Who we are
This policy is published by Nex Order Support ("Nex", "we", "our", "us"), an order communications service operating from Karachi, Pakistan. We operate WhatsApp Business Platform communications on behalf of e-commerce merchants ("Merchants") who engage us to send transactional and supportive messages to their customers ("End Users").
For data we hold about End Users, we generally act as a processor on behalf of the Merchant, who is the controller. For data we hold about Merchants and direct visitors to this website, we act as the controller. Where these roles differ, this policy explains which one applies.
Data we collect
The categories of personal data we process are limited and listed below.
From End Users on WhatsApp
- WhatsApp phone number (received from the Merchant’s checkout)
- Display name as it appears on the End User’s WhatsApp account
- Order reference, store name, and order metadata supplied by the Merchant
- The content of messages exchanged on the WhatsApp Business Platform
- Delivery and read receipts where available from the Platform
- Opt-in source, opt-in timestamp, and any subsequent opt-out
From Merchants
- Business legal name, registration number, and trading addresses
- Contact name, email, phone number, and role of authorised signatories
- Payment information processed by our payment service provider
- Operational data necessary to integrate Merchant systems with ours
From visitors to this website
- IP address, browser, device, and approximate location for security and analytics
- Referrer URL, pages visited, and timestamps
- Information you provide when contacting us through any channel
We do not knowingly collect special categories of data (health, religion, political views, biometric data) from any End User in the course of providing the service.
Why we use it
End User data is used strictly for the following purposes:
- Sending order confirmations, status updates, and delivery notifications
- Responding to customer enquiries during stated business hours
- Routing escalations to the Merchant’s support team
- Maintaining a consent ledger to demonstrate lawful messaging
- Diagnostic logs to investigate delivery failures and quality issues
- Complying with our obligations under WhatsApp Business Solution Terms
Merchant data is used to operate the commercial relationship: invoicing, contract administration, and provision of the service itself.
Website visitor data is used to keep the site available, secure, and to understand at an aggregate level which content is useful.
Legal basis
Where data protection law (including the EU GDPR, the UK GDPR, and the Personal Data Protection Bill of Pakistan once enacted) requires a lawful basis to process personal data, we rely on:
- Performance of a contract — for transactional messages, support, and delivery alerts that are necessary to fulfil an order the End User has placed.
- Consent — for marketing or promotional template messages, which require an explicit and granular opt-in.
- Legitimate interests — for service improvement, security monitoring, and fraud prevention, balanced against the rights of the individual.
- Legal obligation — where we are required to retain data by law, including tax records.
WhatsApp Business Platform
The service is delivered through the WhatsApp Business Platform, operated by WhatsApp LLC and governed by the WhatsApp Business Solution Terms, the WhatsApp Business Messaging Policy, the WhatsApp Commerce Policy, and the AI-Assisted Business Messaging Guidelines (January 2026). Messages sent and received on the Platform are subject to those terms in addition to this policy.
WhatsApp may collect additional metadata about messages (such as delivery timestamps and quality scores) for the purpose of operating the Platform. WhatsApp’s own privacy practices are described at whatsapp.com/legal/privacy-policy. This policy does not modify or replace WhatsApp’s policies.
We do not access an End User’s WhatsApp account beyond the messages directed to or from the Merchant’s registered business number. We do not read other conversations on the End User’s device. We cannot.
Consent and opt-out
Before any End User receives a Marketing template from us, the Merchant must have collected an explicit opt-in to marketing communications on WhatsApp. That opt-in is recorded in our consent ledger with the source (e.g. checkout page, account settings) and the timestamp.
Transactional and Utility messages tied to an order the End User has placed are sent on the basis of contractual necessity and do not require a separate marketing opt-in.
An End User may withdraw consent or opt out at any time by:
- Replying STOP, UNSUBSCRIBE, or BAND on WhatsApp
- Using the ‘Stop messages’ option in the contact’s WhatsApp profile
- Contacting us via the channels in Clause xv
Opt-outs are honoured immediately and recorded across every Merchant store on the same WhatsApp number. Transactional messages tied to a current open order may continue if necessary to complete that order.
Data retention
We retain personal data only for as long as necessary to provide the service or to satisfy a legal obligation. Specifically:
- Conversation transcripts — 90 days from the last interaction, then deleted.
- Consent ledger entries — for the life of the consent plus 24 months after withdrawal, as evidence of the opt-in’s lawful collection.
- Order metadata — for the duration of our contract with the Merchant; returned or deleted on contract termination.
- Invoicing & tax records — for the period required by applicable tax law, typically 6 years.
- Website logs — 30 days, except for security incidents requiring further investigation.
Deletion is performed by overwriting; backups age out within 35 days and are also overwritten on the standard cycle.
Your rights
Subject to applicable law, an individual whose data we hold may:
- Request access to a copy of the personal data we hold
- Request correction of inaccurate or incomplete data
- Request deletion of personal data (subject to lawful retention)
- Object to processing based on our legitimate interests
- Withdraw consent at any time, without affecting prior lawful processing
- Request portability of data in a structured, machine-readable format
- Lodge a complaint with the relevant data protection authority
We respond to verified requests within 30 days. If we cannot fulfil a request in full, we will explain why. To make a request, see Clause xv.
Security
We use reasonable administrative, technical, and physical safeguards to protect personal data, including:
- Encryption of data in transit (TLS 1.2 or higher) and at rest
- Two-step verification on the WhatsApp Business Account
- Access controls based on the principle of least privilege
- Regular review of system logs for unauthorised access
- Confidentiality obligations for all personnel and sub-processors
- An incident response procedure with notification of affected parties
No system can be guaranteed perfectly secure. In the event of a personal data breach we will notify the affected Merchant and, where required by law, the relevant regulator and affected individuals, without undue delay.
Children
The service is not directed at children. We do not knowingly process the personal data of a child under 13 (or the equivalent minimum age in the applicable jurisdiction). If we become aware that we hold such data without the appropriate consent, we will delete it.
International transfers
Data may be processed on infrastructure located outside the country in which the End User resides, including by Meta Platforms in connection with the WhatsApp Business Platform. Where such transfers occur, we rely on appropriate safeguards, including the standard contractual clauses published by the relevant regulator and, where applicable, data processing addenda offered by Meta.
Updates to this policy
We may revise this policy from time to time to reflect operational changes or new legal requirements. The version number and last-revised date at the top of this document indicate the current version. Where a change is material, we will notify Merchants in writing and post a notice on this page in advance of the change taking effect.
How to contact us
For any privacy-related enquiry, including data subject requests, please contact us through one of the following channels:
- WhatsApp — wa.me/923193039691 — reply DATA to begin a verified data request
- Telephone — 0319 3039691 — 09:00–22:00 PKT
- Email — info@nexordersupport.com
- Postal — Nex Order Support, 401 B, Park Avenue, Block 6, P.C.S.I.R Society, Karachi 75600, Pakistan
For any matter that cannot be resolved with us, you may contact your local data protection authority. In Pakistan, this will be the authority designated under the Personal Data Protection Act once it enters into force.
This policy is a public commitment, not boilerplate. If anything in it is unclear, write to us. We will explain it in plain words.