Privacy Policy
1. Who we are and what this policy covers
This policy explains how [[TODO: legal entity name in English]] ("Sanadat", "we" or "us") collects, uses and protects personal data when you use the Sanadat website, its app and the related e-invoicing services. Our address is [[TODO: registered address in English]] and our freelance certificate number is [[TODO: freelance certificate number]].
Our role depends on the kind of data:
- Controller: for account, subscription and payment data, technical logs and the security log, meaning the data we need to open your account, provide and secure the service and bill you for it. We decide the purposes and means of processing it.
- Processor: for the invoice data you enter, such as buyers' names, VAT numbers and addresses, and invoice line items. Here you are the controller, and we process the data on your behalf and on your instructions under the Data Processing Agreement.
This policy is based on the Personal Data Protection Law of the Kingdom of Saudi Arabia, issued by Royal Decree No. (M/19) of 1443H, and its Implementing Regulations, and on the VAT and e-invoicing rules that apply. [[TODO: counsel to confirm the exact citation of the Personal Data Protection Law, its amendments, its Implementing Regulations and the Regulation on Personal Data Transfers outside the Kingdom now in force]]
2. The data we collect
| Category | Examples | Our role |
|---|---|---|
| Account data | The owner's email address, a password hash only (we never keep the password itself), and whether the email is confirmed. | Controller |
| Company data | Company name, VAT number, commercial registration number and seller address. | Controller, for account purposes |
| Invoice data | Invoices and what they contain: buyers' names, VAT numbers and addresses, line items and amounts, plus the customers and products you save. | Processor |
| ZATCA connection data | The invoicing device's credentials with the Zakat, Tax and Customs Authority and the company's private signing key, stored encrypted. | Processor |
| Subscription and payment records | Recorded payments (amount, date, reference and the period covered) and our invoices to you. | Controller |
| Technical logs | Logs of how the service runs and how it is secured, including IP addresses. | Controller |
| Correspondence | Your messages to us by email or WhatsApp when you ask for support. | Controller |
We do not collect payment card data, because the service has no card payments. Our marketing site uses no analytics or tracking tools.
3. Why we process data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account and providing the service: signing invoices, submitting them to ZATCA, showing their status and retrying. | Performance of the contract |
| Managing the subscription, recording payments and issuing our invoices to you. | Performance of the contract, and compliance with accounting and tax rules |
| Keeping invoice records for the period the rules require. | Compliance with legal obligations |
| Securing the service and preventing abuse and fraud: logs, rate limiting, account lockout and the audit log. | Legitimate interest |
| Support and service messages, such as email confirmation and password reset. | Performance of the contract, and legitimate interest |
| Maintaining the service, fixing errors and improving it. | Legitimate interest |
[[TODO: counsel to confirm the lawful basis available under the Personal Data Protection Law and its Implementing Regulations for each purpose above, including whether consent is also required for any of them]]
We do not sell your personal data. [[TODO: operator to confirm that no personal data is or will be used for marketing or shared with third parties beyond those listed in section 4]]
4. Who we share data with
The Zakat, Tax and Customs Authority (ZATCA)
We send signed invoices and the data they need to ZATCA on your instructions and to meet your legal e-invoicing obligations. ZATCA is a regulator independent of us, and its handling of this data is governed by its own rules. [[TODO: counsel to confirm how ZATCA's role should be described (independent recipient or otherwise)]]
Sub-processors
We use the following providers to run Sanadat. They process data only as far as needed to provide their services:
| Purpose | Provider | Data they can access |
|---|---|---|
| Hosting of servers and databases | [[TODO: hosting provider]] ([[TODO: hosting country and region in English]]) | All service data; credentials and keys are encrypted |
| Backups and object storage | [[TODO: backup and object storage provider]] | Backup copies of the databases |
| Sending email | [[TODO: email delivery provider]] | Email address and the content of service emails |
| Error and log monitoring | [[TODO: error and log monitoring provider, or none, in English]] | Technical logs, including IP addresses |
We tell our customers before we add or replace a sub-processor, as described in the Data Processing Agreement.
