1. Who we are In this Policy, "we", "us" and "our" mean Buzmasol (Pvt) Ltd. "Platform" means the Book For Look mobile applications, website and provider tools. "You" means a customer using the Platform to book services.

We are the party responsible for deciding how your personal information is collected and used on the Platform. Privacy contact: info@bookforlook.com In-app: Help & Support

2. Scope and legal framework This Policy applies to customers of the Platform in Pakistan. Service providers (salons, spas, freelance professionals and their staff) are covered by Section 12 below and by their Provider Agreement. Pakistan does not currently have a single comprehensive data protection statute in force. Our handling of personal information is governed by: • The Constitution of Pakistan, Article 14 (dignity and privacy of the home); • The Prevention of Electronic Crimes Act, 2016, as amended in 2025, including its provisions on unauthorised access to and misuse of personal information and its data retention obligations; • The Payment Systems and Electronic Fund Transfers Act, 2007 and applicable State Bank of Pakistan rules, in respect of payment and transaction records; • Pakistan Telecommunication Authority regulations relevant to SMS and subscriber data; • The Companies Act, 2017 and Income Tax Ordinance, 2001, in respect of records we are required to keep. Where the Personal Data Protection Bill is enacted, we will update this Policy and our practices to comply. In the meantime, we have voluntarily built this Policy around the principles in the published draft — lawful purpose, purpose limitation, consent, accuracy, retention limits and security — so that our practices do not need to change materially when the law comes into force.

3. Information we collect

3.1 Information you give us Account details: Name, mobile number, email (optional), profile photo (optional), gender (optional, used for gender-specific service matching) (Why we need it: To create and secure your account) Booking information: Services selected, provider, branch, date, time, price, group bookings and the names you enter for other people in a group (Why we need it: To make and manage bookings) Payment information: Payment method type, transaction reference, amount, wallet balance, refund records (Why we need it: To take payment and handle refunds) Content you provide: Reviews, ratings, photos you upload, support messages, complaints (Why we need it: To run reviews and support) Preferences: Saved providers, favourites, notification settings, language (Why we need it: To personalise the app) We do not store full payment card numbers, CVV codes or card expiry dates. Card details are captured and held by our payment gateway partners, who are regulated for that purpose.

3.2 Information we collect automatically • Device and app information: device model, operating system version, app version, device identifiers, crash logs, push notification token. • Usage information: screens viewed, searches, bookings started and abandoned, timestamps, IP address. • Approximate location: if you grant location permission, we use your location to show nearby providers and estimate travel distance. You can refuse or withdraw this permission at any time in your device settings; the Platform will still work, but you will need to search by area manually. We do not track your location in the background or when the app is closed.

3.3 Sensitive information Some personal-care services relate to skin, hair or body conditions. If you tell us or a provider about an allergy, skin sensitivity, medical condition or similar matter — in a booking note, a support message or a review — that information is treated as sensitive. We use it only to fulfil the booking safely and we do not use it for marketing, profiling or advertising. Please do not send us identity documents, financial account numbers or medical records through in-app support unless we specifically ask for them.

3.4 Information about other people If you make a booking for another person, or add people to a group booking, you must have their permission to give us their name and contact details. We will use that information only for that booking.

4. How we use your information We use your information to: 1. Create and manage your account, including verifying your mobile number by OTP and signing you in. 2. Take, confirm, modify and cancel bookings, and share the details a provider needs to serve you. 3. Process payments, refunds, wallet top-ups and provider payouts. 4. Send you service messages about your bookings, payments, account and security. 5. Send you promotional messages, where you have opted in. 6. Provide customer support and investigate complaints and disputes between you and a provider. 7. Detect, investigate and prevent fraud, abuse and misuse of the Platform, including fake bookings, chargeback abuse and fake reviews. 8. Keep the Platform working and secure — diagnosing crashes, monitoring performance and protecting against attacks. 9. Understand and improve the Platform using aggregated and de-identified analytics. 10. Meet our legal, tax and regulatory obligations and respond to lawful requests from authorities. We do not use your information to make decisions about you that have legal or similarly significant effects without human involvement.

