Privacy Policy

1. Introduction Welcome to NAXAS INVENTIONS LIMITED ("NAXAS", "we", "our", or "us"). NAXAS is a Bangladesh-based technology company specializing in Enterprise Resource Planning (ERP), Software as a Service (SaaS), Business Process Automation, Cloud-Based Solutions, Artificial Intelligence (AI), Mobile Applications, and Digital Transformation. We are committed to protecting the privacy, confidentiality, and security of our customers, business partners, and users. This Privacy Policy explains how we collect, use, process, store, share, and protect information when you visit our website, subscribe to our products, use our software, or interact with our services. By using our services, you acknowledge this Privacy Policy. Where consent is legally required, we will request it separately. 2. Scope of This Privacy Policy This Privacy Policy applies to our corporate website, associated digital services, and the following products and platforms: NAXAS ERP: Engineering ERP with Project Management. NAXAS ERP Pro: Trading and Production Business Automation. Asset Cloud: Cloud-Based Asset Management. NAXAS TravelOS: Travel Agency ERP and Business Automation. NAXAS Fly (NaxasFly): B2B Online Travel Agency Technology Platform. NAXAS HireFlow: Overseas Recruitment Management and Automation. NaxasNgage: AI-Powered Customer Engagement and Social Media Automation. NAXAS FoodFlow: Restaurant and Food Business Management. NaxTime: Corporate Task and Team Management Mobile Application. Nagorik Health: Integrated Digital Healthcare Ecosystem. This policy also applies to future NAXAS products and services that reference it. Where a particular product requires additional privacy terms, those terms will be provided separately. 3. Information We Collect Depending on the products and services you use, we may collect and process the following categories of information. 3.1 Personal Information Full name and contact information. Email address and mobile number. Job title and professional information. Account registration and authentication details. Information submitted through contact forms and service requests. 3.2 Business and Organizational Information Company name and business address. Employee and customer information. Project and operational records. Inventory, asset, and supplier information. Financial and transaction records. Other information entered into our ERP and business management systems. 3.3 Technical Information IP address and device information. Browser and operating system information. Application usage and activity logs. Cookies and similar technologies. Security and diagnostic information. 3.4 Product-Specific Information Depending on the service, we may process travel booking information, recruitment records, social media interactions, employee activities, asset records, and healthcare-related information. We limit the collection and processing of information to what is necessary for legitimate, specified, and lawful purposes. 4. How We Use Your Information We process information for the following purposes, where an appropriate legal basis exists: Providing, operating, and maintaining our products and services. Creating and managing customer accounts. Delivering software subscriptions and technical support. Processing transactions and managing billing. Improving system performance and user experience. Providing customer support and service notifications. Maintaining system security and preventing unauthorized access. Developing new features and improving existing products. Meeting applicable legal and regulatory requirements. Sending promotional communications where permitted by law or authorized by the recipient. We will not use personal information for unrelated purposes without an appropriate legal basis. 5. Data Ownership and Customer Control NAXAS recognizes the importance of customer data ownership and organizational confidentiality. Customers retain their rights and interests in the business information, documents, and records they submit to our platforms, subject to applicable law and contractual agreements. When NAXAS processes customer information on behalf of an organization, we act according to the applicable service agreement, authorized instructions, and legal requirements. NAXAS does not acquire ownership of customer business data merely because it is stored or processed through our software. Access to customer information is limited to authorized personnel and approved service providers where access is necessary for legitimate operational purposes. 6. Data Security and Confidentiality We are committed to implementing appropriate technical and organizational safeguards based on the sensitivity of the information and the risks associated with its processing. These measures may include: Secure authentication and access controls. Role-based user permissions. Encryption where appropriate. Security monitoring and activity logging. Data backup and recovery procedures. Restricted administrative access. Security updates and vulnerability management. Our employees, contractors, and authorized service providers are required to respect applicable confidentiality and data protection obligations. Although we take reasonable steps to protect information, no digital platform or internet-based transmission can be guaranteed to be completely secure. 7. Cloud Hosting and Data Storage Our software and SaaS products may use cloud infrastructure, hosting providers, and third-party technology services. Information may be stored or processed in Bangladesh or other permitted jurisdictions, depending on the applicable product, hosting arrangements, contractual requirements, and legal restrictions. Where cross-border data transfers occur, we will apply the safeguards and comply with the conditions required by applicable law. Data storage arrangements for enterprise and government customers may be specified in their individual service agreements. 