1. Purpose of this Privacy Policy

This Privacy Policy explains how the Power Planning and Monitoring Company (PPMC), acting through the R&D Secretariat for the National Power Sector Innovation Program (NPSIP), collects, uses, stores, shares, protects, and retains information obtained through the NPSIP Innovation Hub and associated submission, screening, evaluation, communication, and reporting processes.

The policy applies to applicants, team members, institutional representatives, evaluators, screening officers, Steering Committee members, portal administrators, and other authorised users of the Innovation Hub.

2. Organisation Responsible for the Portal

The Innovation Hub is administered by the PPMC R&D Secretariat under the National Power Sector Innovation Program. For privacy, access, correction, or complaint matters, users may contact the organisation using the details in Section 19.

3. Information We Collect

3.1 Account and identity information

• Full name, email address, mobile number, designation, organisation, city, province, and other registration details.
• CNIC or other identity information only where formally approved as necessary for eligibility, verification, contracting, award administration, or fraud prevention.
• Login credentials, account status, authentication records, and security-verification information.

3.2 Submission and team information

• Innovation title, selected stream and theme, problem statement, proposed or proven solution, technical approach, implementation details, costs, outcomes, evidence, and supporting documents.
• Names, roles, qualifications, affiliations, contact details, and professional profiles of team members, partners, or institutional sponsors.
• Declarations relating to originality, authority to submit, intellectual property, conflicts of interest, and institutional approvals.

3.3 Evaluation and programme information

• Administrative screening outcomes, technical scores, evaluator rationales, strengths, weaknesses, clarification requests, recommendations, and consolidation records.
• Conflict-of-interest declarations, confidentiality undertakings, recusals, reviewer allocations, and evaluation audit records.
• Communication records, event participation, recognition decisions, and programme follow-up information.

3.4 Technical and usage information

• Internet Protocol address, browser and device information, login time, activity logs, pages accessed, files uploaded or downloaded, and system-error records.
• Cookies or similar technologies required for authentication, session management, security, accessibility, and portal performance.
• Audit logs showing who accessed, reviewed, modified, submitted, approved, or exported a record.

3.5 Sensitive or confidential information

Users should not submit personal, classified, commercially sensitive, security-sensitive, or third-party confidential information unless it is necessary for the application and the user is authorised to disclose it. The portal may restrict or reject material that is unnecessary, unlawful, excessively sensitive, or outside the programme's requirements.

4. How We Use Information

• Create and manage user accounts and authenticate authorised users.
• Receive, validate, register, and administer innovation submissions.
• Conduct Stage 1 administrative screening and Stage 2 technical evaluation.
• Allocate submissions to authorised officers and evaluators while managing conflicts of interest.
• Request clarifications, notify applicants, and administer evaluation deadlines and outcomes.
• Calculate scores, monitor inter-rater divergence, prepare ranked recommendations, and support Steering Committee review.
• Maintain the NPSIP Innovation Registry, institutional records, audit trails, and programme statistics.
• Prevent duplicate, fraudulent, malicious, or unauthorised submissions and investigate misuse.
• Improve portal reliability, accessibility, security, workflow design, and user support.
• Publish approved summaries of recognised innovations, where authorised and after appropriate review.
• Meet legal, audit, records-management, procurement, governmental, and regulatory obligations.

5. Basis for Processing

PPMC processes information because it is necessary to administer a public-sector innovation programme, perform official and institutional functions, manage submissions requested by users, protect the integrity and security of the programme, maintain official records, and comply with applicable legal and governmental requirements. Where consent is the appropriate basis for a specific activity, the portal will obtain it through a clear declaration or opt-in.

Pakistan's Ministry of Information Technology and Telecommunication currently publishes draft personal-data legislation and national data-governance instruments. Accordingly, this policy should be reviewed whenever binding privacy legislation, regulations, or government-wide data standards are issued or amended.

6. Sharing and Disclosure

Information may be disclosed only to the extent reasonably necessary to:

• Authorised PPMC and R&D Secretariat personnel.
• Stage 1 screening officers, Technical Evaluation Panel members, Panel Convenor, and Steering Committee members with role-based access.
• Government entities, power-sector organisations, technical experts, or implementation partners formally involved in the programme and bound by appropriate confidentiality and access restrictions.
• Approved technology, hosting, cybersecurity, email, document-storage, or support service providers acting under contractual controls.
• Audit, oversight, law-enforcement, regulatory, judicial, or competent governmental authorities where disclosure is legally required or officially authorised.
• The public, but only through approved summaries, announcements, recognition material, or innovation compendia. Confidential submission content, individual scores, and evaluator deliberations will not be publicly disclosed unless legally required or expressly authorised.

