In short: organizations use Expense Management to keep their spending records and staff claims. For those records the organization decides what is collected and why, and we process them on its behalf. We also keep a small amount of data of our own to run your NVDRA account, bill organizations and keep the service secure. We do not sell personal data and we do not show advertising.
Who we are and our role
Expense Management is provided by NVDRA Technologies. This policy explains how personal data is handled in Expense Management.
- Data a organization puts into Expense Management: the organization decides what to collect and why, and is responsible for it. We process this data only on its instructions, as set out in our Data Processing Terms. If your information was entered by a organization, please contact it first; we will help it answer you.
- Data we use for our own purposes (your NVDRA account, billing, security logs, support requests, our public pages): NVDRA Technologies is responsible for it.
Pakistan does not yet have a general personal data protection law in force. We follow the Prevention of Electronic Crimes Act, 2016, the Electronic Transactions Ordinance, 2002 and the other laws that apply to us, and we have designed this policy around widely accepted data protection principles: collecting only what is needed, using it only for clear purposes, keeping it secure, and keeping it no longer than necessary. We will update this policy when a data protection law comes into force.
What personal data is processed
| Whose data | What | Where it comes from |
|---|---|---|
| Everyone with an NVDRA account | Name, email address, mobile / WhatsApp number, password (stored only as a one-way hash), the organisations and roles you belong to, sign-in history. | You, or the organization that invited you |
| Staff (team members) | Name, role, branches, the expenses and claims they recorded, approved or paid, and their notes. | The organization |
| Expenses and claims | Date, amount, category, branch, vendor, description, reference, who claimed it, approval steps and decisions with notes, payment account, method and reference, void reasons. | Staff of the organization |
| Receipts | Bills and receipts uploaded as PDFs or images (up to five per expense). They may contain names, addresses or phone numbers of vendors. | Staff of the organization |
| Budgets and recurring bills | Budget amounts, alerts, recurring expense schedules. | The organization |
| Billing | The organization’s name and contact person, invoices and payment proofs (for example, bank transfer receipts). | The Owner |
| Technical data | IP address, browser and device type, sign-in sessions, security and error logs, push notification subscriptions. | Your browser or device |
Receipts can contain more personal data than the expense needs; please upload only what the organization needs to keep.
How the data is used
- To provide Expense Management to the organization: recording expenses and claims, approvals, payments, budgets, recurring bills and reports.
- To notify people: approvers about waiting expenses, claimants about decisions and reimbursements, accountants about bills to pay, and owners about budgets, by in-app notification, push notification or email, in the language each person chose.
- To sign you in once across NVDRA applications through our single sign-on service.
- To bill organizations and verify payment proofs.
- To keep the Service and its users safe: preventing fraud and abuse and protecting accounts.
- To support you and to fix problems you report.
- To improve the Service using aggregated usage information (for example, how many organisations use a feature), not the contents of your records.
- To meet legal obligations, such as keeping records the law requires and responding to lawful requests.
Our reasons for processing are: performing our contract with the organization and with you; the organization’s instructions; consent where it is needed (for example, push notifications on your device); our legitimate interest in running a secure, reliable service; and legal obligations. We make no decisions about people based solely on automated processing that have legal or similarly significant effects.
Who receives the data
We do not sell or rent personal data. It is shared only as follows:
- Within the organization: according to the roles and branches it sets.
- AdvansEdu: when a school connects it, each paid expense (date, amount, category and description) is posted to the school’s AdvansEdu ledger.
- Service providers who help us run Expense Management and may only use the data to do so: hosting and backup providers, email delivery providers, and the push services of browser and phone makers (such as Google, Apple and Mozilla), and font delivery services (Bunny Fonts (Urdu and Sindhi fonts)), which receive your IP address when a page loads.
- Other NVDRA applications the organization connects, which receive only the data needed for the connection.
- Authorities, when required by law, a court order, or a lawful request of an investigating agency under the Prevention of Electronic Crimes Act, 2016, or when needed to protect someone’s safety. Where the law allows, we tell the organization first.
- A buyer or successor of our business, under the same protections, if the Service is transferred. We will tell organizations before that happens.
Where the data is stored
Expense Management is hosted on servers operated by our hosting providers, which may be located in Pakistan or abroad. Some providers listed above process data in other countries. When data is processed outside Pakistan we use providers that apply recognised security standards, and we limit what they receive to what is needed. If Pakistani law requires certain data to be kept in Pakistan, we will comply.
How long data is kept
- Organization records are kept while the organization’s account is open and as long as the organization keeps them.
- After a organization closes its account, its data stays available for export for 30 days and is then deleted from the live system within a further 60 days. Backups are overwritten on a rolling cycle of up to 90 days.
- Voided expenses stay in the records, marked as void, so that numbering and audits stay complete.
- Your NVDRA account is kept until you ask us to delete it or it has been inactive for a long period and is no longer linked to any organisation.
- Billing records are kept for as long as tax and accounting laws require.
- Security and access logs are kept for at least one year, as service providers are required to retain traffic data under the Prevention of Electronic Crimes Act, 2016, and longer if needed for an investigation.
How the data is protected
- All connections use HTTPS encryption, and passwords are stored only as one-way hashes; we cannot see them.
- Access is based on roles, so each person sees only what their role needs. Private files are stored outside the public web folder and served only to people allowed to see them.
- Receipts are kept on private storage and shown only to people allowed to see the expense.
- Access by NVDRA staff is limited to authorised people for support, security and legal reasons. When a senior administrator signs in as a User from the NVDRA Admin Panel, a reason is required, a banner shows it is NVDRA access, and the session is recorded in audit logs.
If a security incident affects personal data, we will inform the affected organization without undue delay so that it can inform the people concerned, and we will take steps to limit the harm.
Your choices and rights
You can ask to see the personal data held about you, to correct it, to delete it where it is no longer needed, to receive a copy in a common format, or to object to a use of it. You can also turn push notifications off in your browser or phone settings, and change your name, email, phone and password in your NVDRA account.
For records kept by a organization, please contact the organization; it decides on the request and we help it. For anything else, write to support@nvdra.com. We will reply within 30 days. We may need to confirm your identity first, and some data may have to be kept for legal reasons; if so, we will explain why.
Cookies
Expense Management uses only the cookies and browser storage needed for signing in, security and remembering your choices. It does not use advertising or tracking cookies. See the Cookie Policy.
Changes to this policy
We will update this policy when our practices or the law change, and show the date of the latest version at the top. If a change materially affects how personal data is used, we will tell you by email or in the app before it takes effect.
Contact
NVDRA Technologies
Email: support@nvdra.com