GDPR & Data Protection

OneSuit is built and operated by Maati Tech Private Limited (Lahore, Pakistan). We designed OneSuit so that every business runs in its own isolated database, and we apply the principles of the EU/UK General Data Protection Regulation (GDPR) to every customer, wherever they are.

1. Who is the controller and who is the processor?

Your business is the data controller for the customers, suppliers, staff and transactions you enter into OneSuit. You decide what to collect and why. Maati Tech is the data processor: we store and process that data only to provide the OneSuit service, on your instructions, and never for our own marketing.

For the onesuit.pk website, your account details and billing, Maati Tech is the controller.

2. What personal data is processed

• Account data — your name, business name, email, phone, subdomain and billing history.
• Business data you enter — customer and supplier names, phone numbers, addresses, invoices, repair jobs (including device serial/IMEI), payments, staff records, attendance and payroll.
• Messages — the content and delivery status of WhatsApp, SMS and email notifications you send through OneSuit.
• Technical data — login times, IP address, device and browser, used for security and login-device management.

3. Lawful basis

• Contract — providing the OneSuit service you subscribed to.
• Legitimate interests — securing the platform, preventing fraud, improving the product using aggregated, non-identifying statistics.
• Legal obligation — keeping billing records and complying with tax law.
• Consent — marketing emails from Maati Tech (opt-out anytime) and cookies on onesuit.pk.

4. Your rights (and your customers' rights)

Under GDPR, individuals can request access, correction, deletion, restriction, portability and can object to processing. OneSuit gives you the tools to honour these requests yourself:

• Export any customer, supplier, sales or job list to Excel/PDF (portability and access).
• Edit or anonymise a customer record from People → Customers (correction, deletion, restriction).
• Delete a user or staff member from User Management.
• Export your entire business data from Settings → Backup.

If a request concerns data Maati Tech holds as controller (your account or billing), email us — we respond within 30 days.

5. Retention and deletion

• Business data is kept for as long as your subscription is active.
• After cancellation or the end of a trial, data is kept for 30 days so you can export it, then permanently deleted from the live database. Encrypted backups expire within a further 30 days.
• Billing records are retained for the period required by Pakistani tax law.
• You can request earlier deletion at any time.

6. Security measures

• An isolated database per business — no shared tables between customers.
• Encrypted connections (HTTPS/TLS) for the web app, API and integrations.
• Two-factor authentication, role-based permissions and login-device approval.
• Automated daily backups stored encrypted, with on-demand backups from Settings → Backup.
• Access to production systems restricted to named Maati Tech engineers under confidentiality agreements.
• System health monitoring and audit logs of logins and key actions.

7. Sub-processors

We use a small number of service providers to run OneSuit. Each is bound by a data processing agreement and processes data only for the purpose stated:

Provider type	Purpose	Data
Cloud hosting provider	Servers, database and backups	All application data (encrypted at rest)
Email delivery (SMTP)	Transactional email you send from OneSuit	Recipient email, message content
WhatsApp / SMS gateways	Notifications you send from OneSuit	Recipient phone number, message content
Payment gateways (Stripe, PayPal, JazzCash, EasyPaisa)	Online payments	Payer name, email, amount — card data never touches OneSuit
eCommerce and accounting platforms (WooCommerce, Shopify, QuickBooks)	Only when you connect them	Products, orders, customers you choose to sync

We will inform you by email before adding a sub-processor that affects your data.

8. International transfers

OneSuit servers are located in secure data centres, and support is provided from Lahore, Pakistan. For UK and EU customers we rely on Standard Contractual Clauses (SCCs) and the UK Addendum in our Data Processing Agreement to cover any transfer of personal data outside the UK/EEA.

9. Breach notification

If we become aware of a personal data breach affecting your business data, we will notify you without undue delay and in any case within 72 hours, with the information you need to notify your supervisory authority and affected individuals.

10. Data Processing Agreement (DPA)

UK/EU customers can request a signed DPA covering the terms above (Article 28 GDPR), including SCCs. Email us with your business name and subdomain and we will send it within 3 working days.

11. Contact

Data protection questions, rights requests and DPA requests: maatitechnologies@gmail.com — Maati Tech Private Limited, 64B Block L Commercial, Al Rehman Garden Phase 2, Lahore, Punjab Pakistan 54000. Read also our Privacy Policy and Terms & Conditions.

This page describes our practices in plain language; it is not legal advice. Last updated September 2026.