Privacy Policy

Effective: 18 July 2026  ·  Applies to: suffahsoft.com and the SuffahERP product

1. Overview

This Privacy Policy describes how Experts InfoTech (Pvt) Ltd., the company behind SuffahERP, collects, uses, discloses, and safeguards your information when you visit our website, request a demo, or use the SuffahERP platform. We take your privacy seriously and are committed to handling your data transparently and in accordance with applicable data protection laws, including the Personal Data Protection Bill of Pakistan where enacted, and internationally recognised standards such as the GDPR principles for customers in the European Union.

By using our website or products, you agree to the practices described in this policy.

2. Information we collect

We collect information in three ways: information you give us directly, information we collect automatically as you use our services, and information we receive from third parties.

Information you provide

• Account information: name, email, phone number, business name, role, and password when you sign up for a demo or create an account.
• Billing information: company address, NTN / tax ID, and bank details for invoicing.
• Support communications: the contents of messages you send us via contact forms, email, chat, or phone.
• Customer data: business data (products, customers, vendors, transactions) that you upload or create inside SuffahERP. You own this data — we only process it on your behalf to provide the service.

Information collected automatically

• Device & usage: IP address, browser type, operating system, referring URL, pages viewed, and time spent on our website.
• Product telemetry: feature usage statistics, error logs, and performance metrics within SuffahERP. We use this to improve the product.
• Cookies: small data files stored on your device. See our Cookie Policy for details.

Information from third parties

• Payment processors may provide transaction status and fraud signals.
• Integration partners (e.g., attendance machine vendors) may send data on your behalf when you connect their service.

3. How we use your information

We use the information we collect for the following purposes:

• To provide and operate SuffahERP — including authentication, data storage, transaction processing, and customer support.
• To communicate with you — sending service announcements, security alerts, billing notices, and product updates. You can opt out of marketing communications at any time.
• To improve our products — analysing usage patterns, identifying bugs, and designing new features. We use aggregated, anonymised data wherever possible.
• To secure our services — detecting and preventing fraud, abuse, and security incidents.
• To comply with legal obligations — including tax, accounting, and law enforcement requests where legally required.

4. Legal basis for processing

Where applicable law requires a legal basis, we rely on one or more of the following:

• Performance of a contract with you, including providing the SuffahERP service you have subscribed to.
• Legitimate interests in operating, securing, and improving our services, balanced against your rights and freedoms.
• Your consent where required, which you may withdraw at any time.
• Legal obligations to which we are subject.

5. Sharing & disclosure

We share information only as described below:

• Service providers: trusted vendors who help us operate our infrastructure (e.g., cloud hosting, payment processing, email delivery). Each is bound by confidentiality and data-processing terms.
• Your instructions: if you integrate SuffahERP with a third-party service (e.g., a bank feed or an e-commerce platform), we share data as you direct.
• Legal compliance: if we are required to disclose information by law, court order, or valid legal process.
• Business transfers: if Experts InfoTech is acquired, merged, or sells substantially all of its assets, your information may be transferred as part of that transaction. You will be notified in advance.
• Aggregated insights: we may publish or share anonymised, aggregated statistics (e.g., "the average SuffahERP customer manages 12,000 SKUs") that cannot be used to identify any individual or business.

6. Data security

We employ industry-standard technical and organisational measures to protect your information, including:

• AES-256 encryption of data at rest and TLS 1.3 encryption of data in transit.
• Multi-factor authentication and role-based access controls for all internal access.
• Regular third-party security audits and penetration testing.
• Encrypted, geographically distributed daily backups with point-in-time recovery.
• Continuous monitoring for anomalous activity and intrusion attempts.

No system is 100% secure. In the event of a personal data breach that is likely to result in a risk to your rights, we will notify you and the relevant authorities within the timeframes required by law.

7. Data retention

We retain your information for as long as necessary to provide the SuffahERP service and comply with our legal obligations. Specifically:

• Account information: for the life of your account, plus 7 years after closure for tax and audit purposes.
• Customer data (your business data in SuffahERP): for the life of your subscription. You may export or delete your data at any time. After account closure, data is retained for 90 days in case of accidental cancellation, then permanently deleted from production systems. Encrypted backups are purged within 12 months.
• Support communications: for 3 years to maintain context for ongoing issues.
• Marketing data: until you unsubscribe, plus a short suppression period to honour your opt-out.

8. Your rights & choices

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data (subject to legal retention obligations).
• Restrict or object to certain processing activities.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a data protection authority.

To exercise any of these rights, contact us at privacy@suffahsoft.com. We will respond within 30 days.

9. Cookies & tracking

We use cookies and similar technologies on our website and within SuffahERP. For full details, please see our Cookie Policy. You can manage your cookie preferences at any time via the cookie banner or your browser settings.

10. International data transfers

Your data is primarily stored in data centres in Pakistan. Some of our service providers (e.g., cloud hosting, email delivery) may process data in other countries. When we transfer personal data across borders, we ensure appropriate safeguards are in place, including contractual clauses approved by data protection authorities.

11. Children's privacy

Our services are not directed to children under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top. If changes are material, we will notify you by email or via a prominent notice in SuffahERP before the changes take effect.

13. Contact us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

• Email: privacy@suffahsoft.com
• Phone: +92 (3) 111-222-715
• Address: Experts InfoTech (Pvt) Ltd., Street # 1, Sajjad Industrial Estate, Behind Govt. Degree College for Women, Millat Road, Faisalabad 38000, Pakistan