Privacy Policy

This Privacy Policy ("Policy") explains how SystoMax ("SystoMax", "Company", "we", "our", or "us") collects, uses, stores, processes, transfers, and protects personal data and operational information when you use our software platform, websites, APIs, mobile-compatible services, and related systems (collectively, the "Platform").

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy and agree to the practices described herein

1. Company Information

SystoMax
Pakistan
Website: https://systomax.com

SystoMax is a Pakistan-based software technology company providing cloud-based housing society, property, accounting, HR, billing, security, maintenance, and operational management solutions to organizations and customers globally

2. Scope of This Privacy Policy

This Privacy Policy applies to

• SaaS software services
• Web applications
• APIs
• Customer portals
• Mobile-compatible interfaces
• CMS websites
• Payment integrations
• Customer support services
• Communication systems
• Marketing websites operated by SystoMax

This Policy applies to all users including

• Housing societies
• Property developers
• Management companies
• Residents
• Employees
• Security staff
• Vendors
• Contractors
• Accountants
• Administrators
• Committee Members
• Website visitors

3. Information We Collect

SystoMax may collect, store, process, and transmit various categories of information depending on how the Platform is used

3.1 Account & Registration Information

We may collect

• Full names
• Company or society name
• Email addresses
• Phone numbers
• Billing addresses
• Country and region information
• Login credentials
• Subscription details
• User role assignments

4. Operational & Society Management Data

Clients may upload or generate operational records including

• Resident profiles
• Unit ownership details
• Family member records
• Contracts and agreements
• Installment Plans
• Payment records
• Maintenance requests
• Parking records
• Visitor logs
• Complaint records
• Employee records
• Payroll information
• Attendance records
• Vendor records
• Asset inventories
• Booking Information
• Announcements
• Audit logs
• Uploaded documents and files

SystoMax processes such information solely for providing and operating the Platform

4A. Client Responsibility for Resident & User Consent

Clients are solely responsible for obtaining all legally required consents, authorizations, notices, and permissions from

• Residents
• Employees
• Visitors
• Vendors
• Contractors
• Family Members
• Customers
• End users

This includes consent for

• Data collection
• Visitor logging
• CCTV references
• Gate pass generation
• Notifications
• SMS communications
• Email broadcasts
• QR code usage
• Document storage
• Biometric or identification information where applicable

SystoMax acts solely as a data processor or software provider unless explicitly stated otherwise

5. Financial & Billing Information

Depending on enabled features, we may process

• Invoice records
• Payment history
• Transaction identifiers
• Subscription billing details
• Gateway reconciliation data
• Offline payment records
• Tax-related information
• Refund records

SystoMax does not directly store full payment card details unless explicitly stated and supported through compliant third-party payment processors

Payment transactions may be processed through

• Stripe
• PayPal
• JazzCash
• Banking systems
• Third-party payment providers

Such payment providers maintain their own independent privacy policies and compliance obligations

6. Technical & Device Information

SystoMax may automatically collect technical information including

• IP addresses
• Device identifiers
• Browser type
• Operating system
• Login timestamps
• Access logs
• User agent strings
• API usage logs
• Error logs
• Geographic region information
• Session activity

This information is used for

• Security monitoring
• Fraud prevention
• Audit logging
• Troubleshooting
• Performance optimization
• System administration

7. Cookies & Tracking Technologies

SystoMax may use

• Cookies
• Session tokens
• Authentication cookies
• Analytics technologies
• Local storage
• Security tracking systems

These technologies help

• Maintain user sessions
• Improve security
• Analyze platform usage
• Store preferences
• Prevent unauthorized access

Users may disable cookies through browser settings; however, certain platform functionality may not operate properly

See our Cookie Policy for detailed information about how we use cookies and similar technologies.

8. How We Use Information

SystoMax may use collected information to

• Provide SaaS services
• Operate platform modules
• Process subscriptions and billing
• Manage user authentication
• Generate invoices and reports
• Enable payment processing
• Provide technical support
• Improve platform functionality
• Conduct analytics and diagnostics
• Send notifications and announcements
• Detect fraud or abuse
• Maintain audit logs
• Enforce legal rights
• Comply with legal obligations

We do not sell personal data to third parties

9. Multi-Tenant Architecture & Data Isolation

SystoMax operates a multi-tenant SaaS infrastructure that may include

• Tenant-specific databases
• Tenant-level isolation
• RBAC access controls
• Domain-based routing
• Permission segregation
• Access logging systems

SystoMax implements commercially reasonable safeguards designed to prevent unauthorized cross-tenant access

However, no digital infrastructure can guarantee absolute security or complete elimination of cybersecurity risks

10. Role-Based Access Control (RBAC)

Access to information within the Platform is controlled through

• User roles
• Permissions
• Module-level access rules
• Audit logging
• Authentication systems

Tenant administrators are responsible for

• Assigning user permissions
• Managing internal user access
• Ensuring authorized usage within their organization

SystoMax is not responsible for misuse caused by improperly assigned permissions by Clients

11. Cross-Border Data Transfers

Because SystoMax serves international customers, data may be

• Stored internationally
• Processed across multiple jurisdictions
• Routed through global infrastructure providers
• Backed up on international cloud systems

By using the Platform, users consent to international transfer, storage, and processing of information

Such transfers may involve countries

12. Third-Party Service Providers

SystoMax may engage third-party providers for

• Cloud hosting
• Email delivery
• SMS gateways
• Payment processing
• CDN services
• Monitoring systems
• Analytics
• Security services
• Backup infrastructure

Third-party providers may process information strictly for operational purposes

SystoMax does not control third-party privacy practices outside its own services

13. Payment Gateway Providers

Payment transactions may be processed by external providers including

• Stripe
• PayPal
• JazzCash
• Banking institutions
• Other regional processors

SystoMax is not responsible for

• Payment gateway security practices
• Banking infrastructure failures
• Payment disputes
• Financial institution actions
• Currency conversion issues
• Chargebacks or reversals

Users should review the privacy policies of payment providers separately

14. Communications & Notifications

SystoMax may send

• Billing notices
• Security alerts
• Maintenance notifications
• Announcements
• System updates
• Password reset communications
• Service-related emails
• SMS notifications

Clients may configure communication preferences through available settings where applicable

Certain critical notifications cannot be disabled

15. Audit Logs & Monitoring

For security, compliance, and operational integrity, SystoMax may maintain audit logs including

• Login history
• IP addresses
• Device information
• Record modifications
• User actions
• Permission changes
• API activity
• Failed login attempts
• Security events

Audit logs may be retained for security, legal, and operational purposes

16. Data Retention

SystoMax retains data for as long as necessary to

• Provide services
• Fulfill contractual obligations
• Maintain backups
• Resolve disputes
• Enforce agreements
• Comply with legal requirements

Unless otherwise agreed

• Customer data may remain accessible during active subscriptions
• Certain backups and logs may persist temporarily after deletion
• Data may be retained after account closure where legally necessary

Clients are responsible for exporting their own records before termination

17. Data Deletion Requests

Subject to legal, contractual, and operational obligations, Clients may request deletion of data

Deletion requests may be limited where data retention is required for

• Security investigations
• Fraud prevention
• Legal compliance
• Financial reporting
• Backup integrity
• Contract enforcement

Deleted information may remain temporarily in encrypted backups or archived systems until routine deletion cycles complete

18. Security Measures

SystoMax implements commercially reasonable safeguards including

• Role-Based Access Control (RBAC)
• Authentication systems
• Database isolation
• Access monitoring
• Encryption where applicable
• Backup systems
• Firewall protections
• Audit logging
• Infrastructure monitoring

Despite these safeguards, no method of transmission or storage is completely secure

Users acknowledge inherent cybersecurity risks associated with internet-based services

18.1 Client Security Responsibilities

Clients are solely responsible for

• Strong password policies
• User access management
• Internal cybersecurity practices
• Employee account security
• Device security
• Antivirus protection
• Network security
• Preventing unauthorized access within their organization

SystoMax shall not be liable for breaches caused by compromised client credentials or poor internal security practices

18.2 Cybersecurity Incident Limitation

SystoMax shall not be liable for damages arising from

• Hacking attempts
• Malware attacks
• Ransomware incidents
• Credential theft
• Phishing attacks
• Distributed denial-of-service attacks (DDoS)
• Internet-wide vulnerabilities
• Third-party breaches

SystoMax will use commercially reasonable efforts to mitigate and respond to security incidents

19. Children's Privacy

The Platform is not intended for use by children under the age permitted by applicable law without supervision or authorization from a parent, guardian, or legally authorized organization

SystoMax does not knowingly collect personal information from children in violation of applicable laws

20. International Compliance

SystoMax operates from Pakistan while serving international customers

Clients are responsible for ensuring their use of the Platform complies with laws applicable in their jurisdiction, including

• Privacy laws
• Consumer laws
• Labor laws
• Financial regulations
• Tax obligations
• Electronic transaction laws

SystoMax does not provide legal or regulatory compliance advice

20.1 No Guarantee of Regulatory Compliance

SystoMax does not warrant or guarantee that use of the Platform alone ensures compliance with

• Local housing regulations
• Accounting standards
• GDPR
• Labor laws
• Tax laws
• Financial regulations
• Record retention laws
• Government filing requirements
• Data localization laws
• Electronic invoicing laws

Clients remain solely responsible for ensuring compliance with all laws applicable to their organization and jurisdiction

21. Compliance With Pakistani Laws

SystoMax operates in accordance with applicable laws of the Islamic Republic of Pakistan, including where applicable

• Prevention of Electronic Crimes Act (PECA) 2016
• Electronic Transactions Ordinance 2002
• Income Tax Ordinance 2001
• Applicable cybersecurity and commercial regulations

Users acknowledge that data may be processed under Pakistani legal jurisdiction

22. Your Rights

Depending on applicable laws, users may have rights to

• Access personal information
• Correct inaccurate information
• Request deletion
• Request export of data
• Withdraw consent where applicable
• Object to certain processing activities

Requests may be subject to identity verification and operational limitations

23. Third-Party Links

The Platform or websites may contain links to third-party websites or services

SystoMax is not responsible for

• External website content
• Third-party privacy practices
• External services or policies

Users access third-party services at their own risk

23A. Government & Law Enforcement Requests

SystoMax may disclose data where required by

• Court orders
• Government authorities
• Law enforcement agencies
• Regulatory bodies
• Legal obligations under applicable law

SystoMax reserves the right to comply with lawful requests without prior notice where legally prohibited from doing so

24. Changes to This Privacy Policy

SystoMax reserves the right to modify this Privacy Policy at any time

Updated versions become effective upon posting on the website or Platform

Continued use of the Platform after updates constitutes acceptance of revised policies

25. Limitation of Liability

To the maximum extent permitted by law, SystoMax shall not be liable for

• Unauthorized access
• Data breaches caused by third parties
• Internet failures
• Cyberattacks
• Payment processor failures
• User negligence
• Misconfigured permissions
• External service outages

Users acknowledge that no online service can guarantee absolute security

26. Governing Law & Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of the Islamic Republic of Pakistan

Any disputes arising from this Privacy Policy or related services shall be subject to the exclusive jurisdiction of the competent courts of Pakistan

International users acknowledge that they are interacting with a Pakistan-based technology provider

27. Contact Information

SystoMax
Pakistan
Website: https://systomax.com

For privacy inquiries, legal notices, or data-related requests, users may contact SystoMax through official support channels available on the website