PRIVACY POLICY
Sky Exchange Company (Private) Limited – Mobile Application
Effective Date: September 14, 2026
Last Updated: September 14, 2026
1. INTRODUCTION
Sky Exchange Company (Private) Limited (“Sky Exchange”, “Company”, “we”, “us” or “our”) respects the privacy of its customers and is committed to protecting personal information entrusted to us.
This Privacy Policy (“Policy”) explains how Sky Exchange collects, accesses, uses, stores, protects, retains and discloses personal and financial information when you:
• Download or use the Sky Exchange mobile application (“App”);
• Register or create an account;
• Request or use foreign exchange services;
• Book a foreign currency deal;
• Request receipt or credit of an inward remittance;
• Request an outward remittance;
• Communicate with Sky Exchange;
• Submit a complaint or service request; or
• Otherwise interact with Sky Exchange through the App or related digital channels.
This Policy should be read together with the Sky Exchange Terms & Conditions and Refund, Cancellation and Reversal Policy.
By using the App, you acknowledge that you have read and understood this Policy.
2. ABOUT SKY EXCHANGE
Sky Exchange Company (Private) Limited
Registered Office:
Office No. 19-23, First Floor,
Mall Plaza, The Mall,
Rawalpindi, Pakistan.
State Bank of Pakistan License No.: 31
Sky Exchange is an exchange company regulated by the State Bank of Pakistan (SBP) and conducts foreign exchange and remittance-related activities subject to its authorization and applicable laws, regulations and SBP instructions.
The regulatory framework applicable to exchange companies includes requirements concerning internal controls, IT systems, transaction records, customer dealings, AML/CFT/CPF controls and regulatory reporting. SBP issued the consolidated Regulatory Framework for Exchange Companies (RFEC) effective January 1, 2025.
3. SCOPE OF THIS POLICY
This Policy applies to personal and other information collected through:
• The Sky Exchange App;
• Sky Exchange’s website, where applicable;
• Customer support channels;
• Electronic communications;
• Transaction processing systems;
• Customer onboarding and KYC processes; and
• Other digital channels operated by Sky Exchange.
This Policy does not necessarily apply to websites, applications or services operated by third parties, including banks, Money Transfer Operators (“MTOs”), payment service providers or other third-party platforms.
Those parties may have their own privacy policies.
4. INFORMATION WE COLLECT
Depending on the services you use and the applicable regulatory requirements, Sky Exchange may collect the following categories of information.
4.1 Identity Information
This may include:
• Full name;
• Date of birth;
• Gender, where required;
• Nationality;
• CNIC/NICOP details;
• Passport details;
• Identification document information;
• Photograph, where required;
• Signature or electronic confirmation;
• Occupation/business information; and
• Other information required for customer identification and verification.
4.2 Contact Information
This may include:
• Mobile telephone number;
• Email address;
• Residential or mailing address;
• City and country;
• Emergency or other contact information where required; and
• Communication preferences.
4.3 Financial and Transaction Information
Because Sky Exchange provides regulated foreign exchange and remittance services, we may collect:
• Bank account details;
• IBAN;
• Beneficiary details;
• Sender details;
• Remitter details;
• Transaction amount;
• Currency;
• Exchange rate;
• Transaction/reference number;
• Transaction date and time;
• Payment information;
• Source and destination of funds;
• Transaction purpose;
• Remittance information;
• Foreign exchange deal information;
• Transaction history; and
• Other information necessary to process or verify a transaction.
Financial information is treated as sensitive information and is handled using appropriate security controls.
5. KYC, AML/CFT/CPF AND REGULATORY INFORMATION
As a regulated exchange company, Sky Exchange may collect additional information required to comply with:
• Know Your Customer (“KYC”) requirements;
• Customer Due Diligence (“CDD”);
• Enhanced Due Diligence (“EDD”);
• Anti-Money Laundering (“AML”) requirements;
• Countering Financing of Terrorism (“CFT”) requirements;
• Countering Proliferation Financing (“CPF”) requirements;
• Targeted financial sanctions;
• Transaction monitoring;
• Source-of-funds requirements;
• Source-of-wealth requirements, where applicable;
• Beneficial ownership requirements; and
• Regulatory reporting requirements.
This information may include supporting documentation and information regarding the nature and purpose of transactions.
We may also conduct screening against applicable sanctions, watchlists, politically exposed person (“PEP”) information and other risk indicators where required.