PPMC will not sell personal information. Programme data must not be used by evaluators or authorised users for personal research, commercial exploitation, recruitment, collaboration solicitation, or any purpose outside their authorised role.

7. Confidentiality of Submissions and Evaluations

Submission content, applicant identities before authorised publication, individual evaluator scores, written rationales, consolidation discussions, draft rankings, conflicts of interest, and pre-notification outcomes are treated as confidential evaluation records. Access is limited according to role and programme stage.

Evaluators must accept the NPSIP Governance Framework, Conflict of Interest Declaration, Confidentiality Undertaking, and Code of Professional Conduct before accessing submission materials.

8. Intellectual Property and Publication

Applicants retain ownership of their pre-existing intellectual property and submission content, subject to any separate agreement, award condition, funding instrument, employment rule, or applicable law. By submitting, applicants grant PPMC a limited, non-exclusive right to store, reproduce internally, review, evaluate, verify, archive, and use the material for programme administration.

PPMC may publish a non-confidential summary, title, team name, organisation, recognition category, and approved description of a recognised innovation. Sensitive technical details, proprietary data, or unpublished intellectual property should not be published without the applicant's approval or another lawful basis.

9. Data Storage, Hosting, and Cross-Border Processing

Information may be stored in PPMC-managed systems or approved third-party infrastructure.

Where service providers process data outside Pakistan, PPMC should apply contractual, security, access, and transfer controls proportionate to the sensitivity of the information and applicable government requirements.

10. Security Measures

• Role-based access control and least-privilege permissions.
• Multi-factor authentication for evaluators, administrators, and other privileged users.
• Encryption in transit and, where technically supported, encryption at rest.
• Secure document storage, malware scanning, session controls, backups, and recovery procedures.
• Immutable or protected audit logs for submission, evaluation, approval, export, and administrative activity.
• Conflict-of-interest controls and access removal upon recusal, role change, or completion of duties.
• Monitoring, incident response, vulnerability management, and periodic access review.

No electronic system is completely secure. Users are responsible for protecting their credentials and immediately reporting suspected unauthorised access.

11. Data Retention and Disposal

PPMC will retain information for the period necessary to administer NPSIP, maintain the Innovation Registry, support audits and reviews, resolve disputes, prevent duplication, preserve institutional memory, and comply with Government of Pakistan records-management requirements.

12. User Choices and Requests

Subject to applicable law, official-record obligations, and programme integrity, a user may request:

• Confirmation of whether PPMC holds their personal information.
• Correction of inaccurate or incomplete account information.
• Update of contact or team information before the relevant submission deadline.
• Deletion or deactivation of a draft account where no official submission record must be retained.
• Withdrawal of optional communications.
• Information about how a privacy or security concern was handled.

A submitted application and its evaluation record may not be deletable on request where retention is required for official, audit, legal, non-duplication, accountability, or programme-record purposes. PPMC may require identity verification before acting on a request.

13. Cookies and Similar Technologies

The portal may use strictly necessary cookies for login, security, session continuity, load balancing, language preferences, and protection against misuse. Optional analytics cookies should not be activated unless the portal provides an appropriate notice and consent mechanism where required.

14. Children and Eligibility

The portal is intended for persons eligible under the published NPSIP rules. Where applicants below the legally applicable age are permitted, the programme should require appropriate parent, guardian, educational-institution, or authorised-representative consent before collecting or publishing their information.

15. External Links and Third-Party Services

The Innovation Hub may link to external websites, video platforms, cloud storage, or government services. PPMC is not responsible for the privacy practices of external services that it does not control. Users should review the relevant third-party notices before providing information.

16. Security or Privacy Incidents

Suspected data loss, unauthorised access, credential compromise, malicious uploads, or confidentiality breaches should be reported immediately to [insert security incident email/helpline]. PPMC may suspend access, preserve logs, investigate the incident, notify competent authorities or affected persons where appropriate, and take corrective action.

17. Changes to this Policy

PPMC may update this Privacy Policy to reflect changes in law, programme rules, evaluation processes, technology, hosting, or institutional responsibilities. The portal will display the current version and effective date. Material changes may be communicated through the portal or registered email address.

18. Governing Framework

This policy is intended to operate consistently with applicable laws of Pakistan, authorised Government of Pakistan policies and records requirements, the Prevention of Electronic Crimes Act, 2016, NPSIP governance instruments, and future binding personal-data or digital-governance requirements. In the event of conflict, applicable law and formally approved government rules prevail.

19. Contact and Complaints

Questions, correction requests, complaints, or security concerns should be sent to innovation@ppmc.gov.pk, with the subject line "NPSIP Innovation Hub – Privacy Request". Users should include their name, submission reference number where applicable, and a concise description of the request. PPMC may request further information to verify identity and locate the relevant record.