Enterprise Privacy Policy

1. Introduction & Scope

Qbix Systems Ltd. is an enterprise software engineering and applied technology firm registered in Dhaka, Bangladesh. This Privacy Policy applies to all personal data and organizational information collected through:

• Our corporate website (https://qbixsys.com and subdomains).
• Our proprietary SaaS products and platforms, including eSchool ERP (eschool.qbixsys.com), ClinicDesk, RetailSync, TurfSync, and PayHub.
• Our client engineering portals, staging environments, and partner networks.
• Direct sales, consultancy engagements, and customer support communications.

2. Data Controller vs. Data Processor Roles

Under international privacy frameworks including the General Data Protection Regulation (GDPR) and local data governance laws, our role depends on the context of data collection:

3. Information We Collect

We collect information in three primary categories:

A. Information You Provide Directly

• Business Contact Information: Name, professional email address, phone number, organization name, job title, and country.
• Account & Authentication Credentials: Usernames, securely hashed passwords, role assignments, and authentication session tokens.
• Commercial & Billing Data: Transaction references, corporate billing addresses, and payment confirmation IDs (we do not store raw credit card or bKash PIN numbers).
• Inquiry Details: Project specifications, statements of work, and support tickets submitted through our forms.

B. Information Collected Automatically

• Network & Device Telemetry: IP address, browser type and version, operating system, referrer URLs, and device identifiers.
• Usage Logs: Timestamped access records, API requests, routing performance metrics, and error stack traces.
• Session Cookies: Cryptographically signed session identifiers necessary to maintain authenticated sessions.

C. Institutional Data (Processed on Behalf of Clients)

For customers utilizing our enterprise educational and healthcare solutions, our systems process rosters, academic records, attendance timestamps, and tuition ledgers as directed by the respective institution.

4. Lawful Basis for Processing

We process personal data only when an established lawful basis applies under applicable law:

• Performance of a Contract: To deliver the software services, integrations, and support agreed upon in our Master Services Agreement (MSA) or Terms of Service.
• Legitimate Interests: To protect our infrastructure against cyber attacks, prevent fraud, optimize platform performance, and communicate with enterprise prospects.
• Compliance with Legal Obligations: To fulfill statutory accounting, taxation, and regulatory reporting mandates in Bangladesh and jurisdictions of operation.
• Explicit Consent: Where you have opted in to receive technical whitepapers, partner newsletters, or marketing communications.

5. How We Use Information

We process collected information strictly for the following purposes:

• Provisioning and maintaining dedicated software instances and high-availability cloud infrastructure.
• Processing client invoices, subscription renewals, and partner affiliate commissions.
• Diagnosing system latency, resolving technical bugs, and monitoring SLA commitments.
• Enforcing role-based access control and security firewalls.
• Delivering critical transactional notifications (such as system maintenance announcements, security alerts, and attendance notifications via SMS/WhatsApp).

6. Multi-Tenant Data Isolation

Qbix Systems employs rigorous multi-tenant data isolation standards. Each enterprise client and educational institution operates within logically or physically partitioned database schemas. Cross-tenant queries are blocked at both the application middleware and database role levels, preventing data leakage between organizations.

7. Enterprise Security Safeguards

We maintain multi-layered technical and organizational controls to protect customer data:

• Encryption in Transit: All HTTP traffic is enforced via HTTPS utilizing TLS 1.3 with modern cipher suites and Strict Transport Security (HSTS).
• Encryption at Rest: Customer databases, configuration vaults, and file storage are encrypted using AES-256.
• Access Governance: Internal production access is restricted via zero-trust architecture, multi-factor authentication (MFA), and just-in-time access logging.
• Automated Backups: Geographically replicated, point-in-time database snapshots with verified disaster recovery protocols.
• Vulnerability Management: Continuous automated dependency scanning, static code analysis (SAST), and periodic third-party penetration testing.

8. Authorized Sub-Processors

Qbix utilizes vetted third-party infrastructure providers to support our operations. Each sub-processor is bound by strict data processing agreements:

9. Student & Institutional Privacy

Protecting student data within eSchool ERP is a core priority:

• Student records are accessed only by authorized school personnel, teachers, and guardians with verified credentials.
• We do not build advertising profiles or deliver behavioral marketing to students or minor dependents.
• Institutions retain total ownership over student rosters, marksheets, and biometric attendance logs, and can request full data export or deletion at any time upon contract termination.

10. International Data Transfers

Where data is processed across borders (e.g., global cloud infrastructure or multi-national clients), Qbix implements Standard Contractual Clauses (SCCs) and verifies that recipients maintain equivalent data protection standards to ensure safe cross-border compliance.

11. Retention & Disposal

We retain personal data only as long as necessary to fulfill the purposes for which it was collected, or to comply with statutory accounting and tax regulations:

• Active Client Accounts: Retained for the duration of the commercial agreement.
• Post-Termination Grace Period: Client data is archived for 30 days following contract termination to facilitate migration, after which it is cryptographically purged.
• System Logs: Retained for a rolling 90-day window for security auditing before automated rotation.

12. Your Data Protection Rights

Depending on your jurisdiction, you hold the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data when retention is no longer legally justified.
• Right to Restriction: Request restriction of processing under certain dispute conditions.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format (e.g., JSON or CSV).
• Right to Object: Object to processing based on legitimate interests or direct marketing.

To exercise these rights, submit a written request to privacy@qbixsys.com. We respond to all verified requests within 30 days.

13. Incident Response & Breach Protocol

Qbix operates a continuous security monitoring program. In the unlikely event of a confirmed security incident impacting personal data:

• We isolate affected systems within minutes of confirmation.
• We notify impacted enterprise clients and Data Controllers without undue delay (typically within 48 to 72 hours of confirmation).
• We provide a detailed incident analysis including remediation measures, affected records, and containment strategies.

14. Data Protection Officer Contact

For questions regarding this policy, data processing agreements (DPAs), or our privacy practices, please contact our Data Protection Office: