Privacy Policy

1. Introduction

This Privacy Policy explains how OnePrefix collects, uses, shares, and protects personal data when you use ERPGear (the "Service"), including our web platform, mobile application, APIs, and related services.

We are committed to protecting personal data in accordance with:

• Egypt: Law No. 151 of 2020 (Personal Data Protection Law, "Egyptian PDPL")
• Saudi Arabia: Personal Data Protection Law ("KSA PDPL")
• UAE: Federal Decree-Law No. 45 of 2021 on Personal Data Protection
• Other GCC countries: respective national data protection laws
• EU/EEA: General Data Protection Regulation (GDPR), where applicable

2. Scope of this Policy

This Policy applies to:

• Tenants: businesses subscribing to ERPGear
• Authorized users: employees and agents of tenants who access the Service
• Mobile application users: individuals using the ERPGear mobile app (including field sales reps, drivers, warehouse staff)
• Website visitors: people who visit erpgear.com or oneprefix.com
• Data subjects within tenant data: individuals whose personal data tenants process through the Service (employees, customers, suppliers, contacts)

3. Our role under data protection law

4. What personal data we collect

5. How we use personal data

6. Legal basis for processing

Where applicable data protection law requires us to identify a legal basis, we rely on:

• Contract: to provide the Service you requested
• Legitimate interest: to improve our Service, prevent fraud, ensure security, send service-related communications, and defend legal claims
• Consent: for marketing communications, non-essential cookies, mobile app permissions (camera, location, etc.), and other processing where consent is the required basis
• Legal obligation: to comply with tax, anti-money-laundering, regulatory, and law enforcement requirements
• Vital interests (rare): to protect the life or physical safety of a person

You may withdraw consent at any time where processing is based on consent. Withdrawal does not affect lawfulness of processing before withdrawal.

7. How we share personal data

We share personal data only with the following categories of recipients:

8. International data transfers

OnePrefix is based in Egypt, with services primarily delivered through data centers in the Middle East / North Africa (MENA) region, including Egypt and the GCC. Through our sub-processors, some processing may occur in countries outside your jurisdiction, including the United States, Ireland, India, and elsewhere.

Where required by law:

• For transfers outside Egypt, we apply safeguards consistent with Egyptian PDPL (Law No. 151 of 2020) and implementing regulations
• For transfers outside Saudi Arabia involving KSA tenants, we apply safeguards consistent with KSA PDPL requirements for cross-border transfers
• For transfers outside the EU/EEA of data subject to GDPR, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission

Tenants with specific data residency requirements may contact info@erpgear.com to discuss enterprise data residency options.

9. Data retention

We retain personal data only as long as necessary for the purposes described in this Policy, or for longer periods where required by law:

• Account data: for the duration of your subscription + a reasonable period after termination (typically 12 months) for legal and operational reasons
• Billing and tax records: for the period required by Egyptian tax law (generally 5 years) and applicable local tax laws
• Customer Data (tenant-controlled): according to tenant instructions; upon account termination, Customer Data is deleted within 60 days from the date of termination request unless the tenant requests earlier deletion or legal retention applies
• Invoices and financial records (where we act as processor): retained for statutory periods under tax law even after tenant termination (typically 5-10 years depending on jurisdiction)
• Support and communication logs: 2 years
• Mobile app diagnostic data: 90 days rolling window
• GPS location data: retained as long as necessary for the specific feature (typically the active period plus 12 months for audit trail, unless tenant configures otherwise)
• Marketing data: until consent is withdrawn or you unsubscribe
• Cookies: per the retention period set in our cookie banner and your browser settings

After retention periods end, data is deleted or anonymized.

10. Your rights

Depending on your location, you may have the following rights:

• Right to access: request a copy of the personal data we hold about you
• Right to rectification: ask us to correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): ask us to delete your personal data, subject to legal retention obligations (note: tax and financial records are subject to statutory retention)
• Right to restrict processing: ask us to limit how we use your data in certain circumstances
• Right to data portability: receive your data in a structured, commonly used format (you can also export most of your data directly through the Service's export features)
• Right to object: object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time
• Right to lodge a complaint: with your local data protection authority (see Section 16)

To exercise any right, contact us at info@erpgear.com. We will respond within 30 days (extendable under law for complex requests).

If you are an individual whose data is processed by a tenant (e.g., employee, customer, supplier), exercise your rights by contacting the tenant directly. If that is not possible, contact us and we will forward your request.

11. Cookies, trackers, and mobile app identifiers

12. Security

We implement technical and organizational measures to protect personal data, including:

• Encryption in transit (HTTPS/TLS) and at rest for sensitive data
• Role-based access controls with principle of least privilege
• Regular security audits, penetration tests, and vulnerability assessments
• Incident detection, response, and notification procedures
• Vendor due diligence for sub-processors
• Employee training on data protection and confidentiality
• Secure development practices and code review
• Backup and disaster recovery processes

No system is completely secure. If we experience a data breach that is likely to result in a risk to affected individuals, we will notify affected parties and the relevant authorities as required by law.

13. Children's privacy

The Service is intended for business use and is not directed to individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact info@erpgear.com and we will delete it.

14. Automated decision-making

We do not make decisions with significant legal or similar effects on you based solely on automated processing, including profiling.

Individual tenants may configure the Service to perform automated approvals, credit checks, or other decisions within their own business processes. Where a tenant configures automated decision-making, the tenant (as data controller) is responsible for complying with applicable data protection law, including providing notice and enabling human review where required.

15. Changes to this Policy

We may update this Privacy Policy to reflect changes in our practices, the Service, or the law. Material changes will be notified by email or in-product notice at least 30 days before they take effect for tenants, and where changes affect end-user rights, a notification will be given through the Service.

Continued use of the Service after changes take effect constitutes acceptance.

16. Complaints

If you have concerns about how we handle your personal data, please first contact us at info@erpgear.com so we can try to resolve your concerns directly.

You also have the right to lodge a complaint with:

• Egypt: the Egyptian Personal Data Protection Center (PDPC), once fully operational under Law No. 151 of 2020
• Saudi Arabia: the Saudi Data and Artificial Intelligence Authority (SDAIA) — the regulator under KSA PDPL
• United Arab Emirates: the UAE Data Office
• Other GCC countries: the respective national data protection authority
• European Economic Area: your national data protection authority
• Other jurisdictions: the relevant data protection authority where you reside

17. Contact

For privacy-related questions, requests, or data subject rights:

For data processing inquiries from enterprise tenants (including requests for a Data Processing Addendum), please specify in your email.