Client Data Policy

1Scope

This policy applies to Client Data processed through the Systems and Services of مؤسسة الجودة والتطوير التقني (EQTech Jordan): ERP and CRM systems, HR and payroll systems, accounting systems, websites and online stores, cloud services, hosting and business email. Personal information that visitors give us through eqtechjo.com is covered by our Privacy Policy.

2Ownership

• The client owns its Client Data in full. EQTech acquires no rights in it, apart from the limited right to process it in order to provide the Services.
• We do not sell, rent or trade Client Data, and we do not use it for advertising or for any purpose unrelated to providing the Services to the client.
• Ownership of Client Data does not include the System itself — its source code, database design or server logic — which belongs to EQTech under the Built with EQTech Jordan Technologies policy.

3Roles and responsibilities

The client decides what data is collected and why, and is responsible for having a lawful basis to collect it and for informing the people concerned — for example its employees and customers. EQTech processes Client Data on the client's behalf, following the Agreement and the client's documented instructions.

4Why we process Client Data

• to host and operate the System or Service;
• to provide support and maintenance, and to fix problems;
• to keep the System secure, monitor it and prevent abuse;
• to take and restore backups;
• to comply with a legal obligation.

5Confidentiality and staff access

Access to Client Data is limited to authorised personnel who need it to perform the Services and who are bound by confidentiality. Support access is used only when needed to resolve a request or to keep the System running.

6Security

We apply technical and organisational measures appropriate to the nature of the data, which may include encrypted connections (HTTPS/TLS), role-based permissions, strong authentication, activity logs, regular backups according to the service plan, and timely updates. No system can be guaranteed to be completely secure, and the client is responsible for its users' accounts, passwords and permissions.

7Service providers

We rely on reputable infrastructure providers — such as cloud and hosting platforms, data centres, email platforms and backup services — to deliver the Services. Depending on the provider and the Service, Client Data may be stored or processed in data centres outside the Hashemite Kingdom of Jordan. We choose providers that apply recognised security standards and, on request, we tell a client which main providers support its System.

8Security incidents

If we become aware of a security incident affecting a client's data, we notify that client without undue delay, share the information available to us and the measures taken, and cooperate with the client in handling the incident.

9Requests from individuals and authorities

Requests from individuals about their personal data are forwarded to the client, and we help the client respond to them. We disclose Client Data to authorities only when the law requires it, and we inform the client first where the law allows.

10Export and return of data

• The client may request a copy of its data at any time during the Agreement.
• When the Agreement ends, the client may request an export of its data within the period set in the Agreement or, if none is set, within thirty (30) days of the end date.
• Data is exported in a commonly used format — such as CSV, Excel, PDF or a database export of the client's records — depending on the nature of the data.
• An export contains the client's data only; it does not include the System's source code, database design or server logic.

11Retention and deletion

We keep Client Data for the duration of the Agreement. After the export period ends, we delete or anonymise it from live systems, and it is removed from backups as they rotate, unless the law requires us to keep it. A client may ask in writing for earlier deletion.

12The client's obligations

• collect and use personal data lawfully, and keep it accurate;
• inform the people whose data it processes, and obtain their consent where required;
• manage its users and their permissions, and keep credentials confidential;
• not upload data or content that breaches the Acceptable Use Policy.

13Legal framework

We process Client Data in accordance with the legislation in force in the Hashemite Kingdom of Jordan, including legislation on the protection of personal data, and with the Agreement.

14Contact

For data requests, exports or incident reports: info@eqtechjo.com · +962 78 867 7607.