Privacy Policy

1. Data Controller, Statutory Framework & Identity

This Privacy Policy is issued by Cloud ERP 360 (Pvt) Ltd (herein referred to as "Cloud ERP 360", "we", "us", or "our"), a private limited software engineering corporation duly incorporated under the laws of Pakistan with company registration authority, maintaining its primary corporate headquarters at Office No. 305, 3rd Floor, Makkah Tower, Sector E-11/4, Islamabad, Pakistan, and international operations represented at 85 Great Portland Street, First Floor, London, United Kingdom, W1W 7LT.

We govern all data processing operations in strict adherence to applicable international and national data protection statutory regimes, including without limitation the European Union General Data Protection Regulation (EU GDPR 2016/679), the United Kingdom Data Protection Act 2018 (UK GDPR), the Prevention of Electronic Crimes Act (PECA 2016) and Personal Data Protection statutory bills of Pakistan, the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL), and Saudi Arabian Personal Data Protection Law (Royal Decree M/19).

2. Classification of Roles: Data Controller vs. Data Processor

To maintain legal transparency under global data protection jurisprudence, Cloud ERP 360 operates under two distinct legal classifications depending on how information is created, stored, and utilized:

3. Categories of Information We Collect & Process

We adhere strictly to the statutory principle of data minimization (GDPR Article 5(1)(c)), collecting only records strictly essential for platform execution, transactional fulfillment, and statutory taxation compliance:

• check_circle
  Account & Organizational Profile Data: Full legal name, business corporate entity name, registered office address, designated administrative email address, telephone and WhatsApp contact numbers, national tax identifier (NTN, STRN, CNIC, or VAT ID required for tax integration), and encrypted authentication passwords.
• check_circle
  Operational ERP & Retail POS Data: Inventory master records, batch/lot tracking numbers, warehouse locations, sales receipts, customer ledgers, supplier bills, cashier shift reconciliations, and fuel nozzle meter readings created inside the tenant's isolated database.
• check_circle
  Technical, Diagnostic & Telemetry Data: Client IP addresses, browser user-agent strings, device operating system version, access timestamps, HTTP request paths, API latency telemetry, and system error crash logs used strictly to diagnose bugs and maintain 99.9% uptime SLA.
• check_circle
  Payment & Billing Records (Paddle Merchant of Record): Subscription plan tier, billing cycle (monthly/annual), transaction confirmation tokens, and invoice VAT receipts. Note: All credit card, debit card, and banking transactions are processed securely by Paddle. Cloud ERP 360 never collects, handles, or stores raw payment card numbers or CVV codes.

4. Lawful Bases for Processing Under International Law

Every single data processing activity carried out by Cloud ERP 360 is legally grounded in one of the recognized lawful bases set forth in Article 6 of the GDPR:

5. Paddle Payment Gateway & Merchant of Record Architecture

To maintain peak financial data protection and statutory consumer compliance across international jurisdictions, all online subscription billing, order checkout, recurring subscription invoicing, and tax collection for Cloud ERP 360 is processed through our authorized Merchant of Record, Paddle (Paddle.com Market Ltd, Judd House, 18-29 Mora Street, London, EC1V 8BT, UK).

• check_circle PCI-DSS Level 1 Compliance: Paddle is certified at the highest tier of the Payment Card Industry Data Security Standard (PCI-DSS). All card inputs occur in isolated, tokenized iframes directly on Paddle servers.
• check_circle Zero Raw Financial Storage: Cloud ERP 360 servers never receive, store, or process raw credit/debit card numbers, expiration dates, or CVV security codes. We store solely anonymous customer IDs and billing transaction references provided by Paddle.
• check_circle Paddle Privacy Policy: Payment transactions are governed concurrently by Paddle's Privacy Policy, accessible at paddle.com/legal/privacy.

