Privacy & Data Policy
1. Overview & Scope
Lama ERP and its affiliates ("Lama ERP", "we", "us", "our") provide an integrated enterprise resource planning platform covering finance, HR, inventory, sales, manufacturing, and more.
This Privacy Policy explains what personal data we collect, why we collect it, and how we use and protect it when you visit our website or use our cloud or on-premises services.
By registering for or using Lama ERP services, you agree to the practices described in this policy. If you are using Lama ERP on behalf of an organisation, you confirm that you are authorised to agree to this policy on its behalf.
2. Information We Collect
A. Account & Contact Data
When you register, purchase a subscription, or fill in a contact or support form, you voluntarily provide us with information such as:
- Name and company name
- Email address
- Phone number
- Postal address (when billing or delivery is required)
- Business sector and intended use of Lama ERP
- Account password (stored in encrypted form)
We never record or store credit card numbers. All payments are handled by PCI-DSS-certified third-party processors.
B. ERP Database Data
When you create a Lama ERP environment, any data you submit or upload is your own. This may include employee records, customer and supplier contacts, financial transactions, files, messages, and pictures. We collect and process this data solely to provide the services you have subscribed to. You retain full ownership and control at all times.
C. Job Application Data
If you apply for a position at Lama ERP, we collect your name, email address, phone number, and any information you choose to share in your cover letter and CV (resume).
For roles with a higher risk of application fraud, we may also ask for a passport or national ID number solely for the purpose of uniquely identifying candidates.
We will never collect information about your racial or ethnic origin, political opinions, religious beliefs, trade union membership, or sexual orientation.
D. Browser & Technical Data
Our servers automatically record certain technical information when you visit our website or use our services:
- IP address
- Browser type, version, and platform
- Operating system
- Pages or resources accessed and time of visit
- Referring web page (how you arrived at our site)
- Browser language and approximate country (geolocation)
This data is used anonymously for security monitoring, performance analysis, and legal compliance. It is only linked to your identity when required by law or when investigating a security incident.
Some of our forms are protected by Google reCAPTCHA, which analyses browser and device characteristics to detect automated abuse. Only the anonymous risk score produced by reCAPTCHA is used by us.
E. Integration & API Data
When you connect third-party services (such as payment gateways, email providers, or cloud storage), the necessary authentication tokens and transaction metadata are collected to facilitate those integrations. OAuth access tokens are discarded at the end of a session or within 48 hours, whichever comes first.
3. How We Use Your Data
We use the data we collect for the following purposes:
- Service delivery: provisioning, operating, maintaining, and supporting your Lama ERP environment.
- Account management: authentication, billing, invoicing, subscription management, and renewal notifications.
- Product improvement: anonymised and aggregated analytics to improve platform features and user experience.
- Marketing & communication: sending relevant product updates, new feature announcements, and promotional offers. Every marketing message includes a clear and easy opt-out link.
- Security: detecting, investigating, and preventing fraudulent, abusive, or unauthorised activity.
- Legal compliance: meeting obligations under applicable laws, including tax records and audit trails.
- Recruitment: evaluating job applications and, where applicable, preparing employment contracts.
We do not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes.
5. Data Retention
Account & Contact Data
Retained for as long as your account is active and for any applicable legal period thereafter, or until you request deletion.
ERP Database Data
Kept for the duration of your active subscription. After cancellation, your database is held in a deactivated state for 21 days (a grace period), then permanently destroyed. You may also request immediate deletion via your control panel.
Browser & Server Logs
Retained for a maximum of 12 months, or longer if required by law or a legitimate security investigation. Session data is discarded within 7 days of inactivity.
Job Application Data
If you are not hired, your application data may be kept for up to 3 years so we can contact you about future openings, unless you ask us to delete it sooner. If hired, data is retained for the duration of employment and the applicable legal period after.
Payment Records
Transaction records are retained for 7 years to meet financial and tax compliance obligations.
Backup Copies
When personal data is deleted from our live systems, it may persist in encrypted offline backups for up to 12 months until those backups are automatically overwritten. Backups of deleted data are not used for any purpose other than maintaining backup integrity.
6. Security
We apply technical, administrative, and organisational safeguards proportionate to the risk of the data we process:
- Encryption in transit using TLS 1.2 or higher
- Encryption at rest using AES-256
- Role-based access controls and least-privilege principles
- Multi-factor authentication (MFA) available for all user accounts
- Regular penetration testing and vulnerability assessments
- Continuous uptime and intrusion-detection monitoring
- ISO 27001-certified hosting infrastructure
- Incident response procedures, including customer notification within 72 hours of a confirmed data breach
If you discover a potential security vulnerability in our platform, please report it responsibly to [email protected] before any public disclosure.
7. Data Location & International Transfers
You choose your hosting region during onboarding. Your primary data is stored in your selected region, with geographically separated redundant backup copies.
| Region | Production location | Backup locations |
|---|---|---|
| Asia-Pacific | Nepal | Nepal |
In some cases, Lama ERP support or engineering staff in other countries may access your data to resolve a technical issue or at your explicit request. Such access is always:
- Limited to what is necessary to resolve the issue
- Subject to the same confidentiality standards as access by local staff
- Governed by EU Standard Contractual Clauses or equivalent transfer mechanisms where applicable
9. Your Rights
Depending on your location and applicable privacy laws (including GDPR), you may have the following rights:
Right to Access
Request a copy of the personal data we hold about you.
Right to Rectification
Ask us to correct inaccurate or incomplete data.
Right to Erasure
("Right to be Forgotten") Request deletion of your personal data, subject to any legal retention obligations.
Right to Data Portability
Receive your personal data in a structured, machine-readable format.
Right to Restrict Processing
Ask us to limit how we use your data in certain circumstances.
Right to Object
Object to processing of your data for direct marketing or on grounds relating to your particular situation.
Right to Withdraw Consent
Where processing is based on your consent, withdraw it at any time without affecting prior processing.
Right to Lodge a Complaint
If you are dissatisfied with our response, you may lodge a complaint with your local data protection authority.
- Log in to your Lama ERP account dashboard and use the data management tools available there, or
- Contact us at [email protected]
We will respond within 30 days. In complex cases we may extend this by a further 60 days, and will notify you if this is necessary.
10. Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or industry best practices. The "Last updated" date at the top of this document shows when the most recent revision took effect.
For significant changes, we will notify registered users by email or via an in-app notification at least 14 days before the change becomes effective. Archived versions of this policy are available upon request by contacting [email protected].
Continued use of Lama ERP after the effective date of any update constitutes acceptance of the revised policy.
11. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:
Lama ERP — Data Protection Officer
Chabhil, Kathmandu, Nepal, 44600