Privacy Policy

Who we are

Apex818 is a commercial property management and advisory practice based in Islamabad, Pakistan. Apex818 operates the website at apex818.com and is the party responsible for the personal information described in this policy, acting as the data controller.

In this policy, "we", "us", and "our" mean Apex818. "You" means anyone who visits apex818.com, submits our contact form, or holds an account in our client portal.

Information we collect

We collect only what we need to answer enquiries, run client accounts, and keep the site working and secure. We do not buy personal information from data brokers, and we do not sell yours.

Information you give us directly

• Contact form. Your name, email address, phone number (optional), and the content of your message. This is sent to our team by email so we can reply.
• Client portal accounts. If we create an account for you, we hold your name, email address, and an encrypted (hashed) password. We never store your password in readable form.
• Two-factor authentication and passkeys. If you enable two-factor authentication, we store an encrypted authentication secret and encrypted recovery codes. If you register a passkey, we store its public key and credential identifier. A passkey's private key never leaves your device, and we cannot read it.
• Correspondence. Emails, messages, and documents you send us in the course of a property enquiry or engagement.

Information collected automatically

• Server and security logs. Your IP address, browser type and version, operating system, the pages you request, the referring page, and the date and time of each request. Our hosting provider also keeps its own access logs.
• Performance data. Aggregate timings for requests, queries, and background jobs, used to find slow or failing parts of the application.
• Account activity records. For portal accounts, a record of significant actions such as sign-in, sign-out, password change, and two-factor changes, together with the time and originating IP address. These exist so that you and we can spot unauthorised access.
• Cookies. See Cookies and similar technologies below.

Information we do not collect

We do not ask for and do not want sensitive personal information such as national identity card numbers, financial account credentials, health information, religious or political affiliation, or biometric data through this website. Please do not send these through the contact form. Where a property engagement genuinely requires identity or financial documents, we will collect them through a separate, agreed channel and tell you how they will be handled at that time.

How we use information

• To respond to you. Answering enquiries submitted through the contact form and following up about property management, tenancy, or portfolio matters.
• To provide our services. Managing client engagements, tenancies, rent collection, reporting, and the client portal.
• To operate accounts. Authenticating sign-ins, enforcing two-factor authentication, and letting you manage your own account.
• To keep the site secure. Detecting and blocking automated abuse, rate-limiting sign-in attempts, investigating suspicious activity, and maintaining an audit trail.
• To improve the site. Understanding which pages are used and where the application is slow or failing.
• To measure and market, where enabled. If and when we switch on the analytics and advertising tools described in section 6, to measure campaign performance and reach relevant audiences.
• To meet legal and professional obligations. Keeping records we are required to keep, and responding to lawful requests.

We do not use your information for automated decision-making that produces legal or similarly significant effects, and we do not profile you for anything other than the marketing measurement described in section 6.

Legal bases

Apex818 operates from Pakistan and complies with applicable Pakistani law, including the Prevention of Electronic Crimes Act 2016 and any data protection legislation as it comes into force.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR:

• Consent - for non-essential cookies, analytics, and advertising, and for marketing emails. You may withdraw consent at any time.
• Contract - to provide services you have engaged us for, and to operate your account.
• Legitimate interests - to respond to enquiries you initiate, secure our site against abuse, and understand aggregate site performance, balanced against your rights.
• Legal obligation - where we must retain or disclose information to comply with the law.

If you are a California resident, we do not sell or share your personal information as those terms are defined under the CCPA/CPRA. See Your rights and choices.

Cookies and similar technologies

Cookies are small files a site stores in your browser. We use as few as we can.

Strictly necessary cookies are set on every visit because the site cannot work without them. Analytics and advertising cookies are only set if you consent, and you can change your mind at any time by clearing cookies in your browser or contacting us.

Most browsers let you block or delete cookies through their settings. Blocking strictly necessary cookies will break sign-in and form submission. We honour Global Privacy Control (GPC) signals where your browser sends them; we do not currently respond to legacy Do Not Track headers, which lack an agreed standard.

Analytics and advertising partners

Meta Pixel and Facebook advertising

When enabled, the Meta Pixel (provided by Meta Platforms, Inc.) will record that a browser visited certain pages or completed certain actions, such as submitting the contact form. Meta may combine this with information it already holds about a Facebook or Instagram account in order to measure our ads and build audiences. The pixel can transmit your IP address, browser and device details, the page URL, and a Meta-set cookie identifier.

• Meta's handling of this data is governed by the Meta Privacy Policy.
• You can control the ads you see and how your activity is used in Facebook Ad Preferences and Meta Accounts Center.
• We do not upload contact lists, hashed or otherwise, to Meta without telling you in this policy first.