8. Third-Party Services and Integrations Certain NAXAS products may integrate with external platforms, including: Payment gateways and financial service providers. Airline, GDS, and travel service providers. Social media platforms and messaging services. E-commerce and business management platforms. Email, SMS, and notification providers. Cloud infrastructure and other technology services. Information is shared with these providers only where necessary for the relevant service, authorized by the customer, or otherwise permitted by law. Third-party services may operate under their own privacy policies and contractual terms. 9. AI and Automated Processing Certain NAXAS products may use artificial intelligence and automated technologies to improve business operations, customer engagement, reporting, and service delivery. Where AI features process customer information, such processing will be subject to the applicable product configuration, contractual terms, authorized purposes, and legal requirements. We will not use confidential customer data to train general-purpose AI models without appropriate authorization or another valid legal basis. 10. Healthcare and Sensitive Information Our Nagorik Health ecosystem may process sensitive information, including medical records, prescriptions, diagnostic reports, appointment histories, and other healthcare-related information. Such information requires additional protection. We will process sensitive personal information only with the required consent or another legally permitted basis and apply appropriate security and confidentiality measures. Access to healthcare information will be governed by applicable authorization, professional responsibilities, contractual arrangements, and legal requirements. Healthcare information will not be disclosed for unrelated commercial purposes without a lawful basis. 11. Cookies and Analytics Our website and digital platforms may use cookies and similar technologies to support essential functionality, maintain user sessions, understand service usage, and improve performance. Where legally required, we will obtain consent before using non-essential cookies. Users may manage cookies through their browser settings and any cookie preference controls we provide. 12. Data Sharing and Disclosure NAXAS does not sell personal information or customer business data to third-party data brokers. We may disclose information in limited circumstances, including: To authorized service providers supporting our operations. To third parties necessary to deliver requested services. When the customer or individual has provided appropriate authorization. To comply with applicable laws, lawful orders, or regulatory obligations. To protect the security and integrity of our systems and services where legally permitted. Any disclosure will be limited to the information reasonably necessary for the relevant lawful purpose. 13. Data Retention and Deletion We retain information only for as long as necessary to fulfill the purposes for which it was collected, provide contracted services, resolve disputes, and comply with applicable legal obligations. Retention periods may vary depending on the type of information, product, contractual arrangements, and legal requirements. Upon account termination or a valid deletion request, we will delete, anonymize, or otherwise handle information in accordance with applicable law, contractual obligations, and relevant retention requirements. 14. Your Privacy Rights Subject to applicable law, individuals may have the right to: Request access to their personal information. Request correction of inaccurate information. Request deletion where legally applicable. Withdraw consent where processing relies on consent. Object to or request restriction of certain processing. Request data portability where applicable. Submit privacy-related complaints. Where information is controlled by an organizational customer, requests may need to be directed to that organization. For privacy-related requests, please contact [email protected]. We will review and respond to valid requests in accordance with applicable legal requirements. 15. Children's Privacy Our general business software and corporate services are not intended for independent use by children. Where a service involves children's personal information, including applicable healthcare services, we will obtain the required consent or authorization from a parent or lawful representative and apply appropriate safeguards. 16. Data Breach Management If a personal data breach occurs, we will take appropriate steps to investigate, contain, and address the incident. Where required by applicable law, we will notify the relevant authorities and affected parties in accordance with the applicable requirements. 17. Compliance With Applicable Laws NAXAS is committed to complying with applicable data protection, privacy, and cybersecurity requirements in Bangladesh, including the Personal Data Protection Act, 2026, and other applicable legislation. Where international regulations apply to a particular service or processing activity, we will address the relevant obligations according to their applicability. 18. Changes to This Privacy Policy We may update this Privacy Policy to reflect changes in our products, business operations, technologies, or legal requirements. The revised policy will be published on our website with an updated effective date. Where legally required, we will provide additional notice or obtain consent before implementing relevant changes. 19. Contact Information For questions, concerns, or requests regarding this Privacy Policy or the processing of your information, please contact us. NAXAS INVENTIONS LIMITED House-04 (Level-07), Main Road, Block-F, Banasree, Rampura, Dhaka-1219, Bangladesh. Email: [email protected] Phone: +880 1805-035150-55 Hotline: +880 1978-221771 Website: https://naxas.ai ©️ 2026 NAXAS INVENTIONS LIMITED. All Rights Reserved.