6. DEVICE AND TECHNICAL INFORMATION
When you use the App, certain technical information may be collected automatically, depending on the App’s configuration and permissions granted by you.
This may include:
• Device type;
• Device model;
• Operating system;
• App version;
• IP address;
• Mobile network information;
• Device identifiers, where permitted and necessary;
• Language and regional settings;
• Date and time of App activity;
• Crash and diagnostic information;
• Security information;
• Login information;
• Authentication events; and
• Information concerning App performance and usage.
Sky Exchange will only collect device information that is reasonably necessary for the operation, security, fraud prevention, troubleshooting or improvement of the App and services.
Sky Exchange will not request access to device permissions that are not required for a legitimate function of the App.
7. CAMERA AND DOCUMENT CAPTURE
Where the App provides digital KYC or document-upload functionality, the App may request access to the device camera or photo/document selection functionality.
Such access may be used to:
• Capture identification documents;
• Capture photographs where required for verification;
• Upload supporting documents; or
• Complete regulatory verification.
Camera or document access will only be requested where required for the relevant functionality.
Where Google Play requires prominent disclosure and affirmative consent before access to sensitive information or permissions, the App will provide the applicable disclosure and permission request before collection. Google Play requires such disclosure where the collection or use may not reasonably be expected by the user.
8. LOCATION INFORMATION
Sky Exchange does not intend to collect precise device location unless a specific App feature requires it and the appropriate permission and disclosure are provided.
If location information is used in a future version of the App, Sky Exchange will disclose:
• What location information is collected;
• Why it is collected;
• Whether it is collected while the App is in use or in the background;
• Whether it is shared with any third party; and
• How users can control the relevant permission.
The App will not request background location access unless it is necessary for a legitimate feature and permitted under applicable Google Play requirements.
9. CONTACTS, SMS, CALL LOGS AND OTHER DEVICE DATA
Sky Exchange does not intend to access:
• Contacts;
• SMS messages;
• Call logs;
• Microphone;
• Installed applications; or
• Other sensitive device information
unless such access is specifically required for a legitimate App function, appropriately disclosed and permitted under applicable Google Play policies.
Where such access is required, Sky Exchange will obtain the applicable permission and provide appropriate disclosure before collecting the information.
10. HOW WE USE YOUR INFORMATION
Sky Exchange may use personal information for the following purposes:
10.1 Providing Services
To:
• Create and maintain your customer account;
• Provide foreign exchange services;
• Process deal bookings;
• Process inward remittance requests;
• Process outward remittance requests;
• Facilitate bank-account credits;
• Process transactions;
• Issue transaction receipts;
• Provide transaction status; and
• Provide customer support.
10.2 Customer Identification
To:
• identify and verify customers;
• conduct KYC/CDD;
• verify beneficiaries;
• establish beneficial ownership;
• assess customer risk; and
• prevent impersonation and identity fraud.
10.3 Regulatory Compliance
To comply with:
• SBP requirements;
• foreign exchange laws;
• AML/CFT/CPF requirements;
• sanctions requirements;
• court orders;
• lawful requests from competent authorities; and
• other applicable laws and regulations.
10.4 Fraud and Security
To:
• detect and prevent fraud;
• detect unauthorized transactions;
• protect customer accounts;
• monitor suspicious activity;
• protect the App and systems;
• investigate security incidents; and
• prevent misuse of our services.
10.5 Transaction Monitoring
To monitor transactions and customer activity for risk management, fraud prevention, AML/CFT/CPF compliance and other regulatory purposes.
10.6 Customer Support
To:
• respond to customer inquiries;
• investigate complaints;
• resolve transaction issues;
• provide transaction information; and
• communicate with customers regarding their requests.
10.7 App Operation and Improvement
To:
• maintain the App;
• identify technical errors;
• diagnose crashes;
• improve functionality;
• improve security;
• monitor system performance; and
• develop new services.
10.8 Legal and Regulatory Reporting
To prepare and submit reports, records or information to SBP and other competent authorities where required or permitted by law.
11. LEGAL AND REGULATORY BASIS FOR PROCESSING
Sky Exchange processes customer information because such processing may be necessary to:
• provide services requested by the customer;
• perform contractual obligations;
• comply with applicable laws and regulatory requirements;
• fulfil KYC/AML/CFT/CPF obligations;
• prevent fraud and financial crime;
• protect the security of customers and our systems;
• investigate complaints and disputes; and
• protect our legitimate business and operational interests, subject to applicable law.