5. Consent, and how to withdraw it We rely on your consent to collect and use your information for the purposes above. You give that consent when you create an account and accept this Policy and our Terms of Service. You can withdraw consent at any time by deleting your account (Section 9). Withdrawing consent does not affect anything we did lawfully before you withdrew it, and does not remove records we are required by law to keep. Separate, more specific consents apply to: • Marketing messages — opt-in, and you can opt out at any time in notification settings or by replying STOP to an SMS. • Location — device permission, revocable at any time. • Camera and photo library — device permission, used only when you upload a photo.

6. Sharing your information

6.1 With the provider you book When you confirm a booking, we share with the provider: your first name, the services booked, the date and time, any note you added, and a masked or in-app contact channel so they can reach you about the booking. Providers are bound by their Provider Agreement to use this information only to deliver the booking you made. They are contractually prohibited from: • adding you to their own marketing lists, WhatsApp broadcast groups or SMS campaigns; • selling, sharing or transferring your details to anyone else; • contacting you for any purpose other than that booking; • retaining your details after the booking is complete and any dispute period has closed, except as their own legal obligations require. Once a provider holds your information, they are also responsible under law for how they handle it. If a provider misuses your details, tell us through Help & Support — we investigate and can suspend or remove providers from the Platform.

6.2 With service providers who operate the Platform for us We use trusted third parties to run the Platform. They act on our instructions and may not use your data for their own purposes: Payment gateways and processors: Taking payments, refunds, settlement SMS gateway: OTP and booking messages Email delivery service: Transactional email Push notification service: App notifications Cloud hosting, database and storage: Running the Platform Crash reporting and analytics: Stability and product improvement Customer support tooling: Handling your queries A current list of the categories and named vendors is available on request through Help & Support.

6.3 For legal and safety reasons We may disclose information where we are required to by law or where we reasonably believe disclosure is necessary to comply with a court order, a request from the FIA, PTA, SBP, FBR or another authority acting within its powers; to enforce our Terms; to investigate fraud; or to protect the safety of any person. Where we are permitted to tell you about such a request, we will.

6.4 Business transfers If our business or a part of it is sold, merged or reorganised, your information may transfer to the acquiring entity. We will tell you in advance and this Policy will continue to apply until the new owner publishes its own, of which you will be notified.

6.5 We do not sell your information We do not sell, rent or trade your personal information, and we do not share it with third-party advertising networks for their own targeting.

7. Where your information is stored Our hosting, database, storage, analytics and notification providers operate data centres outside Pakistan, including in Singapore / the United States / the European Union. Your information may therefore be stored and processed outside Pakistan. Where information leaves Pakistan, we require the recipient by contract to protect it to the standard described in this Policy, and we transfer only what is needed for the purpose. If Pakistani law later restricts cross-border transfer or requires local storage of categories of data, we will comply.

8. How long we keep your information Account profile — While your account is active Booking history — While your account is active, then anonymised on deletion Payment and transaction records — Six years from the end of the relevant tax year, as required by the Income Tax Ordinance, 2001 and sales tax rules Accounting and company records — Ten years, as required by the Companies Act, 2017 Reviews and ratings — Retained after account deletion in anonymised form, so provider ratings stay accurate Support tickets and dispute records — Three years from closure Traffic and access logs — The minimum period required under PECA, 2016 and any PTA direction, and otherwise twelve months Fraud and abuse records — Five years, so that banned accounts cannot simply be recreated Marketing consent and opt-out records — For as long as needed to prove we honoured your choice When a retention period ends, we delete the information or irreversibly anonymise it so it can no longer be linked to you.

9. Your choices and rights You can, at any time: • View and correct your profile information in the app. • Control notifications — push, SMS and email — in notification settings. Essential service messages about bookings, payments and security cannot be switched off while your account is open. • Withdraw location, camera and photo permissions in your device settings. • Delete your account in the app, under Profile → Account → Delete Account. • Request a copy of your data through Help & Support. We will respond within 30 days and may ask you to verify your identity first. • Object to how we use your information, or ask us to restrict a particular use, through Help & Support. What happens when you delete your account. Your profile is deactivated immediately and removed from search. Within 30 days we anonymise your personal data — your name, phone number, email and photo are removed or replaced with an anonymous identifier. Bookings, transactions and reviews remain in anonymised form. Records we are legally required to keep (Section 8) are retained for the stated period and then deleted. Deletion cannot be reversed once anonymisation has run, and you cannot recover wallet balance, credits or booking history afterwards — withdraw or use any wallet balance before deleting.

