Privacy policy

This policy explains what personal data IRISYS collects when you visit irisys.cloud or contact us, why we collect it, how long we keep it and the rights you have over it. It is written to comply with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for visitors located in the European Economic Area, with the General Data Protection Regulation (GDPR).

Who is responsible

IRISYS, established in Dubai, United Arab Emirates, is the data controller for the personal data described in this policy. Questions and requests about your data can be sent to privacy@irisys.cloud.

What this policy covers

This policy covers the public website irisys.cloud, the demo-request and contact forms, and the emails and messages you exchange with us. Data processed inside the IRISYS platform on behalf of a client company (sales, stock, orders, user accounts) is governed by the contract and the data processing agreement signed with that client, for which IRISYS acts as processor.

What we collect

We collect only what is needed to answer you and run the website:

• Demo and contact requests: first name, last name, company, job title, work email, phone number if you choose to give it, number of points of sale, ERP in use, your message, the language and page from which the request was sent, and the date and time.
• Technical data attached to a request: the IP address and browser identification string, kept to detect abuse and duplicate submissions.
• Email correspondence: the content of the messages you send to our addresses and the associated metadata.
• WhatsApp: if you choose to contact us through the WhatsApp button, the conversation is carried by WhatsApp (Meta Platforms) under its own privacy terms. We see your name and number as displayed in WhatsApp.
• Browser preferences: your chosen language is remembered in your browser only, without any cookie or transmission to us.

We do not use advertising trackers, social media pixels or third-party audience measurement on this website.

Why we collect it and on what basis

• To answer your demo or contact request, prepare a proposal and organise a pilot: performance of pre-contractual steps taken at your request, and your consent given when you submit the form.
• To keep you informed about IRISYS after a request, by email, when you have agreed to it: your consent, which you can withdraw at any time.
• To protect the website against abuse, spam and fraudulent submissions: our legitimate interest in keeping the service secure.
• To comply with legal obligations, such as accounting or record-keeping rules when a contract is signed.

Who has access to it

Your data is accessed only by IRISYS staff who need it to handle your request. It is not sold, rented or shared for marketing by third parties.

The following service providers process data on our behalf, under contracts that bind them to confidentiality and security obligations:

• Hostinger International Ltd (Cyprus): hosting of the website, of the request database and of our mail servers, on servers located in Frankfurt, Germany.
• Meta Platforms (WhatsApp): only if you choose to contact us through WhatsApp.
• Your own email provider and ours carry the messages you send us.

We may disclose data when required by law, by a court order or by a competent authority.

International transfers

IRISYS is established in the United Arab Emirates and stores website data in the European Union. Data may therefore move between the UAE and the EU. Such transfers are made in accordance with Articles 22 and 23 of the UAE Personal Data Protection Law and, where the GDPR applies, with appropriate safeguards such as standard contractual clauses. You can ask privacy@irisys.cloud for details of the safeguards in place.

How long we keep it

• Demo and contact requests: 24 months after our last exchange, then deleted. If a contract is signed, the request is kept with the client file for the duration of the contract.
• IP address and browser string attached to a request: 12 months, then removed from the record.
• Email correspondence: for as long as needed to handle the matter, then archived for up to 5 years for legal and evidentiary purposes.
• Client contract data: the duration of the contract plus the retention period required by UAE law.

How we protect it

Connections to the website are encrypted (HTTPS/TLS). Request data is stored in an access-controlled database on a hardened server with regular backups. Administrative access is limited to authorised IRISYS staff, protected by individual credentials and session controls. Our mail servers use transport encryption and message authentication (SPF, DKIM, DMARC). No system is completely secure; if a breach affecting your data occurs, we will notify the competent authority and, where required, you, in accordance with the applicable law.

Your rights

Under the UAE Personal Data Protection Law and, where applicable, the GDPR, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate or incomplete data corrected;
• have your data deleted when it is no longer needed for the purpose it was collected;
• restrict or object to a processing based on our legitimate interest;
• receive the data you provided in a structured, machine-readable format;
• withdraw your consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal;
• not be subject to a decision based solely on automated processing that produces legal effects concerning you. IRISYS does not make such decisions about website visitors.

To exercise these rights, write to privacy@irisys.cloud. We answer within one month and may ask you to confirm your identity. If you consider that your rights have not been respected, you can lodge a complaint with the UAE Data Office or, in the European Economic Area, with your local supervisory authority.

Cookies and local storage

This website does not set cookies for visitors. Your language preference is stored in your browser’s local storage so that the site opens in the right language on your next visit; it never leaves your device and you can clear it in your browser settings.

A session cookie is used only by IRISYS staff to sign in to the administration area; it is not set for visitors.

If we add an audience-measurement tool in the future, it will be a privacy-preserving tool without cross-site tracking, and this policy will be updated to describe it before it is activated.

Children

This website and the IRISYS platform are intended for businesses and their professional users. We do not knowingly collect data from persons under 18. If you believe a minor has provided us with data, contact privacy@irisys.cloud and we will delete it.

Changes to this policy

We may update this policy when our services or the law change. The date at the top of the page shows the latest version. Material changes will be announced on this page before they take effect.

Contact

For any question about this policy or your personal data: privacy@irisys.cloud. For all other matters: contact@irisys.cloud.