Privacy Policy

NexisERP is a cloud enterprise resource planning (ERP) service developed and operated by Nexis Tech Solutions (Pvt) Ltd (“we”, “us”), a company in Pakistan. This policy covers the NexisERP service, this website at nexiserp.com, and the emails we send in connection with them.

This is the privacy policy for NexisERP. Where the general privacy policy published for our company’s other products and services says something different about NexisERP, this policy applies.

For review: Confirm that this policy supersedes the NexisERP section of the company website’s privacy policy, and arrange for that section to refer here. Confirm the exact registered company name and whether the registered address is published.

We handle two kinds of information, in two different roles:

• Information we are responsible for. This is information about the people who visit this website, contact us, or hold an account with NexisERP, and about our customer relationship. We decide why and how it is used, as described in section 3.
• Business data we process for our customers. This is the information our customers enter into NexisERP to run their businesses. Each customer decides what it enters and why, and we process it only to provide the service to that customer, as described in section 4.

For review: Confirm the terms used for these two roles (for example “controller” and “processor”) and the legal framework that applies to them in Pakistan and in any other country where customers or users are located.

Enquiries. When you write to us, we receive your name, email address and whatever you include in your message, and we use it to reply and to follow up on your enquiry.

Account information. For each person who uses NexisERP we hold their name, sign-in name, email address, and, where provided, mobile number; the organization and companies they belong to and the role they hold in each; and their account status. We use it to give each person access to the right companies, to administer the account, and to contact the person about the service.

Customer relationship. We hold the details of each customer organization, its subscription and plan, its billing contact and billing details, and our correspondence with it. We use them to provide, bill and support the service.

Support requests. When someone raises a support request, we keep the request and our conversation with them so that we can resolve it and keep a record of it.

Website. This website does not ask you to sign in, sets no cookies and runs no analytics or advertising. Our hosting provider processes standard technical information about each request, such as the IP address and browser type, to deliver the website and keep it secure.

For review: Confirm the legal basis to be stated for each of these uses.

Our customers use NexisERP to keep their business records. Depending on how a customer uses the service, this may include records of its customers and suppliers (names, addresses, contact details and tax registration numbers), products and stock, batches and expiry dates, product documents such as certificates and safety sheets, quotations, orders, deliveries, invoices, bills and payments, bank and cash records, and accounting entries.

This information belongs to the customer. We process it only to provide NexisERP to that customer — to store it, to perform the actions the customer’s users ask for, to back it up and protect it, and to give support when the customer asks us to. We do not sell it, and we do not use one customer’s business data for another customer.

If your details appear in a business’s records in NexisERP — for example as one of its customers or suppliers — that business is responsible for them. Please contact that business with any request about your information; we will assist our customer as the law and our agreement with it require.

For review: Confirm whether a data processing agreement is offered to customers, and on what terms.

To keep the service secure and the records trustworthy, NexisERP keeps records of sign-in activity (including the time and the IP address of sign-in attempts, failed attempts and active sessions) and an audit trail of business changes in each company, recording who made each change and when. Where a person registers a passkey, we store its public key, never a biometric. A screen-lock PIN is stored only in a protected, non-reversible form.

These records are used to protect accounts, investigate problems, and give customers a reliable history of their own records. The audit trail cannot be edited after it is written.

NexisERP sends transactional emails that are needed to use the service: invitations to set a password, links to reset a forgotten password, notices that a password has been changed, and a notice to the person who invited a user when that user accepts. They are sent from no-reply@nexiserp.com.

These emails never contain a password. A link in them works only once and for a limited time. We do not send marketing emails from NexisERP.

For review: Confirm whether any marketing or product-update emails will be sent in future, and the consent and opt-out wording if so.

This website sets no cookies and uses no analytics, advertising or tracking technology.

The NexisERP application uses strictly necessary cookies to keep a signed-in person’s session. They are set only on the organization’s own NexisERP address, are not readable by scripts and end when the session ends. The application uses no advertising or tracking cookies.

We use a small number of service providers to operate NexisERP and this website:

• Amazon Web Services — hosting of the NexisERP application, its databases and file storage, backups, and delivery of transactional email.
• Vercel — hosting and delivery of this website.
• Hostinger — the domain name system for nexiserp.com and our company email mailboxes, including support@nexiserp.com.

These providers process information only to provide their services to us. We may also disclose information where the law requires it, or to protect the rights, property or safety of our customers, our users or ourselves.

For review: Confirm this list is complete, that each provider’s data processing terms are in place, and how customers will be told about a change of provider.

Our service providers operate infrastructure in several countries. Information in NexisERP and on this website may therefore be stored and processed outside Pakistan, under the providers’ contractual and security commitments.

For review: Decide whether to name the hosting region, and confirm what the law requires for transfers of information outside Pakistan and for customers in other countries.

We keep account and business data for as long as the customer’s subscription is active. When a subscription ends, the customer can ask for its data before it is deleted, and it is then deleted from the live service. Copies in backups are removed as those backups expire. Some records — such as invoices we issued and the security and audit records described above — may be kept for longer where the law requires or where they are needed to resolve disputes.

Customers remain responsible for keeping their own business records for as long as the law requires them to.

For review: Set the retention periods: how long data is kept after a subscription ends, the export window, the backup expiry period, and how long enquiries, support records and security records are kept.

We protect information with technical and organizational measures, including a separate database for each company workspace, role-based access enforced by the server, encryption of data in transit and at rest, protected sign-in, backups, monitoring and an audit trail. Our security page describes these measures in more detail. No online service can be completely secure, and customers should protect their own sign-in details and review who has access.

For review: Confirm the commitment to be made on security incidents — for example to notify affected customers without undue delay and as the law requires — and how notification will be given.

You may ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it where we no longer need it. Users of NexisERP can change their own password and manage their passkeys in the application, and administrators can manage their organization’s users.

To make a request, write to us at the address below. We may need to confirm your identity first. Requests about business records held by one of our customers should be made to that customer.

For review: Confirm the rights to be stated, the response time, and the law under which they apply.

NexisERP is a business service and is not intended for children. We do not knowingly collect information from children.

We may update this policy when our service, our providers or the law change. We will publish the updated policy here with its effective date, and tell customers about material changes in advance.

For review: Confirm the notice period and the channel for telling customers about material changes.

For privacy questions or requests, write to support@nexiserp.com with the subject “Privacy request”.

Nexis Tech Solutions (Pvt) Ltd
Pakistan

For review: Decide whether a dedicated privacy address should be used instead of the support address.