Acuerdo de tratamiento de datos

These policies cover QT-POS, provided by Qayd Altnfyth Company LLC (Q-TANFEETH, CR 7054946186). By using or subscribing to the system you agree to them. If the Arabic and English texts differ, the Arabic governs.

1. Parties and roles

This agreement completes the Subscription Terms. The client is the controller of its customers’ and staff’s personal data entered in the system; Q-TANFEETH is a processor handling it on the client’s behalf and instructions only.

2. Data

What the client enters: its customers’ names and numbers (if recorded), tax invoices and buyer details on B2B invoices, and its staff as system users.

3. Purpose

Running the point of sale, issuing invoices and reporting them to ZATCA, reports, backups and support. Nothing else.

4. Confidentiality

Our authorised staff are bound to confidentiality and look at store data only to provide the service, or for support with the store owner’s explicit permission on a support ticket: read-only, for 7 days, revocable, with customers’ phones masked and the owner notified when we enter and leave.

5. Sub-processors

Hosting (Oracle Cloud, Riyadh region), encrypted backups (OVH), email delivery (Resend), and ZATCA as the receiver of invoices. We tell the client before adding a new sub-processor and the client may object.

6. Security

Appropriate technical and organisational measures: encryption in transit, each store’s data isolated from others, access control, encrypted backups and monitoring.

7. Breaches

We notify the client without undue delay and within 48 hours at most of learning of an incident affecting its data, and help it notify the authorities if needed.

8. Data subject requests

We help the client answer its customers’ requests (access, correction, destruction) through the system’s tools or on request.

9. End of service

We hand the client a readable copy of its data on request, then delete it within 30 days of the subscription ending, except what the law requires to be kept.

10. Audit

On request we give the client the information needed to show we comply with this agreement.