Legal

Privacy Policy

This Privacy Policy describes how Enspekt(“we”, “us”, or “our”) collects, processes, stores, and protects personal data when you use our quality management and enterprise resource planning platform and related services.

Effective: 21 May 2025Last Updated: 21 May 2025GDPR CompliantUAE PDPPL Compliant

The data controller responsible for your personal data is Enspekt, a software-as-a-service company providing quality management solutions to industrial and manufacturing organisations (the “Company”, “we”, “us”).

When you or your employer subscribes to Enspekt, the contracting organisation acts as the data controller for the personal data of its own employees and third parties entered into the platform. Enspekt acts as a data processor on their behalf under the terms of our Data Processing Agreement (DPA).

Contact: privacy@enspekt.com

2.1 Account & Identity Data

Full name, business email address, job title, department
Profile photograph (if voluntarily uploaded)
Organisation name, org slug, and role within the platform
Authentication credentials (passwords stored as bcrypt hashes — never in plaintext)

2.2 Usage & Activity Data

Login timestamps, IP address, browser/device metadata
Page views, feature interactions, and session duration (pseudonymised)
Audit log entries generated by your actions within the platform

2.3 Quality Records Data (Customer Data)

Inspection records, NCRs, MRB dossiers, ITP results, supplier data, documents, and any other content you upload are processed strictly as your organisation's data. We do not access, read, or mine this data for any commercial purpose.

2.4 Communication Data

Emails sent to our support or sales teams
Contact form submissions
In-platform support tickets

2.5 Payment & Billing Data

Billing details are processed by our payment processor (Stripe). We do not store full card numbers, CVVs, or payment credentials on our servers.

We rely on the following lawful bases under GDPR Art. 6 and equivalent provisions of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, “PDPPL”):

Processing Activity	Legal Basis
Account creation & authentication	Contract performance (Art. 6(1)(b))
Service delivery & platform operation	Contract performance (Art. 6(1)(b))
Security monitoring & audit logs	Legitimate interests (Art. 6(1)(f))
Email notifications & alerts	Contract performance / Consent
Analytics (aggregated, pseudonymised)	Legitimate interests (Art. 6(1)(f))
Legal compliance & regulatory obligations	Legal obligation (Art. 6(1)(c))
Marketing communications (opt-in)	Consent (Art. 6(1)(a))

Provide, operate, maintain, and improve the Enspekt platform
Authenticate users and enforce role-based access controls
Send transactional emails (invitations, password resets, notifications)
Provide customer support and respond to queries
Detect, investigate, and prevent fraud, abuse, or security incidents
Fulfil legal and regulatory obligations including tax, audit, and dispute resolution
Generate aggregated, non-identifiable analytics to improve product performance
Send product updates and marketing (only with explicit consent; opt-out available at any time)

We will never sell, rent, or trade your personal data to third parties for their own marketing purposes.

We share personal data only with trusted sub-processors necessary to deliver the service. All sub-processors are bound by Data Processing Agreements and equivalent contractual protections.

5.1 Current Sub-Processors

Provider	Purpose	Location
Supabase	Database hosting & authentication	AWS (EU/US)
Google Firebase	Application hosting, file storage & CDN	Google Cloud (Global)
Stripe	Payment processing	US / EU
Resend / SendGrid	Transactional email delivery	US
Sentry	Error monitoring (pseudonymised)	US / EU

5.2 Mandatory Disclosures

We may disclose personal data to courts, regulators, law enforcement, or government authorities when required by applicable law, valid legal process, or to protect the rights, property, or safety of Enspekt, its customers, or the public.

Data Category	Retention Period
Active account data	Duration of subscription + 30 days
Quality records (NCRs, ITPs, MRB, etc.)	Duration of subscription + 90 days after cancellation
Audit logs & security logs	5 years (legal / regulatory obligation)
Billing records & invoices	7 years (tax law)
Deleted user data	Purged within 30 days of deletion request
Backups	Overwritten on a 30-day rolling cycle
Support communications	3 years

We may retain data beyond these periods where required by applicable law, court order, or legitimate dispute resolution needs.

Data encrypted in transit using TLS 1.3 and at rest using AES-256
Row-Level Security (RLS) enforced at the database layer — no cross-tenant data access is architecturally possible
Passwords hashed with bcrypt (minimum cost factor 12)
Role-Based Access Control (RBAC) enforced at API and database layers
Signed URLs for all private file downloads (maximum 1-hour expiry)
Multi-factor authentication available for all accounts
Regular penetration testing and vulnerability assessments
SOC 2 Type II programme in progress
Incident Response Policy with 72-hour breach notification (GDPR Art. 33)

No security system is impenetrable. Please report any suspected vulnerability to security@enspekt.com.