Where consent is legally required, Sky Exchange will obtain consent through an appropriate affirmative action.
12. SHARING OF PERSONAL INFORMATION
Sky Exchange does not sell personal or financial information of customers.
We may share information where necessary with the following categories of recipients:
12.1 State Bank of Pakistan and Competent Authorities
Information may be provided to SBP and other competent authorities where required or permitted by law or regulation.
12.2 Banks and Financial Institutions
Information may be shared with banks and financial institutions where necessary to:
• process transactions;
• credit beneficiary accounts;
• verify account information;
• process payments;
• investigate failed transactions; or
• comply with regulatory requirements.
12.3 Money Transfer Operators
Where a transaction involves an authorized MTO, relevant customer and transaction information may be shared to facilitate and comply with the applicable remittance arrangement.
12.4 Correspondent Banks and Payment Service Providers
Information may be shared with relevant intermediaries involved in processing, settlement or transmission of transactions.
12.5 Technology and Service Providers
Sky Exchange may use third-party service providers for:
• cloud or hosting services;
• cybersecurity;
• identity verification;
• document verification;
• transaction processing;
• SMS and communication services;
• push notifications;
• analytics;
• technical support; and
• other technology services.
Such providers will only receive information necessary for the relevant service and will be subject to appropriate contractual and security controls.
12.6 Law Enforcement and Judicial Authorities
Information may be disclosed where required by:
• law;
• court order;
• lawful government request; or
• direction of a competent authority.
13. INTERNATIONAL TRANSFER OF INFORMATION
Certain service providers, banks, MTOs, technology providers or financial institutions involved in international remittance transactions may process information outside Pakistan.
Where customer information is transferred outside Pakistan, Sky Exchange will take reasonable steps to ensure that the transfer is undertaken for legitimate purposes and in accordance with applicable legal, regulatory and contractual requirements.
International transfers may be necessary for processing cross-border remittances, sanctions screening, transaction processing, cybersecurity, identity verification or other legitimate functions.
14. INFORMATION SECURITY
Sky Exchange maintains technical, organizational and administrative safeguards designed to protect personal and financial information against:
• unauthorized access;
• unauthorized disclosure;
• alteration;
• destruction;
• misuse;
• fraud; and
• loss.
Security measures may include:
• encryption of data in transit;
• access controls;
• authentication mechanisms;
• role-based access;
• transaction authorization controls;
• audit logs;
• monitoring;
• vulnerability management;
• security testing;
• incident management; and
• other appropriate technical and organizational controls.
Google Play requires apps handling personal and sensitive information to use appropriate security practices, including modern cryptography for data in transit.
No electronic system can be guaranteed to be completely secure. Customers should also protect their passwords, PINs, OTPs and authentication credentials.
15. CUSTOMER RESPONSIBILITY FOR SECURITY
Customers are responsible for:
• keeping their login credentials confidential;
• protecting their device;
• using a secure internet connection where reasonably possible;
• keeping the App updated;
• not sharing OTPs or authentication codes;
• immediately reporting suspected unauthorized access; and
• logging out or securing their account where appropriate.
Sky Exchange will never intentionally request your password, PIN or OTP through an unsolicited communication.
16. TRANSACTION MONITORING
Sky Exchange may monitor transactions and customer activity to comply with applicable AML/CFT/CPF requirements, prevent fraud and protect the financial system.
Monitoring may involve automated systems and manual review.
Where a transaction is identified for additional review, Sky Exchange may request additional information or documentation.
A transaction may be delayed, suspended, rejected or reported where required by applicable law or regulatory requirements.
17. COOKIES AND SIMILAR TECHNOLOGIES
The App and associated websites may use cookies, SDKs, analytics tools or similar technologies where necessary for:
• security;
• authentication;
• session management;
• performance monitoring;
• crash reporting;
• analytics;
• service improvement; and
• other legitimate operational purposes.
Where third-party SDKs are used, Sky Exchange will assess their data practices and ensure that their use is consistent with applicable requirements.
Google Play requires developers to understand and accurately disclose data practices associated with third-party SDKs integrated into their applications.
18. THIRD-PARTY SDKs AND SERVICES
The App may contain third-party software development kits (“SDKs”) or integrations.
