1. Overview
This Privacy Policy explains how A-Finance LLC ("we", "the operator") collects, uses, stores and discloses personal data of users of the Vugrix ERP platform (the "Platform"). It is drafted in compliance with the Law of the Republic of Azerbaijan "On Personal Data" (No. 998-IIIQ of 11 May 2010), the Civil Code of the Republic of Azerbaijan and — to the extent applicable to data subjects in the European Economic Area — Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").
2. Data controller
The data controller (within the meaning of Article 2 of the AZ Law on Personal Data and Article 4(7) of the GDPR) is:
- Entity: A-Finance LLC
- Address: 27th street, building 14, Baku, Azerbaijan
- VÖEN:
2201420022· Reg. No.:1903023201 - Data-protection contact:
support@vugrix.com
3. Categories of personal data we process
- Identification and account data: full name, email, password (stored as a hash), profile photo, telephone number, employer information that you choose to provide on registration.
- Tenant and subscription data: company / organisation name, billing address, tax identifier, subscription plan, payment-method tokens (we do not store full card numbers), invoices, payment receipts.
- Usage data: log records (IP address, user-agent string, timestamps), pages visited, modules accessed, actions performed within the Platform, device language.
- Content data: any business data you upload, store or generate within the Platform (e.g. customers, orders, employees, documents).
- Cookies and similar technologies: see § 6 below.
- Communications: support tickets, abuse reports, email correspondence.
We do not knowingly collect special categories of personal data (sensitive data) unless you choose to upload them yourself as part of your tenant content (e.g. in the HR module).
4. Lawful bases for processing
Pursuant to Article 5 of the AZ Law on Personal Data and Article 6 GDPR, we rely on the following lawful bases:
- Performance of a contract — to create and operate your account, deliver the Platform, bill subscriptions and provide customer support.
- Compliance with a legal obligation — to keep accounting records under the Tax Code of the Republic of Azerbaijan and to respond to lawful requests from competent authorities.
- Legitimate interests — to ensure the security and integrity of the Platform, prevent fraud and abuse, improve our services and conduct internal analytics in aggregated, non-identifying form.
- Consent — for optional marketing communications, optional analytics cookies and any other purpose for which you have given specific consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
5. Purposes of processing
- Account creation, authentication and access management.
- Delivery and ongoing operation of Platform features.
- Billing, invoicing, taxation and accounting.
- Technical support and customer service.
- Information security, fraud prevention and audit logging.
- Improvement of the Platform (in aggregated, anonymised form).
- Compliance with legal obligations and lawful requests from competent authorities.
- Subject to your separate consent, marketing communications about our products and updates.
6. Cookies and similar technologies
We use the following categories of cookies:
- Strictly necessary cookies — required for the Platform to function (session, CSRF, language). These cookies do not require consent under Article 6.4 of the AZ Law on Personal Data.
- Functional cookies — remember your interface preferences (theme, sidebar state).
- Analytics cookies — placed only with your consent; help us understand aggregate usage patterns.
You may manage cookies through your browser settings. Disabling strictly necessary cookies may render parts of the Platform inoperable.
7. Sub-processors and recipients
We share personal data only with carefully selected sub-processors that are bound by written agreements containing equivalent data-protection commitments. The current categories of sub-processors are:
- Hosting and infrastructure providers (Republic of Azerbaijan / EU).
- Email-delivery service providers.
- Payment-processing partners.
- Customer-support tooling.
- Aggregated analytics platforms (where you have consented).
An up-to-date list of sub-processors is available on request to support@vugrix.com.
We may also disclose personal data when required to do so by law, by a court order or by a competent authority of the Republic of Azerbaijan.
8. International transfers
Where personal data is transferred outside the Republic of Azerbaijan (for example to an EU hosting provider), the transfer is performed in accordance with Article 11 of the AZ Law on Personal Data, on the basis of an adequate level of protection in the recipient country, or with your explicit consent. Where applicable, we apply the European Commission's Standard Contractual Clauses for transfers from the EU/EEA.
9. Retention periods
| Category | Retention period |
|---|---|
| Account data | Until the account is deleted, then up to 30 days in residual back-ups. |
| Billing and accounting records | 5 years from the relevant fiscal year (Tax Code of the Republic of Azerbaijan). |
| Security and access logs | 12 months from creation. |
| Support correspondence | 3 years from the last interaction. |
| Abuse reports | 5 years from resolution; longer if required for ongoing investigation. |
After expiry, personal data is irreversibly deleted or anonymised.
10. Your rights as a data subject
Under the AZ Law on Personal Data (and Articles 15–22 GDPR for EEA users), you have the right to:
- Access — obtain a copy of your personal data.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion of your data, subject to retention obligations.
- Restriction — limit processing in certain circumstances.
- Objection — object to processing based on legitimate interests, including profiling.
- Portability — receive your data in a structured, commonly used and machine-readable format.
- Withdrawal of consent — at any time for processing based on consent.
- Not to be subject to a decision based solely on automated processing that produces legal effects concerning you.
11. How to exercise your rights
To exercise any of the rights above, please send a written request to support@vugrix.com from the email address registered with your account. We may ask for additional information to verify your identity. We will respond within 30 calendar days. If we cannot satisfy your request (for example, because of an overriding legal obligation), we will explain the reasons.
12. Right to lodge a complaint
If you believe that our processing of your personal data infringes the AZ Law on Personal Data, you have the right to lodge a complaint with the competent supervisory authority of the Republic of Azerbaijan and, where applicable, with the data-protection authority of your country of habitual residence. We would, however, appreciate the opportunity to address your concerns first by writing to support@vugrix.com.
13. Children's privacy
The Platform is intended for businesses and adult users (18 years of age or older). We do not knowingly process personal data of children. If you become aware that a child has provided us with personal data, please contact us so we can delete it.
14. Information security
We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS/TLS), hashing of authentication credentials, role-based access control, audit logging, regular back-ups and personnel confidentiality undertakings. No method of transmission or storage is, however, 100 % secure; we cannot guarantee absolute security but commit to handling any security incident in accordance with the AZ Law on Personal Data.
15. Changes to this Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform and / or by email at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the current version.
16. Contact
Privacy and data-protection inquiries: support@vugrix.com
Telephone: +994 99 799 00 99
Postal address: 27th street, building 14, Baku, Azerbaijan.