Privacy Policy

VENDIXS – PRIVACY POLICY Effective Date: June 14, 2026 Vendixs ("we," "our," "us") is committed to protecting your privacy and handling your data with transparency and care. This Privacy Policy explains how we collect, use, store, and protect information when you use the Vendixs platform ("Service"). ────────────────────────────────────────────── 1. INFORMATION WE COLLECT 1.1 Account Information - Your name, email address, and password when you register. - Business name, business type, industry, and contact details. - Billing and subscription information. 1.2 Business Data Data you enter into the platform on behalf of your business: customers, products, inventory, sales orders, repair tickets, appointments, patient records, employee records, attendance, payroll, vendor listings, wholesale orders, documents, training materials, and other business records. This data is owned entirely by you. 1.3 Employee & HR Data When using the HR & Workforce module: employee names, contact details, attendance records, leave history, salary information, payroll data, expense claims, job positions, documents, and performance records. This data is collected by you as the employer and processed by us on your behalf. 1.4 Vendor & B2B Marketplace Data When using the Vendor/Wholesale module: vendor profiles, product listings, pricing, buyer details, order history, delivery records, and payment tracking. This data is created and owned by the business using the marketplace features. 1.5 Usage Data - Server log data: IP address, browser type, pages visited, actions taken within the platform, and timestamps. - Device and session information when using the mobile application. 1.6 Payment Information Subscription and billing records. Payment card details are handled exclusively by our payment processor and are never stored on Vendixs servers. 1.7 Support Communications Messages, attachments, and information you send to our support team. ────────────────────────────────────────────── 2. HOW WE USE YOUR INFORMATION We use the information we collect for the following purposes: - To provide, operate, maintain, and improve the Service. - To process your subscription and send billing-related communications. - To send account notifications including trial expiry alerts, maintenance notices, and platform announcements. - To respond to support requests and resolve technical issues. - To detect, investigate, and prevent fraud, abuse, and security incidents. - To comply with applicable legal and regulatory obligations. - To develop new features and improve existing ones (using aggregated, non-identifiable data only). We do NOT use your business data (customers, orders, products, employees, vendor data, etc.) for advertising, marketing to third parties, or any purpose beyond delivering the Service to you. ────────────────────────────────────────────── 3. DATA ISOLATION Every business account on Vendixs is fully isolated. Your data is completely inaccessible to other businesses on the platform. Staff members can only access data within the specific business account they have been invited to, and only according to the role and permissions assigned to them by the Business Owner. ────────────────────────────────────────────── 4. DATA SHARING We do not sell your personal or business data to any third party. We may share data only in the following limited circumstances: - Infrastructure & Service Providers: Trusted vendors who help us run the platform (cloud hosting, email delivery, push notification services) operate under strict confidentiality and data processing agreements. - Legal Compliance: If required by Pakistani law, a court order, or a lawful government authority request. - Business Transfer: In the event of a merger, acquisition, or sale of Vendixs assets, your data may be transferred to the acquiring entity. We will notify you in advance of such a transfer. - Third-Party Integrations: When you connect a third-party service (payment processor, e-commerce platform, social media) through the platform, data relevant to that integration is shared with that provider as directed by you. ────────────────────────────────────────────── 5. VENDOR / B2B MARKETPLACE DATA The Vendor/Wholesale module facilitates B2B commerce between vendor businesses and buyers. In this context: - Vendor profile information (business name, product listings, pricing) is made visible to buyers within the marketplace. - Order data, delivery records, and payment status are stored within the respective vendor's and buyer's business accounts. - Vendixs does not share marketplace transaction data with third parties except as required to operate the platform. - Vendors are responsible for the accuracy of their listings and for handling buyer data in accordance with applicable law. ────────────────────────────────────────────── 6. HR, PAYROLL & EMPLOYEE DATA The HR & Workforce module processes sensitive employee information. In this context: - Vendixs acts as a data processor on your behalf — you (the Business Owner) are the data controller. - Employee data is stored exclusively within your isolated business account. - Vendixs does not access, use, or share employee data except as required to deliver the Service or comply with a legal obligation. - Business Owners are responsible for informing their employees about the use of this platform to manage their data and for complying with applicable Pakistani labour laws. ────────────────────────────────────────────── 7. MEDICAL DATA The Medical Clinic module may process sensitive health-related information including patient records, appointments, diagnoses, and prescriptions. This data: - Is stored exclusively within your business account and is never shared with third parties by Vendixs. - Is your responsibility to handle in compliance with applicable healthcare regulations and patient confidentiality