10. Security We protect your information with measures including: • encryption of data in transit using TLS; • hashing of authentication credentials; • role-based access controls, so staff can access only what their role requires; • logging of administrative actions on accounts, payouts and bookings; • OTP verification for account access and sensitive changes; • separation of production and test environments; • vetting of vendors who handle personal data. We do not store full card details; payment card data is handled by gateway partners under their own regulatory obligations. No system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your device and your OTP codes secure. We will never ask you for your OTP, password or full card number — over the phone, by SMS, by WhatsApp or in the app. If someone does, they are not us. Report it through Help & Support immediately.

11. If something goes wrong If a security incident affects your personal information and is likely to cause you harm, we will: 1. contain and investigate the incident; 2. notify affected users without undue delay and within 72 hours of confirming the incident, describing what happened, what data was involved and what you should do; 3. notify the relevant authorities where the law requires it; 4. publish a notice on the Platform where the incident is widespread.

12. Service providers on the Platform If you register as a service provider, we collect additional information: business name and registration details, CNIC or NTN, bank account or mobile wallet details for payouts, business address, service menu and pricing, staff names and working hours, and business photographs. We use this to verify your identity and eligibility, list you on the Platform, calculate and make payouts, meet tax and anti-fraud obligations, and handle disputes. Provider identity and bank details are shared only with our payment and verification partners, and with authorities where required. They are not shown to customers. Your business name, address, service list, pricing, photographs and ratings are public. Provider records connected to payouts are retained for the periods in Section 8. Full provider terms are in the Provider Agreement.

13. Children The Platform is intended for people aged 18 and over. You may not create an account if you are under 18. An adult account holder may book a service for a child in their care — for example a haircut — by adding the child’s first name and age to the booking. We collect only what the provider needs to deliver that service safely, and we do not create a profile for the child, market to them or retain their details beyond the booking record. If we learn that someone under 18 has created an account, we will close it and delete the associated personal data. If you believe a child’s information has been given to us, contact us through Help & Support and we will remove it.

14. Cookies and similar technologies Our website uses: • Essential cookies — sign-in, session, security and fraud prevention. These cannot be switched off. • Preference cookies — remembering your city, language and settings. • Analytics cookies — understanding how the site is used so we can improve it. These run only if you accept them. You can accept or reject non-essential cookies through the banner shown on your first visit, and change your choice later through the cookie settings link in the footer. You can also block cookies in your browser, though parts of the site may stop working. Our mobile apps use device identifiers and SDKs for crash reporting, analytics and push notifications rather than cookies. You can reset your advertising identifier in your device settings. If you sign in using Google, Google receives the fact that you signed in to Book For Look and provides us with your name, email address and profile picture. Google’s own privacy policy governs what they do with that.

15. Complaints If you are unhappy with how we have handled your information, contact us first through Help & Support or at info@bookforlook.com. We will acknowledge within 5 working days and aim to resolve the matter within 30 days. If you are not satisfied, you may: • complain to the Pakistan Telecommunication Authority where the issue concerns SMS or telecom subscriber data; • report suspected cybercrime, including unauthorised access to or misuse of your data, to the FIA Cyber Crime Wing at www.nr3c.gov.pk; • raise a payment-related matter with your bank or wallet provider, or with the Banking Mohtasib Pakistan; • pursue any remedy available to you in the courts of Pakistan. If a national data protection authority is established under the Personal Data Protection Bill once enacted, we will add its details here.

16. Changes to this Policy We may update this Policy. When we do, we will change the "last updated" date above. If a change materially affects your rights or how we use your information, we will notify you in the app or by email at least 14 days before it takes effect, and where the law requires it we will ask for your consent again. Previous versions are available on request.

17. Contact Company: Buzmasol (Pvt) Ltd Address: Lahore, Pakistan Email: info@bookforlook.com In-app: Help & Support