P2PClouds (Pvt.) Ltd. (“P2PClouds,” “we,” “us,” or “our”) operates the P2P LMS platform (“Service”). This Privacy Notice explains how we collect, use, share, and protect personal information when you use our Service. It also describes your rights regarding that information.

By using the Service, you agree to the collection and use of information as described in this Privacy Notice. If you disagree, please discontinue use of the Service.

1. Data Controller

The data controller responsible for your personal data is:

2. Information We Collect

2.1 Information You Provide Directly

• Account data: Name, email address, phone number, and password when you register for an account.
• Organisation data: Institution name, address, logo, and contact information provided during onboarding.
• Student and staff records: Names, dates of birth, CNIC/B-Form numbers, guardian contact details, academic records, and attendance data entered by administrators.
• Payment information: Billing address and transaction identifiers. Full card details are never stored by us — they are handled directly by our authorized payment provider.
• Communications: Messages and attachments you send to our support team.

2.2 Information Collected Automatically

• Log data: IP address, browser type and version, pages visited, time and date of visits, and referring URLs.
• Device data: Device type, operating system, and screen resolution.
• Usage data: Features used, actions performed, and session duration.
• Cookies and similar technologies: See Section 7 below.

2.3 Information from Third Parties

• Google Sign-In: If you authenticate via Google, we receive your name, email address, and profile picture from Google.
• Payment provider: Our payment provider shares transaction IDs, subscription status, and billing country for subscription management purposes.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Process subscription payments and manage billing.
• Communicate with you about your account, subscription, updates, and support requests.
• Personalise and improve the Service.
• Monitor usage to detect, prevent, and address technical issues, fraud, and abuse.
• Comply with legal obligations.
• Send you transactional emails (invoices, password resets, notifications). We do not send unsolicited marketing emails without your consent.

4. Legal Basis for Processing (GDPR)

Where applicable under the General Data Protection Regulation (GDPR) or similar laws, we process your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Service you subscribed to.
• Legitimate interests: Improving the Service, detecting fraud, and ensuring security — where these interests are not overridden by your rights.
• Legal obligation: Complying with applicable laws and regulations.
• Consent: Where you have given explicit consent (e.g., optional analytics or marketing communications).

5. Sharing and Disclosure of Information

We do not sell, rent, or trade your personal data. We share data only in the following circumstances:

• Service providers: We engage trusted third-party providers to operate parts of the Service (e.g., Firebase for authentication and data storage, our payment provider for billing, Google for analytics). These providers are bound by data processing agreements and are not permitted to use your data for any other purpose.
• Legal requirements: When required by law, court order, or governmental authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of the transaction, subject to equivalent privacy protections.
• With your consent: For any other purpose, with your explicit prior consent.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Upon account deletion or subscription cancellation, we will delete or anonymise your personal data within 90 days, unless retention is required by law (e.g., financial and tax records may be retained for up to 7 years as required by applicable legislation).

7. Cookies

We use cookies and similar technologies to authenticate sessions, remember your preferences, and analyse usage patterns. The types of cookies we use include:

• Strictly necessary cookies: Required for the Service to function (e.g., authentication tokens). These cannot be disabled.
• Functional cookies: Remember your settings (e.g., dark mode, language).
• Analytics cookies: Help us understand how users interact with the Service (e.g., Google Analytics). You may opt out of analytics cookies.

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Service.

8. Data Security

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit (TLS/HTTPS) and at rest (Firebase encryption).
• Access controls and role-based permissions.
• Regular security reviews and monitoring.
• Payment card data handled exclusively by our payment provider — we never store card numbers or CVVs.

Despite these measures, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security and disclaim liability for breaches outside our reasonable control.

9. International Data Transfers

Our infrastructure relies on services (Firebase, Google Cloud, and our payment provider) that may store or process data in countries outside Pakistan, including the United States and the European Economic Area. Where such transfers occur, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses or adequacy decisions).

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (“right to be forgotten”), subject to legal retention requirements.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at info@p2pclouds.net. We will respond within 30 days.

11. Children's Privacy

The Service is intended to be operated by educational institutions on behalf of their students. If student data includes minors (under 18), the subscribing institution is responsible for obtaining appropriate consents from parents or guardians in accordance with applicable law. We do not knowingly collect personal data from children directly without appropriate institutional authorisation.

12. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies before providing any personal data.

13. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. We will notify you of significant changes by email or by displaying a prominent notice within the Service at least 14 days before changes take effect. The “Last updated” date at the top reflects the most recent revision.

14. Contact and Complaints

For any privacy-related questions, requests, or complaints, contact our Data Protection point of contact:

If you are based in the European Economic Area and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection authority.