Privacy Policy

Agrivex — Industrial ERP A product of Rawal Systems, registered in Pakistan.

Effective date: 20 July 2026 Last updated: 20 July 2026

1. Introduction

This Privacy Policy explains how Rawal Systems ("Rawal Systems", "we", "us", "our") collects, uses, stores, shares and protects information in connection with Agrivex, our industrial ERP platform (the "Service"), available at [INSERT DOMAIN].

By creating an account, signing in, or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

Agrivex is a business-to-business platform used by factories, mills and industrial operations. It is not intended for personal or household use, and it is not directed at children.

2. Who we are

For any privacy question, request or complaint, contact us using the details above.

3. Important: our role in relation to your data

Agrivex is a multi-tenant platform. Each customer organization (a factory, mill or company) has its own isolated workspace. This creates two distinct relationships:

a) Account and billing data — we are the controller. Information about your organization and the individuals who register and administer the account is collected and used by us directly, as described in this policy.

b) Data you enter into the Service — we are the processor. Records your organization enters into Agrivex — including data about your employees, customers, dealers, suppliers, growers and farmers (such as names, CNIC numbers, phone numbers, addresses, wages, transactions and balances) — is referred to in this policy as "Customer Data."

Your organization decides what Customer Data to enter, why, and for how long to retain it. Your organization is responsible for that data, including for having a lawful basis to collect it and for informing the individuals concerned. We process Customer Data only on your organization's instructions, to provide and support the Service. We do not sell it, and we do not use it to build profiles or train models for unrelated purposes.

4. Information we collect

4.1 Information you provide

Account information: name, email address, phone number, password (stored only as a cryptographic hash), and role within the organization.

Organization information: legal and display name, logo, brand colour, address, city, province, contact details, National Tax Number (NTN), Sales Tax Registration Number (STRN), industry-specific licence or registration numbers, financial year settings, and bank account details used for printing on invoices.

Customer Data entered by your users, which may include:

• Party records — customers, dealers, suppliers, growers and farmers, including names, CNIC numbers, phone numbers, addresses, credit limits and balances
• Employee and payroll records, where the HR module is enabled — including attendance, wages, advances and loans
• Financial records — invoices, receipts, payment vouchers, ledgers and accounting entries
• Operational records — inventory, batches, production runs, quality and lab test results, weighbridge slips, gate passes, vehicle numbers, driver names and driver CNIC numbers
• Uploaded files — certificates, licences, scanned documents and signatures

Communications: information you provide when you contact support, request a demo, or report an issue.

4.2 Information collected automatically

• Usage data — pages and modules accessed, actions taken, feature usage, timestamps
• Device and technical data — IP address, browser type and version, operating system, device type, and approximate location derived from IP address
• Audit logs — the Service maintains an audit trail of financial, inventory and dispatch actions, recording which user performed which action and when. This is a core security and accounting control of the Service.
• Cookies and similar technologies — see Section 9.

4.3 Information we do not intentionally collect

We do not require or request payment card numbers, biometric data, health data, or information about religious or political beliefs. Please do not upload such information into free-text fields unless your organization has a lawful basis to do so.

5. How we use information

We use information to:

• Create, authenticate and secure accounts, and enforce role-based access controls
• Provide the Service and the modules your organization has enabled — including invoicing, ledgers, inventory, production, dispatch and gate passes
• Generate documents such as invoices, receipts, ledger statements, labels and gate passes
• Provide customer support, troubleshoot faults, and respond to your requests
• Maintain security, prevent fraud and unauthorised access, and investigate misuse
• Maintain audit logs for accountability and accounting integrity
• Improve the Service — using aggregated and de-identified usage statistics that do not identify any individual or organization
• Send service communications (outages, security notices, changes to terms) and, where permitted, product updates
• Comply with legal, tax and regulatory obligations under the laws of Pakistan

We do not sell personal information, and we do not share Customer Data with advertisers.

6. Legal basis for processing

We process information where:

• it is necessary to perform our contract with your organization;
• we have a legitimate interest in operating, securing and improving the Service;
• we are required to do so to comply with a legal obligation; or
• you or your organization have given consent, which may be withdrawn at any time.

7. How we share information

We share information only in these circumstances:

Within your organization. Your data is visible to authorised users of your organization according to the roles and permissions your Admin configures.

Service providers (sub-processors). We use trusted third parties to run the Service — including cloud hosting and database infrastructure, email delivery, and error monitoring. They may process data only on our instructions and under confidentiality obligations. Our current infrastructure provider is Supabase, and data may be hosted in a region outside Pakistan.

Legal and regulatory. We may disclose information where required by law, court order, or a valid request from a competent authority in Pakistan, or where necessary to protect our rights, safety, or the security of the Service.

Business transfer. If Rawal Systems is involved in a merger, acquisition, restructuring or sale of assets, information may be transferred as part of that transaction. We will notify affected organizations.

With your instruction. Where your organization directs us to integrate with or export data to a third-party system.

8. International data transfers

Pakistan does not currently have a comprehensive data protection statute in force, though legislation has been under consideration. Where your data is stored or processed outside Pakistan by our infrastructure providers, we take reasonable steps to ensure it remains protected by appropriate contractual and technical safeguards consistent with this policy.

If your organization requires data residency within Pakistan, contact us to discuss available options before onboarding.

9. Cookies

We use cookies and similar technologies for:

• Strictly necessary purposes — authentication, session management and security. The Service cannot function without these.
• Preference purposes — remembering settings such as your enabled modules and interface choices.
• Analytics purposes — understanding aggregate usage to improve the Service.

You can control cookies through your browser settings, but disabling strictly necessary cookies will prevent you from signing in.

10. Data security

We apply technical and organisational measures appropriate to an ERP handling financial and operational records, including:

• Tenant isolation — every record is scoped to an organization and enforced by database-level Row Level Security, so one organization cannot access another's data
• Role-based access control, enforced both in the interface and on the server
• Encryption in transit using TLS, and encryption of data at rest by our infrastructure provider
• Password hashing — we never store passwords in plain text
• Audit logging of financial, inventory and dispatch actions
• Access to production systems restricted to authorised personnel on a need-to-know basis

No system is completely secure. We cannot guarantee absolute security, and you are responsible for keeping your credentials confidential and for promptly notifying us of any suspected unauthorised access. If we become aware of a breach affecting your data, we will notify your organization without undue delay.

11. Data retention

We retain account and organization information for as long as your account is active.

Customer Data is retained for as long as your organization maintains its account, or as your organization instructs. Because Agrivex holds accounting and tax records, your organization may be independently required under Pakistani tax and corporate law to retain certain records for a minimum period — commonly six years — and should consider this before requesting deletion.

Following account termination, we will delete or return Customer Data within 60 days of a written request, subject to any legal obligation to retain it. Backups are purged on a rolling cycle. Aggregated, de-identified data may be retained indefinitely.

12. Your rights

Subject to applicable law, you may request to:

• Access the personal information we hold about you
• Correct information that is inaccurate or incomplete
• Delete your personal information
• Object to or restrict certain processing
• Export your data in a portable format
• Withdraw consent where processing is based on consent

How to exercise these rights: if you are a user of an organization's Agrivex workspace, contact your organization's Admin first — they control that workspace. If you are an individual whose data was entered into Agrivex by one of our customers (for example, as a grower, dealer or employee), your request should be directed to that organization; if you contact us, we will refer you to them or pass the request on.

For account-level requests, contact us using the details in Section 2. We will respond within a reasonable period and may need to verify your identity first.

13. Your organization's responsibilities

If you use Agrivex as an organization, you are responsible for:

• Having a lawful basis to collect and enter data about employees, customers, growers, dealers and suppliers
• Informing those individuals about how their data is used
• Configuring roles and permissions appropriately and managing user access
• Keeping data accurate and up to date
• Complying with applicable Pakistani tax, labour, accounting and sector-specific regulations
• Responding to requests from individuals about the data you hold in the Service

Particular care should be taken with CNIC numbers, driver details and payroll data, which are sensitive and should only be collected where genuinely needed.

14. Children

The Service is not directed at, and may not be used by, anyone under the age of 18. We do not knowingly collect personal information from children.

15. Third-party links

The Service may contain links to third-party websites or services. We are not responsible for their privacy practices, and we encourage you to read their policies.

16. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version with an updated "Last updated" date, and for material changes we will provide notice through the Service or by email. Continued use of the Service after changes take effect constitutes acceptance.

17. Governing law

This Privacy Policy is governed by the laws of the Islamic Republic of Pakistan, and the courts of Islamabad shall have jurisdiction over any dispute arising from it.

18. Contact us

Rawal Systems 708 Landmark 3, H-13, Islamabad, Pakistan Phone: +92 371 2357969 Email: support@rawalsystems.com

If you have a complaint about how we handle your data, please contact us first. We aim to resolve concerns directly and promptly.