obligations. - Vendixs provides a technical platform only and is not a healthcare provider, medical professional, or health data authority. ────────────────────────────────────────────── 8. DATA SECURITY We implement industry-standard technical and organisational measures to protect your data, including: - Encrypted data transmission using HTTPS/TLS protocols on all connections. - Passwords hashed using strong one-way algorithms — never stored in plain text. - Role-based access controls with granular, configurable permission settings per staff member. - Complete data isolation between business accounts at the database level. - Activity logs and audit trails for sensitive actions (logins, data exports, permission changes). - Regular security reviews, infrastructure monitoring, and vulnerability assessments. - Secure cloud infrastructure with redundancy and backup mechanisms. Despite these measures, no digital system can guarantee 100% security. You are responsible for: - Keeping your account credentials confidential. - Limiting access to your account to authorised staff only. - Logging out from shared or public devices. - Reporting suspected unauthorised access to support@vendixs.com immediately. In the event of a confirmed data breach that materially affects your personal data, we will notify you as required under applicable law. ────────────────────────────────────────────── 9. DATA RETENTION - Active accounts: Your data is retained for the duration of your active subscription. - Suspended accounts: Data is retained for up to 30 days after suspension while awaiting payment. - After termination: Data is retained for up to 30 days following account closure, after which it is permanently and irreversibly deleted. - Certain records (billing history, platform audit logs) may be retained for longer periods as required by applicable Pakistani law or for legitimate operational purposes. ────────────────────────────────────────────── 10. COOKIES AND TRACKING - The Vendixs web application uses session tokens (stored in the browser) for secure authentication. These are essential for the platform to function. - We do not use third-party advertising trackers, behavioural profiling cookies, or cross-site tracking tools. - Basic, non-identifiable usage analytics may be collected to understand how the platform is used and to guide improvements. ────────────────────────────────────────────── 11. PUSH NOTIFICATIONS The Vendixs mobile application uses Firebase Cloud Messaging (FCM) to deliver push notifications for events such as new orders, repair ticket updates, attendance alerts, payroll processing, and system announcements. By granting notification permission on your device: - Your device's FCM token is registered with our notification service. - Notifications are sent only for events relevant to your account and role. - You can revoke notification permissions at any time through your device's notification settings. - Device tokens are stored securely and only used to deliver authorised notifications to your device. ────────────────────────────────────────────── 12. CHILDREN'S PRIVACY The Service is intended solely for use by businesses and individuals who are at least 18 years of age. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has registered an account, please contact us at support@vendixs.com and we will take prompt action. ────────────────────────────────────────────── 13. YOUR RIGHTS Depending on applicable law, you may have the right to: - Access the personal data we hold about you and request a copy. - Request correction of inaccurate or incomplete personal data. - Request deletion of your account and associated personal data. - Object to or request restriction of certain types of data processing. - Withdraw consent where processing is based on consent (e.g., push notifications). - Data portability — request your data in a structured, machine-readable format. To exercise any of these rights, contact us at: privacy@vendixs.com We will respond to verified requests within a reasonable timeframe in accordance with applicable law. ────────────────────────────────────────────── 14. SUPER ADMIN ACCESS Vendixs platform administrators (Super Admins) may access platform-level information — including subscription status, billing records, account settings, and support-related information — to operate, maintain, and support the platform. Super Admins do not access your transactional business data (orders, customers, employees, products, vendor data) as a matter of policy, except in limited circumstances where you have explicitly requested support assistance that requires it. Any such access is logged. ────────────────────────────────────────────── 15. INTERNATIONAL DATA TRANSFERS Our servers and infrastructure may be located in or managed through cloud providers that operate internationally. If your data is transferred outside of Pakistan, we ensure that appropriate contractual safeguards are in place to protect it in accordance with applicable data protection obligations. ────────────────────────────────────────────── 16. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time to reflect changes in our practices, the platform, or applicable law. We will notify you of material changes via email or an in-platform notification before they take effect. The "Effective Date" at the top of this document reflects the date of the most recent revision. ────────────────────────────────────────────── 17. GOVERNING LAW This Privacy Policy is governed by the laws of the Islamic Republic of Pakistan. Any disputes related to this policy shall be subject to the exclusive jurisdiction of Pakistani courts. ────────────────────────────────────────────── 18. CONTACT For privacy-related inquiries, data access requests, or to report a concern: Email: privacy@vendixs.com General Support: support@vendixs.com Platform: vendixs.com