Subject to applicable law, you have the following rights regarding your personal data:

Access

Receive a copy of the personal data we hold about you

Rectification

Correct inaccurate or incomplete data

Erasure

Request deletion of your data ("right to be forgotten")

Restriction

Restrict processing in specific circumstances

Portability

Receive your data in a machine-readable format

Objection

Object to processing based on legitimate interests

Withdraw Consent

Withdraw consent at any time without penalty

Lodge a Complaint

File a complaint with your supervisory authority

To exercise any right, email privacy@enspekt.com. We will respond within 30 days. Identity verification may be required before we can process your request.

Note: Some rights may be limited where Enspekt is acting as a data processor on behalf of your employer (the data controller). In such cases we will direct your request to the relevant organisation.

We use cookies and similar technologies strictly necessary to operate the platform. We do not use third-party advertising cookies.

Cookie	Purpose	Duration
sb-auth-token	Supabase session authentication (HttpOnly, Secure)	Session
sb-refresh-token	Session refresh (HttpOnly, Secure)	1 week
locale	User language preference	1 year
_ga / _ga_*	Firebase Analytics — pseudonymised page load analytics (no PII)	90 days

Enspekt operates globally. Your data may be transferred to and processed in countries outside your jurisdiction, including the United States and the European Economic Area.

All international transfers are safeguarded by:

Standard Contractual Clauses (SCCs) approved by the European Commission
Data Processing Agreements with all sub-processors
Adequacy decisions where applicable
Transfer Impact Assessments (TIAs) for high-risk countries

Enspekt is a business-to-business platform intended exclusively for organisations and their employees aged 18 years or older. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have collected such data without appropriate consent, we will take immediate steps to delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will notify all account holders via email and via an in-app banner at least 30 days before the changes take effect. Continued use of the platform after the effective date constitutes acceptance of the revised policy.

The version history is maintained internally and available on request to any data subject.

For all privacy-related queries, data subject requests, or to contact our Data Protection Officer:

Privacy & DPO

Security Incidents

General Support

Sales & Contracts

Privacy Policy

1. Data Controller

2. Data We Collect

2.1 Account & Identity Data

2.2 Usage & Activity Data

2.3 Quality Records Data (Customer Data)

2.4 Communication Data

2.5 Payment & Billing Data

3. Legal Basis for Processing

4. How We Use Your Data

6. Data Retention

7. Security Measures

8. Your Rights

9. Cookies & Tracking

10. International Data Transfers

11. Children's Privacy

12. Changes to This Policy

13. Contact & DPO

Privacy Policy

1. Data Controller

2. Data We Collect

2.1 Account & Identity Data

2.2 Usage & Activity Data

2.3 Quality Records Data (Customer Data)

2.4 Communication Data

2.5 Payment & Billing Data

3. Legal Basis for Processing

4. How We Use Your Data

6. Data Retention

7. Security Measures

8. Your Rights

9. Cookies & Tracking

10. International Data Transfers

11. Children's Privacy

12. Changes to This Policy

13. Contact & DPO

Privacy Policy

1. Data Controller

2. Data We Collect

2.1 Account & Identity Data

2.2 Usage & Activity Data

2.3 Quality Records Data (Customer Data)

2.4 Communication Data

2.5 Payment & Billing Data

3. Legal Basis for Processing

4. How We Use Your Data

5. Data Sharing & Sub-Processors

5.1 Current Sub-Processors

5.2 Mandatory Disclosures

6. Data Retention

7. Security Measures

8. Your Rights

9. Cookies & Tracking

10. International Data Transfers

11. Children's Privacy

12. Changes to This Policy

13. Contact & DPO

Privacy Policy

1. Data Controller

2. Data We Collect

2.1 Account & Identity Data

2.2 Usage & Activity Data

2.3 Quality Records Data (Customer Data)

2.4 Communication Data

2.5 Payment & Billing Data

3. Legal Basis for Processing

4. How We Use Your Data

5. Data Sharing & Sub-Processors

5.1 Current Sub-Processors

5.2 Mandatory Disclosures

6. Data Retention

7. Security Measures

8. Your Rights

9. Cookies & Tracking

10. International Data Transfers

11. Children's Privacy

12. Changes to This Policy

13. Contact & DPO