Regulatory & Compliance Framework

1. How this fits together

The Terms of Service is the umbrella agreement. This page explains why the other policies say what they say — it is a reference, not a separate contract. Where this page and a specific policy differ, the specific policy (and the Terms) control.

Statute names and their amendment status are stated as at the Last updated date above and are refreshed when the law changes.

2. Pakistan — national law

2.1 Electronic Transactions Ordinance (ETO) 2002

Gives legal recognition to electronic documents, records, communications and signatures, and to contracts formed electronically. On GimartHub this means:

• The Terms of Service, Seller Agreement, Privacy Policy and every other policy are binding electronic agreements.
• Sign-up is click-wrap acceptance. A buyer cannot create an account, and a seller cannot be activated, without ticking a box that explicitly accepts the Terms and Privacy Policy. GimartHub records the acceptance (user id, policy version, timestamp, IP) as an electronic record admissible under the ETO.
• Order confirmations, escrow-status changes, delivery submissions, payment-verification decisions and dispute outcomes are electronic records retained by GimartHub.

2.2 Prevention of Electronic Crimes Act (PECA) 2016, as amended by the Prevention of Electronic Crimes (Amendment) Act 2025

Criminalises unauthorised access to information systems and data, electronic fraud, electronic forgery, identity theft, and dishonest retention/interference with data. The 2025 amendment created new bodies and moved primary cyber-crime investigation to the National Cyber Crime Investigation Agency (NCCIA) (alongside the FIA's existing role).

Because sellers hand over high-value accounts and digital items, GimartHub:

• Keeps an audit trail for fraud investigation and lawful requests — including account IP / access logs, session metadata, order timeline events, payment-proof submissions and their review decisions, delivery records, and buyer–seller message logs.
• Treats recovering or reclaiming a game account after it has been sold (via the original email, 2FA, or a publisher recovery process) as, potentially, an offence under PECA (unauthorised access / dishonest retention) in addition to a breach of the Acceptable Use Policy and Seller Agreement.
• Cooperates with the NCCIA / FIA and courts on valid legal process, and may preserve and disclose records accordingly. Retention periods are in the Privacy Policy.

2.3 e-Commerce Policy of Pakistan (2019) and the Second National e-Commerce Policy ("e-Commerce Policy 2.0", 2025–2030)

Pakistan's e-commerce policy framework (2019), and the draft second policy for 2025–2030, push marketplaces toward: transparent seller-identity disclosure, clearly published refund and return policies, defined escrow / dispute-resolution mechanisms with stated timelines, consumer protection in the digital environment, and interoperable local digital payments. GimartHub reflects these through:

• Public seller profiles with ratings, completed-order counts and a verified marker; seller onboarding that collects identity information (see §2.6, KYC).
• A published, step-by-step Escrow & Payments Terms and Refund & Dispute Policy with response-time targets.
• Local payment options — see §2.5.

2.4 Consumer protection

Consumer protection in Pakistan is largely provincial (e.g. the Punjab Consumer Protection Act 2005 and equivalents in other provinces) plus ICT-consumer rules for federal territory. GimartHub's consumer-facing commitments (accurate listings, honest pricing, a real refund/ dispute route, no unfair terms) are written to be consistent with these regimes; mandatory consumer rights in a buyer's province or country are not waived by the Terms.

2.5 Payments — State Bank of Pakistan (SBP)

Payments in Pakistan use SBP-regulated channels only. GimartHub supports, or intends to support, Raast — Pakistan's instant payment system — including Raast Person-to-Merchant (P2M) acceptance (QR code, Raast Alias, IBAN, Request-to-Pay), alongside JazzCash, Easypaisa and bank transfer. SBP has directed banks and gateways to enable Raast acceptance for e-commerce merchants (deadline 31 March 2025) and requires transparent fee disclosure, clear reconciliation and an accessible dispute process — all reflected in the Escrow & Payments Terms. GimartHub is a marketplace, not a bank or a payment institution, and the escrow balance is not stored value or e-money.

2.6 AML / CFT and KYC

GimartHub follows a risk-based anti-money-laundering / counter-financing-of-terrorism approach aligned with the Anti-Money Laundering Act 2010 (as amended, including the 2020 amendments), the FATF Recommendations, and the supervision framework under Pakistan's AML/CFT Authority (established 2023), SBP and SECP. In practice:

• Payout thresholds trigger verification. A seller must complete identity verification (phone + government ID, and where needed proof of source) before cumulative payouts exceed USD 500, and at any time on risk grounds.
• Sanctions / restricted-party screening on payouts; monitoring for structuring, rapid in-and-out flows, and mismatched identities.
• Suspicious activity may be reported to the Financial Monitoring Unit (FMU) as required.

2.7 Business registration — SECP and FBR

If and when GimartHub is incorporated as a Pakistani entity, it will register with the Securities and Exchange Commission of Pakistan (SECP), obtain a National Tax Number (NTN) from the Federal Board of Revenue (FBR), and register for sales tax on services with the relevant provincial revenue authority before charging platform service fees or commission. Until then GimartHub operates as an unincorporated venture (see Terms of Service).

3. International law and standards

3.1 DMCA safe harbour (17 U.S.C. § 512)

GimartHub is a neutral intermediary / venue, not the seller of any listed asset. It operates a public notice-and-takedown process so copyright owners (including game publishers such as Riot Games, Valve, Epic Games, Krafton, HoYoverse and Electronic Arts) can request removal of allegedly infringing user content instead of suing the platform. See the DMCA / Copyright Policy: designated agent, notice requirements, counter-notice, restoration, and a repeat-infringer termination policy. Equivalent notice-and-takedown handling is offered for other jurisdictions.

3.2 GDPR (EU) and UK GDPR

For users in the EU/EEA, processing follows Regulation (EU) 2016/679 (GDPR); for UK users, the UK GDPR and Data Protection Act 2018 (as amended). The Privacy Policy sets out lawful bases, data-subject rights (access, rectification, erasure, restriction, objection, portability), international-transfer safeguards, a 72-hour breach-notification commitment, and a route to complain to a supervisory authority.

3.3 CCPA / CPRA (California)

For California residents, GimartHub honours the California Consumer Privacy Act as amended by the CPRA, including the updated CCPA regulations effective 1 January 2026 (expanded "sensitive personal information", requirements around automated decision-making technology, risk assessments and cybersecurity audits). This includes the rights to know, delete, correct, and to opt out of "sale"/"sharing" — GimartHub does not sell personal information, and honours the Global Privacy Control signal.

3.4 Pakistan data-protection law (pending)

Pakistan does not yet have a comprehensive data-protection statute. A Personal Data Protection Act has been in draft for years; the latest draft was approved by the Federal Cabinet in 2025 but, as of this page's date, has not been enacted. GimartHub's Privacy Policy is written to be broadly compatible with that draft (controller obligations, data- subject notices and rights, breach notification, and localisation of sensitive data) and will be updated to comply once the Act is in force. Until then, privacy is protected in Pakistan mainly through PECA 2016 and the constitutional right to privacy (Article 14).

4. Records, security and retention (summary)

Security controls (encryption in transit and at rest for sensitive fields, hashed passwords, least-privilege access, audit logging, upload scanning) are summarised in the Privacy Policy.

5. Contact

Compliance, legal and law-enforcement requests: the contact page · Security: The contact page (mark it “security”) · GimartHub, Pakistan.