal data on the seller’s documented instructions as a processor, to the extent applicable.
• Sellers as controllers. Sellers remain responsible for their own customer relationships, follow-up communications, and any further processing after receiving an enquiry.

3. Scope of processing

Subject matter and duration:

• Provision of marketplace software services and related support.
• Processing continues for the life of the Customer account and for any retention period required afterward.

Nature and purpose:

• Hosting and displaying listings; routing quotes and contact requests; enabling messaging and order-related workflows where available.
• Security monitoring, backup, and troubleshooting required to run the service.

Categories of data subjects may include buyers, enquirers, seller staff, and website visitors.

Types of personal data may include names, phone numbers, email addresses, city/area, enquiry content, and technical logs.

4. Customer instructions

Where Smart Energy acts as processor, we will process personal data only on documented instructions from the Customer, including those given through the platform interface, unless law requires otherwise. The Customer warrants that instructions are lawful and that it has a valid basis to collect and share personal data with Smart Energy and (where applicable) other marketplace participants.

5. Confidentiality and security

We restrict access to personal data to personnel and subprocessors who need it to deliver the service, and we require appropriate confidentiality commitments. We implement reasonable technical and organisational measures appropriate to the risk, including access controls, secure hosting practices, and monitoring for misuse.

6. Subprocessors

The Customer authorises Smart Energy to engage subprocessors (for example hosting, email delivery, analytics, or infrastructure providers) to support the platform. We remain responsible for subprocessors’ performance insofar as they process personal data for us. We will update this page or notify Customers of material subprocessor changes where reasonably practicable.

7. International transfers

Personal data may be stored or processed on infrastructure located in Pakistan or abroad, depending on our service providers. Where transfers occur, we take steps appropriate to the risk and applicable law to protect the data.

8. Assistance with data subject requests

Taking into account the nature of processing, we will provide reasonable assistance to Customers responding to access, correction, or deletion requests relating to personal data processed via the platform. Buyers and other individuals may also contact Smart Energy directly as described in the Privacy Policy.

9. Breach notification

If we become aware of a personal data breach affecting Customer personal data we process as processor, we will notify the Customer without undue delay and provide information reasonably available to us to help the Customer assess the incident and meet any legal notification duties.

10. Return and deletion

On account closure or written request, and subject to legal retention requirements and backup cycles, we will delete or return Customer personal data processed as processor, or anonymise it where deletion is not reasonably practicable.

11. Audits

Upon reasonable written request, and subject to confidentiality and operational constraints, we will provide information necessary to demonstrate compliance with this DPA, preferably through existing documentation rather than disruptive on-site audits.

12. Liability and governing law

Liability under this DPA is subject to the limitations in the Terms of Service, except where those limitations are prohibited by law. This DPA is governed by the laws of Pakistan. Courts in Faisalabad, Pakistan have jurisdiction unless mandatory consumer or data-protection rules require otherwise.

13. Contact

For DPA questions, contact us via Contact Us or info@smartenergy.pk.

Office: Near Over Head Bridge Nishatabad, Sheikhupura Road, Nishatabad, Faisalabad.