سياسة الخصوصيةPrivacy Policy

1. Who we are

Nadhim is the commercial app name for a cloud ERP platform based on ERPNext and extended for Saudi construction companies. The current operating company is IMEXUM. Address and phone number will be added when operating details are finalized.

2. Data protection roles

For business data entered by a customer into Nadhim, the customer is usually the data controller because it determines the purposes and content of processing. IMEXUM usually acts as a data processor providing hosting, support, maintenance, backups, and improvements under the service agreement. For website visitor data and demo requests, IMEXUM may act as controller.

3. Data we may process

• Account data: company name, users, email addresses, roles, login logs, and access settings.
• ERP data: customers, suppliers, employees, items, accounts, projects, documents, attachments, invoices, payments, and reports.
• Construction data: contracts, BOQ, cost codes, progress claims, variation orders, subcontract packages, payment certificates, retention, advances, deductions, and project KPIs.
• VAT/ZATCA data: tax numbers, tax templates, readiness status, supplier e-invoice evidence, UUID/hash/QR/XML/PDF where provided by the customer, and review logs.
• Support data: messages, screenshots, log files, and technical information needed to resolve issues.

4. Purposes of processing

We use data to provide the platform, manage subscriptions, enable users, enforce permissions, process documents and reports, operate construction features, provide support, improve security, maintain backups, and enable tax and e-invoicing readiness based on customer settings.

5. Saudi compliance and data subject rights

This policy is intended to support Saudi Personal Data Protection Law requirements. Where applicable, a data subject may request access, correction, update, restriction, destruction, or withdrawal of consent where consent is the lawful basis. For ERP data owned by an enterprise customer, requests should usually be directed first to the customer as data controller.

6. Hosting and transfers

Hosting location, data residency, and subprocessors should be defined in the subscription order or data processing agreement. Personal data should not be transferred outside Saudi Arabia except under applicable legal requirements and appropriate safeguards approved by the customer or required by law.

7. Data sharing

We may share data with hosting, backup, monitoring, support, email, payment, or e-invoicing integration providers where needed to deliver the service. We do not sell customer data. We may disclose information when required by law or a competent authority through applicable procedures.

8. Security

Nadhim uses role-based permissions, audit logs, access controls, encryption in transit where applicable, backups, and operational monitoring. The customer is responsible for managing its users, passwords, permissions, company settings, and the accuracy of data entered.

9. Retention and deletion

We retain customer data during the subscription or as agreed. After termination, data export may be provided according to the commercial terms, followed by deletion or destruction according to retention, backup, and legal obligations.

10. Cookies

The website may use essential cookies to operate the site and remember language preferences. Analytics or marketing tools may be added later, in which case this policy should be updated and any required consent obtained.

11. Updates

This policy may be updated when the service, hosting, legal requirements, or service providers change. Last updated: 24 July 2026.

This is an operational draft and should be legally reviewed before commercial publication.