Public authorities
We may disclose data when a law or an order from a competent authority requires it, and only as far as required.
5. Transfers outside the Kingdom
Your data may be hosted or backed up with providers outside the Kingdom, depending on where their data centres are. The current hosting location is [[TODO: hosting country and region in English]]. Any transfer of data outside the Kingdom that we make follows the controls the law sets.
[[TODO: hosting decision pending; counsel to confirm whether data is hosted or backed up outside the Kingdom, the lawful mechanism for each transfer under the Personal Data Protection Law and its transfer regulations, and any approval or notice required]]
6. How long we keep data, and deletion
- Invoice records: we keep them for as long as VAT and e-invoicing rules require. [[TODO: counsel to confirm the exact retention period required by VAT law and ZATCA e-invoicing rules]]
- Account data: while your account exists, then for the period the law requires after it is closed.
- Technical logs: [[TODO: log retention period]]
- Backups: kept for a limited rolling period. [[TODO: backup retention period, per the replication configuration]]
- Closing your account: we keep a view-only export available to you for [[TODO: length of the read-only export period after closure]], and then delete the data or make it anonymous, except what the law requires us to keep. This includes the ZATCA connection credentials and the signing key. [[TODO: operator to confirm that signing keys and ZATCA credentials are deleted on closure]]
To ask us to close your account or delete your data, write to email. We may be unable to delete what the law requires us to keep, and we will tell you if so.
7. Data security
- Each company's data lives in its own separate database file.
- Signing keys and ZATCA connection credentials are encrypted with per-company keys, which are themselves protected by a master key kept outside the database and its backups.
- Signing keys are not available for download.
- Sign-in uses email confirmation, rate limiting, and a temporary lockout after repeated failed attempts.
- The service is reached over HTTPS only.
- Backups are replicated continuously off the server.
No system is perfectly secure. If a breach of personal data occurs, we will notify the competent authority and the people affected as the law requires. [[TODO: counsel to confirm the breach notification duties and timing towards the competent authority and affected persons]]
8. Your rights and how to use them
The Personal Data Protection Law gives you rights over your data, including the right to be informed how it is processed, to access it, to obtain a copy of it, to ask for it to be corrected, to ask for it to be destroyed, and to withdraw consent where processing relies on it. [[TODO: counsel to confirm the list of rights and their conditions and exceptions under the Personal Data Protection Law and its Implementing Regulations]]
To use any of these rights, write to email. We may ask for proof of your identity, and we reply within the period the law sets. [[TODO: counsel to confirm the response period and any fee rules]]
If you are a buyer whose data appears on an invoice issued by one of our customers, that customer is the controller of the data, so please send your request to them. We help them respond under the Data Processing Agreement.
9. Cookies
Our marketing site sets no cookies, uses no analytics, tracking or advertising tools, and loads no resources from third parties.
The app uses only the cookies it needs to work: a session cookie that keeps you signed in (protected with the HttpOnly and Secure attributes), and a cookie that protects against request forgery (anti-forgery). We use no cookies for tracking or analytics.
10. Children
Sanadat is aimed at businesses and their adult representatives, and we do not knowingly collect children's personal data. If we learn that we have, we will delete it.
11. Changes to this policy
We may update this policy from time to time. The date of the last update is shown at the top of the page, and we notify you of material changes in the app or by email. [[TODO: counsel to confirm the notice period for material changes]]
12. Contact and complaints
For any question about this policy or your data: [[TODO: legal entity name in English]], [[TODO: registered address in English]], email email, WhatsApp [[TODO: support WhatsApp number with country code]].
If you believe our handling of your data breaks the law, you have the right to complain to the authority responsible for personal data protection, the Saudi Data and Artificial Intelligence Authority (SDAIA).