Examples may include:
• analytics services;
• crash reporting services;
• identity verification services;
• security services;
• cloud services;
• communication services; and
• payment or transaction-processing services.
The actual SDKs and service providers used by Sky Exchange may change over time.
Sky Exchange will update this Policy and the Google Play Data Safety disclosures where required when material changes are made to data collection or sharing practices.
19. DATA RETENTION
Sky Exchange retains customer and transaction information for as long as reasonably necessary for:
• providing services;
• maintaining transaction records;
• regulatory compliance;
• AML/CFT/CPF requirements;
• audit purposes;
• fraud prevention;
• dispute resolution;
• complaint handling;
• legal claims; and
• other legitimate business or regulatory purposes.
Certain records may be required to be retained for a prescribed period under applicable SBP requirements or other laws.
Accordingly, deletion of a customer account does not necessarily mean that all information can be immediately deleted.
Where information is required to be retained by law or regulation, Sky Exchange will retain it for the applicable retention period and will restrict its use to the purposes for which retention is required or otherwise legally permitted.
20. ACCOUNT DELETION
Customers may request deletion of their Sky Exchange App account through the account deletion facility provided within the App or through the external account-deletion mechanism made available by Sky Exchange.
Google Play requires apps that allow account creation to provide users with an accessible mechanism to request account deletion, including deletion of associated user data, subject to legitimate legal retention requirements.
Upon receiving a valid account deletion request, Sky Exchange will:
1. verify the identity of the requester;
2. process or close any pending activities where necessary;
3. identify information that may legally be deleted;
4. delete or anonymize information that is no longer required, where technically and legally appropriate; and
5. retain information that must be retained under applicable law, regulation, AML/CFT/CPF requirements, audit requirements, dispute requirements or other legitimate legal obligations.
Account deletion will not automatically cancel or reverse an already executed financial transaction.
21. EFFECT OF ACCOUNT DELETION ON FINANCIAL RECORDS
Because Sky Exchange is a regulated financial-services business, certain transaction and KYC records may be legally required to be retained after account deletion.
Therefore:
Account deletion does not necessarily result in immediate deletion of all financial, transaction or regulatory records.
Such retained information will be protected and will not be used for unrelated purposes except where permitted or required by law.
22. CUSTOMER RIGHTS
Subject to applicable law and regulatory requirements, customers may have rights relating to their personal information, including the ability to:
• request access to certain personal information;
• request correction of inaccurate information;
• request deletion where legally permissible;
• request information regarding how personal information is used;
• withdraw consent where processing is based on consent, where applicable;
• raise a privacy-related complaint; and
• request clarification regarding certain data-processing activities.
These rights may be subject to legal, regulatory, AML/CFT/CPF, record-retention, fraud-prevention and other lawful restrictions.
23. CORRECTION OF CUSTOMER INFORMATION
If you believe that information held by Sky Exchange is inaccurate or incomplete, you may contact us using the contact details provided below.
We may require appropriate verification before making changes to customer information.
Changes to KYC information may require supporting documents and additional verification.
24. PRIVACY AND COMPLAINTS
Privacy-related complaints may be submitted to Sky Exchange through the customer support channels specified in this Policy.
Complaints should include sufficient information to allow us to identify:
• the customer;
• the relevant account, where applicable;
• the nature of the complaint; and
• the information or processing activity concerned.
Sky Exchange will investigate privacy complaints in accordance with its applicable complaint-handling procedures and regulatory requirements.
25. CHILDREN’S PRIVACY
The App is intended for customers who are legally eligible to use the relevant foreign exchange and remittance services.
Sky Exchange does not knowingly collect personal information from children for purposes unrelated to providing a legally permissible service.
If we become aware that personal information has been collected from a person who is not eligible to use the relevant service, we may take appropriate steps to delete or restrict such information, subject to legal and regulatory retention requirements.
26. MARKETING COMMUNICATIONS
Sky Exchange may, where legally permitted and where applicable consent has been obtained, send customers information regarding:
• new services;
• service updates;
• promotional offers;
• exchange-related information;
• customer awareness communications; and
• other relevant communications.
Customers may opt out of promotional communications through the available unsubscribe or communication-preference mechanism.
However, customers may continue to receive essential service, security, transaction and regulatory communications.
