Overview
NEXORA is a multi-tenant ERP platform for medical devices and consumables distribution. This policy covers the public website and the platform. Where a customer agreement or data processing agreement sets different terms for customer data, that agreement prevails.
We keep this policy in plain language. If anything is unclear, contact us and we will explain it.
Who we are
NEXORA provides the platform and acts as the controller for account, billing and website data. For the operational records a customer enters into the platform, the customer is the controller and NEXORA acts as its processor.
Our registered operations are in Riyadh and Jeddah, Kingdom of Saudi Arabia. You can reach our privacy team at hello@nexora.example.
Data we collect
We collect only what is needed to provide, secure and improve the service.
- Account data: name, work email, phone, company, role and language preference.
- Business records: the products, customers, suppliers, orders, invoices and documents you enter.
- Usage data: pages visited, actions taken, device and browser type, IP address and timestamps.
- Support data: messages, attachments and diagnostics you share with our team.
- Website data: form submissions, newsletter sign-ups and cookie or local-storage preferences.
How we use data
We use data to operate the platform, keep it secure and meet our legal obligations.
- Deliver the service, including tenancy isolation, approvals and reporting.
- Authenticate users and enforce roles, limits and segregation of duties.
- Provide support, investigate incidents and prevent fraud or abuse.
- Send service notices, security alerts and, where permitted, product updates.
- Improve performance, usability and documentation using aggregated or de-identified information.
- Comply with applicable law and respond to lawful requests.
Legal bases
Where applicable law requires a legal basis, we rely on performance of a contract, compliance with a legal obligation, our legitimate interests in operating and securing the service, and consent where it applies.
You can withdraw consent at any time for processing that relies on it, without affecting prior processing.
Sharing and processors
We do not sell personal data. We share it only with parties that help us run the service or where the law requires it.
- Hosting, database and backup providers under written data protection terms.
- Email, messaging and support providers used to respond to you.
- Payment and billing providers for subscription processing.
- Professional advisers, auditors and authorities where legally required.
- A successor entity in a merger or acquisition, under equivalent obligations.
Where data is stored
Customer data is stored in the region selected in the order form. Where a transfer outside that region is required, we use appropriate safeguards and documented instructions.
Tenant isolation, access controls and audit logging apply regardless of location.
Retention
We retain data for as long as the account is active and then for the period required by law or by the customer agreement. Operational records follow the retention rules configured by the customer and the legal requirements that apply to them.
When data is no longer required, it is deleted or anonymised through controlled processes and backups expire on their normal cycle.
Security
Security is part of the platform architecture, not a policy layer.
- Tenant and company isolation on every query and write.
- Role-based access, approval limits and segregation of duties.
- Encryption in transit and at rest, with managed secrets.
- Audit trails for postings, approvals and administrative changes.
- Monitoring, backup and controlled restore procedures.
Your rights
Subject to applicable law, you may request access to your personal data, correction, deletion, restriction or objection to processing, and portability where it applies.
To exercise a right, contact hello@nexora.example. We may need to verify your identity. You also have the right to complain to the competent data protection authority.
Cookies and local storage
The public website uses minimal local storage to remember your language preference and, where enabled, to measure basic usage. We do not use advertising cookies.
The platform uses strictly necessary cookies for authentication and security. You can control cookies in your browser, but disabling necessary cookies will prevent sign-in.
Changes to this policy
We may update this policy to reflect changes in the service or the law. The date at the top of the page shows the latest version. Material changes will be communicated through the platform or by email.
Contact
Questions about this policy or your data can be sent to hello@nexora.example. We aim to respond within one business day.
Questions about this document? hello@nexora.example