Privacy Policy

This Privacy Policy explains how GB Innovators ("GB Innovators", "we", "us" or "our") handles personal information in connection with gbinnovators.com (the "Corporate Website"), our GBI Invoicing software available through invoicing.gbinnovators.com (the "Invoicing Platform"), and related demonstrations, customer support and business communications (together, the "Services"). We believe businesses should be able to understand what information is used, why it is necessary, and what choices and protections apply.

This document covers our corporate services and the Invoicing Platform. Businesses using GBI Invoicing remain responsible for the accuracy, legality and appropriateness of the information they enter, including customer and tax-invoice data. Processing of that information may also be governed by a separately agreed service or data-processing agreement.

1. Who we are and how to contact us

GB Innovators provides business software development, SaaS products, business process automation and related technology services. For privacy requests, account-related enquiries or questions about this notice, contact us at adnan@gbinnovators.com or via our contact page. Our published office address is Office No. 602, 6th Floor, Makkah Tower, Adamjee Road, Saddar, Rawalpindi, Pakistan.

When communicating about data belonging to an organisation's invoicing account, please identify your organisation and your role. We may need to verify authority before disclosing, correcting, exporting or deleting account information.

2. Scope and our role

For visits to the Corporate Website, enquiries, demonstrations and our direct customer relationships, GB Innovators generally determines why and how relevant contact and account information is handled. For customer, buyer, product, invoice and related records uploaded by a business into GBI Invoicing, that business generally determines the purposes of processing, and GB Innovators operates the technology on its instructions, subject to applicable law, agreed terms and technical constraints.

This notice does not govern third-party websites, banks, telecommunications services or Federal Board of Revenue (FBR) systems, which have their own rules and privacy practices. An organisation may issue a separate privacy notice to its customers and staff covering information it enters into GBI Invoicing.

3. Information collected on the Corporate Website

When you submit an enquiry, request a demonstration or discuss a software project, we may collect your name, company or organisation, business address, country, preferred contact details, selected service, project type, indicative budget, business requirements, messages and any material you voluntarily provide. We also handle communications, proposal discussions, requests for support and related correspondence.

Our web infrastructure may automatically receive technical data such as IP address, browser and device information, access time, pages requested, security events and diagnostic logs needed to deliver and protect the website. We do not ask you to include passwords, sensitive personal records, payment-card information or third-party confidential material in general enquiry forms.

4. Business and account information in GBI Invoicing

Depending on your subscribed features and configuration, the Invoicing Platform may process business and authorised-user details including names, contact details, organisation addresses, tax registration identifiers such as NTN or STRN, registration status, account permissions, sign-in records, authentication or verification events, business branding and company logo files, and profile settings.

For companies, consultants and delegated users, access information may include organisations under management, approved permissions, invited users and actions performed within the relevant business workspace. Authentication controls may involve one-time verification codes, trusted-device checks or other security signals as configured.

5. Customers, products, invoices and financial records

To provide invoicing features, the platform may process buyer and supplier contact details, organisation names, addresses, NTN/STRN or other tax identifiers, product/service descriptions, HS codes, units of measurement, prices, quantities, tax rates, exemptions or applicable references, invoice numbers and dates, totals, invoice status, generated documents, payment-status entries and related history.

The Services may also record invoice validation outcomes, errors, submission attempts, regulatory response details, QR or verification information where available, and actions performed by authorised users. This material can include commercially confidential business information. Users should only enter information they are authorised to hold and use, and should avoid unnecessary personal details in description or notes fields.

6. FBR connectivity and regulatory information

Where an organisation has enabled and properly configured an applicable FBR digital-invoicing workflow, information required for invoice validation or submission may be transmitted to FBR systems, relevant integration services or an authorised/licensed integrator as applicable. Such information can include seller and buyer tax identifiers, invoice lines, amounts, tax classifications and information necessary to receive an acknowledgement or regulatory validation response.

FBR submission is not performed simply because a user saves a draft invoice. Submission depends on the workflow, account permissions, integration status and user action or configuration. The receiving regulatory service determines whether a submission is accepted; GB Innovators does not control FBR's independent processing, retention, availability, notices or decisions. An FBR identifier or QR-based verification should be treated as valid only when generated from a successful applicable response.

7. Payments, packages and billing details

We may process plan selections, package limits, billing periods, invoices, payment references, amounts due or received, discounts, renewal status and associated business contact information to administer subscriptions and provide support. If payment services are introduced or used through a third party, that provider may process relevant payment information under its own notice and applicable security requirements.

We do not represent that the Corporate Website or Invoicing Platform stores complete payment-card numbers. Please do not send card numbers or other sensitive payment credentials through project enquiry forms or general support correspondence.

8. Why we use information

• Provide the Services: create accounts, display workspaces, manage access, issue invoices, generate reports and support configured integrations.
• Process enquiries: assess project requirements, arrange demonstrations, prepare proposals and communicate about requested services.
• Maintain security: authenticate users, detect unauthorised access, investigate abuse, preserve operational logs and protect business data.
• Administer billing: manage subscriptions, payment statuses, reminders, invoices and customer service records.
• Meet obligations: comply with applicable tax, accounting, legal or regulatory requirements, and respond to lawful requests.
• Improve reliability: troubleshoot errors, monitor system performance, review support issues and refine product quality.

We do not use business invoice content for unrelated third-party advertising. Where promotional messages are sent, applicable law and available preferences govern whether they may be delivered and how recipients may opt out.

9. Lawful grounds and business instructions

Where laws require a lawful basis, processing may be necessary to perform a contract, take requested pre-contract steps, meet legal obligations, protect our legitimate interests in service delivery and security, or rely on consent where required. The applicable ground depends on the nature of the information, jurisdiction and particular processing activity.