27. PUSH NOTIFICATIONS
The App may send push notifications relating to:
• transaction status;
• deal booking;
• security alerts;
• account activity;
• customer requests;
• service updates;
• regulatory or compliance requirements; and
• other essential service communications.
Customers may control certain notification permissions through their device settings, subject to the functionality of the App.
28. DATA BREACH AND SECURITY INCIDENTS
Sky Exchange maintains procedures for identifying, investigating and responding to information-security incidents.
Where required by applicable law or regulatory requirements, Sky Exchange may notify relevant authorities and/or affected customers regarding a security incident.
The nature and timing of any notification will depend on applicable legal, regulatory and security requirements.
29. THIRD-PARTY LINKS
The App or communications from Sky Exchange may contain links to third-party websites or services.
Sky Exchange is not responsible for the privacy practices of third-party websites or applications.
Customers should review the privacy policy of any third-party service before providing personal information.
30. DATA NOT SOLD
Sky Exchange does not sell customers’ personal or financial information.
Customer information may, however, be disclosed to banks, MTOs, payment providers, technology providers, regulators and other authorized parties where necessary to provide services, comply with law, process transactions, protect customers or meet regulatory requirements.
Google Play’s User Data policy also prohibits the sale of personal and sensitive user data, subject to the policy’s specific definitions and requirements.
31. CHANGES TO THIS PRIVACY POLICY
Sky Exchange may update this Policy from time to time to reflect:
• Changes in applicable law;
• SBP regulations or instructions;
• Changes to the App;
• New services;
• Changes in technology;
• Changes in data-processing practices;
• Security requirements; or
• Regulatory requirements.
The updated Policy will be made available through the App and/or the Sky Exchange website.
Where appropriate, Sky Exchange may provide additional notice of material changes.
The “Last Updated” date at the beginning of this Policy indicates when the Policy was most recently revised.
32. CONSISTENCY WITH GOOGLE PLAY DATA SAFETY DISCLOSURES
Sky Exchange will maintain its Google Play Data Safety declarations so that they accurately reflect the App’s actual collection, use and sharing of user data.
If the App’s data practices materially change, Sky Exchange will review and update both this Privacy Policy and its Google Play disclosures.
Google Play requires the Privacy Policy and Data Safety disclosures to accurately and consistently describe the App’s data practices.
33. PRIVACY CONTACT
For privacy-related questions, requests or complaints, customers may contact:
Sky Exchange Company (Private) Limited
Registered Office:
Office No. 19-23, First Floor,
Mall Plaza, The Mall,
Rawalpindi, Pakistan.
Privacy / Customer Support Email: ho@skyexchange.com.pk
Customer Support Telephone: +92 51 5585302
Website: www.skyexchange.com.pk
Subject: Privacy Request / Data Protection Inquiry
34. GOVERNING LAW
This Privacy Policy shall be governed by the laws of the Islamic Republic of Pakistan, including applicable foreign exchange laws, regulations and instructions issued by the State Bank of Pakistan and other applicable regulatory requirements.
Nothing in this Policy is intended to restrict any mandatory right or protection available to a customer under applicable law.
35. REGULATORY REQUIREMENTS PREVAIL
If any provision of this Policy conflicts with a mandatory requirement of:
• the State Bank of Pakistan;
• applicable foreign exchange laws;
• AML/CFT/CPF requirements;
• sanctions requirements;
• a court or competent authority; or
• any other applicable law,
the mandatory legal or regulatory requirement shall prevail to the extent of the conflict.
Sky Exchange may retain, disclose, restrict or process information where required or permitted by law or a competent authority.
36. CUSTOMER ACKNOWLEDGEMENT
By registering for or using the Sky Exchange App, you acknowledge that:
☐ You have read and understood this Privacy Policy.
☐ You understand the categories of information that Sky Exchange may collect and process.
☐ You understand that financial, identification and transaction information may be processed to provide regulated foreign exchange and remittance services.
☐ You understand that information may be shared with banks, MTOs, payment providers, regulators and other authorized parties where necessary or legally required.
☐ You understand that certain information may be retained after account deletion where required by law or regulation.
☐ You understand that you may request account deletion subject to applicable legal and regulatory retention requirements.
By selecting “I Agree”, registering for or continuing to use the Sky Exchange App, you acknowledge this Privacy Policy.
Effective Date: September 14, 2026
Last Updated: September 14, 2026
© Sky Exchange Company (Private) Limited. All Rights Reserved.