Flux Pay operates its transaction event bus, multi-rail gateway aggregation, high-speed webhook relays, and double-entry ledger state machines in formal technical partnership with Volzix Technologies (volzix.io). Core infrastructure operates under rigorous ISO/SOC-2 security paradigms, zero fund custody, and hardened Pakistani banking switch interfaces.
Bank-Grade Encryption: All merchant credentials, webhook signing secrets, and bank tokens are encrypted via AES-256-GCM with TLS 1.3 enforced in transit.
Zero Credential Retention: Consumer wallet MPINs, OTP codes, and banking passwords are never stored on Flux servers—authentication occurs directly on banking switches.
Strict Purpose Limitation: Financial telemetry is processed solely for payment switching, fraud scoring, dispute arbitration, and statutory compliance.
Statutory Data Protection: Financial transaction ledgers and KYC verification records are securely preserved in accordance with Pakistani cyber and tax regulations.
1.0
Preamble, PECA Scope & Commitment
1.1 Corporate Entity, Scope & Applicability
Flux Pay (Private) Limited ("Flux Pay", "Flux", "we", "us", or "our") is a private limited company incorporated under the laws of the Islamic Republic of Pakistan. We are dedicated to safeguarding the privacy and financial information of registered merchants, authorized merchant representatives, integration developers, and consumers interacting with Flux hosted checkouts.
1.2 Legal Compliance Framework
Our data processing practices are governed by the Prevention of Electronic Crimes Act, 2016 (PECA), the Payment Systems and Electronic Fund Transfers Act, 2007, and internationally recognized information security benchmarks.
2.0
Information We Collect & Ingest
2.1 Merchant Identity & Corporate Verification Data
During merchant registration and KYC submission, we collect:
Representative Identification: Full legal name, Computerized National Identity Card (CNIC) or NICOP number, photograph, biometric/NADRA verification proofs, registered mobile contact numbers, and corporate email addresses.
Corporate & Tax Credentials: Business name, trade registration or partnership deed, FBR National Tax Number (NTN) certificate, and registered commercial address.
Settlement Banking Information: Bank name, Branch code, Account title, and International Bank Account Number (IBAN).
2.2 Transaction Telemetry & Customer Checkout Data
When a buyer initiates a checkout through Flux hosted checkout or API:
Payer telephone number and wallet identity (JazzCash, Easypaisa, or Raast Alias);
Transaction metadata: amount, currency (PKR), order reference number, and merchant identifier;
Device telemetry: IP address, user-agent string, device fingerprint, and checkout session timestamps.
3.0
Role of Official Infrastructure Partner: Volzix Technologies (volzix.io)
3.1 Telemetry Routing & Data Security
In technical partnership with Volzix Technologies (volzix.io), real-time transaction event routing, multi-rail gateway aggregation, and webhook dispatch are executed across hardened cloud nodes.
3.2 Data Segregation & Protection
Volzix Technologies operates strictly under a Data Processing Agreement adhering to strict confidentiality. Telemetry transmitted through Volzix routing layers is encrypted via AES-256-GCM and TLS 1.3. Volzix Technologies has zero rights to sell, monetize, or disclose merchant records to any external entity.
4.0
Purposes of Data Processing
We process collected data exclusively for the following lawful and regulated business objectives:
Checkout Execution: Generating hosted checkout sessions, verifying payer authorization with upstream wallet switches, and executing double-entry ledger settlement.
Disbursement Automation: Authorizing and clearing automated bank transfers via SBP Raast and 1Link rails.
Compliance & Tax Integrity: Fulfilling mandatory obligations under Pakistani tax reporting, fraud prevention standards, and anti-money laundering guidelines.
5.0
Cryptographic Security & System Safeguards
5.1 Encryption at Rest and in Transit
Sensitive merchant secrets, including upstream payment gateway signing certificates, webhook HMAC keys, and payout API tokens, are stored utilizing AES-256-GCM authenticated encryption with separate cryptographic key rotation schedules. All data transmitted between browsers, merchant webservers, Flux Pay, and Volzix.io relays is strictly enforced via Transport Layer Security (TLS 1.3).
5.2 Role-Based Access Controls (RBAC)
Internal access to merchant KYC documents and raw banking records is restricted to compliance officers with verified multi-factor authentication (MFA) and is continuously recorded in immutable audit logs.
6.0
Authorized Disclosures & Third-Party Sharing
6.1 Upstream Payment Switches
To process checkouts, payment requests are routed directly to licensed upstream operators: JazzCash (Mobilink Microfinance Bank Limited), Easypaisa (Telenor Microfinance Bank Limited), and 1Link (Raast interbank switches). These institutions process payment requests under their respective SBP banking licenses.
6.2 Legal & Regulatory Authorities
Flux Pay may disclose merchant or transaction data when formally compelled by a lawful order of a Pakistani court of competent jurisdiction, the State Bank of Pakistan, the Federal Investigation Agency (FIA under PECA 2016), or the National Accountability Bureau (NAB).
7.0
Statutory Data Retention Schedules
Under applicable Pakistani commercial guidelines and tax regulations, financial transaction data must be preserved for statutory audit periods. We adhere to the following retention schedules:
Data Classification
Mandatory Retention Period
Statutory Authority
Disposal Protocol
Financial Ledgers & Payments
10 Years from transaction date
FBR Sales Tax Rules & Commercial Code
Permanent cold archive encryption
KYC & Identity Documents
5 Years post account termination
Anti-Money Laundering Act, 2010
Cryptographic purge from active disks
API Logs & Webhook Receipts
90 Days
Operational Security Policy
Automated rolling purge
Live Chat & Support Inquiries
12 Months
Consumer Protection Guidelines
Encrypted database purge
8.0
Merchant Data Rights & Management
Merchants may inspect their registered corporate data, download CSV/PDF transaction ledgers, and request updates to banking details via the Flux Merchant Dashboard. In compliance with SBP mandatory record-keeping laws, requests for immediate erasure cannot apply to completed financial transaction records or ledger accounting entries required for statutory audits.
9.0
Cookies, Session Storage & Telemetry
Flux utilizes strictly necessary session cookies and browser local storage to maintain authenticated merchant sessions, enforce CSRF protection tokens, and preserve real-time live support widget state. We do not deploy third-party behavioral advertising trackers.
10.0
Data Protection Officer (DPO) & Regulatory Inquiries
For questions regarding this Privacy Policy, data access requests, or regulatory compliance disclosures, merchants may contact our dedicated Compliance & Privacy Office:
Compliance & Privacy Desk
Email: legal@gofluxpay.com | compliance@gofluxpay.com Support Desk:Official Flux Merchant Help Center Physical Inquiries: Flux Payment Technologies, Compliance Directorate, Karachi, Islamic Republic of Pakistan.
LEGAL & COMPLIANCE DESK
Questions Regarding Platform Policies?
Our dedicated Legal & Compliance Directorate is available to assist merchants with KYC documentation, corporate onboarding queries, and regulatory disclosures.
