Privacy Policy

1. Who is responsible

VERTEX Suite is sold and invoiced in each country by a company acting as its agent: in Lebanon COREX, and in Kuwait VERTEX DESIGN BUILDING GENERAL CONTRACTING COMPANY. Together with VERTEX Suite, they are “VERTEX” or “we” in this policy. The details of the company for your country are at the top of this page. That company's other businesses have no access to the service or to its data: VERTEX Suite runs on its own systems, separate from theirs. This policy covers the website vertexsuite.app and the service behind it.

We handle personal data in two different roles:

• Your account with us. For the data of people who hold a login (company owners and their team), of visitors to the website, and of people who write to our support, VERTEX decides how it is used and is responsible for it.
• Your business's records. For the personal data a company records in the service about its own customers, staff and suppliers, that company is responsible, and VERTEX only stores and processes it on the company's behalf, as its service provider (its “processor”). If you are a customer or an employee of a shop that uses VERTEX Suite, ask that shop first about your data; we help it answer you.

2. What we collect about you, and why

We do not buy data about you from anyone. We do not use your data for advertising or profiling, and we make no decision about you by automated means alone.

Giving the account and company data is necessary: without it we cannot open an account. Everything else marked optional (a username, a phone number, Telegram, notifications) can be left out.

3. Your business's records

A company records in the service whatever its business needs: products, prices and stock; sales, returns and payments; customers (name, phone number, purchases, credit balance, notes); suppliers and purchases; staff (contact details, role, attendance, leave, pay and social-security details); repair jobs and serial or IMEI numbers; expenses and accounting entries; and files it uploads (photos, receipts).

These records belong to the company. They are visible to the people the owner invites, each according to their role and branch, and to nobody else's company. VERTEX processes them only to run the service for that company, on the terms set out in the Terms of Service (“Personal data: your role and ours”).

4. Who can see your data

• Your own team, according to the roles the owner sets.
• VERTEX staff, only those who need it and only for support you asked for, security, billing or fixing a fault. They are bound to confidentiality.
• The providers listed below, which store or carry the data for us.
• Public authorities, only when a law or a court order that binds us requires it. Where the law allows, we tell the company owner first.
• A successor, if the service is transferred to another company; it must respect this policy.

We do not sell or rent personal data, and we do not share it for anyone's marketing.

5. Where your data is kept, and transfers abroad

All accounts and business records are stored by DigitalOcean in Frankfurt, Germany (European Union, region FRA1): the application server, the database and the uploaded files. Encrypted backups are made every night and kept in Frankfurt for 30 days. This means your data is stored outside Lebanon and outside Kuwait.

We chose this location for its reliability and because providers there work under the European Union's data protection rules. We do not claim any certification on that basis. A second encrypted copy of the backups may be kept in another DigitalOcean data centre in the European Union (Amsterdam, the Netherlands).

The providers that process data for us (sub-processors):

We keep this list up to date and tell company owners before we add or replace a provider that handles their records. If you write to us on WhatsApp, or pay through Whish, WAMD or a bank, those companies handle your message or payment under their own terms; they are not acting for us.

Transfers. Because of the above, personal data is transferred from Lebanon and Kuwait to Germany and, for the services listed, to the countries named. We make these transfers because they are necessary to provide the service you asked for, and you agree to them when you accept the Terms of Service. Data travels over encrypted connections.

6. How we protect it

• Passwords are hashed, not stored. We keep only a one-way scrypt hash, so a password cannot be read back, by us or by anyone who obtained a copy of the database.
• Two-step sign-in with an authenticator app is available to every account; its secret key is stored encrypted (AES-256).
• Each company is isolated in the database by row-level security: a query made for one company cannot return another company's rows.
• Encrypted connections (HTTPS/TLS) between your browser and the service.
• Roles and permissions, branch limits and PINs, set by the owner; an activity log of who did what.
• Limits on sign-in attempts, a notice when your account is used from a new browser, and a list of your open sessions that you can end.
• Nightly backups, encrypted before they leave the server, kept 30 days, so that data can be restored after a fault.

