Contents
1. Controller and inquiries
The party responsible for personal data about its direct website visitors, prospects, account administrators and billing contacts is [[TO BE CONFIRMED]], trading as ALFIDAONE. Privacy inquiries and rights requests: [[TO BE CONFIRMED]], [[TO BE CONFIRMED]]. Registered address: [[TO BE CONFIRMED]]. This notice must be verified against actual data flows and vendor agreements before publication.
2. Data collected
Depending on the service and role, data may include identity and business contact details; account credentials and authentication records; subscription/order/invoice references; support messages; technical events including IP address, device, browser, access and security logs; optional communications preferences; and customer-uploaded POS records. ALFIDAONE should not request full payment-card data into its own application if an approved payment processor can securely handle it. Actual cookies and analytics must be listed in [[TO BE CONFIRMED]], not invented.
3. Why and on what basis we process
We process necessary information to provide and secure accounts, perform contracts, process payments and invoices, provide support, prevent fraud, comply with legally required accounting/recordkeeping duties and address requests. The applicable lawful basis must be mapped for each processing purpose in the internal Records of Processing Activities. Optional marketing requires an appropriate separate lawful basis/consent where required; it must not be bundled with acceptance of commercial Terms.
4. Business customer data and roles
Business customers may input information about their employees, consumers or counterparties into the POS. Their legal responsibilities as controllers, and ALFIDAONE's responsibilities as a processor or other role, depend on actual arrangements and law. Before handling live tenant personal data, parties must execute or accept an appropriate Data Processing Agreement (DPA) and verify that subprocessors, transfers, retention, breach handling, instructions and security duties are covered. This consumer-facing notice does not replace the DPA.
5. Sharing and third parties
Data may be disclosed only as lawfully necessary to vetted hosting providers, secure payment processors, support/email providers, authorized consultants and competent authorities. [[TO BE CONFIRMED]] must list actual providers and purposes. We do not sell personal data. Where cross-border transfer occurs, we will use the legal mechanisms and safeguards required by Saudi law and document destination and grounds; no assertion that all information is stored in Saudi Arabia may appear unless technically verified.
6. Retention and security
Personal data is retained no longer than necessary for identified purposes or legally required periods, using the published [[TO BE CONFIRMED]]. Appropriate controls include role-based access, encryption in transit, protected credentials, logging, tested backups, incident response, tenant separation, and processor safeguards. No system can promise zero security risk. Data deletion may be limited by binding legal retention obligations or the need to protect lawful claims.
7. Your choices and rights
Subject to the Saudi Personal Data Protection Law and its conditions, individuals may request information, access, a readable copy, correction, destruction when applicable, and withdrawal of consent where processing rests on consent. A privacy request can be submitted at [[TO BE CONFIRMED]] or [[TO BE CONFIRMED]]. We verify identity before releasing personal data and respond under applicable statutory requirements. Withdrawing optional marketing consent does not prevent essential service communications.
8. Cookies and tracking
Strictly necessary cookies support sessions and security. Analytics or marketing technologies, if actually used, must be described by name, provider, purpose and relevant choice controls before activation. Do not publish generic claims of tracking technologies that have not been audited.
9. Children and sensitive data
The service is intended for business account users acting on behalf of organizations, not directly for children. Business customers must avoid uploading unnecessary sensitive personal data. If processing high-risk or sensitive information is unavoidable, additional legal, technical and consent safeguards must be implemented and documented.
10. Updates and contact
Material amendments will be documented by version and effective date. Privacy questions: [[TO BE CONFIRMED]]. The applicable Saudi privacy law and regulator guidance take precedence over any inconsistent part of this draft.