The Punjab Enforcement and Regulatory Authority ("PERA" or "the Authority") is a statutory body established under the Punjab Enforcement and Regulatory Authority Act by the Government of Punjab, Pakistan. This Privacy Policy explains how PERA collects, uses, stores, protects, retains, and shares information across its digital applications and connected web modules — including the citizen-facing Ask PERA mobile application available on Google Play.
Use of any PERA application or connected digital service constitutes acknowledgement of this Policy.
01 Introduction
PERA operates multiple digital applications and connected web modules to support internal governance, field enforcement, human-resource administration, and citizen-facing regulatory services. This Policy describes the Authority's privacy practices across all such services, with specific attention to the Ask PERA citizen application which allows members of the public to register accounts, file complaints, and track their progress.
02 Applications & Services Covered
This Policy applies to PERA applications and related digital services — including PERA 360, the PERA Enforcement App, the PERA HRMS App, Ask PERA (the citizen complaint application distributed on Google Play), and the official PERA website and connected public pages.
03 Definitions
Authorized User — a PERA officer, employee, hearing officer, administrator, or support user formally provisioned access by PERA.
Citizen User — a member of the public who has registered an Ask PERA account or who interacts with a PERA public page.
Personal Data — information relating to an identified or identifiable person.
Complaint — a written submission by a citizen reporting a regulatory matter for PERA's review, together with any attachments and location information the citizen chooses to provide.
04 Scope & Applicability
This Policy applies to data processed through PERA's covered mobile applications, connected web modules, citizen-facing public pages, and supporting backend systems.
05 Legal Basis for Processing
- Statutory mandate under the Punjab Enforcement and Regulatory Authority Act.
- Legitimate government interest in public safety, accountability, evidence preservation, and resource management.
- Employment and official duty requirements for officers and employees using internal applications.
- Citizen consent — when a citizen registers an Ask PERA account, submits a complaint, attaches files, or shares device location, that act constitutes consent to process the information for the purposes described in this Policy.
06 Accounts, Roles & Access Management
PERA's internal applications do not provide open public registration. Accounts for internal users are created, modified, suspended, and removed through PERA IT Administration.
Citizen accounts on Ask PERA are self-registered. To create an account a citizen provides the following information, all of which is collected only with the citizen's explicit action:
- Full name and father's name
- Computerised National Identity Card (CNIC) number — verified against NADRA
- Mobile telephone number — verified against PTA records via SMS one-time-password
- Email address
- A password chosen by the citizen (stored only as a salted cryptographic hash)
Once registered, a citizen may sign in to file complaints, attach evidence, track status updates, view their own complaint history, and delete their account at any time (see Section 14).
07 Information We Collect
- Identity & account data — names, user IDs, employee IDs, CNIC, mobile number, email, role, station, posting.
- Citizen registration data — the items listed in Section 6 above, plus NADRA / PTA verification results.
- Complaint content — the incident address typed by the citizen, the category, the narrative description, the assigned district and tehsil, and any optional confidentiality flag.
- Location data — optional GPS coordinates (latitude and longitude) of the incident, attached only when the citizen explicitly taps the "Use my current location" control. See Section 8.
- Attachments — photos, videos, voice notes, and supporting documents that the citizen explicitly selects and uploads with a complaint. See Section 9.
- Operational & case data — inspections, challans, FIRs, confiscations, public complaints and their status history.
- Technical & security data — timestamps, IP address, device model, OS, application version, error logs.
Ask PERA does not collect contacts, calendar entries, SMS messages, call logs, advertising identifiers, or device-installed application lists.
08 Location Data
The Ask PERA mobile application uses the device's precise location (latitude / longitude from the Android geolocator service) only when the citizen taps the "Use my current location" control while filing a complaint. The reading is taken once at that moment to pre-fill the incident location; the application does not track location in the background and does not share location with any third party.
The Pera360 mobile application uses the device's precise location (latitude / longitude from the Android geolocator service) only when the surveyer submits survey data.It is not treated as surveyer location , but treated as the shop location foe which survey is being carried out the application does not track location in the background and does not share location with any third party.
The citizen may decline the location prompt or type the address manually. A complaint can be submitted without any location data. Coordinates that are captured are stored alongside the complaint record on PERA infrastructure and are visible only to authorised enforcement staff handling that complaint.
09 Attachments (Photos, Videos, Audio, Documents)
When filing a complaint a citizen may attach evidence files using the device camera, microphone, or file picker. PERA processes only those files the citizen selects; it does not scan or index the device's media library.
- Photos — captured with the camera or chosen from the gallery (size limited per file).
- Videos — captured with the camera or chosen from the gallery.
- Voice notes — recorded with the microphone for the purpose of the complaint, with the citizen's awareness; recording does not occur in the background.
- Documents — PDFs and similar files chosen by the citizen.
Attachments are uploaded over an encrypted channel and stored on PERA's controlled storage. They are accessible only to authorised enforcement staff routed the complaint and to PERA system administrators.
10 Purpose & Lawful Use of Information
PERA processes data to authenticate users, enable field operations, provide dashboards for supervisors, manage HR, register and route citizen complaints, support legal follow-up, and maintain system security. Information collected from Ask PERA citizen accounts is used solely to register complaints under the citizen's verified identity, to communicate status updates, to enable enforcement officers to investigate and resolve the matter, and to preserve an audit trail required by law.
11 Data Sharing, Disclosure & External Links
PERA shares data only where necessary for official operations, lawful obligations, or clearly disclosed service delivery. Complaints submitted confidentially have the complainant's identity withheld from enforcement staff. PERA does not sell, rent, or trade citizen personal data and does not share it with advertisers, data brokers, or analytics companies.
Limited disclosures may occur to: (a) other Government of Punjab or Government of Pakistan entities where required by law or for the lawful coordination of enforcement action; (b) NADRA and PTA for the sole purpose of identity / mobile-number verification at the moment of citizen registration; and (c) Google Play infrastructure for the distribution of the application binary itself.
12 Storage, Security & Retention
PERA hosts operational and citizen-service data on government-controlled infrastructure within Pakistan. All communication between applications and backend servers is encrypted using HTTPS / TLS 1.2 or higher. Passwords are stored only as salted cryptographic hashes; PERA staff cannot read them.
Complaint records and their attachments are retained for as long as required for the regulatory and legal purposes for which they were collected, including any statutory audit period. When a citizen deletes their account (Section 14), personal identifiers are removed or anonymised while the regulatory complaint record itself is preserved in accordance with the legal duty to maintain an enforcement audit trail.
13 User Rights
- Right of access — you may access information recorded under your account.
- Right of correction — you may request correction of inaccurate personal data.
- Right of deletion — you may delete your Ask PERA account at any time (Section 14).
- Right to withdraw consent — you may revoke device permissions (camera, microphone, location) at the operating-system level at any time; this disables the affected feature in the app but does not by itself delete data already submitted.
- Right to report — you may report any suspected privacy violation using the contact details in Section 17.
14 Account Deletion
In compliance with Google Play's user-data policy, every citizen who can register an Ask PERA account can also delete that account from inside the application at any time, with no need to contact PERA.
To delete your account from the mobile app:
- Open Ask PERA and sign in.
- Open the menu and tap My Profile.
- Scroll to the Danger Zone at the bottom of the screen.
- Tap Delete My Account and confirm the warning dialog.
To request account deletion from the web, or if you no longer have access to the app, write to info@pera.punjab.gov.pk from the registered email address with the subject line "Account deletion request" and PERA IT will process it within a reasonable period.
What happens when you delete your account. Your sign-in credentials are invalidated immediately and all active sessions are terminated. Your personal profile (name, father's name, CNIC, mobile number, email) is removed or anonymised from active records. Complaint case records that you previously filed are retained in PERA's regulatory system for the audit and legal-retention period required by law, but stripped of personal identifiers wherever the law permits. Attachments associated with a closed or pending case may also be retained for the same audit purpose. Account deletion cannot be reversed.
15 Children's Privacy
Ask PERA and the other applications covered by this Policy are not directed to children under the age of 13 (or the equivalent minimum age in the user's jurisdiction). PERA does not knowingly collect personal data from children. Citizen registration requires a CNIC, which under Pakistani law is issued only to persons aged 18 and above. If PERA becomes aware that an account has been created by, or personal data has been provided by, a child, that data will be deleted promptly.
16 Policy Updates
PERA may update this Policy from time to time to reflect changes in applicable law, regulatory practice, or the functionality of its applications. The "Last updated" date at the top of this page is revised on any such change. Material changes will be announced through the application and the PERA website. Continued use of any covered application after the effective date of an updated Policy constitutes acceptance of the changes.
17 Contact Information
Information Technology Administration
PERA Headquarters, Government of Punjab, Lahore, Pakistan
Website: pera.punjab.gov.pk
Email: info@pera.punjab.gov.pk · Helpline: 1315