Google Analytics and Google Ads

When enabled, Google Analytics 4 (provided by Google LLC) will use cookies and similar identifiers to report aggregate statistics about site usage. Google Ads tags may be used to measure conversions and show remarketing ads across the Google Display Network and YouTube. Google may set and read its own cookies, including advertising cookies, and may process your IP address, which it uses to derive approximate location and then discards or truncates.

• Google's handling of this data is governed by the Google Privacy Policy and How Google uses information from sites that use its services.
• You can opt out of Google Analytics across all sites with the Google Analytics Opt-out Browser Add-on.
• You can control personalised advertising at Google Ad Settings.
• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. You can opt out of vendor personalisation at optout.aboutads.info and youronlinechoices.com.

We configure these tools to avoid sending them names, email addresses, phone numbers, or message contents. We do not knowingly pass personally identifiable information to Meta or Google through page URLs or event parameters.

How we share information

We do not sell your personal information, and we do not rent or trade it. We share it only in these situations:

• Service providers. Companies that run infrastructure on our behalf, under contract and only for the purposes we specify. These currently include our web hosting provider and our outbound email provider.
• Analytics and advertising partners. Meta and Google, as described in section 6, and only where those tools are enabled and you have consented.
• Professional advisers. Lawyers, accountants, and auditors, where genuinely necessary and subject to confidentiality.
• Property counterparties. Where you have engaged us on a property matter, the information needed to progress it, for example sharing a prospective tenant's details with a landlord we act for. We tell you when this applies.
• Legal requirements. Where we are required by law, court order, or a lawful request from a competent authority, or where we need to establish, exercise, or defend legal claims.
• Business transfer. If Apex818 is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction. We will notify you before your information becomes subject to a materially different policy.

International transfers

We are based in Pakistan. Some of the providers we rely on, including our hosting and email providers and the analytics and advertising partners named in section 6, operate servers outside Pakistan, including in the United States and the European Union. This means your information may be transferred to, stored in, and processed in countries whose data protection laws differ from those of your own country.

Where we transfer personal information from the EEA or the UK, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as offered by those providers. You can ask us for details of the safeguards that apply.

How long we keep information

• Contact form enquiries. Up to 24 months from your last contact with us, so we can pick up a conversation where it left off. Deleted sooner on request.
• Client portal accounts. For as long as the account is active, and up to 12 months after it is closed.
• Account activity records. Up to 12 months, for security investigation.
• Server and security logs. Typically 30 to 90 days, unless retained longer for an active security investigation.
• Engagement and financial records. For the period required by Pakistani tax, accounting, and professional record-keeping obligations, which may be several years.
• Analytics and advertising data. Held by Meta and Google under their own retention schedules, which we do not control.

When a retention period ends, we delete the information or irreversibly anonymise it.

Security

We take reasonable technical and organisational measures to protect personal information, including encryption in transit over HTTPS, password hashing, encrypted two-factor secrets, support for passkeys and two-factor authentication on portal accounts, rate limiting on sign-in attempts, and access controls that limit who inside Apex818 can see what.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach that is likely to result in a risk to your rights, we will notify you and the relevant authorities as required by applicable law, without undue delay.

Your rights and choices

Subject to the law that applies to you, you may have the right to:

• Access the personal information we hold about you, and receive a copy.
• Correct information that is inaccurate or incomplete.
• Delete your information, where we have no overriding obligation to keep it.
• Restrict or object to certain processing, including direct marketing and profiling for advertising.
• Portability - receive information you gave us in a structured, machine-readable format.
• Withdraw consent at any time, without affecting processing already carried out.
• Complain to a data protection authority in your country. If you are in the EEA or UK, you may complain to your local supervisory authority.

To exercise any of these, send us a message through the contact form on apex818.com, starting your message with "Privacy request". We will respond within 30 days. We may ask you to confirm your identity before acting, so that we do not disclose your information to someone else. Exercising your rights is free; we will tell you in advance in the rare case a request is manifestly unfounded or excessive.

Deleting your data

You can ask us to delete the personal information we hold about you at any time.

Some information may have to be retained after a deletion request, specifically records we are required to keep under Pakistani tax, accounting, or professional obligations, and records needed to establish or defend a legal claim. Where that applies, we will tell you what was kept and why, and delete it once the obligation ends.

Deleting your information with us does not delete data held independently by Meta or Google. To remove that, use the account controls linked in section 6 or contact those companies directly.

Children

This website and our services are intended for business use by adults. They are not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

Third-party links

Our site may link to other websites, including property portals, partner sites, and social media pages. We are not responsible for the privacy practices or content of those sites. Read their privacy policies before giving them your information.

Changes to this policy

We may update this policy as our services, our tools, or the law change. When we do, we will revise the "Last updated" date at the top of this page. If a change materially affects how we use your personal information, we will give prominent notice on the site and, where we hold your email address and the law requires it, by email.

Enabling the analytics or advertising tools described in section 6 will be treated as a material change and announced accordingly.

Contact us

Questions about this policy, or about how we handle your information, should go to: