Privacy policy

This policy explains how HMAT Technologies (“ERPStop”, “we”, “us”) handles personal data. It applies to our website, to people who contact us, and to the ERPStop application. It is written to follow the Saudi Personal Data Protection Law and its regulations (the “PDPL”).

When you visit our website, contact us, or hold a user account in ERPStop, we decide why and how your personal data is used, and we are responsible for it (the “controller”).

When a business uses ERPStop to keep its own customers’, suppliers’ and staff’s data, that business decides what is stored and why. We process that data only on its behalf and on its instructions (the “processor”). If your data is held by a business that uses ERPStop, please contact that business first.

• Website visits: our hosting provider keeps technical records of requests (IP address, time, the address requested, browser type). We do not use cookies, advertising trackers or analytics trackers on this website.
• Your language choice is remembered in your browser’s own storage, on your device. It is never sent to us.
• When you contact us or ask for a demo: your name, company, phone number, email address, what you write to us, and any file you send, such as a sample export. Please remove personal data from files you send us where you can.
• Account holders in the application: username, full name, email address (optional), role and branch access, a password that is stored only as a one-way hash, and a log of sign-ins and changes made in the account.
• Technical records in the application: errors and request identifiers used to find and fix faults.
• Business data entered by our customers: customer and supplier details, products, invoices, payments, stock, and e-invoicing certificates and keys, which are encrypted when stored.

We do not sell personal data. We do not use it for advertising or profiling.

• To provide, secure and support the service (performance of the contract with our customer).
• To answer your enquiries and arrange demonstrations (your request or consent).
• To keep the service reliable and to detect misuse (our legitimate interests, where the PDPL allows them).
• To meet legal obligations, including, at a customer’s instruction, sending its invoices to ZATCA.

We share only what each of them needs for its purpose.

• Our hosting and infrastructure provider, which runs the service for us.
• Email or SMS gateways that a customer chooses to configure, which receive the messages and recipients that customer sends.
• ZATCA, only invoice and credit-note data, and only when a customer sends it.
• Authorities, where the law requires it.

Our infrastructure is currently hosted in Singapore. Using ERPStop therefore means that personal data is processed outside Saudi Arabia.

We transfer personal data only on the grounds the PDPL and its transfer regulations allow, and only as far as is needed to provide the service. You can ask us for details of the safeguards that apply.

No system is perfectly secure. If a breach affects personal data, we will tell the affected customer and the competent authority within the time the law requires.

• Connections to the website and the application are encrypted.
• Passwords are never stored in readable form.
• E-invoicing private keys and service secrets are encrypted when stored.
• Each customer’s data is kept separate from every other customer’s, and access inside a customer’s account follows roles and permissions that the customer controls.
• Sign-ins and changes are recorded in an activity log that the customer can review.

Saudi tax law requires businesses to keep invoices and related records for a number of years. That duty is the customer’s as controller, and we do not delete a customer’s records except on its instruction or as its agreement with us provides.

• Technical request records: for as long as needed for security and operation.
• Enquiries: for as long as needed to answer them and for a reasonable period afterwards.
• Accounts and business data: while the customer’s account is active, and afterwards returned or deleted as the customer’s agreement with us provides.

Under the PDPL you have the right to:

• be told how your personal data is used;
• access your personal data and obtain a copy of it;
• have inaccurate data corrected;
• ask for your data to be destroyed when it is no longer needed;
• withdraw consent you have given, without affecting what was done before.

To use a right, write to contact@erpstop.com. We may need to confirm who you are first. We reply within the time the law sets. If your data is held by a business that uses ERPStop, we will pass your request to that business and help it respond.

Some rights are limited where the law requires us, or the business, to keep the data.

ERPStop is for businesses. We do not knowingly collect personal data from anyone under 18.

Please contact us first at contact@erpstop.com and we will try to put it right. You may also complain to the Saudi Data and Artificial Intelligence Authority (SDAIA), the competent authority under the PDPL.

We will publish any change on this page with a new effective date. If a change matters to how your data is used, we will tell customers directly.

HMAT Technologies

contact@erpstop.com