QUMAXA Privacy Policy

QUMAXA IT SERVICES (SMC-PRIVATE) LIMITED is responsible for personal information it collects for its own business purposes, including website inquiries, customer accounts, billing, marketing, and support. When QUMAXA processes personal information solely on behalf of a business customer, that customer generally determines the purposes of processing and QUMAXA acts as its service provider or data processor, subject to the applicable agreement. Privacy inquiries may be sent using the contact details at the end of this policy.

Depending on your relationship with us, information may include your name, business name, job title, email address, telephone number, country, correspondence, account identifiers, login and access records, subscription details, billing and transaction references, support requests, technical logs, IP address, browser and device information, and service usage information. We may also receive documents, datasets, files, or other content that you choose to provide for a project or upload into a product. We seek to limit collection to information relevant to the stated purpose.

We collect information directly when you contact us, complete a form, request a quotation, create an account, purchase a service, submit a support request, or provide project materials. Certain technical information may be collected automatically when you access our digital services. We may also obtain business contact details from authorized representatives, referrals, publicly available professional sources, or service providers, where permitted by applicable law.

We use relevant information to respond to inquiries, prepare proposals, deliver contracted services, create and administer accounts, authenticate users, provide product features, process subscriptions and billing, troubleshoot issues, communicate service updates, maintain security, prevent fraud and misuse, comply with legal obligations, and improve our offerings. Marketing communications will be provided only where permitted by applicable law, with appropriate opt-out choices. Where relevant privacy law requires a legal basis, we rely on an applicable basis such as contractual necessity, consent, legitimate interests, or legal obligations.

Customers may provide business records, operational information, source code, database extracts, employee or customer information, and project documentation. QUMAXA uses these materials for the agreed development, integration, testing, deployment, maintenance, or support activities. Access should be restricted to authorized personnel and approved service providers with a business need. Project-specific confidentiality, ownership, retention, hosting, and deletion requirements are governed by the relevant contract, NDA, or Data Processing Agreement (DPA).

Our SaaS products may process account details, organization settings, authorized-user permissions, subscription plans, service usage, transaction records, and customer-uploaded content. We use this information to operate the subscribed features, maintain service availability, manage access and billing, provide support, and investigate security issues. Different products may require additional information, which should be explained in their respective product notices. Customers remain responsible for the information they lawfully upload and the permissions they grant to their users.

QUMAXA's AI and automation solutions may process prompts, documents, workflow instructions, extracted information, transaction records, and generated outputs as needed to provide the requested functions. Depending on the product architecture, authorized external AI model providers, hosting platforms, or workflow processors may handle relevant data. QUMAXA should disclose material third-party AI processing arrangements in applicable product documentation or agreements. We do not claim that all AI processing remains exclusively on QUMAXA infrastructure. Customer content will not be used to train QUMAXA-owned general-purpose AI models without an appropriate authorization or other lawful basis. Any third-party model training or retention settings must be addressed through the applicable provider arrangements and product terms.

We ask customers not to submit unnecessary sensitive information. If a contracted service requires financial, identity, employment, health, or other sensitive records, the permitted categories, processing purpose, access controls, retention, and any special safeguards should be established before processing. Additional security measures and contractual provisions may be required depending on the data, jurisdiction, and associated risks.

Our website and applications may use essential cookies or similar technologies for session management, authentication, security, and user preferences. Analytics or marketing technologies may be introduced where appropriate and should be disclosed before activation. Where required by law, we will request consent before setting non-essential cookies and provide available preference controls. Browser settings may allow users to restrict cookies, although some service functions may then be unavailable.

We do not sell personal information as a business practice. We may share relevant information with authorized hosting providers, payment processors, email and communication services, analytics providers, technical subcontractors, AI providers, professional advisers, or other vendors where necessary for legitimate business activities. Such sharing should be limited to appropriate purposes and supported by suitable contractual, confidentiality, and security safeguards. We may also disclose information when legally required or reasonably necessary to protect rights, investigate abuse, or respond to lawful authorities.

QUMAXA operates from Pakistan and may use technology infrastructure or approved service providers located in other countries. Consequently, information may be processed or stored outside the country in which it originated. Where international transfers are regulated, we will seek to use appropriate legal mechanisms and contractual or organizational safeguards. The actual hosting region for a specific customer product or project should be identified in its service documentation or agreement.

QUMAXA aims to apply reasonable technical and organizational safeguards proportionate to the information and services involved. These may include role-based access, strong authentication, encrypted connections, secure development practices, vulnerability remediation, backups, logging, and restrictions on personnel and vendor access. Safeguards differ by product and hosting arrangement. No internet transmission or storage system can be guaranteed completely secure, and this policy does not represent a security certification or guarantee.

We retain information only for as long as reasonably needed for the relevant purpose, applicable contract, security requirements, dispute resolution, or legal and regulatory obligations. Account, support, transaction, backup, and project records may have different retention periods. Where a customer controls the data, deletion or return arrangements are governed by the relevant agreement. Upon an appropriate request or contract termination, information will be deleted, anonymized, or returned where applicable, subject to lawful retention requirements and backup lifecycle limitations.

Depending on applicable law and our role in processing, individuals may request access to personal information, correction of inaccurate details, deletion, restriction or objection to certain processing, withdrawal of consent, or other legally available rights. We may need to verify identity and may refuse or limit a request where legally justified. Where QUMAXA processes information on behalf of a customer, we may refer the request to that customer or assist it under the relevant agreement.

We may process billing contacts, invoices, subscription amounts, payment status, transaction identifiers, and necessary accounting records. Payments may be handled through banks or independent payment service providers. Unless expressly stated for a specific product, QUMAXA does not need to store complete payment-card details. Payment providers operate under their own privacy and security terms. Financial records may be retained as required by applicable tax, accounting, and corporate laws.

We may contact existing or prospective business customers about relevant services, product announcements, demonstrations, and business opportunities where legally permitted. Recipients may request that promotional communications stop. Essential service, security, billing, and contractual notices may still be sent when necessary even after marketing preferences are changed.

If you apply for a role or provide professional information to QUMAXA, we may process your contact details, CV, education, employment history, qualifications, references, interview information, and related correspondence to assess applications and manage recruitment. Additional employee-specific privacy information may be provided when appropriate. Recruitment records should be retained only for justified business or legal purposes.

QUMAXA's corporate website and general business services are not intended for children. We do not knowingly seek personal information directly from children through our general corporate services without an appropriate lawful basis or required authorization. A customer product intended for children, families, schools, or similar users must have a tailored privacy notice and appropriate age-related safeguards.

Our website and products may link to external websites or integrate with customer-selected applications, cloud platforms, APIs, or third-party services. Their privacy practices may differ from ours. We encourage users and customers to review the relevant third-party policies and understand the permissions granted through integrations. QUMAXA is responsible for its own processing activities, but not automatically for independent processing performed by unrelated third parties.

If QUMAXA identifies an incident involving personal information, we will assess its nature and potential impact, take reasonable containment and remediation steps, and notify affected customers, individuals, or authorities where required by applicable law or contractual obligations. Customer-specific incident reporting procedures and timeframes may be established in a Data Processing Agreement or service contract.

QUMAXA is incorporated in Pakistan and is subject to applicable Pakistani laws. Additional privacy and data protection requirements may apply depending on customer location, individuals concerned, product functionality, and processing activities, including potentially the EU or UK GDPR or other jurisdiction-specific legislation. This policy does not claim universal compliance with every international privacy law. Where required, QUMAXA and its customers should establish appropriate notices, contractual terms, transfer safeguards, and compliance procedures.

Yes. We may update this policy to reflect changes in services, products, technology, processing practices, contractual requirements, or applicable law. The current version and effective date will be published on our website. Where a change materially affects personal information and applicable law requires further notice or consent, we will take the appropriate steps.

For privacy questions, data requests, corrections, deletion requests, or concerns, contact QUMAXA IT SERVICES (SMC-PRIVATE) LIMITED using the details below. Please avoid sending sensitive identity documents until a secure verification method has been arranged.

• privacy@qumaxa.com
• +92 304 4254848
• QUMAXA IT SERVICES (SMC-PRIVATE) LIMITED, Johar Block-20, Gulshan-e-Iqbal Town, Karachi East, Karachi, Pakistan