6. Multi-Tenant Isolation, Encryption & Infrastructure Defense

Security is embedded into the core database architecture of Cloud ERP 360 through strict architectural constraints governed by our lead engineering statutes:

7. Statutory Tax Invoicing Integration & FBR PRAL Verification

For businesses subject to digital fiscalization mandates in Pakistan, Cloud ERP 360 includes certified real-time integration with the Federal Board of Revenue (FBR) and Pakistan Revenue Automation Limited (PRAL) servers:

• check_circle Customer-Controlled Activation: Fiscal tax synchronization operates strictly upon affirmative activation by the tenant utilizing their official FBR POS-ID credentials.
• check_circle Transmitted Metadata: Only the legally required fiscal data fields specified by SRO 1006(I)/2021 (such as invoice number, item description, quantity, taxable value, sales tax rate, and buyer NTN/CNIC where applicable) are transmitted to statutory servers. Internal margin calculations, proprietary cost formulas, and non-statutory metadata are never shared.
• check_circle Real-Time QR Cryptographic Verification: FBR invoice numbers and PRAL cryptographic QR codes returned by tax servers are printed directly on thermal customer receipts, ensuring transparent verification by retail patrons.

8. Third-Party Subprocessors & Service Partners

To operate our global cloud infrastructure and deliver mission-critical software capabilities, Cloud ERP 360 engages vetted third-party service subprocessors bound by strict Data Processing Agreements (DPAs):

9. Data Retention, Portability & Account Erasure

We retain personal data and commercial records only for as long as necessary to fulfill operational obligations, satisfy warranty terms, or comply with statutory financial audits:

• check_circle Active Subscriptions: Operational tenant datasets remain fully accessible and maintained throughout active subscription tenure.
• check_circle 60-Day Post-Cancellation Export Grace Period: Upon voluntary cancellation or non-renewal of a subscription, the tenant database is placed into a secured read-only state for sixty (60) calendar days, during which the customer can export all catalog, contact, and accounting ledgers in standard CSV, Excel, or JSON formats without restriction.
• check_circle Permanent Cryptographic Purging: Following the 60-day export window, or upon an affirmative written request for erasure, tenant database rows and attached media files are permanently and irretrievably overwritten in our active database clusters within 30 business days.
• check_circle Statutory Tax Archival: Under corporate taxation statutes, digital invoice transaction logs submitted to national tax authorities are archived in cold immutable format for the mandatory statutory audit window (typically 5 to 7 years) as required by law.

10. International Data Transfers & Global Safeguards

As a global enterprise cloud operating system supporting organizations across Pakistan, the United Kingdom, UAE, Saudi Arabia, Qatar, and North America, personal and commercial data may be processed in countries outside your country of origin.

Whenever cross-border transfers occur, we implement robust contractual, technical, and organizational mechanisms recognized under international law, including the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum (IDTA), and end-to-end data encryption in transit and at rest. We never transfer customer data to jurisdictions lacking comprehensive data protection legislation without explicit contractual safeguards.

11. Your Statutory Data Subject Rights & Controls

Under global data protection statutes (including GDPR Chapter III and international equivalents), you hold fundamental rights concerning your personal data:

12. Cookies, Local Storage & Web Telemetry

We use secure HTTP cookies and HTML5 local storage technologies strictly for technical authentication and operational integrity:

• check_circle Strictly Necessary / Session Cookies: Essential for user session persistence, Cross-Site Request Forgery (CSRF) protection tokens, and role-based access verification. The platform cannot function without these cookies.
• check_circle Functional & Local Preferences: Storing active cashier register ID, active branch selection, thermal receipt printer settings, and table layout zoom preferences locally in your browser.
• check_circle Zero Invasive Third-Party Ad Trackers: We do not deploy invasive third-party cross-site advertising trackers or data-broker cookies. You can manage or disable cookies in your web browser preferences.

13. Data Breach Detection & 72-Hour Notification Protocol

We maintain 24/7 automated security telemetry, Web Application Firewall (WAF) threat filtering, and intrusion detection systems to safeguard our cloud infrastructure.

In the improbable event of a confirmed security breach involving personal or operational data, Cloud ERP 360 will execute our statutory breach incident response protocol:

• 1 Immediately isolate affected clusters, revoke compromised tokens, and deploy counter-measures within minutes of detection.
• 2 Notify the relevant supervisory data protection authorities without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, in accordance with GDPR Article 33.
• 3 Directly communicate with affected tenant administrators outlining the nature of the breach, affected records, and remediation recommendations.

14. Data Protection Officer & Official Inquiries

If you have questions, regulatory inquiries, or wish to exercise your data subject rights regarding this Privacy Policy, our dedicated Data Protection Officer and Legal Counsel are available to assist you: