📋 Table of Contents
1 Who We Are
DONUT ERP ("we", "our", "us") is a GCC-based enterprise software company providing AI-powered ERP solutions for businesses across the Gulf Cooperation Council region. Our platform serves industries including Real Estate, Trading, Facility Management, and more.
For the purposes of applicable data protection laws — including the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL) and other applicable GCC regulations — DONUT ERP acts as the data controller for personal data collected through our website and platform.
2 Data We Collect
We collect personal data in the following categories:
a) Information You Provide Directly
- Full name, job title, and company name
- Business email address and phone number
- WhatsApp contact number (when you reach out via WhatsApp)
- Information submitted through demo request forms, contact forms, or proposal requests
- Messages and communications you send to us
b) Information Collected Automatically
- IP address and approximate geographic location
- Browser type, operating system, and device information
- Pages visited, time spent on site, and referring URLs
- Cookie identifiers and session data (see Section 6)
c) Information from Platform Usage (for ERP clients)
- Business transaction data entered into the ERP system
- User account credentials (stored securely — passwords are hashed)
- Activity logs, audit trails, and system usage data
- Uploaded documents and files within the platform
d) Information from Third Parties
- Business contact information from LinkedIn or other professional networks if you engage with us there
- Referral information if a partner or existing client refers you
3 How We Use Your Data
We use the personal data we collect for the following purposes:
- Service Delivery: Providing, operating, and maintaining our ERP platform and related services
- Demo & Sales: Responding to demo requests, proposals, and sales inquiries
- Customer Support: Resolving support tickets, answering queries, and providing technical assistance
- Communication: Sending product updates, announcements, or important service notifications
- Marketing: Sending promotional emails or WhatsApp messages about new features and offers (with your consent, and you may opt out at any time)
- Analytics & Improvement: Understanding how our website and platform are used to improve user experience
- Legal Compliance: Meeting our obligations under UAE and GCC law
- Security: Detecting and preventing fraud, abuse, or unauthorized access
4 Legal Basis for Processing
We process your personal data based on one or more of the following legal grounds:
- Contractual Necessity: Processing required to perform a contract with you or to take pre-contractual steps at your request (e.g., setting up an ERP account)
- Legitimate Interests: Where processing is necessary for our legitimate business interests, such as improving our services or preventing fraud, provided those interests are not overridden by your rights
- Consent: Where you have given explicit consent, such as subscribing to our newsletter or receiving marketing messages via WhatsApp
- Legal Obligation: Where we are required to process data to comply with UAE or GCC legal requirements
5 Data Sharing & Disclosure
We do not sell your personal data to third parties. We may share your information only in the following limited circumstances:
- Service Providers: Trusted third-party vendors who assist us in operating our website, platform, or business (e.g., cloud hosting, email delivery, payment processing). These providers are contractually bound to protect your data.
- Business Partners: Authorized resellers or implementation partners in the GCC region, only where necessary to deliver services you have requested
- Legal Requirements: Government authorities or law enforcement agencies if required by law, court order, or legal process in the UAE or applicable jurisdiction
- Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, with notice provided to you
- With Your Consent: Any other sharing with your explicit prior consent
6 Cookies & Tracking
Our website uses cookies and similar tracking technologies to enhance your experience. We use the following types of cookies:
- Strictly Necessary Cookies: Essential for the website to function. These cannot be disabled.
- Analytics Cookies: Help us understand how visitors interact with our site (e.g., Google Analytics). Data is aggregated and anonymized.
- Preference Cookies: Remember your settings and preferences for future visits.
- Marketing Cookies: Used to deliver relevant advertisements (only with your consent).
You can control cookie settings through your browser preferences. Most browsers allow you to refuse cookies or delete existing ones. Note that disabling certain cookies may affect the functionality of our website.
By continuing to use our website, you consent to the use of strictly necessary cookies. For other cookie types, we will request your consent where required by law.
7 Data Storage & Security
Your data is stored on secure cloud servers, primarily located within the GCC region (UAE). We implement industry-standard security measures to protect your personal data, including:
- SSL/TLS encryption for all data transmitted between your browser and our servers
- At-rest encryption for sensitive stored data
- Role-based access controls and the principle of least privilege
- Regular security audits and vulnerability assessments
- Secure password hashing (bcrypt/Argon2) — we never store plaintext passwords
- Two-factor authentication options for platform accounts
8 Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:
- Prospect/Lead Data: Up to 3 years from last interaction, unless you request deletion earlier
- Active Client Data: For the duration of the contract plus 5 years thereafter (for legal and audit purposes)
- Website Analytics Data: Up to 26 months (aggregated/anonymized)
- Support Communications: Up to 3 years
- Legal/Compliance Records: As required by UAE commercial and tax laws (typically 5–10 years)
When data is no longer needed, we securely delete or anonymize it.
9 Your Rights
Under applicable data protection laws, including the UAE PDPL, you have the following rights regarding your personal data:
- Right to Access: Request a copy of the personal data we hold about you
- Right to Rectification: Request correction of inaccurate or incomplete data
- Right to Erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations
- Right to Restrict Processing: Request that we limit how we use your data in certain circumstances
- Right to Data Portability: Receive your data in a structured, machine-readable format
- Right to Object: Object to processing based on legitimate interests, including direct marketing
- Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing
To exercise any of these rights, please contact us at privacy@donuterp.com. We will respond within 30 days. We may need to verify your identity before processing your request.
If you are dissatisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in the UAE.
10 Third-Party Links
Our website may contain links to third-party websites, including social media platforms (LinkedIn, Twitter, Facebook) and communication tools (WhatsApp). This Privacy Policy applies only to our website and platform.
We are not responsible for the privacy practices of third-party sites. We encourage you to review the privacy policies of any external websites you visit.
11 Children's Privacy
Our services are intended for business use and are directed at individuals who are at least 18 years of age. We do not knowingly collect personal data from children under 18. If we become aware that we have collected data from a child, we will delete it promptly.
If you believe we have inadvertently collected information from a minor, please contact us at privacy@donuterp.com.
12 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make significant changes, we will:
- Update the "Last Updated" date at the top of this page
- Notify active clients via email or in-platform notification
- Where required by law, seek fresh consent
We encourage you to review this policy periodically. Your continued use of our website or platform after changes take effect constitutes acceptance of the updated policy.
13 Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please reach out:
- 📧 Email: privacy@donuterp.com
- 💬 WhatsApp: +971 50 300 1636
- 🌐 Website: donuterp.com
- 📍 Location: United Arab Emirates, GCC