Privacy Policy

PharmaERP Corporate (the “Service”) is provided by The Captain International Investment SPC, a company registered in the Sultanate of Oman, with its address at Muscat, Sultanate of Oman (“we”, “us”). This policy explains how we handle personal data when you visit our pages, sign up, pay for a subscription and use the Service, as required by the Personal Data Protection Law (Royal Decree 6/2022) and its Executive Regulation (Ministerial Decision 34/2024), as amended. The Service is for businesses; this policy concerns the individuals whose data is involved (account owners, users, vendor contacts and others).

• We are the controller of “Account Data”: the details of account owners, users and vendor-portal users that we need to run accounts, sign-in, billing, support and security, and enquiries sent to us.
• We are a processor of “Customer Data”: everything our business customers put into the Service (for example their customers, suppliers, staff, tenders, quotations, invoices, purchase orders, delivery notes and documents). The customer is the controller of that data and decides why and how it is processed. We process it only on the customer’s instructions, under the Data Processing Addendum.

• Account details: name, work email, phone number, company name, country, role, sign-in records and the email verification status.
• Acceptance records: the version of the Terms and this policy you accepted, the date and time, your IP address and browser details.
• Billing details: plan, periods, amounts, tax invoices and receipts, and the payment status and reference returned by Thawani. We do not receive or store full card numbers.
• Usage and technical data: activity logs inside each company, AI usage and cost records, device and browser information, IP address, notification tokens (if you enable push notifications) and error logs.
• Support and enquiries: what you send us by email or through contact and quote forms.
• Customer Data (as processor): whatever the customer and its users enter or upload, including documents read by AI features.

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that took place before it. If you do not give the details needed to run an account, we cannot provide the Service.

For Customer Data, the business customer is responsible for having a lawful basis, for informing the people concerned, and for obtaining any consent or permit the law requires (including any permit for special categories such as health data). We process Customer Data only to provide the Service, as the customer instructs, and as described in the Data Processing Addendum. We do not sell it, do not use it for advertising and do not use it to train AI models.

If you are a supplier, customer, employee or other contact of one of our customers, please send requests about your data to that company first. If you contact us, we will pass your request to the company and help it to respond.

When a user starts an AI feature, the content needed for that request (for example a scanned purchase order, a tender document, an invoice or a question) is sent to Google’s Gemini API to produce the result. Google processes it to answer the request and, under the terms we use, does not use it to train its models. AI results are suggestions that a person must review. The Service does not make decisions about individuals by automated processing alone. If you believe an automated result affects you, you can object and ask for a human review by contacting us. See the AI Features Notice.

The Service runs on Google Cloud. The database (Firestore) and background jobs are in the me-central1 region (Dammam, Kingdom of Saudi Arabia). Application servers run in the europe-west4 region (Netherlands). Files are kept in Google Cloud Storage. AI requests are processed in Google data centres, which may be in other countries. This means personal data is transferred outside the Sultanate of Oman.

We protect these transfers as the Personal Data Protection Law and its Executive Regulation require:

• we assess the protection offered by each provider and the risks of the transfer, and keep that assessment on file;
• we use only providers bound by written data protection terms that offer a level of protection not lower than Omani law, including Google’s Cloud Data Processing Addendum and its security certifications;
• data is encrypted in transit and at rest;
• by accepting this policy when you sign up, you give your explicit consent to the transfer of your Account Data to these locations. Customers are responsible for any consent needed from the people whose data they put into the Service.

We use these providers to run the Service. Each is bound by written terms to protect the data and to use it only to provide its service to us.

Emails that a customer sends from its own mailbox (for example to its suppliers) go through the email provider the customer chooses. That provider works for the customer, not for us. We will update this list, and tell account owners, before adding a new sub-processor that handles Customer Data.

We do not sell personal data. We share it only with the sub-processors above; with our professional advisers under a duty of confidentiality; with a buyer or successor of the business, under the same protections; and with courts, the competent Ministry and other authorities when the law requires it. Inside a company, data is visible to that company’s users according to the roles the customer assigns, and to vendor-portal users only as the customer shares it.

• Customer Data: while the subscription is active, in grace or read-only. After a subscription ends, the account stays read-only for 90 days so data can be exported; after notice to the account owner, the data is then deleted. A customer can ask for earlier deletion. Backup copies, if any, are overwritten in the normal backup cycle.
• Account details: while the account exists, then for up to 90 days with the Customer Data.
• Billing records, tax invoices and acceptance records: for as long as tax, commercial and evidence laws require (generally up to 10 years), or longer if needed for an existing dispute.
• Security and activity logs: for the limited period needed to protect the Service and investigate incidents.

Under the Personal Data Protection Law you have the right to:

• withdraw your consent to processing, without affecting earlier processing;
• ask for your personal data to be corrected, updated or blocked;
• get a copy of your personal data;
• have your personal data transferred to another controller;
• ask for your personal data to be deleted, unless we must keep it by law or because of an existing dispute;
• be told of a breach of your personal data and of what has been done about it;
• object to a decision based on automated processing and ask for a human review;
• complain to the Ministry of Transport, Communications and Information Technology, which supervises personal data protection in Oman.

To use a right, email info@ciispc.com from the address linked to your account, or explain how we can verify your identity. Requests are free. We answer within 45 days. We may refuse a request that is repeated without reason or needs unreasonable effort, and will tell you why.

Each company’s data is kept separate and protected by access rules enforced on our servers. Data is encrypted in transit and at rest. Access is limited by roles, sign-in tokens are checked on every request, administrative access is restricted to authorised staff, and important changes are recorded in activity logs. The security measures are described in the security annex of the Data Processing Addendum.

If a breach affects Account Data and is likely to put your rights at risk, we will notify the competent department of the Ministry within 72 hours of becoming aware of it, and notify you within 72 hours if it is likely to cause you serious harm, as the Executive Regulation requires. If a breach affects Customer Data, we will tell the customer without undue delay so that it can meet its own obligations as controller, and help it to do so.

We use only essential cookies and browser storage: to sign you in and keep your session (Firebase Authentication), to remember the company you are working in, and to remember interface preferences such as the theme, the sidebar and dismissed notices. We do not use advertising or analytics cookies and do not track you across other websites. Because these items are strictly necessary for the Service, they do not need consent; you can clear them in your browser, but you will then be signed out.

The Service is for businesses and is not directed at children. Users must be adults with full legal capacity. We do not knowingly collect personal data of children. Customers must not upload children’s personal data unless the law allows it and the guardian’s consent has been obtained.

For privacy questions or requests, or to reach the person responsible for personal data protection at The Captain International Investment SPC, contact us by email at info@ciispc.com, by phone on +968 9333 0636 or by post at Muscat, Sultanate of Oman. Please mark your message “Data protection”.

We will post changes here, update the version and date at the top, and tell account owners about material changes by email or in the app before they take effect. Where the law requires your consent to a change, we will ask for it.