No system is perfectly secure. You protect your side by choosing strong passwords, switching on two-step sign-in, and giving each person their own login with the right role.

7. If something goes wrong

If we learn that personal data has been lost, or seen or taken by someone who had no right to it, we will tell the owners of the companies affected without undue delay, and no later than 72 hours after we become aware of it; for customers in Kuwait we aim to do so within 24 hours. We will say what happened, which data is concerned, what we have done and what you should do.

Where a law requires us to notify an authority, we do so within the time it sets. In Kuwait, the Data Privacy Protection Regulation of the Communication and Information Technology Regulatory Authority (CITRA, Resolution No. 26 of 2024) sets 24 hours for notifying the Authority, and 72 hours where a wrongful disclosure harms a large number of users; we follow those limits wherever that Regulation applies to us.

As the party responsible for its own customers' and staff's data, each company decides whether it must tell them; we give it the information it needs.

8. How long we keep it

We keep data longer only where a law requires it or while a dispute is open.

9. Cookies and storage on your device

We use only the cookies the site needs to work. No advertising cookies, no tracking cookies, no analytics from other companies.

The till also keeps data in your browser's own storage on the device: the sales made while offline until they are sent, the till's pairing and settings, and an unsent support message. This stays on the device and is not used to follow you.

Because these cookies are necessary, the site has no cookie banner. You can delete them in your browser; you will then be signed out and your choices forgotten.

10. Your rights

You can ask us, free of charge:

• to see the personal data we hold about you and to receive a copy of it;
• to correct data that is wrong or out of date. You can change your name, username, language and password yourself on the “My account” page;
• to delete your data, where we have no legal duty to keep it;
• to object to a use of your data, or to ask us to restrict it, for a legitimate reason;
• to export your data in a usable format (for a company's records, the owner uses the export in the service);
• to withdraw a consent you gave, for example by unlinking Telegram or switching off notifications.

How. Write to us through the support chat in the app (“Help and support”), or by e-mail to contact@vertexsuite.app. We may ask you to confirm that you are the account holder. We answer as soon as we can: corrections and deletions within 10 days, other requests within 30 days. If we cannot do what you ask, we tell you why.

If you are a customer or an employee of a shop that uses VERTEX Suite, the shop holds your data: ask the shop. If you write to us, we pass your request to the shop and help it answer.

If you are not satisfied with our answer, you may turn to the competent authority or court in your country: in Lebanon, the Ministry of Economy and Trade and the courts, under Law No. 81 of 2018; in Kuwait, the Communication and Information Technology Regulatory Authority (CITRA) and the courts.

11. Notes for Lebanon and Kuwait

Lebanon. We process personal data under Law No. 81 of 2018 on Electronic Transactions and Personal Data: fairly, for the stated purposes, no more than needed, kept accurate and secure. The processing described here concerns our own customers and is carried out with their consent; where that Law requires a declaration to the Ministry of Economy and Trade, we make it.

Kuwait. We respect Law No. 20 of 2014 on Electronic Transactions (consent, stated purpose, accuracy, security, access and correction) and follow the principles of CITRA's Data Privacy Protection Regulation (Resolution No. 26 of 2024): these documents are provided in Arabic and English, you are told before signing up that your data is stored outside Kuwait, in Germany, and your acceptance is recorded.

12. Children

The service is for businesses. Accounts are for adults (18 and over), and we do not knowingly open an account for a child. A company that employs or serves minors is responsible for handling their data lawfully.

13. Changes to this policy

We update this policy when the service or the law changes. The version and date are at the top of the page. For a change that matters (a new purpose, a new provider for your records, a new storage country), we tell company owners by e-mail and inside the service at least 30 days before, and ask them to accept the new version.

14. Contact

For any question or request about personal data: the support chat in the app (“Help and support”), or by e-mail to contact@vertexsuite.app.