This policy explains how BMA Investment Advisors Limited ("BMAIA", "we") handles personal data in the BMA Invests mobile app for Android and iOS. It supplements our general Privacy Policy, which also applies. BMAIA is licensed and regulated by the Securities and Exchange Commission of Pakistan (SECP).
Data the app collects
| Category | What | Why |
|---|---|---|
| Identity | Full name, father’s / spouse’s name, CNIC / NICOP number with issue and expiry dates, date of birth, gender, marital status, nationality. | Opening and verifying your investment account (KYC / CDD), as required by SECP and AML/CFT law. |
| Contact | Email address, mobile number, mailing and permanent address. | Account access (login codes are sent to your registered email), transaction confirmations and service messages. |
| Financial | Bank name, account number / IBAN, occupation, source of income, Zakat status, tax residency (FATCA / CRS), risk-profile answers, holdings, investments, redemptions, conversions and their history. | Processing your transactions, assessing suitability, showing your portfolio and meeting tax and regulatory reporting. |
| Photos and documents | Photos or files of your CNIC, proof of income and other KYC documents you choose to attach, proof of payment for investments, and an optional profile photo. | Verifying your identity and payments. Only the files you pick or photograph are uploaded. |
| Nominee / next of kin | Name, relationship and CNIC of a nominee or next of kin, if you provide them. | Account opening requirements. |
| App and device | A device name sent at login, a push-notification token, login times and the IP address of requests to our servers. | Keeping your account secure (session management, sign-in alerts, fraud prevention) and sending notifications you have allowed. |
| Messages you send us | Complaints and support requests submitted through the app. | Resolving your request and meeting complaint-handling obligations. |
Providing this information is required to open and operate an investment account. You can use the app to view information about our funds without providing it.
What the app does not collect
- Your location, contacts, call logs, SMS messages or browsing history.
- Advertising identifiers. The app shows no advertising and contains no advertising or analytics trackers.
- Biometric data. If you turn on Face ID / fingerprint unlock, the check happens on your phone and the result never leaves it.
We do not sell your personal data, and we do not use it for third-party advertising.
Device permissions
- Camera and photos — only when you choose to photograph or attach a KYC document, proof of payment or profile photo.
- Notifications — to tell you about transaction updates and account activity. You can turn them off in your phone settings.
- Face ID / fingerprint — only if you enable biometric unlock.
Who we share it with
Personal data from the app is shared only as needed to provide the service or meet the law:
- Central Depository Company of Pakistan (CDC), which maintains unit-holder records and processes transactions for our funds;
- Service providers acting on our behalf under confidentiality agreements — technology and hosting providers, SMS and email delivery, and push-notification delivery;
- Banks involved in your investments and redemptions;
- Regulators and authorities — SECP, the Financial Monitoring Unit (FMU), tax authorities and others where the law requires.
How your data is protected
- All data between the app and our servers is encrypted in transit (HTTPS/TLS), and the app verifies our servers' certificates (certificate pinning) to block interception.
- Sign-in tokens are kept in your phone's secure storage (iOS Keychain / Android Keystore).
- Every sign-in needs your password and a one-time code; idle sessions are signed out automatically.
- Screens showing your financial information block screenshots and screen recording.
- On our side, access is restricted to authorised staff on a need-to-know basis.
How long we keep it
We keep your data while your account is open. After it closes, we keep the records that SECP regulations and AML/CFT laws require for the period they require, and then delete or anonymise them. Data that no law requires us to keep is deleted when your account is closed.
Deleting your account and data
You can ask us to close your BMA Invests account and delete your data at any time:
- In the app: Account → Request account deletion.
- By email: info@bmainvests.com with the subject "Account deletion request", from your registered email address.
- By phone or WhatsApp: UAN 021-111-262-111 or WhatsApp +92 320 2111145.
We will verify that the request comes from you before acting on it. If you still hold units in our funds, they must be redeemed or transferred before the account can be closed. Once it is closed we delete your app login, profile photo, notification tokens and any data the law does not require us to keep. Records that SECP and AML/CFT regulations require — such as KYC documents and transaction history — are retained for the legally required period and then deleted.
Your rights
You can view most of your information in the app, ask us for a copy of it, ask us to correct it, or ask us to delete it as described above, using the contact details on this page.
Children
The app is intended for adults (18+). Accounts for minors are opened only through a guardian as permitted by our account-opening rules.
Changes to this policy
We will update this page when the app's data practices change and revise the date at the top. Material changes will also be communicated in the app or by email.
Contact us
BMA Investment Advisors Limited · Email info@bmainvests.com · UAN 021-111-262-111 · Contact page