For data entered by a business in GBI Invoicing, that business is responsible for identifying its own lawful basis, providing any required notices to buyers, employees or other individuals, and giving lawful instructions to those acting on its behalf.

10. Who may receive information

We disclose information only where reasonably necessary for the purposes described above. Recipients may include authorised members of our team; infrastructure, hosting, storage, backup or security providers; customer support and communications services; payment providers if used; professional advisers subject to confidentiality obligations; and FBR or relevant authorised integration services where a regulatory workflow requires it.

Information may also be provided to authorities or other parties where lawfully required, or as needed to protect legal rights, prevent misuse or respond to a legitimate security incident. We do not sell personal information as a business practice. An organisation's authorised users and consultants may access records within the permissions granted by that organisation.

11. Cross-border handling of information

Because cloud infrastructure, support personnel or technology providers may be located in different jurisdictions, information may be accessed or processed outside the country where it was originally collected. When cross-border restrictions apply, we seek to use appropriate contractual, organisational or technical safeguards for the relevant activity. Some transfers may also be necessary to deliver a service requested by the organisation.

Any mandatory local hosting, data-residency or sector-specific restrictions should be raised with us before enabling a service or sharing regulated data so that technical and contractual feasibility can be assessed.

12. Cookies, sessions and similar technologies

The Corporate Website and the Invoicing Platform may use strictly necessary browser storage or cookies for authentication, session continuity, security, CSRF protection, preferences and reliable operation. Such technologies help maintain an active session and protect against unauthorised requests. Cookie availability and retention depend on your browser, security settings and the functionality being used.

If non-essential analytics, advertising technologies or third-party embeds are added, we will review the disclosures and any consent obligations applicable to those tools. Blocking essential cookies may prevent some login and administrative features from working properly. See our Cookie Policy for further general information.

13. Authentication, permissions and activity logs

Access to GBI Invoicing is controlled by account credentials and applicable authentication features. Depending on the role, a user may see only the business workspace and functions authorised for that account. Administrative and account activities may record action type, time, user identifier, device/browser information and IP address to support security, accountability and troubleshooting.

Users must keep credentials and verification codes private, maintain access to approved contact methods, promptly revoke departed staff or consultant access, and report suspected compromise. An organisation is responsible for the invitations and access rights it grants.

14. Security safeguards

We aim to protect information through proportionate controls such as encrypted connections where supported, access restrictions, authenticated sessions, server-side validation, permission checks, logs and operational backup practices. These measures are reviewed as service and risk requirements evolve. Access to information is limited according to legitimate operational need.

No website, network, storage service or transmission method is completely risk-free. We cannot guarantee absolute security. If you believe information has been exposed or an account has been compromised, notify us promptly using the contact details above. We will assess the report and make any notifications required by applicable law or contract.

15. Retention and business records

We retain personal information only for as long as reasonably needed for the relevant service, contract, security, accounting, audit, dispute or legal purpose. Retention varies by category: website enquiries may be kept for follow-up and business records; account and billing details while a customer relationship or lawful recordkeeping need exists; technical logs for proportionate operational/security periods; and invoice or tax records as required by applicable laws and regulatory record-retention obligations.

Deletion or account closure may not immediately remove material from backup cycles, outstanding invoices, regulatory submission systems or records legally required to be preserved. Where practical and lawful, data not required any longer will be deleted or de-identified in accordance with our procedures.

16. Your choices and privacy requests

Depending on applicable law and the nature of the information, you may request access, correction, a copy, deletion, restriction or other available privacy rights. You can also ask us to explain a particular use or stop optional marketing communications. We will review requests, verify the requester's identity or authority, and respond in accordance with legal and contractual requirements. Some requests may be refused or limited where they conflict with another person's rights, lawful retention requirements, security safeguards or an organisation's obligations.

If your information was supplied to GBI Invoicing by one of our customer organisations, please contact that organisation first where appropriate. We may refer the request to the account holder or assist it in fulfilling a valid request, subject to lawful instructions and contractual arrangements.

17. Account closure, exports and deletion

Authorised account holders may request information about available invoice/document exports, account closure and record handling. Data portability or export options depend on the subscribed service, available formats and contractual terms. We may require verification of the business owner or authorised representative before processing a sensitive account request.

Closing an account does not retract invoices already received by a buyer or successfully reported to FBR, and does not cancel independent tax, audit or accounting responsibilities. Customers should retain their own legally required copies and check applicable retention requirements before requesting deletion.

18. Children and sensitive information

The Corporate Website and business invoicing tools are intended for professionals and organisations, not as services directed to children. Do not use the Services to enter children's data or special-category/sensitive personal information unless a legitimate, authorised business requirement exists and the parties have agreed appropriate safeguards. Contact us if you believe a child submitted personal information through a business enquiry form.

19. Third-party sites and integrations

Links to banks, FBR resources, client systems, social networks or other third-party destinations are provided for convenience or functional integration. We cannot control their practices or guarantee their continued availability. Review the receiving provider's privacy and security terms before supplying information. API or data-transfer permissions granted to external services should be managed with the same care as account credentials.

20. Updates to this policy

We may update this Privacy Policy to reflect changes in the Services, infrastructure, legal requirements or operational practices. The revision date shown above indicates the latest published update to this page. For material changes affecting an ongoing customer relationship, we will provide an appropriate notice where required by law or contract. Continued use is subject to the applicable notice and mandatory legal rights.

21. Contact and privacy concerns

To raise a question, make a privacy request, report suspected misuse or discuss information handled on behalf of your organisation, contact adnan@gbinnovators.com or contact GB Innovators. Please describe the concern without sending passwords or unnecessary third-party personal information. We will direct verified account-level requests to the appropriate authorised contact when necessary.