What we collect and why
A photo of the CNIC front and back, plus a selfie of the professional holding the CNIC. We need all three to confirm identity, run a character / background check, and prevent fake or stolen-identity onboarding.
We additionally collect a recent utility bill or rent agreement to verify permanent residence in the service area.
How it is stored
All CNIC images are encrypted at rest with AES-256. Encryption keys are managed by our cloud provider’s key-management service in Asia and are rotated annually.
Images live in a private object-storage bucket that has no public read access. Pre-signed URLs are issued only when an authorised ops staff member needs to review a specific professional, and those URLs expire after 2 minutes.
We never store CNIC images on a professional's phone, our employees' laptops, email, or messaging tools. Access is from the admin panel only, behind enforced two-factor authentication and an IP-restricted VPN connecting only to the Lahore office.
Who can see it
Three roles can access CNIC images: the verification operator who handles the professional's onboarding, the senior ops manager who approves verifications, and our compliance lead. All three are full-time Domiraqo employees based at the Lahore office.
Customers never see professional CNIC data. The app shows a masked ID number on the professional profile (e.g. ••••• 1234) and a verification badge.
No third party (advertiser, marketer, analytics tool) ever sees a CNIC image or full number.
Audit logging
Every CNIC view is logged: which staff member, which professional record, at what time, from which IP. Logs are reviewed monthly by the compliance lead and retained for 2 years.
A professional can request a copy of who has accessed their CNIC record by emailing dpo@domiraqo.com. We respond within 5 working days (and within 30 days at the latest).
Retention and deletion
Active professional: CNIC retained as long as the professional is active on the platform.
Deactivated professional: 1 year retention for dispute resolution and legal compliance (tax, labour law, anti-fraud), then permanently deleted.
A professional may request earlier deletion by emailing dpo@domiraqo.com, provided no open dispute or pending payment involves their record.
Sharing with authorities
We share CNIC data only on receipt of a legally valid request from Pakistani law enforcement (including the Federal Investigation Agency), the FBR, the SBP, or a Pakistani court of competent jurisdiction. We do not share informally, and our legal team reviews every request.
When we do share, we notify the professional within 7 days unless legally restricted from doing so by a gag order or equivalent.